December 2003 - cypherpunks-legacy

RC4
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

I've been out of e-mail range for a while, so some of sci.crypt has fallen off the back end of my host. And I don't read the full Cypherpunks feed. So some of these may be dumb questions, but they're mine and I would like them answered. Does anyone know if this is really RC4? Has anyone compiled it to see if it will run? Has anyone tried to use it to decrypt messages encrypted with some commercial RC4 program? I see that it has been posted anonymously. Was it posted to Cypherpunks only, or did it also get on sci.crypt? If not, did someone from Cypherpunks, anonymously or not, crosspost it to sci.crypt? Has there been any reaction from anybody? RSADS? NSA? NIST? I just sent a copy of Bidzos asking for comment. This seems to be a REALLY GOOD THING, but I would like some verification that it is not a hoax. Inquiring minds want to know. Bruce

3 4

Boulder, Colorado RMIUG Crypto-Fest 9/13 6:30pm
by Michael Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- What: Rocky Mountain Internet User's Group (RMIUG) Crypto-Fest When: Tuesday 13 September 1994 7:00pm-9:00pm, cookies at 6:30pm Where: NCAR (West end of Table Mesa Drive), Boulder, COLORADO Who: Philip Dubois (Philip Zimmermann's lawyer and a very nice guy) and Mike Johnson (alledged crypto expert, designer of the Diamond Encryption Algorithm, PGP beta tester, and PGP user). Sorry, Philip Zimmermann had a change of plans and will be at a conference in Atlanta. The show must go on! RMIUG "Crypto-Fest" A users approach to encryption with PGP (Pretty Good Privacy): I. A Very Short History of Cryptography A. Single Key Systems B. Two Key Systems (Public Key Cryptography) C. Hash Functions (MD4, MD4, SHA) D. What can be done with encryption? II. Current crypto applications III. PGP Building Blocks A. Public Key Algorithm (RSA) B. Hash function (MD5) C. Symmetric Key Algorithm (IDEA) D. Compression engine (Info-ZIP) E. ASCII armor engine F. Key database G. File formats IV. What can PGP do? What are its advantages? A. Privacy B. Authentication with nonrepudiation C. Compression (ZIP) D. ASCII armor C. Distributed Key Management (the Web of Trust) D. Inter-platform compatibility E. Wide availability F. Source code available (except for Viacrypt Digi-Sig) G. Ease of use (best around, but could be better) V. Who uses PGP? What do they use it for? VI. How do you use PGP? Read the fine manual. 2 books coming. A. Getting PGP B. Installing PGP C. Generate your key D. Distribute your public key E. Add keys from your correspondents E. Signing messages F. Encrypting messages (public key method) G. Conventional encryption pgp -c VII. History/development of PGP & Legal Issues A. Why did Philip Zimmermann write pgp? B. Legal Issues C. Version History VIII. What's happening now? A. Legal Actions & Status B. Political Action C. Future Development Plans There will be opportunities to ask questions of the two panelists during and after the presentation. ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mpj/README.MPJ -. --- ----- ....| | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLnUoSPX0zg8FAL9FAQE6nAQAmWpomcfCcWslktsuRYPNotY8kJFOwiuL BUrh5L/UbCnM8L9Gh36CF2PGjrwuxDLhlySc70yhAGpBuMijWryTk0mPcJVKDoDm 6Z9v+L0Xs4Ql2kTshYpiJg5DlUd7CKsuREN0r07xJUMybudUXM8NLUG9YGvDz4CX tIGH4nlDAS4= =Qedh -----END PGP SIGNATURE-----

1 0

Spatial Databases, Law, and Information Policy conference
by gnu 17 Dec '03

17 Dec '03

Forwarded-by: Lee Tien <tien(a)well.sf.ca.us> Forwarded-by: thardy(a)mail.wm.edu (Trotter Hardy) From: Harlan Onsrud <onsrud(a)mecan1.maine.edu> Date: Thu, 8 Sep 1994 11:10:08 -0400 Subject: Conf on Law, Information Policy and Spatial Databases THE CONFERENCE on LAW and INFORMATION POLICY for SPATIAL DATABASES October 28-29, 1994 Arizona State University College of Law Tempe, Arizona SPONSORS National Center for Geographic Information and Analysis Center for the Study of Law, Science and Technology, Arizona State University College of Law CONFERENCE OVERVIEW Geographic information systems (GIS) and their associated databases are gaining widespread use throughout government and the commercial sector in our communities, the nation, and the world. These automated mapping and analysis systems are allowing the collection, integration and interrogation of vast amounts of data. The data and processing capabilities supplied by the technology will constitute a significant component of the emerging national information infrastructure. This enabling technology holds out the promise of increased efficiency in commerce, improvements in the environment, health, and safety, increased convenience for consumers, increases in participatory government, and improved public and private decision-making generally. However, increased use of detailed databases and processing capabilities also poses threats to the ideals of democracies and rights of individuals - the ideals of freedom, security, privacy, and open and free access to government. As we continue to move toward global economies and international networked environments, the need to reconcile competing social, economic, and political interests in digital geographic data will greatly expand. This conference brings together legal and information policy experts with geographic information system specialists to explore four interrelated aspects of information law critical to the handling of geographic information: namely, (1) intellectual property rights in spatial databases, with particular emphasis on copyright; (2) access rights of citizens to publicly held information, including the policies of government agencies in charging for geographic data; (3) protecting personal privacy in using geographic information systems; and (4) liability in connection with the use, sharing, and distribution of GIS data and analysis results. PRELIMINARY PROGRAM Friday, October 28 Welcome and Introduction (7:45 am - ASU Law School, Pedrick Great Hall) Access to Government's Spatial Information I (8:00 a.m.) Moderator: Robert Reis, NCGIA and School of Law, SUNY-Buffalo Establishing a Legal Setting and Organizational Model for Affordable Access to Government Owned Information Management Technology Hugh Archer, Executive Consultant Plangraphics, Inc., Frankfurt, Kentucky A Case for Commercialization of Government Information Products and Services Lori Peterson Dando, Esquire County Attorney's Office (former), Hastings, MN Spatial Databases and Information Policy: A British Perspective David Rhind, Director Ordnance Survey, United Kingdom Question and Answer Session Intellectual Property Rights in Spatial Databases I (9:00a.m.) Moderator: Helen Sharretts-Sullivan, Office of the General Counsel, Defense Mapping Agency Copyright, Licensing, and Cost Recovery: A Legal, Economic, and Policy Analysis William Holland, Executive Director Wisconsin Land Information Board, Madison, WI Surveyors' Copyright in Plans of Survey: Law and Policy John D. McLaughlin, Geographical Engineering and Norman Siebrasse, College of Law, University of New Brunswick, Fredericton Canada Copyright in Electronic Maps Dennis S. Karjala College of Law, Arizona State University Question and Answer Session Break (Coffee, tea, etc.- College of Law Lobby) (10:00 am) Intellectual Property Rights in Spatial Databases II (10:30 am) Moderator: Elaine Albright, Chair, American Library Association Committee on Telecommunications Rights in Government-generated Data Jessica Litman School of Law, Wayne State University Lessons from the Past: Legal and Medical Databases Anne Wells Branscomb Program on Information Resources Policy, Harvard University European Community Directive on Databases Pamela Samuelson School of Law, University of Pittsburgh Question and Answer Session Access to Government's Spatial Information II (11:30 a.m.) Moderator: Dorthy Chambers, J.D., Chief, Branch of Information Access Policy and Coordination, Bureau of Land Management A Review of Alaska's Public Information Access Laws Representative Kay Brown Alaska Legislature, Anchorage, Alaska Issues Concerning Access to Electronic Records Barbara Petersen, Staff Attorney Florida Legislature Joint Committee on Information Technology Resources Federal Information Dissemination and Pricing Policy Peter Weiss, Senior Policy Analyst Office of Management and Budget, Washington, D.C. Question and Answer Session Lunch (12:30 pm - Several eating places within walking distance) Access to Government's Spatial Information III (2:00 pm) Moderator: Earl Epstein, J.D., School of Natural Resources, Ohio State University Effects of Data Policies on the Evolution of the National Spatial Data Infrastructure Nancy Tosta, Staff Director U.S. Federal Geographic Data Committee The Public Interest and the Cost of Government Information: Experience Under the Federal FOIA David Sobel, Legal Counsel Electronic Privacy Information Center, Washington D.C. Promoting a Free Access, Minimal Cost-recovery, Royalty Arrangement for State Held Geographic Information Systems Keene Matsunaga, Esquire, and Jack Dangermond, President, Environmental Systems Research Institute and Prudence Adler, Assistant Director, Association of Research Libraries Question and Answer Session Access to Government's Spatial Information IV (3:00 p.m.) Moderator: Frederick K. Ganyon, J.D., Deputy Chief, Nautical Charting Division, NOAA The Value of Geographic Information. A review of international policies in cost recovery, privatization and commercialization of information gathering and dissemination. Krysia Rybaczuk and Michael Blakemore Mountjoy Research Centre, University of Durham, United Kingdom Remote Sensing Law: Obstacle or Opportunity for GIS? Joanne Gabrynowicz, Associate Professor - Remote Sensing Law and Policy Department of Space Studies, University of North Dakota Implications of Increased Access to Geographic Information Dr. Ronald Abler, Executive Director Association of American Geographers Question and Answer Session Break (4:00 p.m. - coffee, tea, soft drink - College of Law lobby) Liability for Spatial Data I (4:30 p.m.) Moderator: Daniel Strouse, Director, Center for the Study of Law, Science, and Technology, ASU College of Law Tort and Criminal Liability as a Function of the Right to Control Content Henry Perritt, Professor of Law Villanova University School of Law Local Government Liability for Erroneous Data: Law and Policy in a Changing Environment R. Jerome Anderson, Esquire, and Alan R. Stewart, Esquire Plangraphics, Inc., Frankfurt, Kentucky A Case Study in the Misuse of GIS: Siting a Low-Level Radioactive Waste Disposal Facility in New York State Mark Monmonier, Department of Geography Syracuse University Question and Answer Session Saturday, October 29 Liability for Spatial Data II (8:00 a.m.) Moderator: t.b.a. Liability for GIS Datasets as applied to the Commercial, Non- profit and Other Private Sectors Bishop Dansby, Esquire GIS Law and Policy Institute Exploitation of Intellectual Property: Liability, Retrenchment and a Proposal for Change Edward J. Obloy, General Counsel, and B. Helen Sharretts- Sullivan, Defense Mapping Agency Certification of GIS Databases: Reliance and Liability Implications Lawrence Ayers, Executive Vice President and Cliff Kottman, Exec. Manager of Federal Systems, Intergraph Corporation Spatial Data Analysis in the Formation of Public Policy and its Acceptance as Evidence: A Litigator's Perspective on Geographic Information and Analysis Terry Simmons, PhD, Attorney at Law Reno, Nevada Question and Answer Session Protecting Privacy in Using Geographic Information Systems I (9:15 a.m.) Moderator: Lawrence Winer, College of Law, ASU In Plain View: Geographic Information Systems and the Problem of Privacy Michael R. Curry Department of Geography, UCLA Privacy and the Intersection of Geographic Information and Intelligent Vehicle Highway Systems Sheri Alpert and Kingsley Haynes The Institute of Public Policy, George Mason University Privacy: Alternative Protection Scenarios Dr. David Flaherty Information and Privacy Commissioner of British Columbia Question and Answer Session Break (10:15 - Coffee, tea, juice & rolls - College of Law Lobby) Protecting Privacy in Using Geographic Information Systems II (10:45 am) Moderator: t.b.a. Fair Information Practices of the Information Industry Steven Metalitz Information Industry Association, Washington DC Marketing Community Perspectives on Protecting Privacy Tom Gordon, President and General Manager Equifax National Decision Systems, San Diego CA European Perspectives on Protection of Privacy Charles D. Raab, Department of Politics University of Edinburgh, Scotland Question and Answer Session Protecting Privacy in Using Geographic Information Systems III (11:45 a.m.) Moderator: t.b.a. Some Information Age Techno-fallacies and Some Principles for Protecting Privacy Gary Marx, Chair Department of Sociology, University of Colorado-Boulder Protecting Indigenous Peoples' Privacy from "Eyes in the Sky" Wayne Madsen Computer Sciences Corporation, Fairfax, VA Protecting Privacy in Using Geographic Information Systems Harlan J. Onsrud, Jeff Johnson, and Xavier Lopez NCGIA, University of Maine, Orono, Maine Question and Answer Session Closing Announcements (12:45 p.m.) ****************************************************** REGISTRATION FORM Maximum registration will be 250 participants NO ON-SITE REGISTRATION [ ] Full Registration (before October 3) $145 (after October 3) $195 [ ] Student Registration $70 Name: __________________________________ Title: ___________________________________ Affiliation: ______________________________ Address: ________________________________ ________________________________________ ________________________________________ ________________________________________ Phone: __________________________________ FAX: ___________________________________ Email: __________________________________ Make check payable (in US dollars) to: University of Maine and send to: Conference on Law and Information Policy for Spatial Databases NCGIA 5711 Boardman Hall, Rm. 348 University of Maine, Orono, Me 04469-5711 ****************************************************** LOCATION & TRANSPORTATION The conference will take place on October 28 and the morning of October 29, 1994 in the Pedrick Great Hall at the Arizona State University College of Law. The conference has been scheduled to follow immediately GIS/LIS '94 in Phoenix, Arizona. Those attending GIS/LIS and then staying on for this conference should be able to take advantage of reduced airfares because of the Saturday night stay over. The College of Law in Tempe is located approximately ten miles from downtown Phoenix or five miles from the airport. Taxis and hotel shuttles are convenient and moderately priced. For those traveling by car, take the University Avenue exit on Interstate 10 and head east to the ASU campus. The campus is immediately adjacent to Old Town Tempe which contains numerous restaurants and shops within easy walking distance. COOPERATING ORGANIZATIONS American Bar Association Section of Science and Technology American Congress on Surveying and Mapping American Society of Photogrammetry and Remote Sensing AM/FM International Association of American Geographers Computer Professionals for Social Responsibility Federal Geographic Data Committee Information Industry Association National States Geographic Information Council Urban and Regional Information Systems Association CONFERENCE SUPPORTERS Federal Agencies: Bureau of Land Management Coast and Geodetic Survey Defense Mapping Agency Federal Geographic Data Committee Environmental Systems Research Institute Equifax National Decision Systems Intergraph Corporation FOR FURTHER INFORMATION Conference on Law and Information Policy for Spatial Databases 5711 Boardman Hall, Rm 348 University of Maine, Orono, Maine 04469-5711 Phone: (207) 581-2149 Fax: (207) 581-2206 E-mail: ncgia(a)mecan1.maine.edu ___________________________________________ Harlan J. Onsrud National Center for Geographic Information and Analysis 5711 Boardman Hall, Rm. 348 University of Maine Orono, Maine 04469-5711 Phone (207) 581-2175 FAX (207)581-2206 E-mail: onsrud(a)mecan1.maine.edu

1 0

Re: "Packet Sniffers"
by Oluf Bagger 17 Dec '03

17 Dec '03

You should tell the staff at your campuss that a Linux box is no greater threat than any of those PC's used for word processing. A packet sniffer can hide itself as a resident program on a doze box and collect data into a data file. Such a program can be installed by any user on the doze box or even spread as a virus. On a Linux box only root programs have access to the ethernet driver. Any packet sniffer programs can therefore only be installed by root. On a Linux box you only allow access to known users and you have log files stating when users have logged in and out. If the machine have been abused in some way you can trace the problem using the log files. Best Regards, Oluf -------------------------------------------------------------------- Oluf Bagger, Eurochip DTU. tlf: +45 4593 3332 lok. 5722 fax: +45 4593 0216

1 0

RC4
by schneier＠chinet.chinet.com 17 Dec '03

17 Dec '03

It occurs to me that if the code has not been posted to sci.crypt, then some cypherpunks reader outside the US/Canada should do so. Bruce

2 1

Re: RC4
by HALVORK＠sofus.hiof.no 17 Dec '03

17 Dec '03

>It occurs to me that if the code has not been posted to sci.crypt, then >some cypherpunks reader outside the US/Canada should do so. > >Bruce Ops... I never saw this original posting. Could somebody please re-post it? Please include RC4 in the Subject. - Halvor Kise jr. (from Norway (

2 1

RC4 Source Code
by Tom Rollins 17 Dec '03

17 Dec '03

Hello, Strange, I didn't see the RC4 code at my site. Would someone that saved it please E-mail me a copy. Thanks, Tom Rollins <trollins(a)debbie.telos.com>

1 0

PGP on Multiuser machines
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 4:25 PM 9/12/94, SAMUEL KAPLIN wrote: >It's highly doubtful that they could physically get to my computer without >my knowledge. I service alarms for a living. I work for the company who >monitors my alarm. I am the only person who knows the specs on my alarm. It >would be pretty tough to conceal a court order to suspend the monitoring >from me. Someone would tip me off. Plus the system will communicate with >me via 2 other methods that no one knows about. Pretty doubtful. But they *could*. It would involve a lot of work, but theoretically, they could, right? That still puts it in the catagory of "trade off." Besides, I suspect your situation isn't a common one. ;-) >I guess it depends on your level of paranoia or guilt. :) If I was just >putzing around with the software, then I wouldn't be too concerned. If I >was actually doing something illegal or confidential with the software >then I would be greatly concerned. But under no circumstances would I >consider that arrangement secure. If the cops nail this guy, he has no one >to blame but himself. He hanged his own ass. I don't consider myself "putzing" around with the software. Besides the fact that the more encrypted messages are out there, the less "suspicious" one becomes, I send things like credit card numbers and the like via email. Nothing that would embarass me, but not something I like to have floating around. >Then you have the possibility of people sending you secure messages on a >compromised key. (The one on the Unix Box) In most cases, its not the >technology that nails you, it's human error. Take for example the recent Good point. Although I would hope that if I were doing something nefarious, I would have smarter partners than that. :-) Bob -- Bob Snyder N2KGO MIME, PGP, RIPEM mail accepted snyderra(a)post.drexel.edu PGP & RIPEM keys on key servers When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: RC4
by Derek L Davis 17 Dec '03

17 Dec '03

Text item: Text_1 I didn't see the RC4 post either (subject didn't catch my eye) and now its gone. Anyone care to repost??

1 0

PGP2.6.1
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

----- Begin Included Message -----

1 0

Re: RC4
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

>Ah. So the odd subject line resulted in many people not seeing. I don't >know if any US residents would be willing to repost. I'm not. > >Bruce Would you be willing to post simply the subject line and the date of the posting? Many of us may be able to find the post with that information. Doug

2 1

Alleged RC4 source code (message header only)
by sommerfeld＠orchard.medford.ma.us 17 Dec '03

17 Dec '03

In case any of you had filtered this one out based purely on sender and subject, I've enclosed the *headers* of the message and its first paragraph. The message also contained two source files, "rc4.h" and "rc4.c", implementing a stream cypher which is based on incremental shuffling of a permutation of the numbers 0..255, and seems to be fairly well-suited for efficient implementation in software. For obvious reasons, I'm not including the source files here. ------ Date: Fri, 9 Sep 1994 22:11:49 -0500 Message-Id: <199409100311.WAA12423(a)jpunix.com> To: cypherpunks(a)toad.com From: nobody(a)jpunix.com Subject: Thank you Bob Anderson Remailed-By: remailer(a)jpunix.com Complaints-To: postmaster(a)jpunix.com Sender: owner-cypherpunks(a)toad.com Precedence: bulk SUBJECT: RC4 Source Code I've tested this. It is compatible with the RC4 object module that comes in the various RSA toolkits. ------

1 0

Re[2]: RC4
by Davis, Derek L 17 Dec '03

17 Dec '03

The RC4 post was subjected: "Thanks to Bill ..." (I think) My copy is gone, but someone must still have it. Please repost at least to cypherpunks. Thanks. The following mail header is for administrative use and may be ignored unless there are problems. ***IF THERE ARE PROBLEMS SAVE THESE HEADERS***. Precedence: bulk Sender: owner-cypherpunks(a)toad.com Cc: cypherpunks(a)toad.com Subject: Re: RC4 From: doug(a)OpenMind.com (Doug Cutrell) To: schneier(a)chinet.chinet.com (Bruce Schneier) Date: Tue, 13 Sep 1994 08:35:40 -0700 Content-Type: text/plain; charset="us-ascii" Mime-Version: 1.0 Message-Id: <aa9b76e41c02100329f9(a)[198.211.130.8]> X-Sender: doug(a)bluesky.openmind.com Received: from [198.211.130.8] by BlueSky.OpenMind.com (Mercury 1.12); Tue, 13 Sep 94 8:32:16 -700 Received: from MAILQ by OPENMIND (Mercury 1.12); Tue, 13 Sep 94 8:32:22 -700 Received: from OPENMIND/MAILQ by BlueSky.OpenMind.com (Mercury 1.12); Tue, 13 Sep 94 8:32:47 -700 Received: from BlueSky.OpenMind.Com by beeblebrox.tbyte.com (NX5.67d/NX3.0M) id AA10087; Tue, 13 Sep 94 08:32:47 -0700 Received: from beeblebrox.tbyte.com by toad.com id AA27882; Tue, 13 Sep 94 08:40 Received: by toad.com id AA27888; Tue, 13 Sep 94 08:40:13 PDT Received: from toad.com by relay2.UU.NET with SMTP id QQxhet29743; Tue, 13 Sep 1994 11:45:12 -0400 Received: from relay2.UU.NET by hermes.intel.com (5.65/10.0i); Tue, 13 Sep 94 08 Received: from hermes.intel.com by ormail.intel.com with smtp (Smail3.1.28.1 #12) id m0qka63-000MNxa; Tue, 13 Sep 94 08:48 PDT Received: from ormail.intel.com by relay.jf.intel.com with smtp (Smail3.1.28.1 #2) id m0qka64-000twca; Tue, 13 Sep 94 08:48 PDT

1 0

e$: WSJ, CyberCash, and the Falling Barometer
by rah＠shipwright.com 17 Dec '03

17 Dec '03

On the front page of today's (9/13/94) Wall Street Journal Marketing section (Page B-1, lower right hand column) is an article about internet commerce. It talks about a group of companies who formed a consortium called CyberCash. The companies and players include the guy who started Interop, and RSA. They are claiming the ability to do credit cards and bank drafts and they say they are in negotiations with Chaum about licencing digital cash. Anonymity was specifically mentioned as a distinguishing marketable feature of digital cash. They still don't get it, but they will soon enough, I suppose. BTW, there was a veiled reference to Bibliobytes(?). At least the WSJ got their story straighter than the Times did. Like I said before, Secure Mosaic meant that "Wallets" and "Cash Registers" for digital cash were imminent. They're not imminent anymore, they're here, and they were just announced at Interop this week. I should have realized something was up, the barometer was falling at a pretty good clip. It started when I was chatting offline with someone from buyinfo and they said that they were under non-disclosure about something very big, but that I would know about it when Interop opened. Then, last Tuesday, I got an interesting cold call from a stringer for a largeish venture capital outfit in Menlo Park. He was doing due dillegence and wanted to ask me some questions about Internet Commerce, and in particular, about digital cash. I told him what I knew, and referred him to some of the senior members of these lists for much better information. I bent his ear a bit about off-line cash underwriting, and I hope it's healing now. I also sent him all of the traffic I had archived since I subscribed to cypherpunks having to do with the internet and the economics thereof. He had the buyinfo and imp-interest archives already. He seemed to think a "schmooze" conference on e$, including invitations to all the usual crypto suspects, plus people in financial operations, regulatory, political, and the institutional investor community might be a good idea. When I came back from a hike(!) in the White Mountains this weekend, I found at long last a reply to my query to DigiCash, Inc. for information. I answered the beta test questionnaire they sent me and sent it back. The barometric pressure was going down very fast all last week, and I didn't even realize it until this morning. My wife got a membership at the Harvard club. A couple of months ago we decided it was time for me to exercise (I push 350), so I work out in the morning there and walk back to the office in my house here in Roslindale (about 7 miles) about 3 or 4 times a week. (ever see the senior senator from Massachusetts' bare butt? You will... at the Harvard Club) This morning, when I looked at the Journal in the locker room, I let out a whoop. (not from seeing Teddy. From seeing the WSJ e$ article.) I was born in El Paso. I whoop a lot. Everyone in the locker room looked at me like I was from Yale, or something. Jeez. I hope we don't get blackballed. A very happy Tuesday to you all, Bob Hettinga Oh. If anyone's crazy enough to want to work on the technology part (development and integration and eventual operations) for very small startup offline digital cash underwriter, let me know. I've already started talking to a finance guy and a (very) part-time treasury management person. It also looks like the legal stuff has been figured out, or CyberCash wouldn't have done a triple-gainer into the pool like that. Any job offer would be contingent upon funding, of course. ;-). ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Int'l Workshop on Electronic Commerce
by LAURENN%smtpgate＠earth.wri.org 17 Dec '03

17 Dec '03

With all the discussion relating to financial transactions on this list, I thought I'd forward the following call for papers that appeared in INFOSYS this weekend. -- LaurenN(a)wri.org * CALENDAR OF UPCOMING EVENTS * *The INFOSYS Calendar of Upcoming Events is updated * *fortnightly and can be obtained in the following ways: * * * *--E-mail: send the following one-line message to * * listserv(a)american.edu: get infosys calendar * *--FTP: anonymous FTP to ftp.american.edu; file is \infosys\ * * infosys.calendar * *--Gopher: gopher to auvm.american.edu; choose INFOSYS * *--WWW: http://gopher://auvm.american.edu/INFOSYS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ** 0298* * * * * * * * * * * * * * * * * * * * * * * * * * * * ** CALL FOR PAPERS - International Workshop on Electronic Commerce Richard Holowczak, Rutgers Univ <holowcza(a)andromeda.rutgers.edu> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ACM International Workshop on Electronic Commerce In conjunction with The Third International Conference on Information and Knowledge Management (CIKM'94) December 2, 1994 National Institute of Standards and Technology (NIST) Gaithersburg, Maryland OBJECTIVE The workshop will provide an international forum to discuss evolving research issues and applications in the area of Electronic Commerce. Invited speakers from industry, universities and government will present their experiences and vision for the future. The Workshop will begin with a kick-off dinner on Thursday, December 1 evening and a full program on Friday, December 2. The final version of the papers will be included in an edited book that will be published by Springer Verlag as part of its Lecture Notes Series on Computer Science. INFORMATION TO AUTHORS Authors interested in participating in the workshop are invited to submit 2-3 page abstract by October 10 to: Prof. Nabil R. Adam Rutgers University 180 University Avenue Newark, NJ 07102 Fax: (201) 648-1459 E-mail: ecomm(a)adam.rutgers.edu Notification of acceptance will be sent by October 25. * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ABOUT INFOSYS INFOSYS is an electronic newsletter for faculty, students, and practitioners in the field of Information Systems. INFOSYS publishes news items, requests for assistance, announcements of professional meetings and conferences, position notices, a calendar of upcoming events, comments on recent publications, abstracts of papers that authors are willing to share, and other items of interest to the Information Systems community. INFOSYS is published biweekly, more frequently if volume requires it. INFOSYS operates as an electronic mailing list on listserv software at American University in Washington, DC. The editor is Dennis W. Viehland <d.viehland(a)massey.ac.nz>. To subscribe to INFOSYS send the following one-line electronic mail message to listserv(a)american.edu (Internet) or listserv@auvm (Bitnet): subscribe infosys yourfirstname yourlastname (e.g., subscribe infosys John Smith). You will receive a welcome letter that will tell you more about INFOSYS and listserv. Guidelines for submitting articles to INFOSYS are published in the Welcome message each new subscriber receives (or e-mail "GET infosys welcome" to listserv(a)american.edu) Send articles to infosys(a)american.edu or d.viehland(a)massey.ac.nz. * * * * * * * * * * * * * * * * * * * * * * * * ------------------------------ End of NEWSLTR Digest - 12 Sep 1994 to 13 Sep 1994 - Special issue ******************************************************************

1 0

cybercash
by perry＠imsi.com 17 Dec '03

17 Dec '03

Well, this looks interesting, especially given Steve Crocker's involvement being listed in the article... $whois cybercash.com Trusted Information Systems, Inc. (CYBERCASH-DOM) 3060 Washington Road Glenwood, MD 21738 Domain Name: CYBERCASH.COM Administrative Contact, Technical Contact, Zone Contact: Crocker, Stephen D. (SDC4) crocker(a)TIS.COM (301) 854-6889 Record last updated on 30-Aug-94. Domain servers in listed order: NS.TIS.COM 192.94.214.100 NS.LA.TIS.COM 198.147.66.1 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's).

1 0

Re: alleged-RC4
by Hal 17 Dec '03

17 Dec '03

Bill Sommerfeld <sommerfeld(a)orchard.medford.ma.us> writes: >Actually, all the %256 operations in the code are superfluous on >8-bit-byte platforms since the indices are declared as `unsigned >char'. Ah, good point. So my "typo" doesn't really matter (although I think it is a typo.) >Probably the only potential weakness I can see is that the `x' and `y' >counters are always initialized to zero when starting off; this means >that an attacker can almost always know the `x' value used to encrypt >each byte of cyphertext they find. I can't see any way to exploit >this, though. It would seem that you could (slightly) strengthen the >cipher by starting with x=state[0] and y=state[1], then cranking the >key generation loop for two more iterations.. A related point is how the key-dependent state-table permutation is set up. The algorithm is, in pseudo-code, for i from 0 to 255 swap state[i] and state[j] where j is incremented by state[i] plus the next key byte, mod 256. Notice the similarity to the naive random-permutation generator: for i from 0 to 255 j = random (256) swap state[i] and state[j] where random (n) returns a random number less than n. This naive algorithm is not quite right, as it generates 256 to the 256th power equally likely arrangements, when there are actually only 256! arrangements and 256! doesn't even divide 256^256 evenly. The similarity I see is that j is chosen in the prepare_key as a slightly complicated function of the key byte and the current state, and we can view this as a key-dependent substitute for random (256). So it would appear that the prepare_key algorithm, even with a fully random key, may produce a bias in the permutation table. A correct algorithm for a random permutation is: for i from 0 to 255 j = random (i+1) swap state[i] and state[j] Here we choose the random number from among the ones we have already done. This algorithm can be easily proven correct. Perhaps it would be better if the prepare_key algorithm did a similar thing, choosing the entry with which to swap modulo the current "i" value plus one rather than mod 256. One implication of the existing implementation is that there may be a simple relation between at least state[0] and the first character of the key. Initially state[0] will be swapped with the value in the table at the position of the first byte of the key. Since the table is initialized to 0..255, this means that state[0] will hold the value of the first key byte after that swap. Now, it is probable that state[0] will be chosen "randomly" to be swapped with a later entry in the table. But as we discussed here a few days ago, there is about a 1/e chance (about 37%) that it will not be swapped after its first guaranteed swap. This means that 37% of the time that this algorithm is used, state[0] holds the first key byte at startup. OTOH if the modification I suggested above were made, no such conclusion could be drawn and I don't see anything simple you could say about the likely permutation after prepare_key is complete. Now, having said this, I don't see any way to exploit this knowledge to attack the cypher. The "lookup, sum, and lookup" structure of the cypher has too many degrees of freedom to allow this information about state[0] to expose a hint of what the key might be, as far as I can see. But it is an interesting aspect of the key setup, nevertheless. Hal

2 1

Key Signing Party?
by John L Tocher 17 Dec '03

17 Dec '03

Anybody interested in having a key signing party in the Los Angeles area? John Tocher Tocher(a)Igate1.HAC.com

1 0

Crackdown in Queensland, Australia?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

When I saw the Sunday Mail post here on Queensland's prpposed crackdown on cyberspace (for _child pornography_ if you please! I hereby decree that a concerted effort must be made by all to increase the pedophile population of the Net from 97% to 100% - universal coverage. All new subscribers must provide oridinal photographs as evidence of their tendencies before being given a connection), I thought I'd ask Ian Peter himself. Ian Peter, who is quoted in the article and whom I met in February, replied: > Re the Qld stuff - there really are no firm details yet, its proposed > legislation and may well change before becoming law - and the journos > concerned are going on rumnours because no copies of the legislation are > available yet. > > So it's wait and see! > > [... Ian Peter] ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Mailing list for cryptography
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)imsi.com>: > I'm thinking (again) about setting up a specialized mailing list for > discussing cryptography... While I agree with Perry's implication that the CP list does tend to go off track rather often, it _was_ set up specifically to bring together the social and technical aspects of cryptography, and does generate useful discussion on occasion ;-] If you want to discuss only cryptography, there's always sci.crypt... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

Social body and crypto
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I enjoyed Doug's clear statement on the implications of crypto anarchy on society. It should be compulsory reading for all newbies so that they don't get worried next time Larry Detweiler comes bouncing in raving about EVIL LIES MURDER and pseudospoofing. I'd like to point out, however, that crypto anarchy poses no threat whatsoever to personal or corporate relationships based on physical or other concrete identity (truenames). It just makes these relationships _voluntary_ - no one's _forcing_ you to be anonymous. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: Distribution of FAQ to CompuServe, American Online, etc.
by jazz＠hal.com 17 Dec '03

17 Dec '03

I considered suggesting that I strip Tim's email address out of the text; then I realized there are probably dozens of copies of it scattered through the document. Even if the Cyphermonicon were written by Sy Ferpunq and not by Tim, there are enough email addresses in the body of the document that this wouldn't save him from email. Completely sanitizing the document with respect to contact info (i.e. using names/nyms only and no addresses) would be something of a project. And it still wouldn't help. The only counterpoint I could make is that CompuServe users are unlikely to join cpunks (too much mail == too much money) and the service is illequipped to help a member find an internet mail address for a person given just a real name. Sanitization might be enough in that environment. Jason

1 0

Re: Mailing list for cryptography
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>"Perry E. Metzger" <perry(a)imsi.com>: >> I'm thinking (again) about setting up a specialized mailing list for >> discussing cryptography... > >While I agree with Perry's implication that the CP list does tend to go off >track rather often, it _was_ set up specifically to bring together the >social and technical aspects of cryptography, and does generate useful >discussion on occasion ;-] > >If you want to discuss only cryptography, there's always sci.crypt... > Snicker, snicker. What planet are *you* living on? :-) The only reason it's sci._crypt_ is because that's what 90% of the flame-fests get started on. I'd guesstimate that only 1 posting in 100 is actually about crypto, or some directly crypto-related matter. The rest of it is S*****light vs. The World name-calling and character assassinations. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

RC4 ?
by nobody＠vox.xs4all.nl 17 Dec '03

17 Dec '03

SUBJECT: RC4 Source Code I've tested this. It is compatible with the RC4 object module that comes in the various RSA toolkits. /* rc4.h */ typedef struct rc4_key { unsigned char state[256]; unsigned char x; unsigned char y; } rc4_key; void prepare_key(unsigned char *key_data_ptr,int key_data_len, rc4_key *key); void rc4(unsigned char *buffer_ptr,int buffer_len,rc4_key * key); /*rc4.c */ #include "rc4.h" static void swap_byte(unsigned char *a, unsigned char *b); void prepare_key(unsigned char *key_data_ptr, int key_data_len, rc4_key *key) { unsigned char swapByte; unsigned char index1; unsigned char index2; unsigned char* state; short counter; state = &key->state[0]; for(counter = 0; counter < 256; counter++) state[counter] = counter; key->x = 0; key->y = 0; index1 = 0; index2 = 0; for(counter = 0; counter < 256; counter++) { index2 = (key_data_ptr[index1] + state[counter] + index2) % 256; swap_byte(&state[counter], &state[index2]); index1 = (index1 + 1) % key_data_len; } } void rc4(unsigned char *buffer_ptr, int buffer_len, rc4_key *key) { unsigned char x; unsigned char y; unsigned char* state; unsigned char xorIndex; short counter; x = key->x; y = key->y; state = &key->state[0]; for(counter = 0; counter < buffer_len; counter ++) { x = (x + 1) % 256; y = (state[x] + y) % 256; swap_byte(&state[x], &state[y]); xorIndex = state[x] + (state[y]) % 256; buffer_ptr[counter] ^= state[xorIndex]; } key->x = x; key->y = y; } static void swap_byte(unsigned char *a, unsigned char *b) { unsigned char swapByte; swapByte = *a; *a = *b; *b = swapByte; }

1 0

Finger me for MEDUSA
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Sorry I took so long. It's hard having much time left over after getting a job as a novell network administrator (though it's lots of fun.) Anyway, for anyone who is interested in Medusa, I hope you can use finger. If you can't, we'll arange something else... Anyhow, just pipe the output of finger to uudecode in the background and that should do the trick... ie: finger rarachel(a)photon.poly.edu | uudecode And hope it works. This should generate a file called medusa1b.zip which is a beta version complete with sources. Sometime in the future, I will ftp this program to the usual sites... But first I need some free time. :-)

1 0