December 2003 - cypherpunks-legacy

remailer wailer
by Mark Hittinger 17 Dec '03

17 Dec '03

Please do not pay attention to the arguments by some that improvements which do not solve something *completely* should be forgotten. Please do make some of the changes that the e-vil Det has suggested. If some of them don't work out you can always unwind them. Det strikes me as just another guy who can't keep his mouth shut when he notices an emp-error with no clothes on. :-) Watching internet security is a window on what your remailer situation could be like in 5 years. Right now you have a lot of overpaid network administrators who have not put in important fixes that were stale when the Berlin wall came down! :-) Right now you have a lot of overpaid operating systems "developers" that have cemented and calcified a mass of kludges into the commercial rigor mortis known as Unix. The weakness of these systems is so well known that virtually anyone who wants to take a shot at it can do so. Please do something to raise the difficulty level of screwing around with your anti-police-state tools such as remailers. You don't need to write or devise the end-all solution - just raise the wall a little each year. The kids get their game-genie codes to make video games do things that the original designers did not intend. The kids don't know why the codes do what they do and they don't care to experiment too much to find out what else can be done. A precious and valuable few do. The kids on the internet are like the game-genie kids in many ways. They avidly wait for the next phrack so that they can get the latest SUNOS game genie code. Perhaps this month its another sendmail flaw, or maybe a /dev/nit problem. In any event, there will be a recipe for doing it and the kids don't care why it does what it does, or what else can be done. We have an entire generation of "hackers" who are of little use to "us" because they can't blue sky, read source code, theorize about a hole/race condition, and set up a test to exploit it. All they care about is having the latest "how-to" sheet. If the operating systems developers and network administrators had been raising the difficulty level all along the kids would either drop out or get better. The ones that got better would be of use. Don't let the remailers go the same way. Please do some of the minimal things to cover some of the common ideas. If someone comes up with a neat twist and still pulls something - *great*. At least it will be fun. There is nothing more boring than a continual series of attacks using a stale technique. You guys could breed that for the future if thats what you want. Some kid with a remailer genie code could get the press or government interested in your toys before you want them to know. It would really be funny to see you guys form a "RERT" modeled after the highly successful "CERT". Remailer emergency response team. Do something! You have no clothes! You live in a glass house! A stitch in time saves nine! Finally - an old system administrator experience is to never delete the accounts of trouble makers. Always leave their favorite accounts be. It is much easier to keep tabs on them. If you harrass them they will go underground and you will miss things. --------- Whats back with the wrong-ups? Finger me for pee gee pee

1 0

clipper pin-compatible chip
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Here's an idea right out of the Intel-Cyrix-AMD wars. Once the clipper chips are common place, perhaps we could get some company to build IDEA chips that are pin compatible with the clipper chip itself, and perhaps even some switching socket where if you're calling a device and want to use the clipper chip (due to compatibility reasons of course) you activate the clipper chip socket. If not, you flip the switch the other way, and activate the IDEA chip. All we need are pinout, timing/signal specs and a few cypherpunks who are/were EE majors. :-) The chip switching mechanism itself is no big deal. In the worse case we could adopt an Atari/Nintendo type solution where you have a socket for a plug in cartridge which contains the encryption chip of your choice. You then call up your friend and tell him to use his IDEA cart and you do the same. Or RSA, or anything you like. If we could convince hardware manufactures to include chip sockets, this won't be an issue any longer. Which would Joe Bloe using a celular phone prefer? The clipper chip when he knows any spook can listen to him, or a third party IDEA chip which is quite secure? The IDEA cartridge could have some rotary switches with numbers on them to set for a 128 bit key. Sort of like the push button SCSI device ID selectors on external cases. Perhaps the cartridge might even have a touch tone like keypad for typing in a pass phrase.... etc. This could be done quite cheaply. Hell, you could probably just use a 68000 a ROM and a say 64K of RAM and not need a special IDEA chip.

2 1

Re: REMAIL: Cover traffic
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Why can't the remailers themselves send encrypted mail to each other totally masking the incoming messages? Each remailer can have a public/private key associated with every other remailer on the network, with full pgp type signatures to prove they came from a remailer and not a spook or nym? Each remailer has a fingerable public key. When remailer x sends a message to remailer y, it encrypts it with y's public key after fingering y, and also signs the message. Y could also be a paranoid remailer, and if it doesn't know X, it could tell it to go stick its message up its SCSI port. :-) All these ideas along with trash junk mail being sent every few minutes could work. Even better, have each remailer send a specific number of messages to each of the other remailers on the network. These messages would be bogus messages, however, there would be a fixed number of them. If a real nym message arrives, it is sent to the next mailer up the chain, as part of the n (n-1 now) that are bogus. That way a spook couldn't tell where a message was going since he couldn't count the number of messages going out of the mailer. Also if a target remailer has n real messages to be sent to, any messages over that assigned packet size of messages get spooled for the next round of bogus mail. This way each remailer will send exactly n messages to every other remailer on the net every specified period of time. What kind of analysis can be done with this sort of scheme?

1 0

Re: Randomness of a bit string
by doug＠netcom.com 17 Dec '03

17 Dec '03

Tim May said: >I stand by my point that no number or sequence can be proved to be random. To expand a bit on Perry's arguments, the bottom line of all this research is that a claim regarding randomness can only be made *relative* to a particular system for specifying algorithms. In that sense, Tim's statement can be regarded to be correct, iff one assumes that a context (an algorithmic specification system) is not given. That is a huge qualifier, though, and not one to be taken for granted. A trivial example of this: pick some constant bitstring of length 32 or less. Call it K. Now look at the class of algorithms specifiable by the C code fragment printf("%x", K) --- i.e. print K as a hexadecimal number. Relative to that particular set of (one) algorithms, that value of K is trivially nonrandom, in the sense that the probability of of finding that bitstring produced by that class of algorithm is precisely 1. Next consider a program that computes an output by multiplying some input by two. The probability that the output will be K, given any possible (but unknown) input, is exactly zero if K happens to be odd. If K is not odd, then the probability depends on the distribution (randomness) of the inputs. Proceeding in this fashion, it becomes increasingly clear that the randomness of the output of an algorithm can only be measured relative to the properties of the class of algorithms being considered. Randomness in isolation is meaningless. The best sources of intuition regarding randomness usually derive from systems which shift the burden into an existing intuition on a slightly different subject. For instance, flipping a coin can be regarded as a random process in an intuitive sense, but only because it appeals to existing intuitions about equiprobablistic outcomes. Therefore one sees confused appeals to intuition about randomness, probability, entropy, or related ideas, in cryptography, quantum mechanics, information theory, statistical mechanics, philosophy (in regard to free will versus determinism versus randomness), etc, etc, but given Chaitin/Kolmogorov/et al, no intuition from any such subject should be taken at face value. There's more, but I'll pause to allow flames. :-) Doug

2 1

Mondex digital cash press release
by Stanton McCandlish 17 Dec '03

17 Dec '03

This may be of interest to those of use following electronic money issues. Forwarded message:

1 0

Mondex digicash system
by Mike Ingle 17 Dec '03

17 Dec '03

Are there any technical details as to how it works? It is supposedly anonymous, divisible, transferrable, and offline. I've never seen a practical protocol like this. The message said you could put cards in an electronic wallet and transfer money between them. How can you do this, without losing anonymity? Is it possible this system is security through obscurity or observer-based, as opposed to a pure cryptographic protocol? If the security is non-cryptographic, it will probably be hacked eventually.

1 0

for interesting people -- Sunday NYTimes Mag re: encryption
by Lee Tien 17 Dec '03

17 Dec '03

Sunday's NYTMagazine had an amusing bit in its "Sunday" column, titled: HTIJX KTW PNIX "The scrambling and decoding of electronic communication is one of the hottest issues in cyberpolitics. The Government would like to have the key to all communications. Export of cryptographic software is restricted. Both software companies and independent groups like the Cypherpunks argue for the rights of individual privacy." "All of which makes Microsoft's new Creative Writer software for children intriguing. It includes some primitive cryptographic tools to enable kids to encode what they write ... to hide it from curious siblings and F.B.I. agents." What surprised me was the next line -- "Theoretically, this product would come under export restrictions, even though the code would not challenge a spy, let alone a bright 9-year-old." After explaining what a Caesar substitution cipher is, the bit goes on to note that "Presumably, Microsoft will not face any difficulties in exporting its product even though it comes from the K.G.B. (Kids Games Business) at Microsoft. On the other hand, it does instruct the youth of America in the basics of electronic privacy." In case you're wondering, the encrypted phrase is "Codes for Kids." Lee Tien

1 0

Crypto-dongle redux
by ccat＠netcom.com 17 Dec '03

17 Dec '03

I think the idea of a standard user configurable crypto-engine is a good one..that way people could choose (and upgrade) algorythms.. sort of like modern DSP based highspeed modems..(It could also have a socket for ROM based firmware cartridges..(RSA,IDEA,etc..) and a magstripe reader and keyboard for key entry..(This would make trading keys easy..) I think this discussion was had before,about a year ago.. Would anyone care to elaborate on it? -Chris.

1 0

Comments on violence
by Carl Ellison 17 Dec '03

17 Dec '03

I don't know if legalization would prevent the violence at this point. It would probably reduce street crime but I'm concerned that our population is getting adicted to the thrill of violence (movies, TV news, video games, ...) and it might take a kind of drug treatment program for the whole nation to do anything about it. My second, bigger concern is that the government is using this violence as an excuse to attempt to remove our rights. The one I'm most concerned about is the right to privacy in communications through cryptography (since I'm a computer system architect and cryptologist). We have always had the right to invent and use our own strong cryptography (for the whole 4000 year history of cryptography) and yet the administration (no doubt prompted by the NSA) is now trying to claim a right to read all private messages [cf., the "Clipper" proposal], citing violence (drug dealers, snuff movies, etc.) as the need, without establishing a link -- just using the reference as a scare tactic to get voter adrenalin flowing so that they'll feel pro-law-enforcement. This is a major conflict between government and civil rights, coming to a head as we speak. A spotlight on this attempt by you would be appreciated. Thank you. Carl Ellison Sr. Technical Consultant Stratus Computer Corp. / ISIS Distributed Systems

1 0

Re: Randomness of a bit string
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

Tim writes: >But can he ever say "I can prove the number is random"? No. There's >always some chance an even-cleverer puzzle solver will find the >pattern, the key that unlocks the randomness. For example, most >ciphertexts pass nearly all statistical tests for randomness, "look" >random, and even _act_ like random numbers (recall the Blum-Blum-Shub >pseudorandom number generator and how good it is). But simple >application of the key turns the seemingly random >"100010001010110010101" into "ATTACK." But can we say that "100010001010110010101" has been ``compressed'' into "ATTACK"? How do we know? Let IC(x) stand for the amount of information storage used by x. Is IC(100010001010110010101) > IC(ATTACK) + IC(key) + IC(algorithm)? It is not at all clear that this relationship would hold. (in fact, I don't think it will even begin to work out unless the cyphertext is much longer than the plaintext) So in fact, cryptorandom numbers can be considered incompressible if you take into account the algorithm required to perform the operation -- just as if I had used a 100 terabyte dictionary to compress via lookup, or better yet, a one time pad. -Ray All of this is meaningless anyway. Information theory was proven wrong by WEB technologies when they invented a compression program that can recursively compress any input data down to 64k. Harddrives are now obsolete. -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

4 4

Re: NSA museum now open, if you can find it
by Dave Hart 17 Dec '03

17 Dec '03

---------- | From: Hal <netmail!hfinney(a)shell.portal.com> | | That museum sounds fascinating. I got to visit the NSA's so-called | "Friendship Annex" once on business. This is not at Fort Meade itself, | but a few miles away, to keep the impure and unclean away from the holy | temple itself. | | Whoever named this place had quite a sense of irony; [...] As documented in _The Puzzle Palace_, the name derives from Friendship International Airport, now known as Baltimore-Washington International Airport. The Annex buildings are at the end of one of the runways. Dave Hart davehart(a)microsoft.com Not a Microsoft spokesperson

1 0

Re: Could I possibly be deleted, please...
by Al Billings 17 Dec '03

17 Dec '03

On Mon, 24 Jan 1994, Lance Ware {VOXEL Guru} wrote: > Please remove me as well . . . Try using the admin address. The list can't remove you. We only see your messages. -- (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*) | Al Billings aka Grendel Grettisson | "You are, each one, a priest, | | mimir(a)io.com | Just for yourself." | | Sysop of The Sacred Grove (206)322-5450 | | | Admin for Troth, The Asatru E-Mail List | -Noble Drew Ali- | (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)

1 0

quote of the day
by Carl_Ellison＠vos.stratus.com 17 Dec '03

17 Dec '03

Only those means of security are good, are certain, are lasting, that depend on yourself and your own vigor. - Machiavelli

1 0

Provability and Randomness
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

Entropy is relative. A string is `random' (with respect to an observer) when the probability of correctly predicting the next symbol of the string is arbitrarily low (e.g., size_of_the_alphabet^-1). Entropy, and therefore `randomness' can only be considered in the presence of symbol probabilities... and therefore prejudicial knowledge i.e., a context (algorithms, models, history, whatever). Different contexts --> different probabilities --> different quality of randomness. * Absent a context, there is no such thing as `randomness'. Posit two identical contexts, sender and receiver. Sender transmits a `random' string to receiver. (Beeeeeeeeeeep. Sorry, that was the warning that sounds whenever I fib). The sender can only send a random string if the reciever doesn't already `know' that string or doesn't know which string the sender will transmit. If the sender knows something that the reciever doesn't then the contexts are not identical. * Absent differing contexts, there is no such thing as randomness. A fair coin toss can be random because you_before_the_toss and you_after_the_toss are different contexts (reciever and sender, respectively; one of whom knows the outcome). Posit two disjoint contexts, A and B. A transmits a message to B, who has no information in common with A. B has no context with which to predict the first symbol that will appear and thus it is always random. As symbols appear, B builds a model of A... and thus acquires knowledge of A (i.e., a shared context). By the end of the message, B might be predicting quite well. If B can't build any model of A's behavior at all, then B will share no context with A; won't be able to predict characters; the string will remain random. * Absent shared knowledge (overlapping context), all information is random. Imagine that B's shared knowledge with A takes the form of a program to output a prediction of the next symbol A will transmit. This program---however large it is and however it might work inside---is nothing more than B's model of A. When B has no knowledge of A, this program is essentially `empty'. It contains no information, and can make no predictions better some arbitrary limit (e.g., size_of_the_alphabet^-1). The program learns from each symbol transmitted by A, thus a good (and portable) measure of the `size' of the program is how many symbols it has seen. Let us say that this program sees every symbol A ever transmits to B (numbered from 1..n), and thus during it's life it will actually be n+1 different programs (numbered B0..Bn of size 0..n, respectively). Imagine that you can ask any one of these programs to predict any symbol from A. Thus you could ask B3 to predict symbol 4 (exemplary of the normal case) or you could ask B5 to predict symbol 1 (which it could, of course, do perfectly, having already seen symbol 1). Now we have a new definition of randomness. A string is random with respect to B if no program of B shorter than the string can predict it with success greater than our arbitrary threshhold (which is typically defined by the performance of B0). If A is sending a passage from a well known book, and B `discovers' this after receiving symbol 20 and can access the text of that book, B20 suddenly becomes a very good predictor of many future symbols. The string is not random. But it _was_ random to B0, and B1 and perhaps less for each successive symbol. B20 is a different context than B0. It has different knowledge, different probabilities and therefore perceives a different quality of randomness in A's message. B20 is still only a program of `size' 20 (i.e., you don't count the size of the book in B). This is easily demonstrated if you imagine what happens when A sends a message that is a deterministic algorithm for producing a an infinite stream of symbols, followed by the stream it generates. If this algorithm requires i symbols to express, then Bi is a perfect predictor for all subsequent symbols. Bi is clearly of size i (there is no external book for us to add to the size of Bi). In fact, no matter what message A sends, B considers it an algorithm for generating predictions of future symbols. Thus A is actually sending B a sequence of programs (each a prefix of the next, and thus not re-transmitted) B1, B2, ... Bn (but remember, these programs execute in the context of B's knowledge... thus their predictions are not `universal'). This just brings our notion of programs, program length and prediction around to the other side and lets us summarize: * A string is random with respect to B if the string itself is the shortest program with which B can generate that string. ... or qualitatively * The randomness of a string Bn with respect to B is an inverse of the quality of the predictions B can make of Bn from the strings B0...Bn-1. We rely on the `relativity' of entropy. Codes and cyphers can't function without it. The difference between your context and that of an attacker (you know the key or codebook) is what makes the message meaningful only to you (hopefully it will still have _some_ information you couldn't guess before reading it). Randomness is relative, thus there is no universal randomness measure for a string, thus there can be no proof that a string is universally random. You can easily measure the exact entropy of a string with respect to a very formally defined context (one where you can produce exact predictions). This is useful, but reveals nothing about the quality of the predictions a different, even similar, context might make (Just one symbol is the difference between B19 and B20 above; the string was random to one but not the other), It reveals nothing about models we can't describe so perfectly (like human thought). * There is no algorithm for deciding if a string is universally random. In a less obvious leap, it is only by comparing the predictions of Bi with Bk that a string of length j (i < j <= k) can be shown to be random with respect to Bi. Thus: * There is no algorithm shorter than the string itself for determining if a string is random with respect to a given context. Not exactly Q.E.D. but close enough for rock `n roll. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

The Packwood Memorial Diary Server
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I often see threads debating whether the courts have the right to compel you to reveal your encryption key. Some say yes, some say no. Under the assumption that courts *do* have the right (or power) to force you to reveal your key, the problem now becomes: How can you prevent the government from proving you have encrypted documents? One Answer: Don't keep encrypted documents in your possession. Somebody could create a Document Server to store encrypted documents. Users would somehow get an anonymous Document Server account number when they subscribe to the service. Users would use the remailer system to send encrypted documents to the Document Server. The account numbers would be used to organize the document database and for billing (the tricky part). Given a Document Server, the problem now becomes: How can you prevent the government from proving you use a Document Server. This seems like a strictly technical problem, unlike the "can they compel you to reveal your key" problem. Jim_Miller(a)suite.com

3 2

Re: REMAIL: Cover traffic
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Arsen Ray Arachelian writes: > ...Even better, have each remailer send a specific > number of messages to each of the other remailers on the > network. These messages would be bogus messages, > however, there would be a fixed number of them. > > If a real nym message arrives, it is sent to the next mailer > up the chain, as part of the n (n-1 now) that are bogus. That > way a spook couldn't tell where a message was going since > he couldn't count the number of messages going out of the > mailer. > > Also if a target remailer has n real messages to be sent to, > any messages over that assigned packet size of messages > get spooled for the next round of bogus mail. This way each > remailer will send exactly n messages to every other > remailer on the net every specified period of time. > I like this idea. It seems to use fewer CPU resources than having a remailer route a bogus message through a random set of other remailers and back to itself. If I understand the encrypted remailer scheme correctly, the "route through random set" mechanism requires a remailer to enclose a bogus message in a set of nested digital envelopes (one for each remailer in the random remailer set). The "round-robin send to peers" mechanism only requires the remailer to create one envelope per bogus message. I also like the idea because it seems easier to analyse, and therefore easier to describe/formalize the properties of the system as a whole. Jim_Miller(a)suite.com

1 0

DEF CON ][ Initial Announcement
by Conal.Garrity＠f8004.n282.z1.fidonet.org 17 Dec '03

17 Dec '03

Updated Last : 1.16.1994 xxxxxxxxxxxxxxxxxxxxxxxx xx DEF CON ][ Convention Initial Announcement xxxxxxxXXXXxxxxxxxxxxxxxxx xx DEF CON ][ Convention Initial Announcement xxxxxxXXXXXXxxxxxx x x DEF CON ][ Convention Initial Announcement xxxxxXXXXXXXXxxxxxxx x DEF CON ][ Convention Initial Announcement xxxxXXXXXXXXXXxxxx xxxxxxxxx DEF CON ][ Convention Initial Announcement xxxXXXXXXXXXXXXxxxxxxxxxx x DEF CON ][ Convention Initial Announcement xxXXXXXXXXXXXXXXxxxxxx xx x DEF CON ][ Convention Initial Announcement xxxXXXXXXXXXXXXxxxxxxxx DEF CON ][ Convention Initial Announcement xxxxXXXXXXXXXXxxxxxxxx x xx DEF CON ][ Convention Initial Announcement xxxxxXXXXXXXXxxxxxxxxxx xx x DEF CON ][ Convention Initial Announcement xxxxxxXXXXXXxxxxxxxxx x DEF CON ][ Convention Initial Announcement xxxxxxxXXXXxxxxxxxxxxxxxxx DEF CON ][ Convention Initial Announcement xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx DEF CON ][ Convention Initial Announcement READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE ============================================================================= What's this? This is the initial announcement and invitation to DEF CON ][, a convention for the "underground" elements of the computer culture. We try to target the (Fill in your favorite word here): Hackers, Phreaks, Hammies, Virii coders, programmers, crackers, Cyberpunk Wannabees, Civil Liberties Groups, CypherPunks, Futurists, Artists, Etc.. WHO: You know who you are, you shady characters. WHAT: A convention for you to meet, party, and listen to some speeches that you would normally never hear. WHEN: July 22, 23, 24 - 1994 WHERE: Las Vegas, Nevada @ The Sahara Hotel So you heard about DEF CON I, and want to hit part ][? You heard about the parties, the info discussed, the bizarre atmosphere of Las Vegas and want to check it out in person? Load up your laptop muffy, we're heading to Vegas! Here is what Three out of Three people said about last years convention: "DEF CON I, last week in Las Vegas, was both the strangest and the best computer event I have attended in years." -- Robert X. Cringely, Info World "Toto, I don't think we're at COMDEX anymore." -- Coderipper, Gray Areas "Soon we were at the hotel going through the spoils: fax sheets, catalogs, bits of torn paper, a few McDonald's Dino-Meals and lots of coffee grounds. The documents disappeared in seconds." -- Gillian Newson, New Media Magazine DESCRIPTION: Last year we held DEF CON I, which went over great, and this year we are planning on being bigger and better. We have expanded the number of speakers to included midnight tech talks and additional speaking on Sunday. We attempt to bring the underground into contact with "legitimate" speakers. Sure it's great to meet and party with fellow hackers, but besides that we try to provide information and speakers in a forum that can't be found at other conferences. While there is an initial concern that this is just another excuse for the evil hackers to party and wreak havok, it's just not the case. People come to DEF CON for information and for making contacts. We strive to distinguish this convention from others in that respect. WHAT'S NEW THIS YEAR: This year will be much larger and more organized than last year. We have a much larger meeting area, and have better name recognition. Because of this we will have more speakers on broader topics. Expect speaking to run Saturday and Sunday, ending around 5 p.m. Some of the new things expected include: o An INet connection with sixteen ports will be there, _BUT_ will only provide serial connections because terminals are too hard to ship. So bring a laptop with communications software if you want to connect to the network. Thanks to cyberlink communications for the connection. o There will be door prizes, and someone has already donated a Cell Phone to give away. o Dr. Ludwig will present his virii creation awards on Sunday. o A bigger and better "Spot The Fed" contest, which means more shirts to give away. o More room, we should have tables set up for information distribution. If you have anything you want distributed, feel free to leave it on the designated tables. Yes, this year there will be a true 24 hour convention space. o A 24 hour movie / video suite where we will be playing all type of stuff. VHS Format. Mail me with suggested titals to show, or bring your own. o Midnight Tech Talks on Friday and Saturday night to cover the more technical topics and leave the days free for more general discussions. WHO IS SPEAKING: I was going to run a list of the current speakers we have lined up, but at this point things are still fluid. In a few months when the speakers list is more solidified I will release it. I'll name the poeple who have committed to attending in the next announcement. Trust me. WHERE THIS THING IS: It's in Las Vegas, the town that never sleeps. Really. There are no clocks anywhere in an attempt to lull you into believing the day never ends. Talk about virtual reality, this place fits the bill with no clunky hardware. If you have a buzz you may never know the difference. It will be at the Sahara Hotel. Intel as follows: The Sahara Hotel: 1.800.634.6078 Room Rates: Single/Double $55, Tripple $65, Suite $120 (Usually $200) + 8% tax Transportation: Shuttles from the airport for cheap NOTE: Please make it clear you are registering for the DEF CON ][ convention to get the room rates. Our convention space price is based on how many people register. Register under a false name if it makes you feel better, 'cuz the more that register the better for my pocket book. No one under 21 can rent a room by themselves, so get your buddy who is 21 to rent for you and crash out. Don't let the hotel people get their hands on your baggage, or there is a mandatory $3 group baggage fee. Vegas has killer unions. OTHER STUFF: If you check out Wired like 1.5 or 1.6 there was a blurb about the new Luxor hotel with it's total VR experience. It looks like the first true VR ride / experience for a group of people, it seats eight. Intense. A friend was just over there, and tested out the various rides. Not to be outdone the new MGM grand (Largest hotel in the world) has a ride called the R360 which is basically a gyroscope they trap you into with goggles. We should get a group together and make a mass trek over there and check it out. If enough people are interested I'll call and see if we can book a time to reserve space for a bunch of us. Both are within walking distance. I'll whip up a list of stuff that's cool to check out in town there so if for some reason you leave the awesome conference you can take in some unreal sites in the city of true capitalism. MEDIA: Some of the places you can look for information from last year include: New Media Magazine, September 1993 InfoWorld, 7-12-1993 and also 7-19-1993 by Robert X. Cringely Gray Areas Magazine, Vol 2, #3 (Fall 1993) Unix World, ??? Phrack #44 COST: Cost is whatever you pay for a hotel room split however many ways, plus $15 if you preregister, or $30 at the door. This gets you a nifty 24 bit color name tag (We're gonna make it niftier this year) and your foot in the door. There are fast food places all over, and there is alcohol all over the place but the trick is to get it during a happy hour for maximum cheapness. ============================================================================ UPDATE: I wanted to thank whoever sent in the anonymous fax to Wired that was printed in issue 1.5 Cool deal! Dan Farmer posted his paper on unix security on the net, and I've put a copy of it on the ftp site if you want to grab it and take a look. It's called "zen.txt" I've recieved more scanned images from last year, and they will be put on the ftp site. ============================================================================= FOR MORE INFORMATION: For InterNet users, there is a DEF CON anonymous ftp site at cyberspace.com in /pub/defcon. There are digitized pictures, digitized speeches and text files with the latest up to date info available. For email users, you can email dtangent(a)defcon.org for more information. For non-net people call: The Alliance BBS [612] 251.8596 16.8k speed Dual Standard Open Access. 24 Hours. Users get full access on 1st call. iirg disto site, Syncro Net, text files galore. Sysop: Metal Head (The huge guy from last year) A DEF CON directory is maintained here For Snail Mail send to: DEF CON, 2709 E. Madison Street Suite #102, Seattle, WA, 98112 For Voice Mail and maybe a human (me), 0-700-TANGENT on an AT&T phone. A DEF CON Mailing list is maintained, and the latest announcements are mailed automatically to you. If you wish to be added to the list just send email to dtangent(a)defcon.org. We also maintain a chat mailing list where people can talk to one another and plan rides, talk, whatever. If you request to be on this list your email address will be shown to everyone, just so you are aware. [Note: We need some good list-serv software for BSD, if anyone knows where to find some, please e-mail me.] STUFF TO SPEND YOUR MONEY ON: > Tapes of last years speakers (four 90 minute tapes) are available for $20 > DEF CON I tee-shirts (white, large only) with large color logo on the front, and on the back the Fourth Amendment, past and present. This is shirt v 1.1 with no type-o's. These are $20, and sweatshirts are $25. > Pre-Register for next year in advance for $15 and save half. > Make all checks/money orders/etc. out to DEF CON, and mail to the address above. If you have any confidential info to send, use this PGP key to encrypt: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCrAiyI6OcAAAEE8Mh1YApQOOfCZ8YGQ9BxrRNMbK8rP8xpFCm4W7S6Nqu4Uhpo dLfIfb/kEWDyLreM6ers4eEP6odZALTRvFdsoBGeAx0LUrbFhImxqtRsejMufWNf uZ9PtGD1yEtxwqh4CxxC8glNA9AFXBpjgAZ7eFvtOREYjYO6TH9sOdZSa8ahW7YQ hXatVxhlQqve99fY2J83D5z35rGddDV5azd9AAUTtCZUaGUgRGFyayBUYW5nZW50 IDxkdGFuZ2VudEBkZWZjb24ub3JnPg== =ko7s -----END PGP PUBLIC KEY BLOCK----- The next announcement will have more updated information. I'll hold off on naming the speakers unless they commit to attending. It looks to be a great line up. - The Dark Tangent

1 0

Re: IP rerouters (was Re: Remailers: The Next Generation)
by jerry＠terminus.dell.com 17 Dec '03

17 Dec '03

In article <2hunvn$71u(a)uudell.us.dell.com> you write: >From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> >Subject: IP rerouters (was Re: Remailers: The Next Generation) >In-Reply-To: <199401230709.XAA26564(a)servo.qualcomm.com> >References: <199401230709.XAA26564(a)servo.qualcomm.com> > >Phil Karn <karn(a)qualcomm.com> wrote: >> While you guys are thinking about where to take this stuff at the >> application level, how about giving some thought to how you >> might do it at the IP level? >> >Well, it would make tracing FTP difficult, altho, at least intially, >some FTP maintainers might try to block known IP rerouters. Of course, >if such rerouters became commonplace, it would eliminate that problem. ... >Does anyone how much it costs to get a continuous 56K internet >connection? What about a T1? How easy is it to get and set up? Yes anonymous IP would quickly get block by control freak sys admins. Costs for internet connections vary, but plan to spend about 20K/year. Plus about 10K in startup costs, plus equipment costs. Depending on a lot of factors prices can vary up to 50%. Unless you are on the internet it is very hard to get connected. Most of the companies that sell internet access do business through email. -- Jeremy Porter ----------------- Systems Enginneering ---- Dell Computer Corp. --- jerry(a)terminus.us.dell.com -------- ------------------------------------------------------------ Support your Second Amendment rights to encryption technology.

1 0

Re: clipper pin-compatible chip
by drzaphod＠brewmeister.xstablu.com 17 Dec '03

17 Dec '03

Remember folx.. ya heard it here first.. Lesse.. was quite a while ago.. the day/or after that it was announced I believe. when ideas come full circle I can't help but think we missed one go-around and this is another reminder to do it. Let's plan ahead so we don't get trapped without an escape. TTFN. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)brewmeister.xstablu.com] [MindPolice Censored This Bit] - - 50 19 1C F3 5F 34 53 B7 B9 BB 7A 40 37 67 09 5B - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

6 5

Re: The Packwood Memorial Diary Server
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

DrZaphod writes: > This also puts a huge strain on the crypto system itself. > If all your documents are in a virtually [no pun > intended..well..maybe just a little one] public place, > the crypto you use had better be damned secure. TTFN. > Need it be any more secure than the crypto system you would use on your own harddisk (which could get confiscated)? Jim_Miller(a)suite.com

1 0

Perry Nomination Brief w/ Clinton & Press
by jdwilson＠gold.chem.hawaii.edu 17 Dec '03

17 Dec '03

CP's & Friends: FYI > Date: Tue, 25 Jan 94 03:08:42 GMT > Posted: Tue Jan 25 03:08:40 GMT 1994 > Subject: Perry Nomination Brief > > > Subject: Remarks by President Bill Clinton and Deputy Secretary > of Defense William J. Perry upon the announcement of Dr. Perry's > Nomination as Secretary of Defense -- > Conducted at the White House on Monday, January 24, 1994, at > 3:00 p.m. > > > President Clinton: Thank you very much, and good afternoon. > I want to welcome all of you here, especially the distinguished > members of Congress who are here, and the members of Secretary > Perry's family who he will introduced later. > > One year ago I selected Dr. Bill Perry to serve as my Deputy > Secretary of Defense. Today, based on his lifetime of > accomplishment and his solid leadership at the Pentagon, I'm > proud to announce my intention to nominate him as the next > Secretary of Defense. He has the right skills and management > experience for the job. He has the right vision for the job. He > has served with real distinction as both Under Secretary and > Deputy Secretary of Defense. For years, and throughout his > service this past year, he has been at the cutting edge on > defense issues. > > Years ago he had a vision of the power of stealth technology > -- technology that helped the United States win the Persian Gulf > War, and helped save American lives. He's been a leader in > reforming the Pentagon's procurement process and improving > financial accountability. I expect he'll have more to say about > that today and in the weeks and months ahead. > > He's been instrumental in developing a defense budget for > the coming fiscal year that protects the readiness of our forces > and promotes our aggressive efforts at defense conversion, and > the development of dual-use technologies, and the creation and > the preservation of American jobs. He played an important role > in the recent breakthrough to eliminate Ukraine's nuclear > weapons. > > He brings a broad and valuable background to this job. He > has proven experienced in the private sector. He's the chairman, > director, and founder of several successful defense-related > corporations. He's served in the United States Army. His > academic career as a professor of mathematics and engineering has > also contributed to our nation's security. > > In every aspect of his work, Bill Perry has earned high > respect from members of both parties. In the Congress and the > military, among those who study military strategy, and in the > business community. He's demonstrated leadership, integrity, and > a mastery of his field. Time and again we heard about him and > what I have come to know personally -- Bill Perry is a real pro. > You can depend on him. That's why Secretary Aspin and many > others recommended that I select Dr. Perry for this post. > > Let me note, with appreciation that Secretary Aspin has > agreed to stay, as he said he would, until his successor is > confirmed. > > Now we have a lot of work ahead of us. We need to continue > reshaping our forces for this new era so that they remain the > best trained, the best equipped, the best prepared, and the most > strongly motivated in the world. We must implement the > recommendations through the Bottom-Up Review. We must continue > to deal with the new threats of weapons proliferation and > terrorism. We must continue our aggressive work at defense > conversion to save and create American jobs, and to maintain our > industrial base that is so critical for our national defense. > And we must reform the procurement process. > > Bill Perry comes extraordinarily well prepared to meet these > challenges. I hope, and I trust that Congress will quickly > confirm him, and I look forward to working closely with him as an > integral part of the national security team. I think he will do > a remarkable job. > > Dr. Perry? (Applause) > > Dr. Perry: Thank you very much. Thank you, President > Clinton, for the confidence you've shown in me by this > nomination. If I am confirmed, it will be a real privilege to > serve as your Secretary of Defense. > > I would like to take just a moment to introduce my family > that is here. My wife Lee, my daughter Robin, and son David. > (Applause) I have three other children not here today, and eight > grandchildren not here. We have a large and happy family. > > Over the past year, I have welcomed the attention of > President Clinton to the challenge of reshaping our forces for > this new era. We have worked to follow-up the vision that Les > Aspin had in establishing the Bottom-Up Review. I appreciate, > also, Mr. President, your commitment to maintaining the readiness > and the morale of our fighting forces. > > I also look forward to serve because this is a time of great > change, great challenge, and great opportunity. The national > security problems facing the United States today are complex and > difficult. We are making a transition from the security posture > evolved to deal with the Cold War, to a very different security > posture. I look forward to carrying out your commitment. To > make those changes in a way that addresses the need of our > military and civilian personnel, our defense facilities, and the > communities that depend on them. > > This new security posture must deal both with the problems > in the post-Soviet world, while we simultaneously seize the > opportunities. We read about the problems every day -- in > Mogadishu, Sarajevo, Pyongyang, but we must not lose sight of the > opportunities in this new post-Soviet world. > > For example, this year we have what I would call a window of > opportunity to make a major reform to the defense acquisition > system so that we combine modern equipment for our military > forces at affordable prices. The President has already made a > commitment to readiness, but the acquisition and new equipment > deals with the forces five years hence, or ten years hence, so we > must look to that problem as well. > > I have the full commitment of the President to proceed on a > vigorous program of acquisition reform, and I believe that we can > work effectively with the Congress to establish real reform in > the system, and it's long overdue. > > Last week, Mr. President, at the NATO Summit meeting, we > provided leadership for the new Partnership for Peace in NATO. > This partnership opens the door to a security partnership with > our former enemies in the now extinct Warsaw Pact, but it does > not draw a line dividing Europe at the very time we are trying to > bring Europe together. > > We also provided the leadership for the historic agreement > on nuclear weapons reached at the Moscow Summit. When fully > implemented, this agreement will see the country with the third > largest number of nuclear weapons in the world voluntarily become > a non-nuclear state with all of its nuclear weapons dismantled. > This summit agreement takes a major step back from the nuclear > abyss, and takes a major step forward for peace and stability in > the world. > > The British novelist Graham Greene once wrote, "There always > comes a moment in time when a door opens and lets the future in." > The ending of the Cold War opens such a door. The summit > agreements will help us guide the future as it comes in. > > Mr. President, I have great respect for the way you have > been guiding our national security, and I am enthusiastic about > the opportunity to help you guide it. I understand very well the > demands of this job and the strains that it puts on one's family. > My family and I have discussed this at considerable length this > weekend, and they fully support my decision. > > Mr. President, I am looking forward to working with you, the > Vice President, General Shalikashvili, Tony Lake, Warren > Christopher, and the rest of our national security team, and I > look forward to serving the American people. > > I thank you. > > (Applause) > > Q: Did you have to be persuaded to take this job? And > what do you think will be the toughest part of it? > Dr. Perry: No, I did not have to be persuaded to take the > job. I met with the President to discuss this job Friday > morning, and I left that meeting fully prepared to take on the > job. I had a meeting with my family that evening, because it's > not just me that's getting into this job. I put them under > considerable strain when I do it, too. We had a follow-up > meeting on Saturday morning with the White House where I told > them that if I had to accept the job at that time, my answer > would have to be no. I met, then, with the Vice President, and > he told me I could take my time, take some time on the decision, > meet with my family further. I took advantage of that. On > Sunday afternoon I called the Vice President back and said if you > still want me for your Secretary of Defense, I'm eager to serve. > > Q: Why did you have second thoughts? > Q: Why didn't you say yes immediately? What did you have > to think about? > Dr. Perry: I tried to explain that. It was because I did > not want to drive my family into a decision, into my decision > without their support, so I wanted to wait until I had their full > support for it. > > Q: Mr. President, why was this job so hard to fill? > President Clinton: It wasn't easy to fill. It wasn't hard > to fill, I mean. We had an abundance of talented people to > consider, but I asked Secretary Perry and he said yes. It wasn't > difficult at all. I can't say any more than you already know > about what happened in the previous example, but we didn't go on > a big search here. We had a very short list, and I quickly > narrowed it to one. I had an interview with one person, I asked > him if he'd take the job, and he did. I don't think that > qualifies it as difficult. > > Now I have had some difficult positions to fill. This > one wasn't. > > Q: What do you think he brings to the job that your > current Defense Secretary did not? > President Clinton: I don't think the two things are > related. Secretary Aspin made his statement last month. We had > our press conference on that. We answered your questions. It's > got nothing to do with what we've said here today. > > Q: Are you going to go along with Secretary Aspin's views > on military women in planes and ships? > Dr. Perry: Yes. > > Q: That's good. (Laughter) > Dr. Perry: Secretary Aspin created many important legacies > this year. I mentioned the Bottom-Up Review, his work on all of > the social aspects in the military. In particular, his > advancement of women in combat is one which I enthusiastically > support. > > Q: Is there anything at all in your background that's come > out over the past weekend that could conceivably cause you or the > Administration any problems during the Senate confirmation > process? In that regard, I'm specifically also referring to the > so-called "nanny problem"? > Dr. Perry: Nothing has come out that I believe would cause > me any problems in the confirmation process. > > Q: Dr. Perry, do you think that in terms of conservative > government in Moscow that there's a possibility there may be a > new Cold War starting? > Dr. Perry: I would observe that we cannot control the > events in other countries, including Russia. But we can > influence them. I believe the President has adopted a program to > assist, not just the Russians, but many of the former nations in > the former Soviet Union, to help stabilize their economy. This > is the most constructive thing we can do to minimize the chance > of that unfortunate disaster occurring. > > Q: Was your answer categorical about the nanny questions, > Dr. Perry? > Q: (inaudible)...the budgetary crisis that the Pentagon > faces and the possible difficulty you may have in actually > carrying out the blueprint the President has laid out? > Dr. Perry: In order to carry out the Bottom-Up Review with > the funds that are posed for it, we will have to manage the > Pentagon very well. We will have to have real acquisition > reform. We will have to have careful planning and management of > our programs. We have to do all of this while we're maintaining > a very high level of readiness and a level of morale and cohesion > in the military forces. It is a difficult management job. I > believe it's doable, and that's what I'm undertaking to do. > > President Clinton: Thank you very much. > > (END) >

1 0

ENCRYPTED DOCUMENT SERVER
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Jim Miller wrote: . . . Somebody could create a Document Server to store encrypted documents. Users would somehow get an anonymous Document Server account number when they subscribe to the service. Users would use the remailer system to send encrypted documents to the Document Server. . . . Given a Document Server, the problem now becomes: How can you prevent the government from proving you use a Document Server. This seems like a strictly technical problem, unlike the "can they compel you to reveal your key" problem. /No hay problema/. The situation can be handled similarly to that of a "spendthrift trust." In that case, the trustee has complete discretion whether or to releases money to the beneficiary. Trustees NEVER release funds to the taxman or other creditors. If your Document Server is located in a foreign jurisdiction, and you instruct its operator NOT to release your files--even to you--if you are incarcerated or otherwise under duress, there's nothing the government can do. Just be sure you take all the necessary steps *prior* to coming under a court's jurisdiction. S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: The Packwood Memorial Diary Server
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

jdblair writes: > Now, this sounds like a perfect opportunity for the > digital stamps we talked about using with anonymous mail > servers. Stamps could be sold in different megabyte-day > values. Say I've got 500 megs of gifs I want to hide for a > month-- slap a 15000 m-d stamp on the file, and send it off. > The file could be retrieved using an id number from the > stamp. > Cool. Another paradigm is to think of the Document Server as an anonymous digital safe deposit box server. A user could purchase, via anonymous digital cash, X megs of space up front, and then fill it up with whatever bits they wish. However, done this way, management of the contents of the box would be left to the user. Perhaps the service would offer specialized boxes for different types of contents. Just random thoughts (well, not provably random thoughts, of course). Jim_Miller(a)suite.com

1 0

Tidbits from DOD
by jdwilson＠gold.chem.hawaii.edu 17 Dec '03

17 Dec '03

Things have been so serious lately, I hope you don't mind if I inject a little bit of humor for you from the paperboy, cause it seems that life on isolated duty may have taken a turn for the worse: > > No. > 008-M > MEMORANDUM FOR CORRESPONDENTS January 7, 1994 > > The Defense Logistics Agency (DLA) has announced > debarments and suspensions involving the following companies and > individuals: > > SUSPENSIONS > > California Inflatables Company, Inc., Oceanside, CA, Mr. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > Robert D. Sandquist, San Diego, CA, Mr. David M. Ross, City of > Temecula, CA, Mr. Ronald C. Gladnick Jr., San Diego, CA, Mr. > Donald V. Hitzfield, Mission Viejo, CA > I guess they just don't make those dolls like they used to <hehehe> ============================================================================= | Aloha from paradise! | | "Don't take life so seriously, 9 | | nobody gets out alive..." 9 | | 9 | | Jim Wilson, jdwilson(a)gold.chem.hawaii.edu 999 | | 9 | | /\ 11*11*11*11*11*11*11*11*11*11*11 _()_ 9 | | 9 | | OTO FRC ETC| |"The opinions expressed are my own, or one of my personalities, or one | |of my channelled guides. I'm not crazy, just rationally challenged" Riba | =============================================================================

1 0

Care to submit a msg re crypto?
by jdwilson＠gold.chem.hawaii.edu 17 Dec '03

17 Dec '03

CP's: seems like this might be a chance to preach the PGP sermon and possibly make $2500 - no doubt crypto tech is an issue here: > > > Contest seeks essays on joint warfare > > ALEXANDRIA, Va. (Army News Service) -- If you can write about > joint operations, you could win $2,500. > After four years of sponsoring the Warfighting Essay Contest, > the U.S. Naval Institute, Annapolis, Md., is opening the contest to > other services. Named for the former chairman of the Joint Chiefs > of Staff, the Colin L. Powell Joint Warfighting Essay Contest > offers $2,500, $2,000 and $1,000 for the three best entries. > The competition seeks "those who are motivated to enter this > contest not by a need to 'toe the policy line,' but who are devoted > to the security of this great nation," Powell said. > All servicemembers and civilians are welcome to enter. They > should write about combat readiness in a joint context -- > discussions of tactics, strategy, weaponry, combat training or > other issues involving two or more services. > Essays can feature one service in detail, but they must apply > to joint force structure, doctrine, operations or organization for > combat. They may discuss the interoperability of hardware and > procedures, within the context of combat readiness. > Entries can be no longer than 3,000 words, and must be > postmarked no later than April 1. Shorter opinion pieces or > "professional notes" -- typically 2,000-word technical arguments -- > may also be competitive. > Following are the entry rules, as set by the U.S. Naval > Institute -- > -- Essays must be original, not to exceed 3,000 words, and not have > been previously published. An exact word count must appear on the > title page. > -- Mail entries to: Colin L. Powell Joint Warfighting Essay > Contest; U.S. Naval Institute; 118 Maryland Ave.; Annapolis, Md.; > 21402-5035. > -- Entries must be postmarked on or before April 1. > -- For fairness, entries will not be identified by the author's > name -- the name must not appear on the essay. The author will give > the essay a motto, in addition to a title. This motto will appear > on the title page, with the title. It will also be written by > itself on the outside of an accompanying sealed envelope. Enclosed > will be the author's name, address, phone number, Social Security > number, a short biography, essay title and motto. Envelopes will > not be opened until the winners are chosen. > -- Entrants must submit two complete copies of the essays, > typewritten, double-spaced, on 8-1/2x11-inch paper. Authors who use > computers are also asked to submit IBM-compatible disks and specify > which word-processing software was used. > -- The essays will be screened by a panel of officers from the five > armed services. The panel will recommend six essays to the Naval > Institute's Editorial Board, which will award the three cash > prizes. > -- The winners will be notified by phone in late May. Letters > notifying all other entrants will be mailed by mid-June. Awards > will be presented in July. > -- The three top essays will be published in "Proceedings," the > Naval Institute's magazine. Non-winning essays may also be > published; their authors will be paid at the magazine's regular > rate.

1 0