December 2003 - cypherpunks-legacy

To: an5877@anon.penet.fi
by J. Michael Diehl 17 Dec '03

17 Dec '03

Sorry folks. This person anonymously sent me a message to which he expects a reply. But it is impossible for me to reply to this person anonymously since he would be able to place my anonymous Id with my real Id. I know I should learn how to "bounce" anonymous messages, but there seems to be a lack of standardization in this area which I don't want to deal with at the moment. Sorry for the bandwidth. -----BEGIN PGP MESSAGE----- Version: 2.2 hDwC8VlOkFb8HfkBAYCgq9GJ1tSQXsX5Pm5pGrvFfjJPaIRlsYcLdotqAUuSx6jj Rgl3GZfgp8WRRigwd6qmAAAEmyQ6+Ci6MqT5oSmmXNUJ3rR/cguMWRHDt1TOJlae ck6ezF0MZZlQCWp4Lvh7IhWNZckT9pQ4VWHsWqp5jgeWzYaRbspVfEWnZXVvEAvT 9qZVgNJn7ZGlrmXjkpLTMj+/bk516lLAuVCpGj1TaiIRPTt7YEKgJIYY5FjNdvc5 kLkab5GJcRaNOLG8VjVlSyxRg+sbce1eUEgNaIJtg0VvR2dy9BlPyh3xbBgko3C5 3DZ9TIpM3dtHUueOCm16BRITEkzBvHOYgL+xcj4RVcWrkkxI/hiEi12u1SthDQHK CVmvYcsnt5XGgp27dTPprS1i6COPIHtufH7l9/GIbBrOfn4+whegAl0TT72dL2An on62k+RMP2uPFkbAMNPGtMuWZW0ibpoqx/Wz5njsV8ubPVXDXayiXl0WSGBst/DV dQ56iqmV2tUI5ZDe09ARpnkj61mdnjvlBvFYaoRo6SCI2iLg7m6VsUm6XzNYBzG0 KNvpsd0SLFqz98wrSYIK9RqFrvgNKklsliGwciDwg7AJBYIUxxqrmSvRLtZ7eucm 5+Qc5uMPbPp6UohewDp20zwLz6Jjxff7APZOONKn58xKj+bpbKJb2giuohcI+ZzU EJMGis+dZQtcUPHonf6GQ65ly3HDDcDu5nAz9qZOkLASEZ0zRJjgOXprC6bwyiYF p1tXZCIAJPlEeT6uAejMEhBGeUxmbzd0mgGP+Zft0ITMDESeJS/Z3dtW16OcI1+k i77lMw6cNxtLjy5BDgjGaMUhQy7fH9+Xu7csuhoaTPGn+ljSyfxYyV1BwCdYW0h6 lhR3lblqAzSjQrEFQIm9GOn5rHM2iUh0cCPisc0ZKDHsBt6ay4gB5B+MkbO3MPj9 9QtIAtfzjBbJXUh+/jZgKD6lgix3FLoGLt7yYOcxZ4FIcviEW4/5gKoieIy6DPtk WN9L8bSjodnMtKBNFx/H4nUL5HAFyB9WV5PTD3RjgBIZ9p0CNn9TOUkplYQ1uOHa Amfw/z1IIa3Db5YIxEJinRbwfjWudG0jwaaa1Bj6xn/OxY4guw1k3WJ17PrTP61b DDonzptjqRY9UHcvnnrolIaESFYT5Cb2dUZk5yXEcjOsG90lKkIJ+pueGOYY3ZDh CuCONfnAT7ph+vjtYHA0w+s5q6I5rGOI3Pwa7eRi2N4U/bV/O8k207i2NFeqJZ/l aQMs0eFk31mdz4NFsEctX7DZ7bNo5xhQH4ojCDcUhP2GFkghMr6683NGsH90qjZJ 52h23g4ZXCOONDJLkR4kPzcWF+CzfgFPAYzDzjSYPa02RAlapOBV41HkNNJ69vae X5cypQ/HyCIvos6ayNZHdPI+y+13U1GBdwu5O1AwaONqz/B0Q2H3jriSHzqAdDZK 0N8qvutz0PouNBlcMHpTUxon7VTR10oSRV/JieQqYVJ+nlT8WBj+mVxsU2ZGD2mH peg8ZpJWP3X7tW7518BQRH95fLcEoX4Fcnb509hGv9+F+JTH30eG6H5R1aDD6ZXT tfgz05vIrelBI8XYJuZtmid1cxQzXBwML9r9skgF7Scp8q+1pDeAUz4yAp/Oyw==

1 0

To: an5877@anon.penet.fi, again.
by J. Michael Diehl 17 Dec '03

17 Dec '03

Sorry folks. This person anonymously sent me a message to which he expects a reply. But it is impossible for me to reply to this person anonymously since he would be able to place my anonymous Id with my real Id. I know I should learn how to "bounce" anonymous messages, but there seems to be a lack of standardization in this area which I don't want to deal with at the moment. Sorry for the bandwidth. -----BEGIN PGP MESSAGE----- Version: 2.2 hDwC8VlOkFb8HfkBAYCgq9GJ1tSQXsX5Pm5pGrvFfjJPaIRlsYcLdotqAUuSx6jj Rgl3GZfgp8WRRigwd6qmAAAEmyQ6+Ci6MqT5oSmmXNUJ3rR/cguMWRHDt1TOJlae ck6ezF0MZZlQCWp4Lvh7IhWNZckT9pQ4VWHsWqp5jgeWzYaRbspVfEWnZXVvEAvT 9qZVgNJn7ZGlrmXjkpLTMj+/bk516lLAuVCpGj1TaiIRPTt7YEKgJIYY5FjNdvc5 kLkab5GJcRaNOLG8VjVlSyxRg+sbce1eUEgNaIJtg0VvR2dy9BlPyh3xbBgko3C5 3DZ9TIpM3dtHUueOCm16BRITEkzBvHOYgL+xcj4RVcWrkkxI/hiEi12u1SthDQHK CVmvYcsnt5XGgp27dTPprS1i6COPIHtufH7l9/GIbBrOfn4+whegAl0TT72dL2An on62k+RMP2uPFkbAMNPGtMuWZW0ibpoqx/Wz5njsV8ubPVXDXayiXl0WSGBst/DV dQ56iqmV2tUI5ZDe09ARpnkj61mdnjvlBvFYaoRo6SCI2iLg7m6VsUm6XzNYBzG0 KNvpsd0SLFqz98wrSYIK9RqFrvgNKklsliGwciDwg7AJBYIUxxqrmSvRLtZ7eucm 5+Qc5uMPbPp6UohewDp20zwLz6Jjxff7APZOONKn58xKj+bpbKJb2giuohcI+ZzU EJMGis+dZQtcUPHonf6GQ65ly3HDDcDu5nAz9qZOkLASEZ0zRJjgOXprC6bwyiYF p1tXZCIAJPlEeT6uAejMEhBGeUxmbzd0mgGP+Zft0ITMDESeJS/Z3dtW16OcI1+k i77lMw6cNxtLjy5BDgjGaMUhQy7fH9+Xu7csuhoaTPGn+ljSyfxYyV1BwCdYW0h6 lhR3lblqAzSjQrEFQIm9GOn5rHM2iUh0cCPisc0ZKDHsBt6ay4gB5B+MkbO3MPj9 9QtIAtfzjBbJXUh+/jZgKD6lgix3FLoGLt7yYOcxZ4FIcviEW4/5gKoieIy6DPtk WN9L8bSjodnMtKBNFx/H4nUL5HAFyB9WV5PTD3RjgBIZ9p0CNn9TOUkplYQ1uOHa Amfw/z1IIa3Db5YIxEJinRbwfjWudG0jwaaa1Bj6xn/OxY4guw1k3WJ17PrTP61b DDonzptjqRY9UHcvnnrolIaESFYT5Cb2dUZk5yXEcjOsG90lKkIJ+pueGOYY3ZDh CuCONfnAT7ph+vjtYHA0w+s5q6I5rGOI3Pwa7eRi2N4U/bV/O8k207i2NFeqJZ/l aQMs0eFk31mdz4NFsEctX7DZ7bNo5xhQH4ojCDcUhP2GFkghMr6683NGsH90qjZJ 52h23g4ZXCOONDJLkR4kPzcWF+CzfgFPAYzDzjSYPa02RAlapOBV41HkNNJ69vae X5cypQ/HyCIvos6ayNZHdPI+y+13U1GBdwu5O1AwaONqz/B0Q2H3jriSHzqAdDZK 0N8qvutz0PouNBlcMHpTUxon7VTR10oSRV/JieQqYVJ+nlT8WBj+mVxsU2ZGD2mH peg8ZpJWP3X7tW7518BQRH95fLcEoX4Fcnb509hGv9+F+JTH30eG6H5R1aDD6ZXT tfgz05vIrelBI8XYJuZtmid1cxQzXBwML9r9skgF7Scp8q+1pDeAUz4yAp/Oyw== =tHfY -----END PGP MESSAGE-----

1 0

Crypto crackdown - this i
by Duncan Frissell 17 Dec '03

17 Dec '03

R >They may not be able to prosecute you based on illegal evidence, but R >they can take everything you own and keep it until you are broke R >and homeless. Unless you are judgement proof. For a small fee, I am always willing to teach people how to become judgment proof (which is *not* the same thing as poor). Duncan Frissell ::Exclude *.gov --- WinQwk 2.0b#0

1 0

anon.penet.fi
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>What is your policy on chaining to anon.penet.fi? Hmmm, it would be bad to post to anon.penet.fi through a remailer, as the anon id assigned by penet would be associated with the remailer, _not_ with you. Therefore, people who responded to the message would actually be sending mail to the operator of the remailer that was the hop into penet. Not to mention the fact if the remailer account were also a personal account, and the operator was a client of penet, that his anon id could be compromised in this way (if he was foolish enough not to have a password). Therefore, it seems reasonable that remailers should refuse to mail into penet, unless and until a non-anonymous reply to anonymous mail facility becomes available there. To the penet knowledgeable: is my understanding correct? Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

3 2

Does this seem illegal to you?
by rees＠cs.bu.edu 17 Dec '03

17 Dec '03

Hi. Just picked this up from alt.dcom.telecom. Doesn't it seem like an illegal invasion of privacy to do something like this? Or maybe I just don't have the whole picture. Anyway, here it is: >GOING FROM A TO B. You're in your car. You're at A. You want to go >to B. You have no idea where B is. So you go to a Sprint payphone >and use its TeleMap service, give the telephone number of your >destination, and receive precise directions. (Tampa Tribune 9/12/93 >B&F 5) Of course, if you have a wrong phone number, that may be a >problem. You may go to C, wherever that is. -Dave (rees(a)cs.bu.edu)

3 3

Newsgroup...
by Christian Void 17 Dec '03

17 Dec '03

So, is there a specific reason why someone hasn't created an <alt.cypherpunks> newsgroup? It seems appropriate, as most of the current mass amounts of traffic are dedicated to paranoia and bickering... Christian Void /T71 | "I don't like it, and I'm sorry I | VMResearch, Inc. cvoid(a)netcom.COM | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-807-5491 | -Erwin Schrodinger (1887-1961) | SF, CA 94117 * PGP v2.3a Public Key Available Via Finger *

1 0

Cypherpunks & GOPHER
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cypherpunks, I'd like to announce the Cypherpunks Gopher Site - dedicated to putting up information for access, and meant to be a list resource. I'm running the gopher site at chaos.bsu.edu, thanks to Chael Hall, who graciously donated an account to me to be used for any and all projects. This is something I've been wanting to do for quite some time but have been unable to. But now I have an account and a sympathetic system administrator...! Chaos.bsu.edu is 147.226.53.28, and the port is 2000. That is port 2000 and not the usual port 70 - when Chael and I have some more time I will ask him to perform the various and necessary incantations (chown) and I'll move it to the usual place. So: try 'gopher 147.226.53.28 2000' and browse around. The site doesn't have much stuff yet... I plan to add more information sometime in the future. Currently the site consists of some old back articles from the list, some faq's, etc. I plan to sift for more stuff, especially Clipper related, and add it in. In posting back articles, I have attempted to give proper credit at the BOTTOM of the article, unless a signature already appears. I figure that posts sent to the list are meant to be seen, but if the original author of something wants is taken off, mail me. If lots of people want stuff removed, I'll probably just solve the whole problem with 'rm -rf ~/gopher-data' I will sift through my archives of the list, incomplete as they are, and add files when I have time. Direct questions to: klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLJuILIOA7OpLWtYzAQFcjgP+K2MOSFKX1M+Y903DKTSdEAOoVdLSl/N4 /1eukQ5B8f09Rw6zU2AjpxcGa4uQcKQ2brNGXzEG4n3+SK5WcEq5t5+oLQ679jrM /aWcWLJWT9sNoiJPQt0li26BWhKhFQSanqbDr+MZ+5JRWu5FBIFgM4cOe0gwK3p1 5S9NokdBBfE= =gMFB -----END PGP SIGNATURE-----

2 1

analysis: attack PKP driven? significance of June 1, 1991
by L. Detweiler 17 Dec '03

17 Dec '03

June 1 1991 is the date that both the MobyCrypt and PRZ subpoenas reach to. What is the significance? the early indication: this is the date of the 'official' release of PGP 1.0. C'punks: upon further reflection this dual assault seems to be ostensibly PKP motivated/driven. It is possible the prior NSA harassment of Moby Crypto was just a shocking coincidence. As reported on this list by D. Barnes <cman(a)io.com>, NSA had been prodding Austin Code Works (Maria Nekam) over DES export many months prior to this date. Does ACW currently deal with cryptographic software? how is it NSA was bugging them *months* ago? did Grady Ward indicate that long ago publicly (Usenet) his intent to use them as a publisher? This reminds me of stories of censorship of Yardley from Kahn (The Codebreakers) and censorship of Kahn reported by Bamford (Puzzle Palace) -- somehow, the NSA just *knows* when publishers are coming out with information related to cryptography or the NSA (I wonder how? <wink, wink>). We need more information: - how long has the NSA been harassing Austin Code Works? - does Austin Code works currently deal with cryptographic code? - or is this all entirely due to Grady Ward's Moby Crypto project? - was NSA complaining about (1) DES or (2) something else? export? - how did NSA find out that Austin Code Works was involved with Moby Crypto? On the other hand, the evidence that this is primarily PKP motivated seems to be in the primarily *PGP* and *RSA* oriented aspect of the subpoena queries. My current pet theory is that PKP has seen Grady Ward talking about his cryptographic recipe book on newsgroups (Bidzos has been known to track and respond on sci.crypt) and lumped him in an accusation & complaint, filed with the customs office, that ITAR laws on cryptographic export of cryptographic algorithms have been violated -- hence the investigation by a customs agency, the PGP 1.0 release date, the Viacrypt timing, etc. Maybe PKP got the impression that G. Ward was including RSA Source code -- has he said so on Usenet? -- this would be very inflammatory for them. RSA has virtually *no* international protection, all the patents only apply in the U.S. Finally, there is some other peripheral evidence regarding PRZ in this line I'm not really at liberty to state. that's the current 'conventional wisdom', anyway, subject to nanosecond fluctuation. Point: I think this new episode will without any doubt resolve whose side PKP is on. They've successfully remained in the shadows, like the NSA, until now, but like the NSA is discovering, continuing this will be impossible... Another point: remember the amazing scrutiny given to the E911 document, its *exact* and *precise* path of geneological distribution and leaking in the court proceedings and subsequent literature (e.g. B. Sterling, Hacker Crackdown)? I suspect, very soon, the same laserlike magnifying-glass pinpoint attention is going to be focused on exactly *who* first made PGP available *internationally* outside the U.S. -- anyone who can come forward with information on this (it all appears to have transpired in 1991) will be momentously affected. I don't know if this can be traced as effectively, however. The tracks are bit cool, and some people may not want to exactly *announce* this information.

2 1

CRADA robber
by Peter Wayner 17 Dec '03

17 Dec '03

I spoke with Dennis Branstad at length a couple of days ago about just what it means to get involved with NIST in the Software Key Escrow CRADA. It was a nice conversation and he told me that he personally didn't seem to think that a workable system would emerge, but that others felt differently. Plus the push for a software solution meant that the agency felt that it should at least explore the topic before dismissing it. The system seems to be quite commercial. A group of people and companies petition NIST to get involved with the project and then a group forms out of a subset of these applications. Usually this is the team that is most likely to get the job done. For that reason, people need to bring something to the project be it expertise, capital or whatever. At the end, the group owns the intellectual property rights to what is discovered. This may be something patentable and it could be worth some money. I don't know how likely this is, but it seems possible. In fact, it is probably the reason many of the participants are willing to enter into the project. The role of NIST is both gatekeeper and fascilitator. They get everyone together and occasionally push things along. In this case, they'll also offer some technical assistance which will include feedback from the NSA. Dennis Branstad said that this would most likely take the form of Siskel and Ebert-like ratings of the systems proposed. The NSA would suggest, "Yes" or "No" but they probably wouldn't go into details. This is because the procedure would be unclassified and the NSA usually won't relate technical details without classifying them. I've read the Federal Register announcement and it really isn't that interesting. There are only two columns of text and most of it is devoted to the formatting and standard operating procedures. This note contains much more information than the announcement itself. This leaves me with several questions: * Is this process intended to fail? Will NIST just keep saying that software isn't good enough and that way they'll be able to answer the criticism that hardware is too expensive? * How selective is the group formation process? Are people really out for money? * There are supposedly several other groups interested in participating. Who are they? Is it RSA and PKP? * Is a software process really that much more insecure than a hardware based approach? Sure, it is easier to tamper with software, but given that we can always tamper with the software shell around the Clipper hardware, it shouldn't be _that_ much different. -Peter

1 0

gopher site
by Karl Lui Barrus 17 Dec '03

17 Dec '03

I forgot to mention I will take suggestions for what to place at the gopher site - for example, what 10 or so Clipper articles from the archives at soda.berkeley.edu MUST be available? I haven't read them all and won't have the time for the forseeable future to do so. Pointers and suggestions to other docs and files are welcome. Should I put stuff like appropriate rfc's and documentation (pgp and ripem, etc.) or not? All of this is subject to disk space and it may be I'll give preference to shorter items. I am leaning towards including the rfc's for PEM and the two for Rivest's MD4/MD5 hash algorithms. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

2 1

Re: anon.penet.fi
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>Solution: if you send to na12345(a)anon.penet.fi, then your mail won't >be pseudonymized; if you send to an12345(a)anon.penet.fi, then your mail >will be pseudonymized. Good. Therefore, remailers should translate 'Request-Remailing-To:' addresses like this: if ( /an(\d+(a)anon.penet.fi)/ ) { s//na$1/; } That is unless there are fifty other ways to say @anon.penet.fi. In which case, I would need to know the fifty ways. Is this reasonable? Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

NIST proposes software key escrow development
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

Peter Wayner <pcw(a)access.digex.net> writes of the NIST announcements to develop software-based key escrow. I think it would be utmost folly for software developers to work with the NIST and NSA on this or invest any time or capital. The fundamental requirement for NSA approval is the implementation of Skipjack in *software* in such a way that the algorithm is *protected* like it is in the booby trapped Clipper chips-- that is, impossible to deduce. But this appears to be complete *fantasy*. Any such system must rely on some kind of a hardware approach. But then we're back to where we've started -- Clipper and Capstone. Only the NSA has enough inbred, insular self-delusion to propose that 'secure' software is even a *possibility*. These companies could better spend their time proving that Fermat's Last Theorem is FALSE. (Hey Cypherpunks! I KNOW! what we need is a Secure Clipper Encryption Server that handles encryption via Email! Let's get the NSA to run it! Then it would *really* be secure! <SMIRK>) Furthermore, anyone who submits to this development is giving the NSA valuable (free?) development time for the purpose of, fundamentally, a KEY ESCROW SYSTEM. Now, perhaps someone can explain to me why a software system for depriving us of our rights is superior to one in hardware? Doesn't anyone have the faint glimmer of the idea that NSA, the *premier* cryptographic agency in the *world*, with unsurpassed technological and engineering prowess in the area, would have already *figured out* how to do this if it was *at all* feasible? Personally, I think this stinks putridly of an NSA decoy to simply claim or suggest that they're responsive to alternative solutions. This is nothing but a *cruel mirage* in a *barren desert*. >At the end, the group owns the intellectual property rights to >what is discovered. This may be something patentable and it could >be worth some money. I don't know how likely this is, but it >seems possible. In fact, it is probably the reason many of the >participants are willing to enter into the project. yes, that's *exactly* what we need -- another software patent. But this is just a meaningless dangling carrot. (They damn well *better* have rights to whatever they develop under private capital.) >The role of NIST is both gatekeeper and fascilitator. They get >everyone together and occasionally push things along. In this >case, they'll also offer some technical assistance which will >include feedback from the NSA. Dennis Branstad said that this would >most likely take the form of Siskel and Ebert-like ratings of the >systems proposed. The NSA would suggest, "Yes" or "No" but they >probably wouldn't go into details. This is because the procedure >would be unclassified and the NSA usually won't relate technical >details without classifying them. Take a LOOK at what you've written, and ask if this project has ANY CHANCE of succeeding. The NIST is proposing that a lot of companies put in work into a key escrow system in software, that the NSA has ultimate overruling veto power with *no explanation* of negative answers. This all to come up with something that the NSA ultimately must *accept* under the whole point of the proposal. What's the POINT?! Yes, sign me up today to do DEVELOPMENT WORK for the NSA on a KEY ESCROW SYSTEM. Let's put in thousands of man-hours to come up with something as fundamentally feasible in principle as perpetual motion! All for the sheer joy of the thought the NSA *might* pat us on the back! how could this be anything but the most PRODUCTIVE and REWARDING experience?! A company would have to be INSANE to go with this as presented! >* Is this process intended to fail? Will NIST just keep saying that >software isn't good enough and that way they'll be able to answer >the criticism that hardware is too expensive? you mean the NSA -- and does that answer your question? >* How selective is the group formation process? Are people really >out for money? I think NIST would be overjoyed to hear that anyone outside of NSA consultants is interested. >* There are supposedly several other groups interested in participating. >Who are they? Is it RSA and PKP? RSA, PKP, RSADSI, Bidzos -- that makes at least four, right? the KGB would also like a secure software system. Sternlight & Denning would surely sign up. Just another dangling carrot -- or rather, an apple with a razor blade inside. >* Is a software process really that much more insecure than a hardware >based approach? Sure, it is easier to tamper with software, but given >that we can always tamper with the software shell around the Clipper >hardware, it shouldn't be _that_ much different. is an ASCII text file really that much more pliable than a silicon computer chip?! I'm trying to be gentle, but you simply don't seem to get it! the NSA wants a software implementation of Clipper that is TAMPERPROOF and INVISIBLE. This is like asking for a way to send locked lead safes through phone lines! it's based on a fundamentally *bizarre* premise! We *cannot* tamper with Skipjack in its present forms of use -- Clipper and Capstone -- they would not exist unless the NSA had the tamperproof technology. And the first rule of software is that it is 'TAMPERLADEN'! ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: NIST proposes software key escrow development
by doug＠netcom.com 17 Dec '03

17 Dec '03

an12070(a)anon.penet.fi said: >I think it would be utmost folly for software developers to work with the NIST >and NSA on this or invest any time or capital. Clearly this is true for cypherpunk sw developers, but others see an opportunity to make some bucks. >The fundamental >requirement for NSA approval is the implementation of Skipjack in >*software* in such a way that the algorithm is *protected* like it is in >the booby trapped Clipper chips-- that is, impossible to deduce. > >But this appears to be complete *fantasy*. Any such system must rely on >some kind of a hardware approach. Not necessarily. Zero knowledge proof techniques, for instance, can be applied to make source code as impenetrable as one wishes. This tends to carry a heavy runtime overhead, of course. And even hardware solutions can be reverse engineered. In fact, it's guaranteed to happen eventually. Triple layer metal interconnect chips can be selectively peeled via ion beam etching to reveal them to scanning tunneling electron microscope probing. Camouflage in the form of unnecessary functional units that mask actual operation can be uncovered by data flow analysis. Such a project would be extremely expensive...but someone will eventually do it. The Mafia or the KGB, for instance, if no one else. >Doesn't anyone have the faint glimmer of the idea that NSA, the *premier* >cryptographic agency in the *world*, with unsurpassed technological and >engineering prowess in the area, would have already *figured out* how to do >this if it was *at all* feasible? I think everyone assumes that the NSA is technologically several steps ahead of the game at all times, and clearly they have their own agenda. Some people just don't see their hidden agendas as threatening. C'est la vie. I think it makes for a very interesting chess game, myself. The NSA is attempting checkmate, but they're not strongly enough positioned to do so. In chess parlance, it's a bluff, but one with enough steel behind it to force a response, which gives them a minor but real tactical advantage. The obvious counter-response is to advance a pawn towards queening...which is already in progress. I'm reasonably happy with what the NSA appears to be doing in regard to foreign intelligence gathering; it's their domestic agenda that threatens the constitution. But that's in the nature of spook organizations. "Eternal vigilance is the price of liberty." Doug

3 3

Re: gopher links
by doug＠netcom.com 17 Dec '03

17 Dec '03

henry strickland <strick(a)versant.com> said: >(p.s. I have no idea why they call them "cool" links) "cool" links are the opposite of "hot links". The latter are active; nontrivial computation is done when the link is followed. The former are passive and merely point to information. Hypertext jargon. Then again, the man page you quoted implies that the author just thinks that such things are cool. Doug

1 0

software key escrow ruse
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

Isn't it obvious? 1. People try to do key escrow in S/W (rather than refuse to play along with key registration) 2. By doing so, they lend apparent approval to the idea of registration. 3. The S/W effort fails, of course. 4. Conclusion: S/W encryption is no good and must be abandoned because you can't do key registration that way. It is important not to entertain the notion of registration, even as an academic exercise, lest the effort be used to claim that some reasonable person believes key registration is OK. - Carl

1 0

Re: gopher links
by strick -- henry strickland 17 Dec '03

17 Dec '03

<root> writes to me: # strick wrote: # > (Just for the halibut I tried "gopher gopher.uu.net" and # > "gopher ftp.uu.net" but no dice. If you were using WWW instead # > of gopher, you could link "ftp://ftp.uu.net/inet/rfc/rfc1321".) # # Gopher can link to ftp directly without the destination being served by a # gopher server. RT*M: (p.s. I have no idea why they call them "cool" links) Actually, I have RT*Protocols, but the original protocols, not the one you describe here. Come to think of it, it looks like this is executed by the gopher server, since it also has a "exec" option. Not so efficient for ftp, but the old client-server protocol would still work. Karl, if this works with your gopherd, you should abuse it ... strick # GOPHERD(8) # # # ADDING COOL LINKS # One cool thing you can do with .Links is to add neato ser- # vices to your gopher server. Adding a link like this: # # Name=Cool ftp directory # Type=1 # Path=ftp:hostname@path/ # Host=+ # Port=+ # # Name=Cool ftp file # Type=0 # Path=ftp:hostname@file # Host=+ # Port=+ # # Will allow you to link in any ftp site into your gopher. # Make sure that there is a /tmp directory to store the # files for the gateway. Note that if you're running with- # out the -c option, you must create a "tmp" directory at # the top level of the gopher-data directory. # # Another neat thing you can do is to execute shell scripts: # # Name=Execed command name # Type={a type} # Path=exec:"args":/scriptname # Host=+ # Port=+ # # This is usually used by other types of gateway scripts. # For instance, The first script might take a search and get # a few hits. It could then generate "exec" scripts that # would retrieve the actual document the hit referred to. # # Note that the scriptname *must* begin with the magic char- # acter "#!/". It also must be executable. #

1 0

So. Calif. Cypherpunks Outreach
by jkhastings＠aol.com 17 Dec '03

17 Dec '03

"State Evader" comes out of the Green Dragon Tavern BBS (213) 365-1132 pseudonym closet to shamelessly promote his upcoming speeches at the H.L. Mencken Forum and the Libertarian Party of CA Region 62 Los Angeles Westside: ------------------------------------------------------------ State Evader = J. Kent Hastings Assistant Director of the Agorist Institute, "Techtics" columnist for the Tactics of the Movement of the Libertarian Left newsletter, internet cypherpunk, and ham radio operator WA6ZFY. Both speeches will be on the topic: "Cyber Cash: Free Market Money Comes of Age" I will talk about untraceable digital cash, public-key cryptography, spread-spectrum radio, un manned vehicles, and the latest government actions that threaten everyone's privacy: The Clipper/ Skipjack key escrow agents and the subpoenas served to the Austin Code Works and ViaCrypt for all PGP, RSA export info. -------------------------------------------------------------- Mencken info: (310) 289-3234 (reserve now!) L.P. info: (310) 477-6491 -------------------------- Mencken location: The Old Spaghetti Factory 5939 Sunset Blvd near Hollywood Freeway in L.A. Wednesday September 22, 1993 6:30 Libatio ns, 7:00 Dinner, 8:00 Speaker, 10:00 Adjournment First time "virgins" reserved: $3 -------------------------------------------------- L.P. of CA Region 62 L.A. Westside: Chris's Italian Restaurant 10105 Venice Blvd. at Clarington Ave Thursday, September 23, 1993 Cocktails 6:30, Dinner 7:00, Talk 8:30 Not sure if admission is charged. ---------------------------------------------- Kent - <jkhastings(a)aol.com>

1 0

more deranged lunatic ravings -- just delete 'em!
by L. Detweiler 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <pmetzger(a)lehman.com> >Why all this silly speculation? We will all know the complete answers >soon enough. There is no need for us to reach out and "investigate". ah yes, just like everyone 'soon enough' knew the 'complete answers' behind the Steve Jackson Games investigation. All we have to do is sit around and wait for it to be handed to us by everyone involved, including The Enemy. Look at that E911 investigation -- this was an example of *community* involvement. Laywers on *both* sides were unaware of the fact that E911 documents were publicly available, that they could even be *ordered* from Mountain Bell with no restriction, until someone 'out there' made the link and pointed it out -- and this was a *very* significant aspect of the defense case. >"We" need no information. We are not the attorneys. EFF and the rest >are involved and have fine lawyers and investigators. Anything "We" >uncover will be useful only for personal amusement. the situation *directly affects* us *now*. what is the scope of the grand jury investigation? could it potentially be *expanded* beyond this initial inquiry? what about sites that are currently distributing PGP outside the U.S.? what about the fact that cypherpunks have *always* been closely involved with PGP and its international distribution? >"We" don't even >have our facts right -- the "NSA" has not been directly harassing >ANYONE. say *what*?! Grady Ward has been posting for over a week on a bazillion Usenet groups that Agent X from the NSA has contacted him, with a phone number, fax, and identification standard for NSA employees (I forwarded one of his early messages here). A representative from Austin Code Works informed a Cypherpunk (who wasn't afraid to do a little poking around himself) they have been prodded by the NSA months prior over DES export. And "the NSA has not been directly harassing ANYONE." well, yes, I guess they haven't stuck anybody on the rack, if that's what you mean. >I'd calm down, Mr. Detweiler. Write some code -- its a productive >persuit. ah yes, I'm 'persuing' the sequels to PGP and Moby Crypt right now <g> you seem to be fundamentally averse to excitement. this is the Cryptographic Case of a decade, and we're all to just wait patiently for the bleached official reports prior to a proper, dainty discussion? not I. but in deference to you, Mr. Metzger, and others, I will not post any more speculation ... without some new juicy articles to speculate on :)

4 6

GOPHER: misc
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Thanks for the feedback about links - I didn't read that far in the server.doc! It looks like I could point to the EFF gopher for legislation and stuff, if they wouldn't mind...? But, stuff I link to has to be available from another gopher, right? I mean, I just can't point to a directory on some machine and have gopher retrieve the file for viewing? Or can I? Because I definitely would like to have the RFC's and message digest stuff viewable, or pointed to. Also, will gopher uncompress a file before displaying? I think I should read the gopher FAQ :-) And look at WWW when I have some time. Also, where is the "Digital Silk Road" paper? I'd like to put the text version in the "Digital Cash" section. I'd also like to put the two reports at cwi up, but those are postscript... gopher.wustl.edu has a TANTALIZING menu item for the ftp site, but I got a connection refused message. I need to talk to Chael to see exactly what kind of disk space we have to work with - it looks like to me an ftp option retrieves files to the gopher site (chaos). I put up some more stuff, including remailer public keys, but not much more on anonymous mail and still nothing on clipper. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

3 2

Re: Does this seem illegal to you?
by George A. Gleason 17 Dec '03

17 Dec '03

Sprint TeleMap: You've been after this woman who gives you the ultimate hard-on, but she won't play. Every night you write her another letter, pouring out your heart, begging for her hand, telling her all the lucious things you'll do with her once she comes to her senses and lets you into her life. Lately you've been getting your letters back,"return to sender, no such addressee" in purple Post Office ink. But no matter, you call her number, and get the recording with her new number. You've been getting angrier lately, as she's changed her number three times now. If only she would let you into her life, you'd make wonderful music together by the moonlight- but No!, she just won't play. The anger has been building, and lately you've been taking to leaving more and more desperate messages on her answering machine. She's really getting to you now, you want to teach her a lesson, a lesson she'll never forget. You've been trying to follow her car home from work, but for some reason she's not driving the same car or taking the same route; she might even have changed jobs. Boy oh boy, you'll teach *her* a lesson, teach *her* to say No to you! You feel inside your jacket, where your .38 is carefully tucked. Yeah, teach her a lesson for sure! And lo, a Sprint payphone! You dial the 1-800 number and ask for directions... give them her last known phone number... the seconds tick by, your head whirling with the things you're going to tell her and make her plead with you.... a second or two later, the operator comes back on the line. Go right at Harbor... left at Main... two blocks down to Third, second house on the left. Aha, there we go. Thank you, operator. A warm bulge rises in your pants as you contemplate your next move. Boy are you going to teach her a lesson! This special moment brought to you by Sprint TeleMap. ,

3 2

Attn: P. Metzger and an36440, please delete this immediately
by L. Detweiler 17 Dec '03

17 Dec '03

Forwarded from J. Bidzos. this actually *strengthens* the NSA theories. (go ahead, flame me some more. I've been called, culling from all the best, a ``screaming, ranting, hysterical, yammering lunatic running about like a headless barnyard fowl just adding noise and confusion'' -- can anyone top that?) I'm leaving out Bidzos' email address so he is not harassed any further than I've already done :) ------- Forwarded Message Date: Sun, 19 Sep 93 11:17:18 PDT Message-Id: <9309191817.AA10201(a)RSA.COM> To: ld231782(a)longs.lance.colostate.edu In-Reply-To: "L. Detweiler"'s message of Sat, 18 Sep 93 17:24:41 -0600 <9309182324.AA10638(a)longs.lance.colostate.edu> Subject: PGP & Moby Crypto investigation PKP, RSA, nor I have anything to do with this subpoena business. No complaint has been filed. This looks to be an investigation into violation of export laws, but I don't know. ------- End of Forwarded Message

2 1

Re: Definition of "Zero Knowledge"
by doug＠netcom.com 17 Dec '03

17 Dec '03

From: khijol!erc(a)apple.com (Ed Carp) >Thanks for the definition (but I knew that, anyway). Sorru I wasn't clear - >what I was looking for was examples of how zero-knowledge proof techniques >could make source code impenetrable. An arbitrary algorithm can be translated into a zero proof theory model that is intractable to functionally analyze. Its operations on inputs and outputs can take place within the realm of the intractable model, with the inputs and outputs being transformed from the encoding of the outside realm into an encoding useful to the realm of the model. The inputs and outputs are the queries and answers of zero proof theory. With such a thing, knowing every detail of the registers and instructions being executed at all times still wouldn't tell you what you really wanted to know. I'm unsure whether this has been published, let alone implemented; I just thought it was an obvious corollary back when ZPT itself was first published. It might have been discussed in the literature at the time, but if so, I've forgotten. I'm also not claiming this is necessarily a useful approach in practice, because the obvious ways of implementing such a thing would be more than a little slow. I suspect that it could be done efficiently with a little algorithmic cleverness, but I don't have evidence of that this instant. I'm currently designing something with very much the same flavor, but with somewhat different goals, and computational expense of the operators in the model is precisely the difficulty with that, too, so far. Doug -- Doug Merritt doug(a)netcom.com Professional Wild-eyed Visionary Member, Crusaders for a Better Tomorrow Unicode Novis Cypherpunks Gutenberg Wavelets Conlang Logli Alife HC_III Computational linguistics Fundamental physics Cogsci SF GA VR CASE TLAs

2 1

Re: NIST proposes software key escrow development
by doug＠netcom.com 17 Dec '03

17 Dec '03

Brad Huntting <huntting(a)glarp.com> said: >> And even hardware solutions can be reverse engineered. In fact, it's > >Why? The easiest way to foil SlipJack is to simply run another >encryption mechanism on top of it. Because we weren't (just then) talking about foiling it, we were talking about whether it could be figured out. Unless I misunderstood the discussion from careless reading, the point seemed to be that they wanted to make the workings of the chip secret. I was furthmore assuming that there would be motivation for people to figure out such secrets because it would help them do their own illicit decryptions, but that's getting slightly off subject. >> I'm reasonably happy with what the NSA appears to be doing in regard to >> foreign intelligence gathering; it's their domestic agenda that threatens >> the constitution. But that's in the nature of spook organizations. > >I dont know about you, but many of my best friends are "foreigners", >and many of them live in riskier situations than I do (both in the >US and abroad). Their need for privacy is at least as pressing as >mine. The argument that "we" can abuse the rights of "foreigners" >is nationallistic at best and jingoistic at its worst. That's not what I said. The charter of the NSA isn't to abuse the rights of your foreign friends. Now that you've raised the subject, I wouldn't be happy with the NSA doing so, either. I have friends outside the U.S. too. I just meant that countries do intelligence gathering on each other all the time as a matter of course, and most of that isn't abusive in nature, it's just the usual game of politics and defense etc. But I suppose it's silly of me to say something like that on a list with so many rabid paranoids; how could I possibly imagine that not *every* act of the NSA is inherently ***EVIL***!? Sigh. Doug

1 0

GOPHER: cpsr
by Karl Lui Barrus 17 Dec '03

17 Dec '03

I just discovered the CPSR gopher (gopher.cpsr.org) mirrors the cypherpunk soda archive, including the clipper directory there. So I'll figure out how to create a link to it. I don't know about cool links though; the only gopher sever and client I could compile on chaos (net BSD some.version) was gopher1.12S, and I don't think is has that functionality. Later, I'll give the gopher2.06 a try again. Plus, I've noticed that sometimes the name resolver can find chaos.bsu.edu, sometimes not, for whatever reason. So maybe I'll talk to Chael and see if we can't make a gopher login for telnet access. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

Delete Me
by rwalters＠gtech.com 17 Dec '03

17 Dec '03

Hi, there... Please delete me from the cypherpunks mailing list. It's a little greater traffic than I expected... Sorry about the hassle, and thanks. R.

1 0