December 2003 - cypherpunks-legacy

"Root Canal" questions
by David Sobel 17 Dec '03

17 Dec '03

"Root Canal" questions >In the latest CPSR update: >> "Each FBI Special Agent in Charge's contacting key law >> enforcement and prosecutorial officials in his/her territory >> to stress the urgency of Congress's being sensitized to this >> critical issue; > >Isn't this a violation of the Hatch Act? Either on the part >of the agents, or on the part of the "key" officials directly >"sensitizing" Congress, or both. The Hatch Act applies only to "partisan" activity (i.e., electoral). There is, however, a very real question as to whether or not the activity we've uncovered might violate 18 U.S.C. Sec. 1913, which prohibits the use of "appropriated funds" for lobbying purposes. I'm in the process of looking into that. There's no way to read this material without concluding that the Bureau was undertaking an orchestrated, agency-wide lobbying campaign in support of the "Root Canal" initiative. BTW, anyone have ideas about that name!? David Sobel CPSR Legal Counsel

1 0

Re: Instant check system
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Mike McNally writes: > The Brady Bill is just a gun-grabber Creationist plot to foil > Nazi Abortionists who don't realize that Libertarinaism is the only > true way to distinguish saffron from turmeric. What about the Nazi Abortionists who *do* realize that Libertarinaism is the only true way to distinguish saffron from turmeric? Will we still be able to get guns? :-) I'm beginning to regret my 'Brady Bill and Instant Check system' post... Jim_Miller(a)suite.com

1 0

VMS Password security
by baldwin＠LAT.COM 17 Dec '03

17 Dec '03

One of the barn-door sized holes in VMS was (still is?) that VMS used the Purdy Password hashing function. I considered using it for the Oracle RDBMS password function, but dropped the idea when I realized that it is possible to invert the hash function. I don't have my notes, but I recall that it only took me a couple days to work it out. The problem is that many passwords hash to the same value. It is actually hard to find out the true password that someone else chose, but easy to find another password that will hash to the same value. The hard part is finding a printable password that maps to the desired value. --Bob Baldwin

1 0

Re: Should we oppose the Data Superhighway/NII?
by jazz＠hal.com 17 Dec '03

17 Dec '03

Okay, now let's look at Tim May's hypothetical case. Tim wants X-rated cable. But the first nine cable companies don't want to provide it. And the Metzger-Godwin Cable operation, which would provide it, can't get financing. There's a market for it, but there's also a barrier to entry. If there's a market for it, investors will poney up the money; that's just the way it works, Mike. I leave to your imagination what happens in the event that we *do* start the P-G Cable company, but content providers won't sell other programming to us so Tim is forced to choose between only X-rated cable--us--and cable services that provide other kinds of programming. (Tim may have no problem with this, but lots of other people in our market will want to watch CNN as well as X-rated videos.) Cable, like many other utilities, doesn't restrict you to a single provider. I can imagine having phone lines from two local loop providers to maximize redundancy; similar for an information utility, where the information provided will likely differ from one provider to another. In the cable business, two companies will not want to compete on price; they'll try to compete on content instead, each having exclusive material. The ideal situation from the cable companies' perspective is for customers to *want* to subscribe to more than one. The infrastructure will grow to allow it. Wouldn't it be better to live in a world in which the cable infrastructure, like the telephone infrastructure, could be serviced by competing providers, and at the individual level? We already have this with long-distance--if I want, I can have Sprint, MCI, *and* AT&T accounts and use them all from the same phone. Ultimately we'll have it in the local loop. If you have competition in the local loop on shared infrastructure - who owns that infrastructure, who maintains it, who allocates costs? Probably some neutral 3rd party, possibly regulated. Square one. > > They used the same wires, Perry. > > Nope, they didn't. If necessary, we can dig up references. Oh, you're saying that one couldn't make a phone call from one local phone company to another? Exactly correct; you had to know which company provided service to your party and use their equipment. Much like dialing 1-800 numbers from overseas; you have to contact the US operator for the company that provides 800 service and ask them to hook you up. Perhaps 800 number portability will solve that, though; are you suggesting something like the infrastructure that supports 800-number portability will appear at the local-loop level as well? Not any time soon; they can barely get the 800 number stuff to work right, and local loop is three orders of magnitude larger. Jason Zions

1 0

The Depravities of Cypherpunks
by jazz＠hal.com 17 Dec '03

17 Dec '03

>Also, I have mail from Mr. Jason Zions (jazz(a)hal.com) also complaining >that I violated Mr. Metzger's privacy in revealing his mailbomb to me >to the list as a whole. This strange code of cypherpunk chivalry I am >not familar with. It's not chivalry; it's copyright law. The creator of a message owns the copyright to that intellectual property; the recipient owns the copy of the message, much like one who buys a recorded album owns the copy of the work. The message you quoted contained the statement "Do not forward/reproduce this message" or words to that effect. That is a clear statement by the copyright holder which limits any redistribution rights that might have otherwise become yours upon receipt of the message. Given the nature of the communication (i.e. mention of potential email bombing), I believe you'd be within your rights to share the threatening content of the message with upstream mail host admins who might play a role in preventing such an occurance; but no further. It's also common courtesy. You can have significant disagreements with a person, yet still honor their simple requests. Jason

1 0

Key Sharing Protocols
by an7822＠anon.penet.fi 17 Dec '03

17 Dec '03

I'm working on an internal protocol for securing company records and I'd like to solicit some net.wisdom. One of my requirements is to ensure that no data is lost if an employee quits, is fired, dies, etc. At the same time, I don't want to have a security officer with the "keys to the castle" for every user. I've had these ideas, so far. * Use PGP for all encryption, for both E-mail and personal files on disk. * For personal files, encrypt with your own public key. This allows all files and communications to be encrypted while using one passphrase, which may be changed without having to re- encrypt files. To allow for loss of a passphrase, for whatever reason, use a secret sharing protocol to split the secret key of the user into several pieces, held by designated security officers. Reconstruction of the key will require cooperation by "n" security officers. I have some problems with this. * While I can extract the secret key from the user's private keyring, it is still encrypted by the user's passphrase. Is there any method for extracting an unencrypted key? * If there is no way to produce an unencrypted key, I could have the user extract her key after setting her passphrase to some standard value, and then change it again after extraction. * How can I ensure, without reconstructing the key from my secret sharers, that the key and passphrase I have been given are, in fact, correct. If I could produce an unencrypted key, I would just have to verify that this was the correct private RSA key. If the private key can only be extracted encrypted, I have to verify both the standard passphrase and the private RSA key. I would be interested in comments and suggestions on this proposed protocol and the unresolved issues. My intent is that a user be able to generate a key pair, run a job to split the key into n segments for the sharers and have the sharers able to verify that they have the correct key, without having to reassemble the key. Has anyone implemented code for any of the secret sharing protocols, or am I going to have to reinvent this particular wheel? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

(fwd) Netcom adds access in Denver area
by jazz＠hal.com 17 Dec '03

17 Dec '03

Gee, it'd sure be nice if they showed up in Austin. Hint, hint. Jason

1 0

Caller ID: belated thanks
by Philippe Nave 17 Dec '03

17 Dec '03

Many thanks to all the people who posted responses to the Caller ID question! I appreciate your time, thought, and responses. ........................................................................ Philippe D. Nave, Jr. | The person who does not use message encryption pdn(a)dwroll.dw.att.com | will soon be at the mercy of those who DO... Denver, Colorado USA | PGP public key: by arrangement.

1 0

CPSR cypherpunks archive
by Philippe Nave 17 Dec '03

17 Dec '03

Dave Banisar sent us the November 12 CPSR alert [thanks, by the way!] which contained, among other things: > The CPSR Internet Library is available via FTP/WAIS/Gopher from > cpsr.org /cpsr. Materials from Privacy International, the Taxpayers > Assets Project and the Cypherpunks are also archived. For more ^^^^^^^^^^^^^^^^^^^ This caught my eye, especially in light of the recent postings about whether or not the cypherpunks postings should/should not be provided to Usenet. ........................................................................ Philippe D. Nave, Jr. | The person who does not use message encryption pdn(a)dwroll.dw.att.com | will soon be at the mercy of those who DO... Denver, Colorado USA | PGP public key: by arrangement.

2 1

Re: The Depravities of Cypherpunks
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

Jason Zions thus emailed: > >Also, I have mail from Mr. Jason Zions (jazz(a)hal.com) also complaining > >that I violated Mr. Metzger's privacy in revealing his mailbomb to me > >to the list as a whole. This strange code of cypherpunk chivalry I am > >not familar with. > > It's not chivalry; it's copyright law. The creator of a message owns the > copyright to that intellectual property; Apart from the ridicule of this whole thing, there at least two different and independent issues here: Privacy issues and copyright issues. And I'm still not fully clear on the legal side of some of their subtelties (help from our legal types would be appreciated). In the case of private mail from one person to an other. I'm under the impression that the sender retains copyright ownership on the message, but that the receiver has the right to make the content public (as in disclosing what it is about, and that the communication occured). (This impression gleaned from -Syslaw, Lance Rose, Jonathan Wallace, 1992- in particular) How far the recipient can go in disclosing is not clear: posting the whole or part of the message seems to go against the ownership rule. Header notices like "Do not forward" or "reposting with permission only" do not change much the ownership issue, but do they alter the privacy issue? What is the origin of any right of the recipient to disclose the message to third party? For that matter, is there sufficient "intellectual input" in a short mail bomb / threat like the one that was used (if I remember) to cause significant copyright ownership? Apologies for nitpicking. It's just that the ownership/privacy issue is very important for the Future Net, and that I'm interested in THAT aspect of the war. > Given the nature of the communication (i.e. mention of potential email > bombing), I believe you'd be within your rights to share the threatening > content of the message with upstream mail host admins who might play a role > in preventing such an occurance; but no further. Given the nature of the communication, I believe it's clearly his rights to make the threats public... especially in the case where the threatener is his own sysadmin, and especially on this list where we can all (ahem... :-) benefit from knowing how things evolve (nobody forces anybody to read any of the longish drivel, mine included). > It's also common courtesy. You can have significant disagreements with a > person, yet still honor their simple requests. LOL This really cracks me up. I mean, that some bystanders still use the words "common courtesy", "disagreements" and "simple requests" when talking about this war. Remember both/either sides could have started using mail filters ages ago, instead they are now proudly mail bombing and reputation bombing. Just a bystander... maybe standing a bit in the middle... Pierre. pierre(a)shell.portal.com

1 0

Are we gatewayed into USENET?
by cvoid＠albemuth.tatertot.com 17 Dec '03

17 Dec '03

For a moment there, yes. But alas, I have the problem fixed. You see, I was gating the list into a local group for my own purposes, and was not aware my machine (albemuth) was batching the list outgoing. My smarthost asked about this as it was being junked on his end. Well evidently, the junking stopped and alas <cypherpunks.list> starting showing up on Netcom. The problem is corrected. Sorry if anyone is upset, but alas, shit happens. ;) Christian Void /T71 | "I don't like it, and I'm sorry I | VMResearch, Inc. cvoid(a)netcom.COM | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-807-5491 | -Erwin Schrodinger (1887-1961) | SF, CA 94117 * PGP v2.3a Public Key Available Via Finger *

1 0

Re:Bandwidth limitations, DNA binary coding
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matthew J Ghio writes: >Um, minor correction: There are four base pair combinations, and each can be >represented by two bits. There are four base pair combinations, but HUGO (Human Genome Organization) has elected to use 15 letter symbols in it's representation of the genome coding sequence (X is any base, for instance). 15 symbols, 1 byte. >Frankly, if I had the kind of technology to easily sequence my entire genome, >I doubt I'd be content to just look at it. I'd probably be saying, "Hmm.. I >don't like that gene, it might give me heart disease, I'll just use a >modified retrovirus to substitute a better one..." :) Lee Hood is working on the technology (PCR, for which Kary Mullins just won a Nobel Prize will help) for sequencing large amounts of DNA code, granted it's 15 years away at least, but just wait. Also, Have you been reading French Anderson in the New York Times? As one of the people who helped design the "modified retrovirus" of which you speak (Retroviral Expression Vector, N2), I can tell you that they work great in cells that live in a dish and lousy in a whole organisms, don't trust your heart to them. We can, however, engineer you in other ways. Scott G. Morham ! The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Key by Request ! and Third Levels ! of Information Storage and Retrieval ! DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOMCRz2paOMjHHAhAQG62wQAg2fHDYdhJADiz5KdEMTDCLg74IZ9onBQ TCrQcuFdiWBlB+Wt970a8zmur8Js5NdskpKYMiDCz6BKqEP1t17ZWPCL1lliTsPF gtikx9dTsCRiWbWKUzPPfiEDXDGO/GovuLVbC98dOyJrTVBjrBHsJtuXL21S/R+n 74C/S2k4o74= =jI3W -----END PGP SIGNATURE-----

2 1

Dr. Dobb's Editorial
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

As mentioned, the December, 1993 issue of Dr. Dobb's Journal has an excellent editorial about the government investigation of PGP export and the general crackdown on cryptography. This issue also includes an article by Bruce Schneier describing the IDEA encryption algorithm. As usual with DDJ, source code is included: IDEA.C, apparently based on PGP source. Dr. Dobb's has published encryption source before. A few months ago there was an article by Burt Kaliski of RSADSI on using Montgomery multiplication to speed up an RSA implementation. Earlier there was an article on the (patented) Lucas public-key system. Both articles had source. No doubt there have been others as well. Here is the text of the editorial: Cryptography is like one of those West Virginia subterranean fires that smolder along coal seams for months before flaring up above ground. The current flame along the encryption firing line involves a pair of Federal grand jury subpoenas handed out to distributors of Phil Zimmermann's PGP ("Pretty Good Privacy") message signature and privacy software. Earlier this fall, the Austin Code Works (a Texas software distributor) and ViaCrypt (a Phoenix cryptography-tool developer) were slapped with demands to produce contracts, payments, correspondence, and related information concerning their international distribution of PGP and RSA cryptography source code. Neither company was told why they must turn over this information, nor were they given any indication of when or what the next shoe to drop might be. For the past year Code Works has been selling Grady Ward's Moby Crypto, a collection of crypto software that includes PGP, RSA, MD4, DES, and the like. Although not mentioned in the subpoena, Code Works has also been separately selling a DES encryption and decryption software package. For the time being, both have been removed from Code Works' shelves. ViaCrypt, on the other hand, licensed PGP from Zimmermann, combined it with ViaCrypt's DigiSig+ cryptographic engine, and released a toolkit called "ViaCrypt PGP," the first commercial PGP-based package. Interestingly, ViaCrypt is also a sublicensee of RSA public-key encryption from Public Key Partners, holder of the RSA patent and a big-time competitor and long-time critic of PGP. Ostensibly, the subpoenas are part of a U.S. Customs investigation into the export of PGP. (A letter the State Department's Enforcement Branch fired off to the Code Works begins with, "It has come to the attention of this office that your company is making cryptographic source code... available for commercial export....") State Department regulations lump cryptographic software with munitions and weapons, making it subject to export licenses as per International Traffic in Arms Regulation guidelines. However, Code Works' current advertisements clearly state that both Moby Crypto and DES Encryption are "not for export," and ViaCrypt says sales are made "export regulations permitting." In short, there's no indication that either company has exported crypto software, leading you to believe that the investigation is really nothing more than a fishing expedition. The timing is curious, considering that the Clinton administration views many high-tech export rules as antiquated Cold War laws that hinder U.S. trade. Consequently, the administration is rethinking export laws so that U.S. manufacturers can more easily export communications and other high-tech equipment - what's protected today may be fair game in a few months. Of course, the government also wants to make it harder to sell high-tech military equipment to renegade countries. Unfortunately, cryptography has a foot in both military and civilian communications camps. Neither the Code Works nor ViaCrypt had anything to do with developing PGP. You could even argue that Zimmermann really isn't the "author" of the software. True, he did write Version 1.0, but subsequent editions (2.3 is the current release) are the contributed efforts of U.S. and non-U.S. programmers who've created what's been described as the strongest, easiest-to-use encryption utility available to the public in source form. There's no question that PGP was exported, but neither is there a hint that Zimmermann shipped it overseas. He assiduously avoided the chance of _his_ exporting PGP, to the point of having other people upload the software to the nets. The bottom line is that PGP was legally on the net and anyone with a PC and a modem could have moved it across international borders - just as with DES, which has been on the nets and authorized by the government for more than a decade. Still, you have to wonder why the government is taking action now. PGP has been around for a couple of years. Maybe the Feds are upset that Zimmermann's encryption scheme is good - PGP is thought to be stronger than DES, the NSA and FBI reportedly can't crack it, and the thought of publicly available cryptography scares the dickens out of them. Or maybe the announcement of a commercial PGP-based application finally hitting the shelves prompted PGP's competitors to lean on the government. We just don't know, and the Feds aren't talking. The government is struggling to cope with a changing world, one in which technology has altered many of the old rules. Regulations, written for a paper-based society, aren't adapting well to digital reality. International electronic networks make it hard to control software distribution and information dissemination. Like wildfire, bank transfers and e-mail are circling the globe unfettered - and encryption is keeping secret the contents of these communications. But the means by which Washington is attempting to maintain control over cryptography is, in the long run, injurious to us all. From a business perspective, these tactics hobble U.S. companies from competing internationally. More importantly, the First Amendment guarantees us the right to speak in an encrypted way and insidious attempts to douse public access to cryptography, cloaked under the guise of software-export investigations, appear to stifle those rights. Jonathan Erickson editor-in-chief

1 0

Re: Fractal cryptography
by mycal 17 Dec '03

17 Dec '03

On Fri, 12 Nov 1993 19:31:09 -0500, "Perry E. Metzger" <pmetzger(a)lehman.com> wrote: > > Amateurs regularly develop systems and claim fantastic things for > them. They then turn out to be trivial to break. This has made people Just to add a data point, chaos seems to be worth a look. MIT's Research Lab have created new signal-processors designs based on chaos theroy for use in secure communication. They are based on a recent descovery called synchronized chaos, where a transmitter and receiver synchronize with each other. I have a photo copy of an article in front of me but (blush) it has no identifying elements to it. I will look monday for the original and post the source. mycal

2 1

random dot stereo benefactor
by Carl Ellison 17 Dec '03

17 Dec '03

For those who are interested, my source for the random dot stereo code was Tony Marotto: marotto(a)camb.com (Sorry, I still haven't tested it.)

1 0

Re: Key Sharing Protocols
by an7822＠anon.penet.fi 17 Dec '03

17 Dec '03

> > I'm working on an internal protocol for securing company records > and I'd like to solicit some net.wisdom. > (...) > > To allow for loss of a passphrase, for whatever reason, use a > secret sharing protocol to split the secret key of the user into > several pieces, held by designated security officers. > Reconstruction of the key will require cooperation by "n" > security officers. I have some problems with this. > Sorry, I should have done some more reading before I posted. What I'm after is a "Fair Cryptosystem". I'm not happy with the whole idea of escrowed keys, but in this case, it's the best solution which will be accepted by this organization. Micali describes how the user can generate their own key and create verifiable pieces for the escrow agents. Does anyone know of code which implements this scheme? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

REMAIL: Cypherpunks Anonymous Remailer Installation
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Finally, after a few months of slacking off, I've finally gotten this remailer installation thing cleaned up to release it. I'll be throwing this in /pub/cypherpunks/incoming on soda.berkeley.edu. The Cypherpunks Anonymous Remailer Installation Version 1.0 Installer: Sameer Parekh Remailer: Eric Hughes & Hal Finney, with minor modifications by Sameer Parekh - ----------------------------------------------------------------------------- This is the Cypherpunks Anonymous Remailer Installation Suite Version 1.0. By simply running the script "install_remail" included in the archive, you can very easily install a cypherpunks anonymous remailer service in almost any UNIX account. The anonymous remailer uses the .forward file to pipe all mail to the remailer system. If mail to the remailer account is not acted upon by the remailer software, it lands in the standard mailbox of the account. First on the TODO list is to make it so that non-remailer mail is acted upon in a fashion which allows an alternate .forward file operation. To install: gunzip and untar the archive: % gunzip RemailInstall.tar.gz % tar xfv RemailInstall.tar execute the remail_install program: % remail_install answer all the questions. The program automatically self-tests, and mails me a notice saying that the remailer is in operation. I plan on writing a system which will wait one week after receiving the notice, after which your remailer will be pinged. If the ping is received, your remailer will be added to my list of active remailers, updated and posted weekly to the cypherpunks list. (Not yet operable, but the installation script still sends a notice.) Remember that running a remailer is a sensitive issue on the net. If you choose to run a remailer, keep in mind that some powerful net-personalities object to anonymous remailers, endangering your access to the internet. Stay free, Sameer sameer(a)uclink.berkeley.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOSxbXi7eNFdXppdAQFGgwP/SlSe8zKTH2QDY47cjdjbfHaR7NPBTtYv BYQ5nmHauYVwhoZxLVPUrdYUc2Gfv/5zIbgjb3df5ZWIaY6qo4dcsUtFHIR1CIvx SYJkBrLw22Jqfal2g2Wqzg+PsiQcsjjxREEVzyHaN3uNaQwYShXtwAhQ4Rfb3Bu2 AN6ytzyqg1A= =UFzz -----END PGP SIGNATURE-----

1 0

The Religion of the Cypherpunks
by L. Detweiler 17 Dec '03

17 Dec '03

- EH & TCM statements on pseudospoofing - hypocrisies and the religion of pseudospoofing - the second pseudospoofing survey - a tale of two `cypherpunks' (Or: The Postmaster, The Magicians, and the Critic) EH & TCM statements on pseudospoofing -- >From `someone': >There is no conspiracy. EH and TCM have publicly stated several times >that they have never "pseudospoofed." Why would they go to such lengths >just to create an elaborate hoax and attempt to drive you crazy? There's >no conceivable reason. It's easily confirmed that there are hundreds of >real, unique individual people on the cypherpunks list. You see their >email addresses. This is crazy. I just don't see your point. You are >exhibiting MAJOR paranoia symptoms. Why do this to yourself? I missed the public statements by EH and TCM that `they have never `pseudospoofed'', despite my various requests, both public and private, over the past few weeks -- could someone email those to me? Mr. May told me he `had experimented' with the technique (I only say this because I think it is public knowledge at this point). I have seen some circuitous statements (quoted in the RISKS article) that pseudonyms are a fact of life in cyberspace, and `the situations you despise will occur.' None of these are very authoritative, IMHO. All the statements I have seen are far from conclusive, and they have consistently stonewalled and evaded me in private mail. (That is the *only* reason I have continued to escalate my rhetoric.) If they answered my simple questions, and been straightforward about their practices, I would have no objections, and I would have `gone away' a long time ago. hypocrisies and the religion of pseudospoofing -- One of the things I don't understand about this pseudospoofing religion thing -- if it is the cypherpunk religion, as hundreds of email messages have convinced me it is, why are so many cypherpunks so resistant to revealing their personal involvement? Isn't religion supposed to uplifting, something you can be proud of, something you can announce to the world? Why is there so much secrecy? You don't think there's anything wrong or criminal or shameful about what you're doing, do you? I suppose all the secrecy would be useful in promoting a *conspiracy*, but what's the use in that? Isn't the whole idea that you are trying to promote all these neat techniques to the whole world, so that everyone can use them? (Oh, that's that annoying egalitarian idea-- sorry, of course you have flamed that searingly.) I always thought that cypherpunks were against things like secret conspiracies and corruption. Or maybe they only are against it when a *government* is engaged in it. Private practice, so to speak, is entirely wholesome, commendable, useful, and desirable? I suppose that the more that people knew about widespead pseudospoofing, the less susceptible to it they would become, so the usefulness of the technique would be diminished. (the `robbing the treasury' principle I wrote about earlier --eventually it becomes bare!). Or, some people have these nagging taboos against it. For example, a net legend John Palmer supposedly is famous for it. Also, some people might just leave anywhere where the pseudospoofing was really prevalent. That would be unpleasant for anyone who wanted to practice it routinely on unsuspecting and unwilling participants. I suppose this secret conspiracy approach does fit in with some of the Extropian and cryptoanarchist ideas also, about elevating the idea of private companies, tax evasion, and black marketeering to the point of the complete dissolution of governments, etc. I asked a top Extropian leader about their official opinion on pseudospoofing -- neutral, pro, con, or undecided. He was quite upset by my question and refused to answer it, and cc:ed his response to all the other prominent leaders in the group. (I guess this could tie in with a letter by H.Finney to me saying that one of the Extropian leaders could help verify the independent existence of J.Dinkelacker.) I appreciate all the cypherpunks outlining their philosophies in so many forums. It helps me to understand what you all are about. For example, I just started posting to a list on Internet Mercantile Protocols, and was quite surprised to find a group of cypherpunks already there, strongly promoting things like completely untraceable cash and total anonymity (and criticizing all alternatives as Orwellian). In fact, one of them had written one of the most *beautiful* classic cypherpunk essays in favor of the Joy of Pseudospoofing (`tapping into new areas of the human psyche' or a `truer, more free debate', or something like that.) If anyone else knows of other cypherpunks posting to various Internet development project lists, esp. those related to digital cash or identification protocols, I would be interested in hearing from you. Have they generally been polite? Do they look at all sides of the issues? What do they have to say about identity protocols? Really, though, the bottom line is that anyone doesn't like to talk about their religion of pseudospoofing is nothing but a hypocrite. If pseudospoofing is OK, then why hide it? If you are hiding it, does that mean it is not OK? the second pseudospoofing survey -- As an example of this idea of disclosure, I asked two prominent cypherpunk `leaders' (who object to the term, and will remain nameless to protect their `privacy') to answer the following questions, which would obviously unequivocally resolve their own involvement in the practice of `pseudospoofing': > I will stop harassing you two personally over the issue of > pseudospoofing if you post the following, and cc: me: > > 1) how many identities each of you is currently maintaining > 2) how many U.S. states they span > 3) how many countries they span > 4) how many independent phone numbers you have established > 5) what mailing lists you are using them in, past & present > 6) what newsgroups you are using them in, past & present > 7) the people you have privately emailed under them > 8) how many other people you know in Cypherpunks who are routinely pseudospoofing > 9) their own responses to these questions > 10) your software capabilities in promoting the pseudospoofing agenda > 11) the number of hours per day you spend on pseudospoofing > 12) your future intentions in promoting the capability > > Note that I am not requesting that you actually disclose any of the > identities (or even close geographical information). Since you find > pseudospoofing entirely ethical, I see no reason you would object to > answering any of the above. > > Otherwise, `the beatings will continue until morale improves' > > p.s. what do you think of the RISKS article? I think it turned out > great. Hope to hear from you. <g> > > If you wish to make your own demands, I'm negotiable. > I asked these questions because I was disapointed by the results of my survey I posted to talk.politics.crypto. While I received many responses, few were from the cypherpunks who had openly advocated pseudospoofing on this list. And the `core cypherpunk leadership' was completely unrepresented. I was laboring under the impression that everyone that passionately pursued pseudospoofing was also passionately interested in explaining their brilliant techniques! But it appears they are very reluctant to talk about their obviously highly refined culture of science, religion, and art of pseudospoofing. I greatly despaired that the cypherpunks were so unrepresented officially, especially given their strong advocation of pseudospoofing. Surely, they would want to let the world know about their religion! If they didn't, it might look like they were not holy saints but just lowly conspirators! Also, this could be the comprehensive official cypherpunk statement crafted by EH and TCM (revered cypherpunk leaders) on pseudospoofing that has so far eluded me. A Tale of Two `Cypherpunks' (Or: The Postmaster, The Magicians, and the Critic) -- So I devised this new variation of my previous survey, designed to be completely free of `invasions of privacy', and targeted at the core cypherpunk leadership. Sort of like a direct mailing approach. Anyway, in response to my questions, one of the two eminent cypherpunks was very terse, as he has a habit of being, and called my questions `inquisitional'. I guess he was referring to the Spanish Inquisition, where all kinds of grisly torture devices were used to extract `confessions' from supposed criminals (often completely innocent). I'm not clear of the connection. Perhaps someone could elaborate on this metaphor. The second cypherpunk was more grandiose and verbose in his rhetoric. He acknowledged that `I have resisted until now responding to your recent rants'. For those not currently familar with the unique language of the Pseudospoofing Religion, he was saying here that he has not answered any of my questions directly so far because, likely, the answers would be embarrassing, incriminating, humiliating or all of the above. He was so compassionate as to remark on my recent apparent strain over the topic of pseudospoofing, suggesting that I seek counseling or take a long vacation from the Net (thanks so much for your concern). Then he talked about how my `threats' especially the `violent ones' could not be `idly dismissed'. This cypherpunk has an extremely active imagination (this is evidenced in his love for great works of science fiction, especially those that refer to the blurring of identities). I'm not sure where he got the idea about `violence'. The only violence that has ever been involved is entirely metaphorical, happening on the plane of reputations and credibility. (I assure you that lately I am bloody myself!) Maybe he took the obviously satirical line about `continued beatings' literally. Ah, he is quite suggestible. I guess the only thing I can remember on this subject was Dinkelacker's letter to me, `you better start looking over your shoulder'. That was *definitely* unpleasant! Oh, and there was what's-his-name's comment, `I'm going to come over and kill your family with a rusty razor blade'. This cypherpunk goes on to say that I have turned myself into the `laughingstock of the Net [...]' from `your latest paranoid descent into fantasy in RISKS, and your email harassment of many of us.' As for `paranoid descent into fantasy', I think everyone understood this was a hypothetical scenario. Maybe Mr. Cypherpunk has information that suggests otherwise. If so, I would love to see it, as I'm sure everyone else here would too. Actually, it's all I've been aiming for over about a dozen posts and articles now. I'm not sure what he is referring to as `harassment'. I think some of the questions I have raised in my writings on pseudospoofing, and perhaps the questions above, he considers `harassing'. I'm quite at a loss as to why. The questions I included above are very innocuous. I would think that someone proud of themselves and their beliefs would humor me immediately in answering them, recognizing that I will not go away until they do so (and answering a simple question, of course, is just common courtesy). Certainly, I would fill out the questions myself, and am sure many other honest cypherpunks would see no invasion of privacy in doing so either (they are vague enough to protect privacy, IMHO, as designed to do, but of course I'm biased!). This cypherpunk closes by stating that `I have a strong feeling that you're going to have a very hard time getting a job in the computer industry after this spectacular series of rants.' Thanks, again, for your concern! Actually, I have made some very valuable contacts from professionals from the RISKS article, who are as concerned about these issues as I am. My mailbox has been quite deep with requests for the `Joy of Pseudospoofing' essay, first posted here! (Again, if anyone has not seen it, please email me.) I'm quite glad I managed to get in this prestigious journal, because now others can be aware of the potential abuses of widespread, systematic, routine pseudospoofing. The cypherpunks have been largely uninterested or critical in my writings on the subject, so it's very refreshing to find someone else in Cyberspace who can discuss something as important as pseudospoofing dispassionately, knowledgeably, and honestly. The `terse' cypherpunk had earlier notified my postmaster about my public posting here revealing Mr. Metzger's (prominent cypherpunk and close friend of the core leadership) mailbombing me and further mailbomb threats. He didn't find it necessary to notify my postmaster this time about my `inquisitional' questions. I guess he understood when my postmaster and I both sent him mail explaining why this was an inappropriate tactic. The second cypherpunk had not previously mailed my postmaster, but >I am taking the step I have never before considered doing, in more >than five years of active participation in the Net, of copying your >postmaster on this note. Maybe he can talk some sense to you. I guess the `terse' cypherpunk had not informed him that my postmaster was uninterested in his personal problems. (This is surprising, given their obviously strong affinity for each other.) But my postmaster did send him a note later explaining why he `didn't have time for this nonsense'. There do not appear to be any new developments along this line. I am crossing my fingers that my postmaster will not be further harassed by other cypherpunks. Anyway, I think he has already decided I have just offended a particularly vocal group of raving religious fanatics. (Some other people have gotten this impression from the RISKS article. Maybe the clarifications on pseudospoofing by the top leadership will help resolve all this.) I generally regard all these lamentations and supplications to my postmaster as extremely desperate attempts to censor me where all other efforts at silencing me have failed. Also, I think they are definitely invasions of my privacy. How many other people out there would like to have your postmaster bothered just because you offended some particularly sensitive people? Again, if you object to what I write, just stick me in your kill file. You will certainly save us both a lot of trouble! Mr. Hughes, our eminent and esteemed moderator, has recommended this numerous times in other contexts. I'm absolutely aghast and amazed at how many cypherpunks think that the most effective way of getting me to be quiet is to send me mail. It is quite a curious and perplexing approach. (Even more baffling was Mr. Metzger's procedure of sending me mail, saying essentially `do not reply to this or I will mailbomb you with 400 messages.' I respond to virtually all personal mail, but as I noted I have made a worthy exception for His Royal Eminence, as learned the hard way.) (I would like to thank those who have the power to censor me and have refrained. It shows you have a strong and admirable sense of morality. At one point someone told me `If I did not allow you to post, that would not be censorship'. I never understood the reasoning. But so far, it appears that the cypherpunks are generally opposed to direct censorship, although the indirect route is not taboo.) The bottom line is that my efforts at enlightenment, now spanning many weeks, have so far have gone `unrequited'. The top cypherpunks do not wish to reveal the extent their amazing feats of pseudospoofing. We can only continue to speculate on their sheer prowess and fantastic span! (I'm currently investigating the opportunity to do so in reputable publications -- email me and I will toss your offer into the current batch under consideration). I guess the Tantalizing Two feel that `a magician never reveals his secrets'. And what amazing feats of deception we have witnessed! Dozens of Rabbits emanating from a Single Hat, all while the magician says, `nothing up my sleeves!' Are there any stagehands or informed audience members that would like to comment on their masters' remarkable skill? So far, it is a remarkably unified front. But I am continuing to `cram' wedges into the cracks... Ah, the pity of it all. The tension, anxiety, and anticipation is driving me crazy! I wish to consummate this affair, so to speak! The spotlight continues to burn down hotly! When will the show be over? When can I go home? Tell my friends what happened in the end and write my review? When will the fat lady sing? p.s. anyone in Colorado, PRZ is giving a talk in Boulder on Sunday I think. if you email me I might be able to scrounge up the details somewhere in my piles of slobbering hate mail. <g>

2 2

Re: Should we oppose the
by George A. Gleason 17 Dec '03

17 Dec '03

You ask, "why have telecoms prices been declining for years?" and cite overseas calls as an example. In fact, the actual cost of local service has gone up over 240% since deregulation, according to a detailed research report a friend of mine is about to publish.

3 2

Re: fractal crypto
by Matthew J Ghio 17 Dec '03

17 Dec '03

> give a hint about the chaotic function you used... like what it > was x(1-x) or something else > > that would just leave the "key" to be determined... a reasonable test! hehe... I did something involving the trigonometric tangent function. The actual "key" isn't too complex actually...

1 0

RAMPANT CONSPIRACIES and MASSIVE COVERUP
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

As David Letterman says, I don't have a joke here, I just like saying ... <g> ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re:Bandwidth limitations, DNA binary coding
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry writes: >15 symbols, HALF a byte (actually a touch less.) One nybble can express 16 >possible symbols (or one Hex digit, or whatever.) Oops, I stand corrected, 15 symbols half a byte. What I was trying to convey is that GenBank (the repository for genomic sequence data) has a specific format for binary representation of DNA sequence data. Most genomic analysis programs use GenBank sequence format now (some use EMBL which is similar) and probably will in the future. Thus, the half byte per GATC symbol is defined as convention, not by the fewest binary digits neccesary for encoding them. It may waste bandwidth but that's no problem for fiber optics. Which is how this thread started. >plus, of course, the genome is highly compressable -- lots of repeated >sequences, especially in interons. This brings up an interesting topic. There are four classes of DNA: Foldback DNA, highly repetitive DNA, middle-repetitive DNA and single-copy DNA. Foldback DNA consists of palindromic sequences which form hairpin like structures. Highly repetitive DNA is made up of short sequences from several to hundreds of bases long (repeated around 5 x 10^5 times). Middle repetitive DNA consists of longer sequences, hundreds or thousands of bases long (these appear hundreds of times in the genome). Single-copy DNA sequences are usually genes themselves, of which (in humans) it is estimated that there are around 1 x 10^5. Since the genome is highly redundant (in mammals up to 60% of the genome is repetitive sequence), you could probably compress alot of it just by designating symbols for specific repetitive elements. Most of the repetitive nature of the genome is found as highly repetitive sequence localized as tandem arrays (not in introns). However, a second class of element known as SINEs and LINEs are found in introns, gene flanking regions and intergenic regions. The most widely characterized SINE is the Alu sequence, which is approximately 300 bases long and scattered throughout the genome over 5 x 10^5 times. This constitutes 5-6% of the genome! That's a lot of compressability. I often wonder if the redundancy is a way to encrypt a species genome, thus keeping different species from genetic communication. The "key" being millions of random base pairings which allow like species to decrypt their own genetic code and successfully have progeny. Pairings between species that are too dissimilar would be a refractory event because the key is not homologous. By the way, genes are made up of exons and introns. Scott G. Morham ! The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Key by Request ! and Third Levels ! of Information Storage and Retrieval ! DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOR1gj2paOMjHHAhAQFNZwP+Lv7Xv4bityeHd2L53fgY4seWKZX/Mkrw YmHv5hPpusiXx6jt2tVGPnPyH0TVtdFb5Cy1YVnvLydgU4FPblJAO7chWuc5EPXn 7/SQ29AuGrDnWu9gEGaQiqEUgn40idPgvDVVQPikAX8tn5OmWo8vygMwIYgicQUh Po8BHvPSLfg= =ek9F -----END PGP SIGNATURE-----

1 0

REMAIL: installer script not working
by Sameer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I jumped the gun, and posted before I was ready. Oops. The installation script isn't working perfectly yet. Hopefully I won't wait two months before fixing these problems like I did last time. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOUdEni7eNFdXppdAQG6AwQAkJAoiz3KE7nYhS2JPmtP6u0VokIaJ1Dl TfgYEgNxqQhb3M1VBvM0vIaxtGk6K956+ji3W7WhpkJk65IBvmyVMm/O3b6ZFG1h kGQ9wjmUTOGageXag3fXCOGo3NFXi2WIhLyzix1u02Q+iw7Bwf2pSTztp60Mw32g ePTbENC128E= =8jWg -----END PGP SIGNATURE-----

1 0

REMAIL: scan, folders scripts
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Well, I put two PERL scripts I wrote at the ftp site (named misc.elm.scripts.tar.gz); here is the README file: scan is the script which prints out signature information of pgp signed messages (instead of where the message came from). Thus, if pgp signed mail is sent through an anonymous remailer, you see who signed the message instead of where it came from. The inner loop is ugly and needs major reworking; I've noted this below and in a comment in the code :-) It would be easy to include this in the mh 'folder' command, but I don't have mh anymore here on owlnet :( Integration into elm itself would be great. -----BEGIN PGP SIGNED MESSAGE----- These are two experimental PERL scripts I wrote which report information about elm mail folders. folders prints a summary of mail in your ~/Mail directory. It prints out how many letters are in each folders, and how many files are in each directory. ~> folders Folder austin : 4 messages Folder cypher : 20 messages Folder educom : 1 message Folder inc : 17 messages Directory misc : 12 messages Folder store : 26 messages Folder ysn : 0 messages - -------------------- scan prints out a more detailed summary of a folder in the ~/Mail directory. It prints message number, who the message is from, and the subject. ~>scan cypher 1 hfinney(a)shell.portal.com Chaum's credentials (technical question) 2 hughes(a)ah.com Chaum's credentials (technical question) 3 hfinney(a)shell.portal.com Signing keys for nyms 4 hfinney(a)shell.portal.com message depots, packet routing? 5 hughes(a)ah.com Signing keys for nyms 6 szabo(a)netcom.com Commerce models scan also takes an optional argument: -p this will make scan look for pgp signed messages, and attempt to verify them. An asterisk is printed at each signed message, and the signer's address is printed instead. ~>scan -p cypher 1* Hal Finney <74076.1041@com Chaum's credentials (technical question) 2 hughes(a)ah.com Chaum's credentials (technical question) 3* Hal Finney <74076.1041@com Signing keys for nyms 4* Hal Finney <74076.1041@com message depots, packet routing? 5 hughes(a)ah.com Signing keys for nyms 6 szabo(a)netcom.com Commerce models Here, we see three messages are signed, and the signer's address is printed instead. This distinction is important if a message is sent via and anonymous remailer, for example. In this case, instead of printing the anonymous remailer as who sent the message, you will see who signed the message (which may in turn be a pseudonym, etc.) BUGS: folders counts the number of message by looking for 'From' at the beginning of a line. This causes problems if the text of a message contains 'From' at the left, or if a message contains a forwarded message, or somehow pastes in another message's header. In these cases, the message count will be off. scan probably also makes this mistake. In fact, you will find the inner loop of scan to be pretty ugly. I will clean it up eventually. scan winds up piping message to PGP to check signatures. This degrades performance. scan is not able to deal with pathological files: pgp messages that don't have an end delimiter, etc. One of these days I will read RFC-822 and other relevant documents and make the message count accurate. Comments, bug fixes, enhancements :-) are all welcome at klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOUhEoOA7OpLWtYzAQG4PAP/eTw/EWw0wlQ4QVpHfUP6OI3sWdKOltwN 3pgB41JxK1sY/GCnP8rCP9HDEkY/OePTBZDsu9CGJG1fneTsZIlCXrXpKSGzQpvC 94819bdF/+OFe5DcMUcaTcsG/KN3asw3TO0ed4KyOXqTE/SrAIyHsChgKRtHO70u 3uuLWrp0nR8= =vVg8 -----END PGP SIGNATURE-----

1 0

key servers
by lear35!mdbomber＠nebula.acs.uci.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Could someone tell me where to find a list of PGP keyservers and how to use them? I haven't been able to find such a thing on soda.berkeley.edu or on toxicwaste.mit.edu (the 2 relevant sites I can remember). -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLOUvDTSSmvXojb+5AQGt0gH/T1ikHaWU/W7GR2VAGcx5fncjw9bDbmn3 CPfzPu28j4ejq3OlUJKRt3yz3wYryhYM/xT+OftOFfONpgqPjIS+TA== =U7Q0 -----END PGP SIGNATURE-----

2 1