December 2003 - cypherpunks-legacy

Re: Tessera
by Phil G. Fraering 17 Dec '03

17 Dec '03

Perry, how do you know it's well engineered? Phil

2 1

Re: Information on Internet/Cryptology
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Yeah, the Internet is awfully big these days. (I started reading Usenet in the early 1980s when there was less than 1/2 MB per day of news and you could really read it all at 1200 baud :-) It's busier now...) For cryptography, the interesting places I know of are: - Usenet newsgroups: sci.crypt is the main technical crypto newsgroup talk.politics.crypto is the main random-discussion newsgroup alt.privacy.clipper is intended for Clipper discussions alt.privacy is a general-purpose priovacy newsgroup (there are others.) alt.security.pgp is for discussion of PGP and how to use it - cypherpunks mailing list (send mail to cypherpunks-request(a)toad.com to get help) is a fairly buysy (25-50 msgs/day) mailing list which deals with topics like writing crypto code, discussing protocols, using crypto to build privacy, political activism, etc. Signal/Noise ratio is usually pretty good. - ftp sites (file transfer protocol - log on as "anonymous", password=yourlogin, rsa.com - RSA's ftp site ftp.funet.fi - Finnish University Network ftp site, where most of the interesting code that's outside the US goes. garbo.uwasa.fi - Another good site in Finland; I think the name's right. ftp.csua.berkeley.edu (formerly soda.berkeley.edu) - home of the cypherpunks ftp archives ftp.eff.org - Electronic Frontier Foundation's ftp includes some crypto discussions There's also the World Wide Web, which I don't currently have software for, so I don't know if there are good Web sites yet (I've seen a lot of Web addresses go by, but most seem to really be ftp sites.) For finding code, "archie" is useful - telnet to ds.internic.net or archie.ans.net or archie.rutgers.edu , log in as archie, no password, and then type help to find out how to use it - it tells you where to find code for ftp. (Most archie sites actually tell you "There are too many users on right now, here's a list of other archie sites", and you randomly pick one in Korea or Israel or somewhere that's not too busy :-) Good luck! Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: anti-clipper t-shirt
by Eric Johnson 17 Dec '03

17 Dec '03

: I've already ordered my "1984" T-shirt, but saw the reference to another : anti-Clipper T-shirt, as well. What are the gory details on the non-1984 : shirt (price, where to order, size(s?), etc). I think that was probably my shirt you are referring to (the "original" 1984 shirt :-). Both John Blair and I were at CFP '94, and we both got the "We're behind schedule" line from a NSA employee who was representing only himself at the conference. The shirt idea I had was to take the Big Brother Inside logo that has been floating around, and use that for the front of a "anti-clipper" shirt, as you put it. On the back, I originally planned to use a !Key Escrow (the words Key Escrow inside a universal red circle/slash), but decided to use the "We're behind schedule" instead. Who knows, maybe there is another shirt in the making... My shirts are supposedly printed (I haven't seen them yet). I've received several orders, but I have been deliberately circumspect on the list; I made one "RFI" (request for interest) to cypherpunks. All the rest of my "advertising" has gone to those who initially expressed interest via email. To see John's .gifs: http://phoenix.aps.muohio.edu/users/jdblair/t-shirt.html (for those who don't have it, John is jdblair(a)nextsrv.cas.muohio.edu) To see my .gifs: ftp://pmip.maricopa.edu/pub/1984.gif ftp://pmip.maricopa.edu/pub/bbi.gif If you are interested in ordering a shirt from me, send email. --Eric

1 0

Re: Crypto scripting language
by Hal 17 Dec '03

17 Dec '03

From: peace(a)BIX.com > I wrote a cryptographic scripting language that has been implemented in > a commercial product. I hesitate to post it here due to its length. > If there is a place to send it where it can be archived for public > down-load, I could do that. I am in the process of writing it up for > a symposium, but have other things that I would rather do. If I could > modify it to improve it's integration w/ telescript, I would like to > do it, but I don't have telescript, does anyone here have it? I'd like to hear more about your scripting language. You could post it for ftp to soda.berkeley.edu, or if it is something which should be export- controlled you could consider asking mpj(a)csn.org to put it up on his U.S.-only site. In the mean time, perhaps you could describe the language here. What is its syntax like? Interpreted or compiled? What kind of special crypto support does it have? If you actually own the rights to it, I'm sure we would be interested in looking at it. Re Telescript: I sent away a few months ago for General Magic's press kit. Telescript is a scripting language which they describe as being like "Postscript for net communications" (not an exact quote). Later this year, PDA's (Personal Digital Assistants, like Newton) will be released which run GM software, including the Magic Cap software. Magic Cap provides a graphical user interface that is said to be easier to use, with pictures of desks, buildings, etc. for the user to tap on. It will also run Telescript for its communications. As I understand it, users will use Telescript to write agent scripts, which will then be sent into the net where they can seek out information, negotiate payment if necessary, even trade or sell things. RSA is used for authen- tication and protection. It appears that these agents will require special software platforms where they will run. They won't just be able to surf the internet as it is today. Instead, they will only run on Telescript servers, where typically sellers of goods, services, and information will have their own agents waiting to make deals. AT&T is starting up a special network specifically for this purpose called PersonaLink. (It will also do ordinary email, presumably, as this would be a subset of agent capabilities.) In considering whether Telescript could become a new standard for commun- ications and networking, one flaw I see is that it appears that the software itself must be proprietary. This would suggest that it will be difficult to see Telescript servers spread through the Internet as WWW or gopher has done, for example. The internet as it is today does not mesh that well with pro- prietary software. Perhaps GM has a strategy for this but my impression is that they intend to create their own network and put their efforts there. I don't have any information on the language itself, so it's hard to judge its suitability for crypto based protocols. The RSA authentication and encryp- tion is built in at some level, but I don't know whether it is transparent (which would make it hard to replace) or explicitly called from the scripts (which might suggest that other alternatives could be hooked in). But the fact that the language is communications-oriented, and perhaps there- fore is already set up to deal with the unreliability and delays we often see with electronic communications, could be a good starting point. Hopefully when the PDAs hit the shelves in a few months we will start to see more infor- mation on Telescript. Hal

1 0

Re: Milgram & Authority
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Duncan writes: > Privacy 101 - A few years ago, Rebecca Schaefer told the State of > California where she lived. Her killer used that information to find her > and kill her. Only give out your address on a need to know basis. The San Francisco papers had a few articles a week ago about the San Francisco police giving out somebody's address from motor-vehicle records to her ex-boyfriend who was stalking her, as well as other private data - he got the information several times as she moved around. It's supposedly a misdemeanor, but of course the computers don't keep track of who requested what data, so they don't know which cop you can't trust. (Anybody who tries stalking me using motor vehicle records will either wonder how I keep all my furniture in that little box, or else have to figure out how to find my streeet address from my mailing address, not that that's real hard...) Bill

1 0

Re: clipper not end of world
by Dan Day 17 Dec '03

17 Dec '03

> From: Mikolaj Habryn <dichro(a)tartarus.uwa.edu.au> > Seems to me, if one is talking about videophone type devices, > they are transmitting quite a great deal of info, and stegging in a > message is quite feasible, is it not? You don't even have to do much of a > hardware modification. Do something like having an HF carrier tone in the > background, that anyone listening to it can't detect without the knowing > what they're listenong for. Or insert a microburst transmission - it'll > look like static. In one of his novels, James P. Hogan had a clever way to insert clandestine messages. There was a moon-earth communications link, and the traffic over the link was monitored to make sure no one was giving away secrets from the installation on the moon to a mole on the earth end. The problem was that they were doing the surveillance on the cleaned-up data stream. The transmission protocol had the semi-standard error correction, whereby blocks of data were transmitted, the checksum was calculated and compared, and bad blocks were thrown away followed by a request for a resend. The spies on the moon merely contrived to send the occassional "bad block" which actually contained the message they wanted to piggyback on the datastream. A listening post monitored the raw data stream and extracted those "bad blocks" which had the right data signature, and the hidden messages were stored and decoded. The people checking the received data which passed the error check never saw the message and assumed all was well, since their own communications gear had already editted it out of the data stream.

2 1

Re: Schneier's source code
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> >Oh come on, all this talk about OCR makes it sound like nobody would ever > >be willing to just type in the code by hand. It only need be done once, .... > But seriously, isn't the point that you may make some silly typing mistake > that compiles anyway, but ruins the algorithm? Since it's perfectly legal to *import* crypto code to the US, that's simple - ship it back to the US to check if it's correct. You also do checksums for each page and maybe each line, and have them run the checksums to make sure they've typed the page correctly as well, but use the ship-back-here method for final diffs. Meanwhile, since much of crypto is eventually about economics, it's worth pointing out that you can probably hire typists in Russia who speak English and C well enough to type it in accurately, and pay them an amount of money that's small here and quite large there. I don't know if Russia has crypto import/export laws? There's certainly Russian crypto software available in the West.

3 3

Publishing code books
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Tim May wrote: > Someone in Cypherpunks has a novel solution: print code in the most > easily OCRable font---I think the suggestion was that OCR-A and OCR-B, > or somesuch, are optimized for this (one would think so from the > names, but I had thought they had something to do with the magnetic > ink printing on checks...). > > I'm sure Schneier would be entertain the idea of a special > "exportable" version of his code in which purchasers paid the $30 he > charges and received a loose-leaf book of very neatly and precisely > printed code, ready for easy OCRing. I think that it's a great idea for enterprising cypherpunk publishers to print "exportable versions of restricted code." There should be a good market, whether or not code is OCR-able. There may be a lot of unavailable code that could be worth typing. As a matter of fact, any plain font OCRs very well. The costs of such publishing would be very low, and I for one wouldn't mind paying >$50 for such 'code books'. Phil Karn <karn(a)qualcomm.com> wrote: > Oh come on, all this talk about OCR makes it sound like nobody would ever > be willing to just type in the code by hand. It only need be done once, > and the task could easily be divided up for a group. The listings for any > particular cipher just aren't that long. But the listings for a library of ciphers are. Besides OCRs are quite good nowadays, you don't really have to print in an OCR font. ------------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! -------------------------------------------------------------------------------

4 3

RSA-129 Cracked
by cyphpunk＠aol.com 17 Dec '03

17 Dec '03

"Business Wire MORRISTOWN, N.J.--April 26, 1994--A Bellcore scientist has guided an international team in cracking a code once thought uncrackable. The team consisted of three academics and more than 600 volunteers on the Internet from around the world, and the code they cracked was based on a 129-digit number called RSA 129. The renowned number is: 114,381,625,757,888,867,669,23 5,779,976,146,612,010,218, 296,721,242,362,562,561,842,93 5,706,935,245,733,897,830, 597,123,563,958,705,058,989,07 5,147,599,290,026,879,543,541 The 129-digit number is called RSA 129 for its originators, Ronald Rivest, Adi Shamir and Leonard Adleman (RSA). The three embedded a message using the code in 1977 and challenged anyone to crack it. The achievement of Arjen Lenstra and the team has important implications for future security technologies, since the codes protecting such security are often based on the difficulty of factoring very long numbers--that is, breaking a number down into prime numbers. (A prime number is only evenly divisible by one and itself). In France, similar codes protect telephone ''smart cards.'' And they have other applications besides telecommunications--in banking, in the security systems of nuclear power stations, and in the military. Lenstra, Bellcore's factoring expert, guided the global effort to factor RSA 129. Lenstra designed the computational software used by the Internet volunteers, and the software used in the final stages of factoring. Dr. Paul Leyland, a computer-systems manager at Oxford University in England, and two students, Derek Atkins, from M.I.T., and Michael Graff of Iowa State University, monitored the day-to-day progress and managed the hundreds of volunteers on the Internet. ''In 1977, this would have been unimaginable,'' says Bellcore's Lenstra. ''The evolution of computing technologies and of the Internet has made the network vulnerable -- but, ironically enough, provides the means for protecting it by enabling the use of larger numbers than would have been feasible or necessary a few years ago.' Bellcore, on behalf of most of the nation's local telephone companies, evaluates the security of networks. This includes studying cryptographic systems and trying to break them. To ensure 'trustworthy networks,'' Bellcore examines ways to protect the privacy of information traveling on the networks as well as information stored in network databases. This role is critical, as the emerging information superhighway will foster new ways of doing business electronically. The ability to factor large numbers could potentially threaten many security codes based on a widely used cryptographic system created by Rivest, Shamir, and Adleman. The RSA system is based on the principle that it's infeasible to factor large numbers equalling the product of two large primes. Lenstra and the team broke RSA 129 down into two prime numbers, one of 64 digits, one of 65. Identifying these two primes allowed them to break the code. The numbers were: 3,490,529,510,847,650,949,147,849,619,903,898,133, 417,764,638,493,387,843,990,820,577 32,769,132,993,266,709,549,961 ,988,190,834,461,413,177, 642,967,992,942,539,798,288,53 3 The RSA code acts like a locked box with two keys. One key is a large, composite number which the owner may distribute publicly. Anyone can use that key to open the box and put a message in for the owner. But once the message is put in, the locked box can only be opened again by the owner, who has the second key, which is composed of the two factors of the composite number. Only the owner knows these numbers, because he or she has purposely constructed the composite number from two large prime numbers. ''Cracking the RSA code provides a very useful benchmark on the difficulty of factoring numbers, and thus provides very useful guidance to users of the RSA cryptosystem as to how large their prime numbers should be,'' says Rivest of MIT. The use of modern security technology, such as the RSA system, is an important aspect of Bell Atlantic's ability to provision a secure information highway, says Ravi Ganesan, Manager of Center of Excellence for Electronic Commerce at Bell Atlantic. ''These security tools are critical enablers for the long-term viability of electronic commerce technologies, which we are aggressively pursuing,'' he adds. ''Consequently, the analysis of these security technologies, and the quantification of their strength and vulnerabilities, is critical. In this context, the efforts of Arjen Lenstra and others at Bellcore in providing Bell Atlantic state-of-the-art evaluations of important security tools is invaluable.'' Background This attack on RSA 129 originated last summer after Bellcore's Lenstra was asked by Atkins, Leyland and Graff to suggest a factoring challenge that would involve volunteers on the Internet. Lenstra proposed the formidable RSA 129. The team eventually involved volunteers on every continent but Antarctica. Volunteers worked in the Australia, Belgium, Brazil, Canada, Chile, Denmark, Finland, France, Germany, Holland, Ireland, Israel, Italy, Japan, New Zealand, Norway, Portugal, South Africa, Spain, Sweden, Switzerland, the United Kingdom, the United States and Venezuela. ''We wanted to demonstrate, in public, how a team of enthusiasts could factor a number of the same size as those being used to protect commercial information,'' Leyland says. As the international mathematical challenge began, the problem was broken into thousands of tiny pieces and sent to the Internet volunteers to perform the preliminary calculations on their computers, on their own time. Graff corresponded on the Internet with potential volunteers, dividing the work between them. They then sent the results to Atkins at M.I.T. to be checked for accuracy. Atkins arranged for the use of a file server at M.I.T. to collect and process the work of the volunteers. He also handled system administration, making sure the data was backed up regularly. Leyland became the team's chief trouble shooter, and also produced regular status reports to keep the volunteers informed and interested. Once compiled and checked, the data was sent to Lenstra, who in turn assembled the data in one mammoth calculation on a MasPar supercomputer to produce the factors of RSA 129. ''Just as it was impossible to predict in 1977 that RSA 129 would be broken, so it is impossible to predict how quickly other such codes can be broken,'' Lenstra says. ''But the ability to break codes is getting better all the time, aided by increasingly powerful computing tools. Bellcore's work supports its customers in designing and implementing telecommunications systems that use longer numbers to assure the privacy and security of information traveling and stored on their networks,'' he added. Bellcore performs research and other technical services for the telecommunications companies of Ameritech, Bell Atlantic, BellSouth, NYNEX, Pacific Bell, Southwestern Bell and U S WEST, as well as Cincinnati Bell, Inc., The Southern New England Telephone Company and other leaders in industry and government." "BELLCORE NEWS RELEASE: BROKE CODE THOUGHT UNCRACKABLE 4/26/94" _San_Jose_Mercury_News_, 27 April 1994:Business Section.

1 0

Gee...
by Phil G. Fraering 17 Dec '03

17 Dec '03

All those cryptographers, and their solution to exporting restricted source code is to print them up as barcode in books.\ How about tarring the code together, encrypting it, and e-mailing the message out? Phil (Who thinks that the whole point of cypherpunks *was* supposed to be that modern electronics and networking would make standard spook blind drops and the like obsolete).

5 4

Re: Rights are on the CP agenda
by Phil G. Fraering 17 Dec '03

17 Dec '03

>Perry, I would suggest that you leave the list if you don't like it. Your >only contributions have been snide little flames, anyway. >tw Hmm, werner(a)mc.ab.com. Tim Werner. Let me fire up nn... Okay, setting for ten days... (1st offence)... Plonk!

1 0

Re. FBI & CIA
by Brad Dolan 17 Dec '03

17 Dec '03

>From: Black Unicorn <unicorn(a)access.digex.net> >Subject: Re: CIA & FBI, a marriage made in ___? >To: 71431.2564(a)CompuServe.COM (Bradley W. Dolan) >Date: Wed, 27 Apr 1994 22:06:25 -0400 (ADT) > >> >> >> Does it concern anybody besides me that the CIA [with a bunch of >> underemployed manpower] is jumping into bed with the FBI [whose >> spokesman recently testified to Congress that they didn't have >> enough manpower to enforce the Crime Bill on us]? > > >Yes it bothers me, but not for the reasons that you think. > >First, be careful about characterizing the change as the CIA >jumping in bed with the FBI. What is really happening is that >the FBI is taking over some of the counterintelligence functions >of the CIA. [...] > >Believe me, the CIA is more upset about it than >you are. They are hardly "jumping into bed" with anyone. Bent over a >chair is more like it. O.K., so it's rape. They're still in bed together. And I don't think I'm going to like the progeny. >The usurpation of CIA's CI functions bothers me because of the doctrinal >distinction, not because it empowers the FBI. Both aspects bother me. Further empowerment of the FBI bothers me more. >> >> Does it make anybody nervous besides me that this is occurring >> at the same time that the 2ond and 4th amendments are being >> dispensed with? While the Clipper chip and digital telephony >> bill are being foisted on us? > >Yes it makes me nervous, but not for the reasons you think. > >See below. > >> Is there a trend here? > >Yes. I'm not sure if my version is close to yours, however. > Opposite side of the same coin, I think. You worry (correctly) that a politicized intelligence/law enforcement establishment won't be very good at intelligence/law enforcement. I worry that it may become good at something else. > >The trend is to use the intelligence and federal law enforcement agencies >for domestic politics. The NSA to promote the economic regulation of the >crypto market. The FBI to further the executive's domestic survell. >technology agenda, and put out the crime fire at home. The CIA to >demonstrate, via a parade of horrors, how bad the problem is, and be the fall >guy for the FBI. [...] >This is a perversion. I discussed this before on the list and in usenet. >Using the NSA as a public relations tool to the degree you see today is >an idea that only the intelli-clueless Clinton would think of. >Intelligence and law enforcement are not the President's personal program >advocates. >It detracts from real business and it destroys the >credibility of the agencies in the eyes of the public. Yes >This makes it hard for real business to be addressed. Yes >I have the greatest respect for the office of the Presidency, however. If I keep an image of Washington or Jefferson firmly fixed in mind, I can maintain just a shred of respect. >-uni- (Dark) bd

1 0

Re: Gee...
by Phil G. Fraering 17 Dec '03

17 Dec '03

>Gee, how about getting arrested for exporting munitions? That'll happen with the book'o'barcodes too, and you can't use an anonymous remailer for that. Phil

1 0

Re: Milgram & Authority
by Blanc Weber 17 Dec '03

17 Dec '03

From: Duncan Frissell Privacy 101 - < daily affirmation from DF deleted > --- WinQwk 2.0b#1165 ......................................................... What does "WinQwk 2.0b#1165" stand for? Blanc

1 0

Re: Gee...
by juola＠bruno.cs.colorado.edu 17 Dec '03

17 Dec '03

>Gee, how about getting arrested for exporting munitions? That'll happen with the book'o'barcodes too, and you can't use an anonymous remailer for that. I believe that's the question under discussion -- whether or not a book'o'barcodes would pass under the ITAR regulations. Given that the book itself passes (has already passed), what changes would need to be made so that the book could still be exported but be much easier to enter into a machine than having to retype the whole thing. Patrick

1 0

Liberating Schneier's Code?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

In typical Cypherpunks fashion, we are beating this one to death! (How else can we keep our message traffic high enough to keep using the Cypherpunks list as a plaintext channel to carry messages stego'ed in the right-hand margins?) - some want the source code printed in OCRable form - some just want it typed in by volunteers and then distributed - and others are expecting the Karns case to get the export situation resolved soon enough anyway Need I point out that the source code already exists in machine-readable form on the $30 disketter Schneier is selling? All it takes is for someone to order it, then put the code on an ftp site. Outside the U.S. And there are of course _many_ ways to get such a diskette outside the U.S. "This post is for disussion purposes only and is not to be construed as an inducement to infringe the property rights of Schneier or his publisher or to violate the ITAR, COCOM, or Sales to Pinko Nations Laws." (had to put this in) Yes, this solution "violates" Schneier's "property rights," but so do the main alternatives above that folks are discussing. (And I'm not being sarcastic here in my quotes around "violates" and "property rights." There are complicated issues here. Bruce Schneier himself said he wanted to include the disk with every copy or at least have an ftp site, so I don't think money is the main issue. And he's presumably selling quite a few copies of the book, anyway.) Independent of the Schneier book, I do think there needs to be a code repository of useful code. Mark Riordan has some at his RIPEM site, there's the RSAREF code that RSADSI makes available, and several other code ftp sites I've seen (and which I've collected for the Cypherpunks FAQ I'm getting closer to releasing). --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Gee...
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: "Phil G. Fraering" <pgf(a)srl01.cacs.usl.edu> > > All those cryptographers, and their solution to exporting restricted > source code is to print them up as barcode in books.\ > > How about tarring the code together, encrypting it, and e-mailing the > message out? See you in jail. Anyone can get this stuff out of the country surreptitiously. I think the point was to get it out _legally_, through the law's _own_ loopholes. Then they're completely powerless to stop it or persecute the responsible parties in any way. It also makes any further attempts to stop the export of the algorithm pointless (though I guess that wouldn't stop them anyway--the government has spent billions of dollars protecting "secrets" that have long since been leaked by renegade CIA agents.) --Dave.

3 2

Mirrors...
by Peter Wayner 17 Dec '03

17 Dec '03

I was just at a talk at the Space Telescope Institute that described a telescope that would be suspended from a balloon over the South Pole. There was no one mirror. It was a composite of 10 smaller mirrors that were layed out over a grid. They did all sorts of studies on the harmonics. It was not clear to me, though, that the array could be folded up. I'm sure that they needed very careful alignment. -Peter

1 0

Re: Liberating Schneier's Code?
by Peter Wayner 17 Dec '03

17 Dec '03

In re Schneier's property rights: ` He didn't write most of it. The stuff I donated to the collection is freely distributable (but not public domain). I suspect that someone else could put together their own collection.

2 1

re: Crypto scripting language
by wet!naga 17 Dec '03

17 Dec '03

>Date: Wed, 27 Apr 1994 09:00:10 -0700 >From: Hal <hfinney(a)shell.portal.com> >To: cypherpunks(a)toad.com >Subject: Re: Crypto scripting language > >From: peace(a)BIX.com >> I wrote a cryptographic scripting language that has been implemented in >> a commercial product. [...] > >I'd like to hear more about your scripting language. >[...] In the mean time, perhaps you could describe the language here. What >is its syntax like? Interpreted or compiled? What kind of special crypto >support does it have? > [...] >Hal Well, I don't know anything about peace(a)BIX.com's crypto scripting language but according to my manual for Dolphin Encrypt Advanced Version (a different product from DE) the program supports a script language. It's an interpreted language. It's explained in an 11-page appendix in the manual. From a quick perusal: The script is contained in a textfile. You run DE with a command like DE2 @XXX.SCR and it reads XXX.SCR and interprets the commands. Apparently the script language is designed only for use with the Dolphin Encrypt program itself (so you can't use it to encrypt with DES, etc.). I don't have much use for scripting crypto applications myself (though if there were lots of encryption/decryption to be done daily I could see a use), so I can't post any that I've written for my own use only, but here's two of the sample scripts from the DEAV disk: #TEST2.SCR #Script for testing Dolphin Encrypt #Last mod.: 1992-05-02 if not there_are_any C:\TEMP\*.TXT output: output: There are no C:\TEMP\*.TXT else encrypt C:\TEMP\*.TXT C:\TEMP\*.ENC /c /b8 if exit_status = 0 decrypt C:\TEMP\*.ENC C:\TEMP\*.DEC /b- if exit_status = 0 run DCOMPARE C:\TEMP\*.TXT C:\TEMP\*.DEC if exit_status = 0 output: File comparisons OK else output: File comparison error! endif endif endif endif // VIEWENC.SCR // A script for decrypting and viewing text files in the current directory // which have been encrypted as files with extension .ENC. // No input parameters required // Use: DE2 @VIEWENC.SCR // Last modified: 1993-03-25 set escape on // Allow termination from script // by pressing the Escape key. output // Print a blank line decrypt *.ENC *.DEC // Decrypt the .ENC file(s) if not successful // Check if decryption successful. output: Decryption error! // Print message if not. else // Otherwise: beep // Pause so that user can wait: Press a key ... // verify successful decryption. save screen // Save the video screen. DFR *.DEC // View the plaintext files using DFR restore screen // Restore the video screen. beep // Get the user's attention. output // output a blank line output: Decrypted plaintext files: DIR *.DEC /w // Show decrypted files on disk. output // output a blank line ask: Purge decrypted file(s)? if answer = Y purge *.DEC /d // /d means display file names. if not successful // If error occurred beep // attract user's attention wait // and wait for a keypress. endif endif if printer // If output redirected to printer eject // issue a formfeed. endif endif Lessee now ... for those interested, Dolphin Software's address is ... got it right here ... 48 Shattuck Square #147, Berkeley, CA 94704.

3 2

Re: Liberating Schneier's Code?
by Peter Wayner 17 Dec '03

17 Dec '03

Yes, books are hard to update, but hardware is even harder. What is going to happen to all of those Capstone chips that use the "old" unfixed version of MD-5? Imagine what would happen if the Capstone was widely used in the country? It could easily cost many millions to update an algorithm in hardware.

3 2

Re: DId you ever think...
by jpp＠markv.com 17 Dec '03

17 Dec '03

> From: uri(a)watson.ibm.com > Date: Wed, 27 Apr 1994 09:10:16 -0500 (EDT) > > Wrong again. There was no "proto-DES". From Lucifer to DES took a > few years and significant redesign, but NSA didn't help (however > they sure as hell wanted to keep updated on what was going on, so > we were telling them [or rather - the team who designed it,'cause > I joined later on :-]). Are you saying that IBM developed DES entierly on their own? This doesn't fit my model at all. But, I'm not afraid to be wrong. > > Learn something new every day... > > Please do! (:-) Gladly! Please tell (learn) me: what was the history of the development of DES. How were DES, IBM, NSA, NIST (then NBS), and FIPS related? Wasn't there some concern on IBM's part about liability -- Thus the us Governments participation, including the 'secret' changes to DES? > > Since about 1977 I wondered what the 'rediscovered > > crypto techniques' were. > > Will you bet your ass it was the only technique in consideration? Why would I do that? j'

1 0

Level of Discourse on the Cypherpunks List
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

This post is about the level and quality of discourse here on this list. Because of the number of posts I make (and one hopes, the quality?), I get a fair amount of personal mail directed at me from people with personal gripes about the way the list discussion is working, or not working, or "should be run," and so on. Some of these points I even agree with...and sometimes I tell my e-mailers this. But several things need to be said: - the list has more than 700 names on it, last time I checked (send the message "who cypherpunks" (in the body) to majordomo(a)toad.com) - these folks have diverse interests - often newbies join the list and have things they want to get off their chest; their agenda sometimes dominates the discussion until they've exhausted what they wanted to say (or burn out and leave the list) - old-timers who have been on the list for many months, and sometimes since the beginning in October 1992, have seen the main themes many times and may not want to contribute each time a thread comes up - the list is an anarchy: it is not "run" by any one person, although Eric Hughes has certain powers as List Administrator, and John Gilmore has other powers (as owner of the machine on which the list runs). [Please, not another debate about who owns the list, about how our words are not owned by Hughes et. al., etc. And, please, not another meta-debate about why shouldn't we debate this. One of the problems with a community of 700, any of whom can take the "floor" at any time, is that any statement gets a rebuttal, every debate becomes contentious. _This_ paragraph will likely be angrily rebutted by at least one of you out there.] - I repeat: the list is an anarchy. There is no voting, no membership, no Board of Directors, no formal policies or charter. Just a collection of relatively common memes. This whole issue came up again when a list member sent me a message saying he had been lurking on the list for several weeks and that he would "give it another couple of weeks" to see if the S/N ratio--for the things that interested him--could be improved. I wrote him the following reply. I have of course edited out his comments and replaced them with vanilla comments. "I've been lurking for several weeks. I'm unhappy with the large number of posts which have little to do with this list. I'm more interested in crypto methods, software, etc., and had hoped to see more discussion of that." There's certainly a lot of what you are talking about, wouldn't you say? Yes, a lot of other stuff, too. That is, mixed in with all the political stuff, the jokes, etc., is a fair amount of commentary on algorithms, new code, status of exising programs, etc. This certainly will appear to be fragmentary (e.g., a bunch of short comments about D-H code), but this is because Cypherpunks is a mailing list, not an essay list exclusively. Most of the main stuff has been written about at least several times, so newcomers cannot possibly expect a steady flow of tutorials, incisive essays, etc. (And a steady flow of tutorials would turn-off a lot of others, ironically.) "I'm not willing to read 60-80 messages a day to find the stuff I'm interested in. Or to find the associations with the alleged topics at hand." [the last is my correspondents choice of phrasing.] Then you are probably best off leaving the list, as nobody will tailor their posts to match your exact needs, or even your approximate needs. "I'll stay for another few weeks, then leave if things haven't improved. However, I'd be interested in corresponding by mail with others who are interested in working on code." There have been at least half a dozen such attempts to create spin-off lists, or subsets of the main list. There was a "hardware punks" list, a "steganography list," and at least several regional sub-lists. All have died for lack of interest. or at least are dormant. For example, the "DC-Net list" was formed a year ago, by some guys who were tired of reading about topics that didn't interest them. There was one message, the welcome message, and then nothing more. C'est la vie. (I joined several of these sub-lists, out of a sense of duty and mild curiousity to see how they would do, and there's now zero traffic on them. It's a critical mass problem: the Cypherpunks have the critical mass to sustain discussions---perhaps sustain them too long, some might say.) "Maybe I misunderstood what the cpunks list was all about..." The best way is to lead by example. So, where are your posts? I look forward to them. But complaining that not all of the posts are to your liking is pointless. I can't change what other people write, can I? Nor can you. The thing you can change is what _you_ write. Besides, and this will be my final point, the list has been running since October 1992, with an average of 400 people on it (700 recently). Most topics have been covered at least several times, and sometimes a dozen times. The "old-timers" will thus usually sit-out these nth rehashings of TEMPEST, or the powers of the NSA, or steganography, or whatever. If you want a higher level of discourse, begin it. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Faking hostnames & CHATTERBOXES
by Gary Jeffers 17 Dec '03

17 Dec '03

About faking hosts names being inconvenient: A week or two ago I did a post FREEDOM DEAMON in which I suggested the idea of the "CHATTERBOX". A "CHATTERBOX" would be the Internet Chat equivalent of a remailer. Other names for "CHATTERBOXES" would be "RECHATTERERS" or "RECHATS". It would hide the location of the user. It would also have the cap- ability to send commands without disclosing location. For instance, you could TELNET really anonymously! Lots of other things too! Someone feel free to write it. Still another way to get rid of host name.- Some- one once TELNETed to a foreign country computer, then that computer was kind enough to allow user to IRC to Internet Chat. Who was that "masked man?" Yours Truly, Gary Jeffers PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCKKK! BBBEEEAAATTTT STATE!

1 0

Re: Gee...
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

From: Sandy Sandfort <sandfort(a)crl.com> > On Wed, 27 Apr 1994, David Mandl wrote: > > > Anyone can get this stuff out of the country surreptitiously. > > I think the point was to get it out _legally_, through the law's > > _own_ loopholes. Then they're completely powerless to stop it > > or persecute the responsible parties in any way. . . . > > Wrong on both counts. Getting it out legally would be nice--it's a great > *fallback* position--but that's not the object of the game. The idea is > to get it out and make it widely available. Period. First of all, the above was not my position (though I have no big problem with it). I was just explaining the point of this thread, which the previous poster seemed to be unaware of. Now, are you saying I'm wrong about it being easy to get crypto software out of the country illegally? If so, you've got to be kidding. This stuff has probably crossed the border fifty times TODAY. Everyone on this list knows that. If simply getting crypto code out of the country By Any Means Necessary was the goal, this thread would never have been started, Perry would never have considering publishing code in machine-readable form, and no one would have done the little test with Schneier's book (Hal?...I forget who it was). The point was to get it out in such a way that no one had to hide from the lawman or pretend the code was written overseas, and we could all walk in the sun. Me, I have no problem with people exporting it illegally to their heart's content. > The Constitution and other laws are not magic talismans. It is fantasy > thinking that technical compliance with the government's laws renders > them "completely powerless." A Smith & Wesson beats four-of-a-kind. Your point? Sure, the government can do whatever they want. So? I have no interest in the Constitution and the "Law" (though I obey the latter because I'm not keen to spend the rest of my life in jail). I just don't care. All I was doing above was explaining this thread to someone who seemed to miss the whole point. > S a n d y, (Attorney-out-law)

2 1