December 2003 - cypherpunks-legacy

CLT&G Update: 29 Dec 98
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Chip Ford" <chip_ford(a)cltg.org> To: "MassLP Reflector" <general(a)lpma.org>, "MassGOP Listserv" <debate(a)list1.channel1.com> Subject: CLT&G Update: 29 Dec 98 Date: Tue, 29 Dec 1998 14:31:11 -0500 Sender: owner-general(a)lpma.org Citizens for Limited Taxation & Government PO Box 408 * Peabody, MA 01960 Phone: (508) 384-0100 * E-Mail: cltg(a)cltg.org Visit our website at: http://cltg.org --------------------------------------------------------------- *** CLT&G Update *** Tuesday, December 29, 1998 The Boston Globe Monday, December 28, 1998 The US suffered through turmoil in '98 -- 1798, that is By Jeff Jacoby, Globe Columnist, 12/28/98 So shocking were the president's deeds, so extreme were his opponents, so furiously did partisan passions roil the public, that by the end of '98 some of the nation's most eminent leaders were questioning whether America's experiment with constitutional democracy was coming undone. No, not the Clinton scandals. The year was 1798. John Adams was in the White House and the United States was undergoing an agony of political turmoil. It was a bitter time, but it produced two of the most remarkable statements on liberty and limited government in our history - the Kentucky and Virginia Resolutions of 1798. Americans were sharply divided over a host of issues that year, none more so than US-French relations. The Federalists, who controlled the presidency and both houses of Congress, deeply mistrusted the French revolutionaries and refused to support them when France went to war with Britain. Republicans led by Thomas Jefferson were sympathetic to the French cause, which they identified with America's own revolt against royal abuse two decades earlier. The Jeffersonians denounced Adams and the Federalists as "monarchists" and "Tories" - denunciations echoed by a growing population of anti-British immigrants. Angered by Washington's neutrality, France began seizing American vessels. US diplomats in France were snubbed. A scandal erupted - the famous XYZ Affair - when agents of the French foreign minister, Talleyrand, demanded a bribe from President Adams's emissaries. Federalists were outraged; war fever swept the country. There were rumors that France was planning an invasion - and that Vice President Jefferson, whose Republican supporters were violently condemning the federal government, would join the invaders and overthrow the Adams administration. In this superheated atmosphere, Congress and the president enacted a package of grotesquely unconstitutional laws. The Alien Enemies Act empowered the president to jail or expel without trial any foreigner he deemed "dangerous to the peace." The Sedition Act prohibited all criticism of federal officials made "with intent to defame." Just seven years after the ratification of the First Amendment, editors, printers, and politicians were hauled into court and sent to prison for the crime of opposing the president. Jefferson and James Madison - who called the Sedition Act a "monster that must forever disgrace its parents" - resolved to strike back. Knowing that a Supreme Court fight would lose (the bench was dominated by Federalists), they decided to attack through the state legislatures. Working with allies in Kentucky and Virginia, Jefferson and Madison arranged for each state's general assembly to adopt a statement protesting the new laws. Jefferson drafted the Kentucky resolution, which was passed on Nov. 16, 1798. Madison wrote the Virginia resolution, which was adopted on Christmas Eve. "Resolved," the Kentucky Legislature declared in its opening paragraph, "that whensoever the General Government assumes undelegated powers, its acts are unauthoritative, void, and of no force." Supreme authority in America, it argued, was held not by the federal government but by the people and the states, and Congress and the president had only those powers clearly delegated to them by the Constitution. The Alien and Sedition Acts were intolerable above all because the federal government had no right to enact them. In the 20th century, the 10th Amendment has been largely ignored, but in the Kentucky Resolution, Jefferson quoted it repeatedly: "It is true as a general principle, and is also expressly declared by one of the amendments to the Constitution, that the powers not delegated to the United States by the Constitution, nor prohibited to it by the States, are reserved to the States respectively, or to the people."' Nothing in the Constitution gave federal officials any right to interfere with freedom of speech or the press, or to exercise any jurisdiction over aliens. "Therefore, the act of Congress passed on the 14th day of July, 1798 ... is not law, but is altogether void, and of no effect." The Virginia Resolution was also blunt. Congress and the president, Madison wrote, have only the powers "enumerated in that compact [the Constitution]; and that in case of a deliberate, palpable, and dangerous exercise of other powers not granted by the said compact, the states ... have the right and are duty bound to interpose for arresting the progress of the evil." These resolutions weren't empty theory. They were a forceful defense of freedom, and a reminder that when governments are allowed to infringe the liberty of A, it is only a matter of time before they move on to B's. "The friendless alien has indeed been selected as the safest subject of a first experiment," declared the Kentucky resolution, "but the citizen will soon follow - or rather has already followed, for already has a Sedition Act marked him as its prey." Jefferson and Madison were fearful, as more Americans should be today, of allowing power to be concentrated in the central government. They won the battle: Americans came to hate the Alien and Sedition Acts, and the Federalists were thrown out in the election of 1800. But did they win the war? In our day, the federal government has grown monstrous, strangling Americans' freedom through endless regulations, restrictions, and taxes. The bicentennial of the Kentucky and Virginia Resolutions reminds us how much we have lost - and points the way to win it back. Jeff Jacoby is a Globe columnist. You can write Jeff at Jacoby(a)globe.com. * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * "The Only Alternative to Limited Taxation and Government is Unlimited Taxation and Government" --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

QuickEmail, A Web-based E-mail message
by whiterose＠liveinfreedomor.die 17 Dec '03

17 Dec '03

SSA, IRS, VA A-OK FOR Y2K President Clinton says that the U.S. Treasury Financial Management System has completed testing by independent auditors and is now "certified as Y2K (Year 2000) compliant." The Y2K problem or "millennium bug" is found in old programs that (because their authors used only two rather than four digits to designate years) will make mistakes when doing calculations based on dates. The Social Security Administration has led the way in dealing with the Y2K problem, which it first started working on in 1989. (San Jose Mercury News 29 Dec 98) A service provided by TechAID Computer Services, http://www.techaid.net The e-mail address of the sender MAY NOT BE AUTHENTIC.

1 0

CLT&G Update: 29 Dec 98 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 29 Dec 1998 14:57:08 -0500 > From: Robert Hettinga <rah(a)shipwright.com> > Subject: CLT&G Update: 29 Dec 98 > Jefferson and Madison were fearful, as more Americans should > be today, of allowing power to be concentrated in the central > government. The entire point of a consitutional democracy is to avoid centralization. A better way to word this is that we should be afraid of the federal government becoming the central government. ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

STUDENTS WEB SITE COVERED BY THE RIGHT OF FREE SPEECH
by Pallas Anonymous Remailer 17 Dec '03

17 Dec '03

A federal judge has ruled against the school district of a Missouri high school student suspended because he and his sister posted a personal Web page using vulgar language to criticize the school's official Web site. U.S. District Court Judge Rodney Sippel has issued a preliminary injunction barring the school district from suspending the student, punishing him, or restricting his ability to post his personal home page. Sippel's opinion asserts: "Dislike or being upset by the content of a student's speech is not an acceptable justification for limiting student speech." (AP 28 Dec 98)

1 0

Re: "Hit 'em Where They Ain't": Deploying Digital Bearer Transactions
by Ryan Lackey 17 Dec '03

17 Dec '03

[BTW, there's a new mailing list to discuss how technical implementation details of DBS would [hypothetically] affect market dynamics, user experience, etc. -- send mail to pecunia-request(a)venona.org if interest. It's for stuff a bit too technical for dbs, and stuff too tenuously connected to cryptography for a mailing list like cryptography or coderpunks.] Quoting Todd Boyle (tboyle(a)rosehill.net) > Much hot air has been expended on directions in which accounting systems > will be re-architected for the internet. Meanwhile Quickbooks continues past > 90% and up, in small and medium sized businesses. It has got the user > interface solved, among many other problems. There is no possibility anybody > will take away the Quickbooks market in the next 3-5 years. I hate this. > But it's reality. > [suggestion: integrate electronic cash clients into Quickbooks] The same argument could be made for integration with the successful shopping cart systems (for retail purchasing), the successful web server (apache, maybe netscape and ms iis if you are feeling charitable), the popular internet client platform (netscape or maybe msie). I believe in this theory to an extent. Unfortunately, it seems easier to develop a platform-independent client for a DBS system first in standalone mode, then work on integrating into various existing applications. * Development and testing tools for generic systems such as Java are generally far superior to those for closed systems * A development team experienced in the other details of a payment system (cryptography, network protocols, security) is more likely to be familiar with generic software development than with developing for a specific application * Debugging a standalone client is generally far easier than debugging a plugin for an application which may itself have bugs. * Disagreements as to which particular proprietary systems should be supported. While Quickbooks, for instance, may control the business accounting market, packages such as quicken are more entrenched for individual (and perhaps very small business), and very large corporations use different packages. Which market segment, even for just accounting, should be the target? * The risk that a proprietary vendor will change the interface on the development team partway through development, or will go out of business, or become less important in the marketplace -- this is more of an issue the longer the product development cycle is. * Substantial minorities who are very attached to particular tools, in contrast to the majority of the target market -- witness the macintosh minority. This is because of the interface, legacy plugins, or whatever, and basically needs to be taken as a given. Looking at another popular crypto application which I believe had considered this issue is PGP. The core functionality of PGP, especially until relatively recently, has been to send encrypted email messages. A fairly compelling number of users use a small number of mail programs (Eudora, maybe Netscape Mail, maybe MS Exchange/Outlook). However, PGP chose to develop and continue developing a standaline application, leaving it to third parties to integrate PGP with existing mail readers. One logic would have said PGP should have created a standalone mail program, subsuming whatever functionality a tool like Eudora offers. There are a few reasons this might be worthwhile -- easier integration for the user by virtue of only having a single tool to use, both in configuration and in daily use -- perhaps market reasons such as greater profits -- greater brand identity -- assurances of secure behavior by the underlying levels (since they're integrated into the applications). However, there are many reasons subsuming the mailer functionality into the security application doesn't make sense. First of all, it was not necessarily known that electronic mail would be such a compelling application for PGP (well, actually it was). Additionally, they rightly noted that people would be reluctant to leave their existing mail programs (additionally, the market was a bit more fractioned at the time). There were the same problems with integrating into multiple applications, and also I don't think Phil Z. or the other early PGP developers had much experience developing application-plug-ins for any of the major mail clients. There are probably other factors involved here which I haven't addressed. My take on the question of how to do clients is that one should first develop functional standalone clients, with a well defined API, then either find existing people doing plug-ins or third-party applications and get them to do the integration work (keeping the code in the main line of the application, if possible, to keep it compatible with the latest releases of the product). Additionally, in some cases there exist wide-ranging standards which are easy to implement (such as the UNIX standards for stdin/stdout and argument handling, or perhaps HTTP/HTML, or maybe at some point XML or OFX) which should be implemented. There are also some applications which are so widespread that their own internal interface standard, if well documented and relatively unchanging, is worth writing to -- perhaps this is the case for browser plug-ins for Netscape and MS IE, perhaps for MS Office add-ons, and maybe the case for Eudora. However, in most of these cases, I'd be much happier writing a standalone system first, getting most of the development process out of the way, then doing a shorter development cycle to integrate the well-tested codebase into a third-party application...this lowers the window of risk for changes in the third party application as well as providing the above advantages. In the long run, though, I agree that integrating DBS into existing accounting systems at least as well as current payment systems, and probably far better, is of very high importance. I wasn't aware quickbooks was that popular, and will look at it soon...it sounds like it would be an interesting package to work with. Happy New Years, Ryan ryan(a)venona.com

1 0

Hoppe on Defense
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Mises Institute News" <news(a)mises.org> To: <miseslist(a)mises.org> Subject: Hoppe on Defense Date: Tue, 29 Dec 1998 14:53:24 -0600 Sender: miseslist-owner(a)mises.org Status: U We are pleased to announce another paper in our Essays in Political Economy series: "The Private Production of Defense" by Hans-Hermann Hoppe (Professor of Economics, University of Nevada, Las Vegas; Senior Fellow, the Ludwig von Mises Institute). >From the essay: "Among the most popular and consequential beliefs of our age is the belief in collective security. Nothing less significant than the legitimacy of the modern state rests on this belief. And yet, the idea of a collective security is a myth that provides no justification for the modern state. Private-property owners, cooperation based on the division of labor, and market competition can and should provide defense from aggression." This powerful and radical essay can be purchased here http://mises.org/product.asp?sku=p131 or by calling 334-844-2500. The price is $4.00 postpaid (no postage charges will appear on your credit card, regardless of what your shopping basket says). * * * * * A special 4-page, supplemental Austrian Economics Newsletter has been published this quarter. It features an interview with Roberta Modugno of the Center for the Methodology of the Social Sciences at the Libera Universita Internazionale degli Studi Sociali in Rome, Italy. She discusses her new book, Murray N. Rothbard e il libertarismo amerciano (Robbettino Ediotre, Soveria Mannelli, 1998). Students and faculty have been mailed a copy of this special AEN. If you are not on the list to receive one, email susan(a)mises.org with your address. Subscriptions to the AEN are $16 a year. Something to look forward to for Spring 1999: An interview With Richard Vedder (Ohio University) * * * * * The new Mises Review features David Gordon reviewing books by Allen Oakley on Austrian economics; Francis Beckwith and Gregory Koukl on relativism; Richard John Neuhaus et al. on judicial tyranny; Zbegniew Brzezinksi on American foreign policy; Jim Sleeper on liberal racism; Michael Levin on race; and Ronald Dworkin on affirmative action. Individual copies are $5. Subscriptions are $16 per year. Back issues are available on Mises.org. Subscribe: http://mises.org/product.asp?sku=MR * * * * * As we approach the new year, we wish you a happy one, and hope you enjoy Clifford F. Thies's article on millennial hysteria and its historic connection with socialist ideology. http://mises.org/fullstory.asp?FS=+%3Ch3%3EThe+Year+2000 In the next few days on Mises.org, we'll feature an article on the Euro and coverage of the continuing debate between Robert Bork (taking the statist position) and Michael Kinsley (taking the free-market position) on Microsoft's future. It may seem like a strange turnabout, but even stranger things have happened this month, in addition to the political turmoil in the Belly of the Beast: the Mises Institute and the Village Voice agreedthat the U.S. government should not be destroying people and property in Iraq. --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[EFGA] DragonCon.net Receives Subpoena for User Records
by Robert A. Costner 17 Dec '03

17 Dec '03

Date: Tue, 29 Dec 1998 17:02:48 -0500 To: announce(a)efga.org From: "Robert A. Costner" <pooh(a)efga.org> Subject: [EFGA] DragonCon.net Receives Subpoena for User Records Sender: owner-announce(a)efga.org Reply-To: owner-announce(a)efga.org X-URL: http://www.efga.org DRAGONCON.NET RECEIVES SUBPOENA FOR USER RECORDS This week DragonCon.net, a free email service, received a Subpoena requesting information on one of its users including the true and correct legal name, IP addresses, E-mail addresses, E-mail headers and postal address The matter has been referred to attorneys to see if the Subpoena is valid and should be complied with. DragonCon.net places a high value on the privacy of it's users and will not release user info based on a casual request. http://www.dragoncon.net is a privacy friendly email forwarding and newsgroup posting service using technology developed by Electronic Frontiers Georgia (EFGA) <http://www.efga.org>. EFGA is known for it's leadership in the worldwide anonymous remailer community, the Georgia Cracker remailer <http://anon.efga.org>, and as the original plaintiff in the internet anonymity case ACLU vs. Miller. DragonCon.net has been a way to extend a form of privacy and anonymity to those who wish for some anonymity in communications without the burden of encryption imposed by the Cypherpunk remailer system. Dragon*Con <http://www.dragoncon.org> is a science fiction and fantasy convention held each year in Atlanta, Georgia. DragonCon.net is a free email service for members of Dragon*Con which also allows anyone else to have an email account. DragonCon.net, the email service, is operated independently of Dragon*Con by a third party company. Says Chairman Ed Kramer of Dragon*Con, "Dragoncon.net is run by an independent company; we have no control over their policies. However, we certainly respect the privacy of our members and support the pro-privacy polices of the internet service towards their users. We've been told that attorneys are reviewing irregularities in the subpoena, and the internet service may be forced to not honor it." The matter is a civil action against a group of email-name defendants, none of which appear to be the Dragoncon.net user. Dragoncon.net is not a party in the suit. We do not yet know the nature of the civil action. More information will be announced in a few days. For more information contact Robert A. Costner pooh(a)efga.org 770 402-3580 * To join or be removed from this list, send a message to majordomo(a)efga.org with the message body of SUBSCRIBE announce or UNSUBSCRIBE announce

1 0

Fwd: trigger locks on public weapons
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 29 Dec 1998 17:23:38 -0800 To: rah(a)shipwright.com From: Vinnie Moscaritolo <vinnie(a)vmeng.com> Subject: Fwd: trigger locks on public weapons > Date: Tue, 29 Dec 1998 17:22:51 -0800 > To: staff(a)goal.org > From: Vinnie Moscaritolo <vinnie(a)vmeng.com> > Subject: trigger locks on public weapons > Cc: > Bcc: > X-Attachments: > > congratulations on your move to force the MA legislators to eat their > dogfood by placing trigger locks on the Besses in the state house.. I am > an ex resident of the People's Democratik Socialist Commonwealth of > Massachusetts and was recently visiting the Rude bridge in Concord, > showing my wife the very place where America started. I happened to > visit the museum at the bridge and noticed that that there were three > functional Brown Besses in display, and non of them were properly locked. > I was appalled to see this, after all this is a place where many visitors > come to see where freedom started, where the Colonists stood against the > king who only wished to protect them by confiscating their guns.. and to > find that the weapons displayed there were did not comply with the law of > the day quite dismayed me.. but I thought that if I informed the folks at > GOAL you might be able to contact the propler authorities and set things > straight.. > > good luck my brothers.. Vinnie Moscaritolo http://www.vmeng.com/vinnie/ Fingerprint: 3F903472C3AF622D5D918D9BD8B100090B3EF042 ------------------------------------------------------- Those who hammer their swords into plows, will plow for those who don't." --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Triple DES "standard"?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 29 Dec 1998 19:11:37 -0500 To: jehill(a)nexis.org From: Vin McLellan <vin(a)shore.net> Subject: Re: Triple DES "standard"? Cc: Rodney Thayer <rodney(a)tillerman.nu>, Cryptography(a)C2.net Sender: owner-coderpunks(a)toad.com Rodney Thayer reported: >> Curiously enough, there seem to be no references to a standard before >> the X9.52 effort, which appears to be only a year or two old. NIST calls >> Triple DES a "private" standard. Josh Hill <jehill(a)nexis.org> responded variously: >? >Before things become standards, they are just good ideas. Triple DES is >widely used, despite the fact that there is no absolute standard. The >draft standard, itself, is actually quite straight forward... Nothing >really interesting about it, aside from ANSI's blessing. >NIST does the "we'll just refer to another standard and call it ours" >thing a fair bit... Look at FIPS 186-1: The RSA signature scheme accepted >is the one specified in ANSI X9.31. Actually, as I recall the tale, the Amercian Bankers Association-sponsored ANSI-accredited X.9 Committee's blessing of DES3 was itself pretty interesting. I understood that the NSA lobbied bitterly against the X9 effort to standardize 3DES as an ANSI standard, insisting that DES would surfice until its successor was chosen. A couple years ago, when the X9 committee -- or maybe one of the X9 crypto subcommittees -- rejected that advice and initially recommended that 3DES be made a standard, I was told that the NSA rep angrily declared that 3DES would _never_ get an export license and would never be shipped overseas. (Which may have put a damper on the 3DES standardization effort;-) Unfortunately, these standards development efforts usually escape the media's attention. Anyone on the list active in X9 and can give us the real story? Since the birth of X9 in the late 70s, the US National Security Agency has its own representative on the X9 Committee. As one might expect, the NSA has traditionally had significant influence over the ANSI "F" (crypto) subcommittees and cryptographic standards in financial services. There was a time when Ft. Meade effectively dictated those standards. Now, that is not necessarily so.... (After the NSA blundered so badly in trying to force the Banking industry to switch from DES to CCEP/Clipper in the late 80s, the Agency's mesmerizing control broken. The initial intro of CCEP/Clipper -- at an ABA meeting -- proposed that only US owned institutions could have access to Clipper. At the time, as I recall, maybe 10-15 percent of the US banks were foreign owned;-) The bankers couldn't believe that these idiots -- obviously so ignorant about the workings of the industry they were trying to defacto regulate -- were from the NSA of Legend and Lore.) I always felt that the NSA's alienation of the Bankers was probably the single most important factor in the collapse of the government's Cipper campaign. Suerte, _Vin ----- Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 -- <@><@> -- --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: PWL files
by Chris Rowley 17 Dec '03

17 Dec '03

> > I've been trying to figure out the method of encryption for OSR2 Win95 and > > Win98 *.pwl files and I was hoping someone had some details about the > > method used. [...] Does anyone have it figured out? > > I think Peter Gutmann and someone else figured it out sometime ago. Peter Gutmann figured out the old system. In reaction the system was changed by the OSR2 patch and in all further releases of Windows. What exactly it was changed to is the question. Chris.

1 0

!! Wanted Home Product Assemblers !!
by Death46760＠aol.com 17 Dec '03

17 Dec '03

*****This is a one time Mailing. You will not receive mail from us again.***** Looking for Home Product Assemblers!! How would you like to Assemble Products at Home & get Paid! Choose your own Hours! Be your own Boss! Easy Work! Excellent Pay! Earn Hundreds of Dollars Weekly! Here are just a few examples of the work you will have to choose from: Wooden Products - up to $220.00 Weekly! Hair Accessories - up to $320.00 Weekly! Holiday Crafts - up to $270.00 Weekly! Beaded Accessories - up to $350.00 Weekly! ........Plus many others. There are over 75 Companies to choose from! Why not enjoy the Benefits and Freedom of Home Assembly Work! To find out more Call.....Toll Free (24 Hour Recording) 1-888-289-9708. U.S. Publishing Co. P.O. Box 633 Rocky Mount NC 27802 Name ___________________________________________ Address ___________________________________________ City & State ___________________________________________

1 0

distribution scheme
by Anonymous 17 Dec '03

17 Dec '03

forget my earlier mail saying I had uploaded to funet.fi - seems I get "permission denied" from both there and csua.berkeley.edu even in the incoming dirs. am I missing something here? please tell me where I can upload. Falcon

1 0

distribution scheme
by Anonymous 17 Dec '03

17 Dec '03

I'm sorry, but it seems I have missed the original mail, i.e. the first quote here. if there is anything important in it that was not quoted, please include it somewhere in your replies. I hope I haven't missed any other mail. >>Falcon, aka FitugMix, wrote about a suggestion to chop crypto or other >>contraband material into separate streams, e.g. bit 1 of each byte in >>stream 1, etc., hoping that this would be "legal" because it's not >>really >>encryption, though if managed carefully it would still be hard to read. >this concept is virtually identical to fractal encryption, where a >message is chopped into its component parts (25 a's, 3 b's, 8 c's, and so >on) and also chopped into a configuration scheme. this form of >encryption does fall under the definition of munitions by the u.s. >government... yes, I found that out in the meantime. the legal aspect falls short of my expectations. I still consider the scheme to be both simple and useful because it actually changes the byte structure, so looking for 'a' or 'e' or similiar pattern-analysis does not work anymore. in combination with steganography, I believe this can make things really hard to find, but I'm willing to learn the opposite if someone with more cryptoanalysis know-how tells me. if I'm right, it might still be useful for people, e.g. in china working outside their local laws anyways. it probably needs extension before it's really useful, so I have put up the code on funet.fi (pub/crypto/cypherpunks/incoming). take a look and tell me what you think, please. Falcon

2 1

FINAL REMINDER: New PGP and Mixmaster keys at squirrel.owl.de
by Johannes Kroeger 17 Dec '03

17 Dec '03

New keys at squirrel already in use; old ones expire on January 1, 1999. Key for user ID: Squirrel Remailer <mix(a)squirrel.owl.de> (EXPIRE:1999-07-01) 2048-bit key, key ID 912CA289, created 1998/11/25 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3in mQENAzZcErkA2gEIAMQpXNh1i9puYy/XwQIA8UrK+3BIPyCd92GBCqubdsJeEhAV cOCwfk3g0XGBDYiJBSkCqHG06IZMnXU6BVyukcLEUrmJXeyum7Nc6287ZBT92Ebm XCivROmMiOi2ZpdLUf2Na3QbFyUbZDu/vFTL64wJh3pqjP6BokpVoJi6IIGj7AS3 /Hi2iX9+jP80KUYfMZO0lAW3lTwXYtyduRuT8EoV71/+GTu/DNSBylXdR1zZVueH 531jDOysZbK+kqdlBc3U6GZYe405WVY8xbOprojI4nguPLKC19biLu2hJfFIYElX 7wvBBOMrIlUisvvsO1xm7XKdo/69fYC945EsookABRG0O1NxdWlycmVsIFJlbWFp bGVyIDxtaXhAc3F1aXJyZWwub3dsLmRlPiAoRVhQSVJFOjE5OTktMDctMDEpiQEV AgUTNlwUCLwPSJ4oQv5pAQE+iQgAzYGKS1rNcqQLzeKPAIfX0NrPfuHPWww+b9ZF y9d/dTPeR6dmdX4DbVguuYsRAO6rttklsYJRXpRN1CPO4pFGdSZhbfD2aaKQmADX Y3x0Jjf83jZhHo4sgWF6KxzZXNnZgao1Kkk4BNS8uRBy1jc6e/rTMhRrVABu5nt2 /NZEW8RrrRP3gOb1OSypieBKAfShxskLTiV5yi9rm2IRNhrRnadAygFiKjKBWIGy gKQgWuFNltXrMWriMffg5TVe+PjlTVIynkM9gjdQgE/cg56rqHkv/H5I6UsY0fol dYuNuATT+a1fbflqTfdjZYryEJZR3xndrCQk6wJbu8IMq8U1aokBFQMFEzZcE3oe XusFsYA8HQEBMYMIAJW3NETaKOaj3HA+mzHtmKf5GybI5yBBQ++NchMYOVBcJlHU 3euZx0kjgkjdm2SFZIZnjaLqYS7Nk4IJYMcvsGBrEtk7TFtyEZ8uHOQgUN1nbmOv tYr8gO7OyS/XULjz8uCuEvDza2dIBBiWstgxUOoKjMSXrjlMT4MRYPUphZS7Wf5n aNE2Y2cD0ANZIFbB3afc96TNtnO+VKnH2hIPWDogoSVGCO4Y1wqsH+VwiRwoLPcY R5qiWITbK6Ax3JCHv/a27VMiv4uHNDLU+FGq/8ksk9/EclWN2+Ni3qMD1aI/pTtt 3XhHBc8tLgWpW8J7Yy9DNxZmaAArqut4FqjPudKJARUDBRA2XBMRfYC945EsookB AQyuB/9hDivQELGw37CwDIgqmqdF31SpJeuHxhm4/BQg3Gc0Ezn3WaetkheX9p9+ lsEEq36oknIyg8GYgTr3nsRTgJXuwssB0SkiB+x3CkYegsuCgh30xAaxVB3RlIfU ny75Ltxl52p387bJ2sDc3STUQBEAy0HfjlgD98p7IO38D/rw/WWrXTko6rCcnuEx AzJ2Lx9klS0GLq/PxS9wK3V/5VM4rxMEhcnog+lHF1/GpvGnXAtNJztqqgdijjW8 C8qEJRKKh9c5PTCxBfwqLOHxsGCeBaEDzjO/LyCEohYlwZhBlVqN56zS6z0y7yBL AAF5qt39x2jsrKSH9p9fpZO06WuB =Yqyh -----END PGP PUBLIC KEY BLOCK----- =-=-=-=-=-=-=-=-=-=-=-= squirrel mix(a)squirrel.owl.de 3de441b2b721e4853259ae6952a0cfca 2.0.4b43 CNm -----Begin Mix Key----- 3de441b2b721e4853259ae6952a0cfca 258 AATdqb9WxExPliCxZIZ9GZyXCGZZiDa4bwZPSP4S lz7UORYAZu+rjGDinf4lfmPxfZIcF0X1oefLetF4 TxN4dZxmJWqz65NufN7pu4BngA1yGcV5Mn7LqbJh 8kqlGEdUFeb4LJTxhYW1flD1HEfmfE4nuYMQniSb oXLX1rypyH9OiwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB -----End Mix Key----- -- Johannes Kroeger <hanne(a)squirrel.owl.de> Send mail with subject "send pgp-key" to get my PGP key

1 0

Happy New Year 1999 - Export Trade
by anali 17 Dec '03

17 Dec '03

30-12-1998. DEAR SIR, WE ARE ONE OF LEADING EXPORT ORGANIZATION IN SRI LANKA.WE WISH FORWARD OUR EXPORT MARKETS INFORMATINS FOR YOUR REFERENCES.OUR EXPORT COMMDITIES DETAIL GIVEN BELOW: EXPORT COMMODITIES- ******************* 1.FRESH FRUITS AND VEGETABLES. 2.CEYLON BLACK TEA IN BAGS,PACKETS OR BULK. 3.CEYLON HERBAL TEA IN BAGES,PACKETS OR BULK.DETAILS AS FOLLOWS: i.Bevila Tea (Sida Racemosa)Recommended for Reumatic pains/Cooling. ii.Ginger Tea (Zingiber Officinale)Recommended for Stimulant/Carminative. iii.Beli Tea (Aegle Marmelos)Recommended for Chronic Fever/Piles. iv.Ranawara Tea (Cassia Auriculata)Improve complexion in Woman. v.Gotukola Tea (Centella Asiatica)Improve the Memory. vi.Cinnamon Tea (Cinnamomum Zeylanicum)Recommended for Reumatism/Cold. vii.Clove Tea (Eugenia Caryophyllata)Recommended for Cold/Stomachie. viii.Polpala Tea (Aerva Lanata)Recommended for Kidney flushing. ix.Lantana Tea (Phyla Nodiflora)Recommended as Diuretic/Carminative. 4.CEYLON HERBAL PORRIDGE IN CONSUMER PACKETS.(HATHAWARIYA,- GOTUKOLA,WEL-PENELA,MUKUNUWENNA & IRAMUSU). 5.CEYLON HERBAL TEA (BLOOD PURIFYING TEA)- TEPHROSIA PURPUREA,TINOSPORA CORDIFOLIA,PHYLLANTHUS EMBLICA,- EVOLVULUS ALSINOIDES & CASSIA AURICULATA. 6.CEYOLN HERBAL TEA (SLIMMING TEA)-GYRINOPS WALLA,- BAUHINIA VARIEGATE,ATALANTIA MISSIONIS,MINOSA PUDICA- & CALOTROPIS GIGANTEA. 7.SPICES (BLACK PEPPER,CARDAMONS,CLOVES,GINGER,MACE,NUTMEG TUMERIC AND CINNAMON). 8.FRESH COCONUTS AND DESICCATED COCONUT. 9.FIBER(COIR PRODUCTS)-FIBER MOSSTICK,HUSK CHIPS,COMPRESSED COCOHUSK,DUST,PEAT. 10.SEA FOODS.DETAILS FOLLOWS: i.Fish -Frozen/Chilled ii.Shrimp. iii.Black Tiger Farm Prawns. iv.Giant Tiger Prawns. v.Cattle fish. vi.Octopus. vii.Live Prawns. vii.Lobster (Live or Frozen) Processing and Packing can be arranged to suite your requirements.All shipments by Air and Carry Sri Lanka Government Health Certificate of Origin. 11.RICE AND DHAL (RED LENTILS ). 12.NARURAL RUBBER. 13.SUGER. 14.INTERNATIONAL BRAND NAME CIGARETTES. 15.INTERNATIONAL BRAND NAME BEER AND NON ALCOHOLIC BEER AND LIQUOR. 16.ALL INTERNATIONAL BRAND NAME PERFUMES. 17.CRUDE OIL,PETROLEUM BY - PRODUCTS. 18.MEAT PRODUCTS-CHICKEN/BEEF/PORK WE ARE THANKING YOU IN ADVANCE FOR YOUR EARLY ATTENTION IN THIS REGARD. BEST REGARDS, LIONES ENTERPRISES NO-30,SUNETHRADEVI ROAD,KOHUWALA, P.O.BOX-77 ,NUGEGODA, SRI LANKA. TEL :0094 1 823464 (5 Lines) FAX :0094 1 823464 E.MAIL:anali@slt.lk **************************** We are following brand name Cigarettese and Beer manufacturer's Agent. Details as follows: CIGARETTES - ALL PRICES IN F.O.B.COLOMBO/SRI LANKA (USD.) ********************************************************** ONE (01)CASE CONTAIN 10,000 STICKS ********************************** 1/MARLBORO - LIGHT/REGULER Origin:U.S.A. 2/MILD SEVEN -HARD PACK Origin:U.K. AND SWITZERLAND 3/DAVIDOFF -CLASSIC Origin:GERMANY 4/SUPER KING Origin:U.K. 5.REGAL KING SIZE Origin:U.K. 6.TEDLAPIDUS Origin:U.K. 7/ROTHMANS Origin:U.K. 8/DUNHILL Origin:U.K. 9/555 -REGULER/LIGHT Origin:U.K. 10/555 -INTERNATIONAL Origin:U.K. 11.Camel,Winston,Salem and More Brand Cigarettes we can supply at the rate of USD.315.00 QUANTITY: 1 MASTER CASE = 10.000 Cigs 1 x 20' Container = 430 Master cases 1 x 40' Container = 920 Master cases SHIPMENTS - 20' AND 40' FCL'S ONLY. ************************* BEERS ***** 1.BARON'S BEER (MADE IN HOLLAND) ******************************** Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 2.MASTER BEER(MADE IN HOLLAND) ****************************** Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 3.HOLLANDIA BEER(MADE IN HOLLAND) ********************************* Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 4.BAVARIA BEER(MADE IN HOLLAND) ******************************* Packing :24 cans per shrink-wrapped tray 2261 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 5.ORANJEBOOM PREMIIM BEER(MADE IN HOLLAND) ****************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 6.REMBRANDT MASTERPIECR LAGER BEER(MADE IN HOLLAND) *************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 7.MELCHERS PREMIUM EXPORT PILSENER(MADE IN HOLLAND) *************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 8.VAN DELFT PREMIUM EXPORT PILSENER(MADE IN HOLLAND) **************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 9.HEINEKEN (GREEN LABEL)MADE IN HOLLAND *************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. GENERAL TERMS AND CONDITION *************************** SHIPMENTS - 20' or 40' FCL'S ONLY. DELIVERY TIME :Received your L/c to our Bank arrange the shipment Further informations ******************** ATLANTIC NAVIGATIONS LINES (PVT) LTD NO-30,SUNETHRADEVI ROAD , KOHUWALA , NUGEGODA.COLOMBO. SRI LANKA. TEL: 0094-1-823464 (5 LINES) FAX: 0094-1-823464 E.Mail: anali(a)slt.lk

1 0

Happy New Year 1999 - Export Trade
by anali 17 Dec '03

17 Dec '03

30-12-1998. DEAR SIR, WE ARE ONE OF LEADING EXPORT ORGANIZATION IN SRI LANKA.WE WISH FORWARD OUR EXPORT MARKETS INFORMATINS FOR YOUR REFERENCES.OUR EXPORT COMMDITIES DETAIL GIVEN BELOW: EXPORT COMMODITIES- ******************* 1.FRESH FRUITS AND VEGETABLES. 2.CEYLON BLACK TEA IN BAGS,PACKETS OR BULK. 3.CEYLON HERBAL TEA IN BAGES,PACKETS OR BULK.DETAILS AS FOLLOWS: i.Bevila Tea (Sida Racemosa)Recommended for Reumatic pains/Cooling. ii.Ginger Tea (Zingiber Officinale)Recommended for Stimulant/Carminative. iii.Beli Tea (Aegle Marmelos)Recommended for Chronic Fever/Piles. iv.Ranawara Tea (Cassia Auriculata)Improve complexion in Woman. v.Gotukola Tea (Centella Asiatica)Improve the Memory. vi.Cinnamon Tea (Cinnamomum Zeylanicum)Recommended for Reumatism/Cold. vii.Clove Tea (Eugenia Caryophyllata)Recommended for Cold/Stomachie. viii.Polpala Tea (Aerva Lanata)Recommended for Kidney flushing. ix.Lantana Tea (Phyla Nodiflora)Recommended as Diuretic/Carminative. 4.CEYLON HERBAL PORRIDGE IN CONSUMER PACKETS.(HATHAWARIYA,- GOTUKOLA,WEL-PENELA,MUKUNUWENNA & IRAMUSU). 5.CEYLON HERBAL TEA (BLOOD PURIFYING TEA)- TEPHROSIA PURPUREA,TINOSPORA CORDIFOLIA,PHYLLANTHUS EMBLICA,- EVOLVULUS ALSINOIDES & CASSIA AURICULATA. 6.CEYOLN HERBAL TEA (SLIMMING TEA)-GYRINOPS WALLA,- BAUHINIA VARIEGATE,ATALANTIA MISSIONIS,MINOSA PUDICA- & CALOTROPIS GIGANTEA. 7.SPICES (BLACK PEPPER,CARDAMONS,CLOVES,GINGER,MACE,NUTMEG TUMERIC AND CINNAMON). 8.FRESH COCONUTS AND DESICCATED COCONUT. 9.FIBER(COIR PRODUCTS)-FIBER MOSSTICK,HUSK CHIPS,COMPRESSED COCOHUSK,DUST,PEAT. 10.SEA FOODS.DETAILS FOLLOWS: i.Fish -Frozen/Chilled ii.Shrimp. iii.Black Tiger Farm Prawns. iv.Giant Tiger Prawns. v.Cattle fish. vi.Octopus. vii.Live Prawns. vii.Lobster (Live or Frozen) Processing and Packing can be arranged to suite your requirements.All shipments by Air and Carry Sri Lanka Government Health Certificate of Origin. 11.RICE AND DHAL (RED LENTILS ). 12.NARURAL RUBBER. 13.SUGER. 14.INTERNATIONAL BRAND NAME CIGARETTES. 15.INTERNATIONAL BRAND NAME BEER AND NON ALCOHOLIC BEER AND LIQUOR. 16.ALL INTERNATIONAL BRAND NAME PERFUMES. 17.CRUDE OIL,PETROLEUM BY - PRODUCTS. 18.MEAT PRODUCTS-CHICKEN/BEEF/PORK WE ARE THANKING YOU IN ADVANCE FOR YOUR EARLY ATTENTION IN THIS REGARD. BEST REGARDS, LIONES ENTERPRISES NO-30,SUNETHRADEVI ROAD,KOHUWALA, P.O.BOX-77 ,NUGEGODA, SRI LANKA. TEL :0094 1 823464 (5 Lines) FAX :0094 1 823464 E.MAIL:anali@slt.lk **************************** We are following brand name Cigarettese and Beer manufacturer's Agent. Details as follows: CIGARETTES - ALL PRICES IN F.O.B.COLOMBO/SRI LANKA (USD.) ********************************************************** ONE (01)CASE CONTAIN 10,000 STICKS ********************************** 1/MARLBORO - LIGHT/REGULER Origin:U.S.A. 2/MILD SEVEN -HARD PACK Origin:U.K. AND SWITZERLAND 3/DAVIDOFF -CLASSIC Origin:GERMANY 4/SUPER KING Origin:U.K. 5.REGAL KING SIZE Origin:U.K. 6.TEDLAPIDUS Origin:U.K. 7/ROTHMANS Origin:U.K. 8/DUNHILL Origin:U.K. 9/555 -REGULER/LIGHT Origin:U.K. 10/555 -INTERNATIONAL Origin:U.K. 11.Camel,Winston,Salem and More Brand Cigarettes we can supply at the rate of USD.315.00 QUANTITY: 1 MASTER CASE = 10.000 Cigs 1 x 20' Container = 430 Master cases 1 x 40' Container = 920 Master cases SHIPMENTS - 20' AND 40' FCL'S ONLY. ************************* BEERS ***** 1.BARON'S BEER (MADE IN HOLLAND) ******************************** Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 2.MASTER BEER(MADE IN HOLLAND) ****************************** Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 3.HOLLANDIA BEER(MADE IN HOLLAND) ********************************* Packing :24 cans per shrink-wrapped tray 2277 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 4.BAVARIA BEER(MADE IN HOLLAND) ******************************* Packing :24 cans per shrink-wrapped tray 2261 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 5.ORANJEBOOM PREMIIM BEER(MADE IN HOLLAND) ****************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 6.REMBRANDT MASTERPIECR LAGER BEER(MADE IN HOLLAND) *************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 7.MELCHERS PREMIUM EXPORT PILSENER(MADE IN HOLLAND) *************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 8.VAN DELFT PREMIUM EXPORT PILSENER(MADE IN HOLLAND) **************************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. 9.HEINEKEN (GREEN LABEL)MADE IN HOLLAND *************************************** Packing :24 cans per shrink-wrapped tray 2300 trays 24 x 330ml per 20'FCL Quality :5% Vol.Alc. GENERAL TERMS AND CONDITION *************************** SHIPMENTS - 20' or 40' FCL'S ONLY. DELIVERY TIME :Received your L/c to our Bank arrange the shipment Further informations ******************** ATLANTIC NAVIGATIONS LINES (PVT) LTD NO-30,SUNETHRADEVI ROAD , KOHUWALA , NUGEGODA.COLOMBO. SRI LANKA. TEL: 0094-1-823464 (5 LINES) FAX: 0094-1-823464 E.Mail: anali(a)slt.lk

1 0

Re: Triple DES "standard"?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Reply-To: <rankney(a)erols.com> From: "Rich Ankney" <rankney(a)erols.com> To: <dcsb(a)ai.mit.edu>, "Digital Bearer Settlement List" <dbs(a)philodox.com>, "Robert Hettinga" <rah(a)shipwright.com> Subject: Re: Triple DES "standard"? Date: Wed, 30 Dec 1998 09:40:38 -0500 Sender: <dbs(a)philodox.com> List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> <snip> > Actually, as I recall the tale, the Amercian Bankers > Association-sponsored ANSI-accredited X.9 Committee's blessing of DES3 was > itself pretty interesting. > > I understood that the NSA lobbied bitterly against the X9 effort to > standardize 3DES as an ANSI standard, insisting that DES would surfice > until its successor was chosen. > > A couple years ago, when the X9 committee -- or maybe one of the X9 > crypto subcommittees -- rejected that advice and initially recommended that > 3DES be made a standard, I was told that the NSA rep angrily declared that > 3DES would _never_ get an export license and would never be shipped > overseas. (Which may have put a damper on the 3DES standardization > effort;-) > > Unfortunately, these standards development efforts usually escape > the media's attention. Anyone on the list active in X9 and can give us the > real story? > I was at the meeting. This was a meeting of (I think) X9F3, which is a working group in X9F, which has several working groups doing security. 3DES was being pushed really hard by the Fed. The vote was to get a sense of how much interest there was in a 3DES standard. (There is no requirement to have such a vote to work on something; the X9 rules require a new work item ballot sent to all X9 members.) The NO votes were, IIRC, from NSA (with the above quote, more or less), IRS, and IRE (a commercial outfit located in Baltimore). NIST abstained. I don't recall the official X9 vote, but it was along the same lines. The work was done in a different working group, X9F1, chaired by the legendary Blake Greenlee. The standard was published a few months ago. Again, the Fed pushed really hard on this; kudos to them. I'm sure Cindy Fuller of the X9 Secretariat (cfuller(a)aba.com) would have the official X9 ballot results if anyone is interested... > Since the birth of X9 in the late 70s, the US National Security > Agency has its own representative on the X9 Committee. As one might > expect, the NSA has traditionally had significant influence over the ANSI > "F" (crypto) subcommittees and cryptographic standards in financial > services. There was a time when Ft. Meade effectively dictated those > standards. Now, that is not necessarily so.... > > (After the NSA blundered so badly in trying to force the Banking > industry to switch from DES to CCEP/Clipper in the late 80s, the Agency's > mesmerizing control broken. The initial intro of CCEP/Clipper -- at an ABA > meeting -- proposed that only US owned institutions could have access to > Clipper. At the time, as I recall, maybe 10-15 percent of the US banks > were foreign owned;-) The bankers couldn't believe that these idiots -- > obviously so ignorant about the workings of the industry they were trying > to defacto regulate -- were from the NSA of Legend and Lore.) > I didn't start attending meetings till the early '90's, but I can certainly testify that Clipper/Fortezza were pushed really hard. In fact, X9F1 may still have open work items on some of this stuff (no work going on, but it needs a formal vote to remove it from the list). My major objection was the attempt to standardize on a particular *product*, which used classified algorithms, vs. standardizing on a public algorithm which could be implemented in H/W or S/W. So X9 ended up with: 3DES instead of Skipjack; DSA and RSA (and ECDSA real soon now) for signatures; and DH, RSA, and EC (real soon now) for key management. It's interesting that our DH standard seems to have reinvented much of the interesting stuff in KEA. Regards, Rich --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: CLT&G Update: 29 Dec 98
by Michael Motyka 17 Dec '03

17 Dec '03

>> Jefferson and Madison were fearful, as more Americans should >> be today, of allowing power to be concentrated in the central >> government. > >The entire point of a consitutional democracy is to avoid >centralization. > >A better way to word this is that we should be afraid of the federal >government becoming the central government. > The ENTIRE point? ONE of the points was to define and limit the extents of centralization. There is no cure for the chronic tendency of people in power to try and increase their scope. The repeated application of palliatives is the only way to deal with that social disease.

1 0

Re: CLT&G Update: 29 Dec 98 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 30 Dec 1998 08:53:44 -0800 > From: Michael Motyka <mmotyka(a)lsil.com> > Subject: Re: CLT&G Update: 29 Dec 98 > >The entire point of a consitutional democracy is to avoid >centralization. > > > >A better way to word this is that we should be afraid of the federal > >government becoming the central government. > > > The ENTIRE point? The ENTIRE point. > ONE of the points was to define and limit the extents of centralization. No, the point of a democratic government is to eliminate centralization of authority. To distribute and limit what each level can do from the top to the bottem. Read the 9th and 10th again. > There is no cure for the chronic tendency of people in power to try and > increase their scope. The repeated application of palliatives is the > only way to deal with that social disease. If you truly believe this then you should shoot yourself now and get it over with. There is a cure, that cure is to recognize the behaviour in people and build systems that limit the opportunity to express it. The best plan we've come up with so far is constitutional democracy. ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Crackers Set Sights on Iraq
by Mark 13 17 Dec '03

17 Dec '03

Geniuses at work: http://www.wired.com/news/print_version/politics/story/17074.html?wnpg=all > "It's a crime in itself to build weapons of mass destruction when the > children of the country are starving," said a group member who goes by > the name "kInGbOnG." And do they hope to kill Saddam, or help in NOT starving the nation? No, they plan to attack the government information systems used to rationing and planning deliveries of the food! > Though the systems' geographic origin could not be positively confirmed, > login prompts contained phonetic spellings of Arabic words. And to top it off, they're not even sure which country they are attacking! They can't possibly hit any military targets with this attack! And they hope to further the human rights with this attack? God save us from this kind of stupidity. -------------------------------------------------------------------------- http://www.wired.com/news/print_version/politics/story/17074.html?wnpg=all Crackers Set Sights on Iraq by James Glave 3:00 a.m. 30.Dec.98.PST A global group of 24 hackers and crackers spent Monday night probing, mapping, and preparing to attack computer networks owned by the government of Iraq. Quoting at one point from the Declaration of Independence, Steve Stakton, a member of the seven-year-old Legions of the Underground group, called for a concerted one-week cracking campaign against Iraq. "Iraq has treated human rights issues as poorly as China has," said Stakton in a meeting of the group that was held Monday night on Internet Relay Chat. "We need to carry out what the government won't, and can't, do." Stakton, 24, quoted from the group's mission statement: "We are ready to commence, and take [part] in electronic warfare if requested." Iraq has no connection to the public Internet, though Iraq Net, an official government homepage, is based in New York. Group members claim to be targeting an older, nonpublic network inside Iraqi borders that they say runs on a vintage protocol called X.25. "We are targeting them via terminal dialup," said Stakton in an interview conducted with group members on Tuesday over IRC, a global text-based chat network where identities can easily be forged. Group members said they were probing sequential network numbers within an older network owned by MCI, which they believed were assigned to Iraq. They described the system as "a gateway that handles systems that have no local chain of numbers." "It would effectively isolate them from the world if we took out the X.25," added a 19-year-old member based in Minnesota who goes by the name "lothos." "If we wanted we'd be able to dial up and make a huge amount of connection to their systems and possibly bring it down to its knees," Stakton said. One member said that he was analyzing network scans from the Iraqi cities of Ar Rutbah and Al Kut. Scott Ellentuch, a network security specialist with Internet consultancy TTSG, said X.25 networks are commonly used to connect older equipment. Iraq hasn't received any computers or computer supplies since the United Nations embargo was put in place at the time of the Gulf War. "If they do have an X.25 connection into Iraq, and that is their only network capability, someone could hop off the Internet and hop on to the X.25 and ride into the X.25 network," said Ellentuch. The group said its efforts partly involved "wardialing," a process of automatically dialing one phone number after another looking for modems. Members said that many modems answered at 2400 bps -- a speed common in the late 1980s. "Many other countries don't have ... technology as [advanced as] the United States," said Ellentuch. "The exploits that are possible on these machines have been around for ages." A member of the group supplied Wired News with a log of attempted connections to various institutional computer systems and bulletin board systems. Though the systems' geographic origin could not be positively confirmed, login prompts contained phonetic spellings of Arabic words. Stakton said that Legions' scanning efforts would continue Monday night, but declined to say when the group hoped to launch its attack. The Legions said that the attack was a legitimate act of protest against a rogue dictator. "It's a crime in itself to build weapons of mass destruction when the children of the country are starving," said a group member who goes by the name "kInGbOnG." In recent months, Legions of the Underground, whose members are largely in their 20s, has launched numerous attacks against China to draw attention to that nation's human-rights record. Last July, in a demonstration of their technical abilities, members claimed to have remotely moved a satellite dish owned by Time Warner Cablevision. The company confirmed a security breach in that incident.

1 0

New Crypto Regs
by John Young 17 Dec '03

17 Dec '03

Thanks to Ed Roback, NIST: BXA issued a press release today on new crypto regulations: http://www.bxa.doc.gov/press/98/1230encryption.html (copy below) The regs themselves are available today only in hardcopy in Washington DC on display at the Federal Register, but the electronic version will be published in the Federal Register tomorrow and will be on the BXA Web site <www.bxa.doc.gov>. Anybody in DC who could get a copy of the hardcopy and fax it to us, it would be appreciated: Fax: (212) 799-4003 Vox: (212) 873-8700 ---------- Commerce Updates Export Controls on Encryption Products (Washington, D.C.) The Commerce Department will publish new regulations significantly streamlining government export controls on powerful encryption -- products that scramble computer data -- as part of the Clinton Administration initiatives to make government more efficient and enhance the global competitiveness of U.S. businesses. These amendments to the Export Administration Regulations, on public notice today at the Federal Register, end the need for licenses for powerful U.S. encryption products to companies worldwide in several important industry sectors after a one time review by the Commerce Department. The regulations implement the policy changes announced by Vice President Gore in September. "Through the hard work of industry and government officials to finalize this regulation, U.S. encryption firms will be better able to compete effectively with encryption manufacturers around the world," said William A. Reinsch, Commerce Under Secretary for Export Administration. Virtually eliminated are restrictions on selling powerful computer data scrambling products to subsidiaries of U.S. corporations. There will also be favorable licensing treatment to strategic partners of U.S. companies. Strong U.S.-made encryption products are now available, under license exception, to insurance companies headquartered in 46 countries and their branches worldwide. Sales of powerful encryption to health and medical organizations in the same countries are also eased. To facilitate secure electronic transactions, between on-line merchants in those same countries, and their customers, the updated regulations permit, under a license exception, the export of client-server applications (e.g. SSL) and applications tailored to on-line transactions to on-line merchants. A list of eligible countries is posted on the BXA web-site. Further easing government restrictions are new allowances for U.S. encryption manufacturers to share their source code with their own foreign subsidiaries (while requiring that any resulting new products remain subject to U.S. regulation ) and streamlining reporting requirements for U.S. firms so that compliance is less burdensome. The new regulations expand the policy of encouraging the use of recoverable encryption by removing the requirement to name and approve key recovery agents for exports of key recovery products from regulations. It also defines a new class of "recoverable" encryption products which can now be exported under Export Licensing Arrangements to foreign commercial firms for internal company proprietary use. As part of its stated goal to balance the needs of national security and public safety with the desire to protect personal privacy and strong electronic commercial security, the Administration continues to encourage the development and sale of products which enable the recovery of the unscrambled data, in an emergency situation. Finally, the regulations eliminate the need to obtain licenses for most encryption commodities and software up to 56-bits or equivalent strength. [End]

2 1

National Know Your Bank Day
by Jim Burnes - Denver 17 Dec '03

17 Dec '03

In the interest of National Know Your Bank Day, for what its worth, I'd like to address the issue of perpetual public debt that the Federal Reserve System and our esteemed Congress has foisted on us. Here is a wonderful and powerful quote from Mr Jefferson. "To preserve [the] independence [of the people,] we must not let our rulers load us with perpetual debt. We must make our election between economy and liberty, or profusion and servitude. If we run into such debts as that we must be taxed in our meat and in our drink, in our necessaries and our comforts, in our labors and our amusements, for our callings and our creeds, as the people of England are, our people, like them, must come to labor sixteen hours in the twenty-four, give the earnings of fifteen of these to the government for their debts and daily expenses, and the sixteenth being insufficient to afford us bread, we must live, as they now do, on oatmeal and potatoes, have no time to think, no means of calling the mismanagers to account, but be glad to obtain subsistence by hiring ourselves to rivet their chains on the necks of our fellow-sufferers." --Thomas Jefferson to Samuel Kercheval, 1816. ME 15:39

1 0

limitations of fed power (was CLT&G Update: 29 Dec 98 (fwd)) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 30 Dec 1998 11:46:39 -0700 (MST) > From: Jim Burnes - Denver <jim.burnes(a)ssds.com> > Subject: limitations of fed power (was CLT&G Update: 29 Dec 98 (fwd)) > > > >The entire point of a consitutional democracy is to avoid >centralization. > > > > > > That would be a valid point if we were living in that arrangement. I > like to be a little more specifc. We are living in a democratically elected > reprentative constitutional republic. A representative democracy is still a democracy. The ONLY guarantee of limits in ANY democracy is whether it is constitutional or not. That is the defining issue because that is what limits and defines the governmental structures. The defining issue is not whether it is representative or direct but rather that it has a constitution. A constitution and a bill of rights are in no way a requirement for a democracy (representative or direct). That constitution is what prevents mob-rule. > The point of that constitution is to shackle the tendancy of > a bureaucracy from assuming authority over matters never > assigned to it and using its enforcement powers to assure it. Which is the point under discussion after all. > Eventually the people, wallowing in ignorance, forget the > infraction and the bureacracy assumes de facto control. That is a function of human psychology and not democracy. Blaiming democracy for a function of human behaviour is more than a little misleading. People are social animals. It's gotten us this far and there is no reason to expect a radical shift in human population dynamics in the near term. Really a moot point. It is also the reason the constitution splits authorities, per the 9th and 10th, as it does. The fundamental aspect of a working democracy is conflict, not cooperation as much of todays spin doctor press would have you believe. And by conflict I don't mean spilled blood in the streets. What is really amazing about it is that we have the intelligence to recognize and deal with the trait at all. ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

[ISN] Academic Attacks on SAFER+ (fwd)
by Max Inux 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: [ISN] Academic Attacks on SAFER+ Forwarded From: "Jay D. Dyson" <jdyson(a)techreports.jpl.nasa.gov> Originally From: John Kelsey <kelsey(a)plnet.net> I believe I have found two attacks on the SAFER+ version with 256-bit keys. While these attacks aren't practical, they demonstrate a weakness in the SAFER+ key schedule design, and may lead to more practical attacks in the future. The first attack is a modified meet-in-the-middle attack, requiring 2 known plaintexts and their corresponding ciphertexts, 2^{37} bytes of memory, and work equivalent to about 2^{241} SAFER+ encryptions. I have discussed this attack with Massey, and am fairly confident it really works. The second attack is a related-key attack, requiring 256 chosen plaintexts and their corresponding plaintexts encrypted under two related keys, and work equivalent to about 2^{216} SAFER+ encryptions. This is a much newer attack (about two days old), and I am less certain of it, but I believe it works. I will be writing these attacks up for publication fairly soon, but I wanted to announce them here to get the word out, and to see if anyone can either improve on them or find problems with them. Both attacks exploit two useful properties of SAFER+. First, I will describe the two useful properties, then I will describe the two attacks very briefly. The rest of this note assumes familiarity with SAFER+. 1.0. The Two Useful Properties of SAFER+ Consider SAFER+ with a 256-bit key. The key schedule is quite simple: We extend the key by a parity byte, getting a 33 byte extended key. We then use the 33 byte extended key to generate the entire sequence of subkeys. Each subkey byte is determined by only one key byte. If you know a given key byte, you know all the subkey bytes it determines; if you know a subkey byte, you know the key byte from which it was derived. SAFER+ rounds use 32 bytes of subkey each, in two blocks of 16 bytes. If the key bytes are k[0..32], then we have First Round: k[0..15] k[1..16] Second Round: k[2..17] k[3..18] Third Round: k[4..19] k[5..20] etc. This means that it takes quite a while in the encryption process for the last couple key bytes to affect the encryption. SAFER+ with a 256 bit key has 16 rounds and an output transformation. The output transformation uses only sixteen key bytes. Now, consider how many key bytes have affected the encryption at all after each round: After the first round (round 0), 17 key bytes have been used. After the second round, 19 key bytes have been used. After the third, 21. Continuing, we can see that it takes 9 (out of 16) rounds before SAFER+ has used all 32 key bytes. This allows both of my attacks. 0 17 1 19 2 21 3 23 4 25 5 27 6 29 7 31 8 all The other useful property is that we don't have to know all the key bytes to be able to recognize an output from a round of SAFER+ as being correct. Consider the situation where we know all but the last byte of the key of some round, and we know its input block. Each SAFER+ round consists of the keyed byte substitution layer, and the mixing layer. If we know k[0..14], but not k[15..16], then we end up knowing all but two bytes of the input into the mixing layer. The result is that we end up knowing *none* of the bytes of the output. However, we still know relationships between the bytes of the output. The matrix that describes the mixing layer makes it easy to see how to combine the output bytes into values that are not dependent on the unknown bytes of input. Now, consider a situation where we know all but the last two key bytes for round 0, and all but the first two key bytes for round 1. We can go backward through the mixing layer of round 1 (it's unkeyed), and then go back through the keyed byte substitution layer, learning all but two bytes of the output from round 0. We then make use of the trick described above. We will know relationships between the remaining known bytes of output from round 0, regardless of the unknown key bytes. 2.0. The Meet-in-the-Middle Attack The real insight that makes the low-memory attack work is that we can do meet-in-the-middle with two rounds whose key material we don't know all of. That is, we guess the keys for rounds 1-7 (numbering from one), which gives us all but two of the bytes for round 8. That's 29 key bytes guessed. We then compute some expressions in the output bytes of round 8 that don't rely on knowing the two unknown bytes of key, and that don't rely on knowing the two bytes of round 8's output that will depend on the two unknown key bytes when doing the guess on the other side. We guess the keys for the output transformation (16 bytes), plus the keys for rounds 10-16. That means 30 bytes of key guessed, and it also gives us enough information to get knowledge of all but two bytes of the output of round 8. We then compute those same expressions in those bytes. The result is that we can do the meet-in-the-middle at the output from round 8, despite not knowing all the key bytes used in round 8 or 9. Round | Key Bytes Guessed 1 17 2 19 3 21 4 23 5 25 6 27 7 29 8 29 (two unknown key bytes) - - -------------- (this is where the meet-in-the-middle happens) 9 30 (two unknown key bytes) 10 30 11 28 12 26 13 24 14 22 15 20 16 18 OX 16 That is, we can compute a set of bytes that are dependent only on the 29 bytes of key guessed from the top, or the 30 guessed from the bottom. Now, this would seem to take up a lot of memory to do this meet-in-the-middle attack. Fortunately, however, most of the key bytes guessed from the top are also guessed from the bottom. We thus mount the attack by first guessing all key values in common from the top and the bottom. We then do the meet-in-the-middle by trying all possible 2^{24} values from one side, and all possible 2^{32} values from the other. We compute this intermediate value that doesn't need any other key material from both sides, store our results in a sorted list, and look for duplicates from the top and bottom. With two plaintexts, it's easy to get more than 32 bytes of intermediate values, meaning that we don't expect to see any matches from incorrect guesses. 3.0. The Related-Key Attack The related-key attack works on a similar principle. My current attack is very simple: We choose a pair of keys, K,K^*, such that the keys differ only in the first two bytes; in these two bytes, we have a difference of 0x80. Under K we encrypt 256 plaintexts, P[i], each identical except with a different leftmost byte. Under K^* we encrypt 256 plaintexts, P[i]^*, with some fixed difference D<>0x80 from P[i] in the leftmost byte, and with fixed difference 0x80 in the next byte over. With probability about 1/2, we get at least one pair of plaintexts P[i],P[i]^*, whose values after two rounds are identical under the different keys. When this happens, their values are also identical after nine rounds. Now, we do our trick from the meet-in-the-middle attack, again, and guess the last 26 bytes of relevant key material. This lets us peel off the output transformation and the last five rounds, leaving us with access to the output from the eleventh round. We can peel off the PHT layer, since we know it and its inverse. We can then learn all but two of the bytes input to the eleventh round. We now know all but two bytes of the output from the tenth round, and we know a pair of texts for which only the last two bytes of the input to the tenth tound had changed. We can check to see if the values we've computed as being the outputs from the tenth round are consistent with this situation, and thus are consistent with this being a right pair. We expect to have to check 256 different pairs of texts in this way, each with work equivalent to 2^{208} SAFER+ encryptions. This leaves us with work equivalent to about 2^{216} encryptions, total, to learn 208/256 of the SAFER+ key bits. The remaining 48 bits can be brute-forced after these are known. We thus break SAFER+ with a differential related-key attack, using 2 related keys, 512 plaintexts encrypted under each key, and 2^{216} work. Comments? - - --John Kelsey, kelsey(a)counterpane.com / kelsey(a)plnet.net NEW PGP print = 5D91 6F57 2646 83F9 6D7F 9C87 886D 88AF -o- Subscribe: mail majordomo(a)repsec.com with "subscribe isn". Today's ISN Sponsor: Internet Security Institute [www.isi-sec.com]

1 0

'Tis the day after Christmas And something's not right
by qiy68＠leica.com.au 17 Dec '03

17 Dec '03

'Tis the day after Christmas And something's not right Were painfully aware That our clothes are too tight. We ate lots of gravy And pumpkin pie too Oh, no, not a diet... But what shall we do? Now you can lose weight without suffering. Call Tides of Life at 1-888-817-7443 for information on safe, natural, and effective weight loss products. Our premier product, Cheat & Eat, contains 1000 mg of chitosan per tablet along with herbs. This binds to fats and sugars in the intestinal tract, blocking absorption and passing them out of the body before you can absorb the calories! Also stops sugar cravings. Clinical studies show an average weight loss of 4 pounds per week with no drugs, side effects or starvation diets! We are offering a great introductory price of $29.50 plus $2.50 shipping for a 6 week supply. You can buy much weaker chitosan products for $70/bottle but we have located the best product for you at the best price. Call 1-888-817-7443 for more information on Cheat & Eat and other natural weight loss products. Tides of Life has specialized in natural hormonal products and related health supplements since 1993. Free price list upon request. *-*-*-*-*-*-*-* Removal from lists, please go to http://209.216.69.189/remove/ #2167659jdfv94894hde nqr is <qiy68@leica

1 0