December 2003 - cypherpunks-legacy

Re: Patents on RSA will expire soon....
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> The algorithm that factored RSA129 takes about exp(sqrt((log n)(log log > n))) steps. > Indeed 10^17 instructions is just about how much work was required to > factor RSA129--. > That formula gives about 10^29 for a 1024 bit number. If computers double > in speed every 18 months then they will be only 32 times as fast when the > patents expire. If that rate of speedup held long term, and no significantly better factoring algorithms showed up, it would be 60 years until a 1024 bit number were as easy to factor as RSA129 was this year. -fnerd - - - - - - - - - - - - - - - and i dreamed i was flying high up above my eyes could clearly see the statue of liberty sailing away to sea --Paul Simon -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

2 1

NIST Good Intentions
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> [Clipper] is not intended to be mandated in the future, a [NIST] > official said today in congressional testimony. Paving the superhighway to Hell, of course. -fnerd quote me - - - - - - - - - - - - - - - and i dreamed i was flying high up above my eyes could clearly see the statue of liberty sailing away to sea --Paul Simon -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

MBone map - updated...
by lile＠netcom.com 17 Dec '03

17 Dec '03

The last version has been updated and can be found in ftp://ftp.isi.edu/mbone/mbone-topology.ps -lile

1 0

Estimating Population Summary
by ritter＠io.com 17 Dec '03

17 Dec '03

Summary of: Estimating Population from Repetitions in Accumulated Random Samples In the latest (April 1994) issue of Cryptologia, I describe the development of a new technique for the statistical estimation of population. An example of such a problem would be estimating the number of different values or codes produced by a physically- random number generator. Background This work is an outgrowth of a sci.crypt discussion in early 1992 in which Nico de Vries promoted as "physically-random" a computer program which made use of variations between software and "IBM PC" hardware timing. It was difficult to know how one could determine the amount of "state" (and, thus, the limit of "randomness") in such a mechanism. Ross Anderson suggested measurement using the "birthday paradox." The Experimental Procedure The experimenter will obtain a value from the RNG and save it, repeating this for some fixed number of random samples, a "trial." Each new sample must be compared to all previous samples to see if there is a match or "exact double." (The birthday paradox does not apply to those statistical RNG's which are designed to produce a sequence without value repetition.) A trial contains enough samples if, on average, it produces a few doubles. About 2.5 or 3 Sqrt(N) samples will be needed, given population N, but N is the value we wish to measure. Producing and saving N samples may not be trivial. Exact Repetitions In a single trial, if we find two occurrences of some value, we have a single level-two "repetition"; this is an "exact" repetition count. But if we then find another occurrence of the same value, we have a level-three repetition and no level-two repetitions. Note how increased information (another occurrence) results in reduced effectiveness in the level-two measurement statistic. Expectations Classical binomial equations can predict the number of expected exact repetitions for a given population and number of samples. But these equations are extremely difficult to reverse for use in predicting population. Trying to use these equations with numerical root-finding techniques produces ambiguous results, as there are generally multiple roots. Equations which _estimate_ the probability of repetitions are well known, but it was not previously clear how accurate these would be, how they could be used effectively, what they would mean in random sampling distribution, or how they could be generalized to higher repetition levels. Augmented Repetitions I have found a new, simple, exact, and easily-reversed combinatoric relationship between population and a value which I call "augmented repetitions." An "augmented double" consists of the number of exact doubles (exactly two samples which have the same value), _plus_ contributions from exact triples, exact quads, etc. An exact triple may be seen as three doubles: There are three ways in which an exact triple may produce exact doubles. Therefore, for augmentation purposes, a triple should count as three augmented doubles. Similarly, a quad or exact 4-rep may be 4 seen as ( ) or 6 doubles, the number of combinations of four 2 things taken two at a time. When we do this, we find that simple equations predict the result _exactly_. Thus, the number of augmented repetitions at the kth level (k = 2 means doubles), given r exact repetitions at level i is: i n i ar = SUM ( ) r . k i=1 k i (This is equation 2.3 which very unfortunately was printed incorrectly in the article.) That is, we multiply the number of exact matches at each level by the effective number of matches each could produce at the lower level, and accumulate an overall sum. Augmented Doubles and Population Given population N, the expected number of augmented doubles Ead found in s samples is _exactly_: s (s - 1) Ead(N,s) = --------- . 2 N Given population N = 10,000 (so Sqrt(N) = 100), we can show the expected number of augmented doubles for various numbers of samples: s Ead ----------- 100 0.495 150 1.118 200 1.990 250 3.113 300 4.485 400 7.980 The formula implies, of course, that the population N is related to augmented doubles ad and samples s as: s (s - 1) Nad(s,ad) = --------- 2 ad which is the desired simple form for estimating population. Distribution A major issue in population measurement is the fact that the number of augmented doubles varies greatly over similar trials on the exact same population. Thus, a single trial is essentially meaningless for estimating population. Experiments indicate that various numbers of augmented doubles occur in Poisson distribution over different trials, a result which also has theoretical support. Therefore, we should develop an arithmetic mean or expected value which is the Poisson parameter. The Poisson distribution is asymmetric, and changes radically for different expected values. In general it will be necessary to perform tens or hundreds of separate trials to develop an accurate mean for population estimation. It is worthwhile to accumulate the entire distribution (rather than just a simple mean), and compare that shape with the ideal shape of the Poisson distribution for the given mean. The Poisson distribution also gives us a way to talk about the probability of finding augmented doubles Ead: -Ead Pd(N,s) = 1 - e . So, for population N = 10,000: s Ead Pd ------------------ 100 0.495 0.39 150 1.118 0.67 200 1.990 0.86 250 3.113 0.96 300 4.485 0.99 400 7.980 0.9997 It is often stated that the birthday paradox predicts a match with the sample size s = Sqrt(N), but this value is actually a little small; the expected number of augmented doubles for s = Sqrt(N) is 0.5 (and there are at least as many augmented doubles as exact doubles). Thus, if we want one augmented double on average, we need something like s = 1.5 Sqrt(N) samples. But it is beneficial to move the Poisson distribution toward a symmetric Normal curve, so 2.5 Sqrt(N) or 3 Sqrt(N) are reasonable experimental minimums. The Advance A new statistically-exact combinatoric relationship has been found between population and value repetition in random trials. Since previous well-known estimates could be used for rough estimates, it is not clear that this is a breakthrough in practice. However, the identification of an applicable _exact_ relationship, and its expected distribution in random trials, is important in that it clarifies what we can expect to see in actual use. The paper starts with simple probability, limits itself to algebra and statistics, discusses the existing techniques for exact and other repetitions, and develops general expressions for augmented repetitions. It also has tables of all possible trials for some tiny populations, whose resulting repetition values correspond to predictions exactly. The paper also has some nice graphs of experimental results on larger populations, which show a real Poisson distribution in action, and tables show the effect of estimating population from the experimental results. --- Terry Ritter ritter(a)io.com

1 0

Enhanced One-time pad
by Duncan Frissell 17 Dec '03

17 Dec '03

What I love about the nets.... Part 1073 <New one time pad software announcement elided.> J > J >Thanks, Jim Pinson -Galapagos ^^^^^^^^^<--------------------------- J > jpinson(a)fcdarwin.org.ec J > J > J > DCF "Ergonomics is an important part of interface design" Proposed HyperForm "Document" standard: "The Ruger Mini-14 was based on the US Army's M-14 battle rifle. Make sure your Molecular Deposition Desktop Fabricator is turned on and click the buttons to produce some samples. ---------- ---------- ---------- l Mini l l 100 l l 2,000 l l 14 l l Round l l Rounds l l l l Drum l l .223 l ---------- ---------- ---------- --- WinQwk 2.0b#1165

1 0

*Here they come
by Gary Jeffers 17 Dec '03

17 Dec '03

Lefty reports some really nasty political facts in *Here they come about what constitutes sexual harassment. Would it be sexual harasse- ment to put up signs saying "DEATH TO THE POLITICALLY CORRECT" OR "DEATH TO STATISTS". Or, you could wear buttons or drop the phrases casually in conversations. It would surely be protected speech by the 1st Amendment. In case pressure was brought against you, you could just say "hey, I was only kidding." I think that we should think past behavior that bothers us in certain cases &, instead, think about the kinds of people who constantly sanction this behavior. When these people realized that we morally sanctioned their deaths, they would be less pushy. Or, at least, we could help redefine "hostile environment" for them. hey, its just a goof, Gary Jeffers

1 0

Re: *Here they come
by lefty＠apple.com 17 Dec '03

17 Dec '03

> Lefty reports some really nasty political facts in *Here they come >about what constitutes sexual harassment. Would it be sexual harasse- >ment to put up signs saying "DEATH TO THE POLITICALLY CORRECT" OR >"DEATH TO STATISTS". Or, you could wear buttons or drop the phrases >casually in conversations. It would surely be protected speech by the >1st Amendment. In case pressure was brought against you, you could just >say "hey, I was only kidding." > I think that we should think past behavior that bothers us in certain >cases &, instead, think about the kinds of people who constantly >sanction this behavior. When these people realized that we morally >sanctioned their deaths, they would be less pushy. Or, at least, we >could help redefine "hostile environment" for them. I doubt that there's a court in the land, not even in California, that would view the phrases "DEATH TO THE POLITICALLY CORRECT" or "DEATH TO STATISTS" as being sexual in nature. Beyond that, and I feel certain this will disappoint you, I haven't a clue as to what you're talking about. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Phantom Exchange public client list -------------------------------------------- aa <bb@cc> ... etc. Is there someone out there who would like to act as a broker (for a small fee, natch), so that I can maintain rigorous anonymity while trading? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCcAgUBLdFfwLhnz857T+PFAQGKiQQ49PT6XiiXCjcIt4TRRApXdom4iaKBYnTs hPbdYSm7Yo3tBbzluZwBH2zX3k2P48yO2Z3nSoMzQvtI7AW9761xzInDl7mvyTlu QBIT5glBrbFGFkUl5HFfAV4mpOnNoXRHRsxp7QvIZTT3vG9YrzH5FAi/7gjBQvyE h+V7MSBrF7vuhpAHs+5/ =SRWU -----END PGP SIGNATURE-----

1 0

Fwd>>Internet billing service
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

>Date: Wed, 11 May 1994 15:32:21 -0500 >Sender: Computer-assisted Reporting & Research <CARR-L(a)ULKYVM.LOUISVILLE.EDU> >Subject: Re: Fwd: Internet billing service [nontopical stuff deleted] > "A group of students in the M.S. program in Information Networking > at Carnegie Mellon University have designed and implemented a > prototype of an Internet Billing Service -- an electronic credit > card service for the Internet environment. The service provides > account management, authentication, access control, credit > verification, management reporting, billing and collection services > to network-based service providers." > >Two papers, in Postscript format, are available via anonymous ftp from >"netinfo.ini.andrew.cmu.edu", directory "pub/billing_server".

1 0

test please ignore
by Greg - Kucharo 17 Dec '03

17 Dec '03

this is a test..please ignore. -- Greg Kucharo kryten(a)shell.portal.com University of Maximegalon College of Computer Science This .sig contains much that is apocryphal,or at least wildly inaccurate.

1 0

encrypted telnet - care to assist this user?
by NetSurfer 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 11 May 1994 23:49:13 GMT From: Jon Zeeff <zeeff(a)ZIP.EECS.UMICH.EDU> To: Multiple recipients of list TCP-IP <TCP-IP%PUCC.BITNET(a)cmsa.Berkeley.EDU> Subject: encrypted telnet Does anyone have a telnet/telnetd that encrypts the conversation? Key management is not really a concern for my application.

1 0

Message Havens (research havens, remailer usage)
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > I saw it and thought it quite good. As to why nobody [...] > commented.... I wrote an essay on how the "bad posts drive out the > good," that is, the trivial chatter and net.repartee posts Well, I am glad somebody read my post, admist the heavy and sometimes irrelevant traffic... >being flaky (the "Joe College remailers." one might call them), these Ah, sorry about the mixup in nomenclature - I like "Joe College" as a name actually, reminds me of Snoopy ;) Funny, but I was going to describe something I've been kicking around for a while, something in between a remailer and a data haven (a different service I could try setting up after getting a slip connection, or on an existing account, etc.). But as I sifted through list mail today I see you did it for me! > 1. Investigate ways to create an "anonymous Web site," that is, a > WWW site that can be reached only through a system of remailers. > Actually, due to the slow response (else traffic analysis is a big > danger), this would be more like a "CryptoGopher." (But gopher is > being subsumed into the Mosaic/lynx model, I suspect, and will be > obsolete soon.) Actually, I based my idea on gopher and called it a "message haven". Basically, write some scripts which accept incoming mail and file it into a gopher accessible hierarchy. Then, anybody could connect up and browse for messages. For example, if you wanted to contact Pr0duct Cypher, you could encrypt a message with his key and send it to the message haven. Leave your own public key in the message and he can respond the same way. People could use anonymous remailers to send in messages, and use pseudonyms to protect their privacy. (The service would allow you to specify the name you want your message filed under, and both parties would have to agree on details such as this, etc. The haven could even accept digital cash - say by default messages are only kept for a day but you can pay for extensions.) An advantage would be no mail is sent out, so there (hopefully) won't be anybody complaining about receiving harrassing mail, a common objection to anonymous mail. Bandwidth may be saved (as opposed to sending to usenet or a mailing list to reach one person, all mail would just go to the haven). How is privacy preserved? Well, it's kinda ugly but you borrow a trick from Mr. Slippery ("True Names") and browse the entire message database, buffering all messages and later extracting what's relevant to you. This way even if gopher logs are kept, exactly what message interested you is undeterminable (since you read them all). If your net connection is monitored, no information can be derived since you took it all. (Note: this could be impractible, perhaps there is a better way?) The reason why I based this on gopher since I have some experience with gopher from helping the run the cypherpunks gopher site. Chael tells me that eventually all the files will be moved out of my home directory into the same directory used by anonymous ftp. Which would free up my disk space (running near quota ;) and allow people to retreive files with ftp. More important, I would have space to try some other crypto experiment, like this message haven. Why only messages? Largely due to disk space restrictions, I would hope that messages would tend to be short (shorter than 1000 graphic or sound files, etc.) Well, does this sound useful? Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdF4xoOA7OpLWtYzAQFwqgP+IccxFxK1fTb5YYzO+kJOt3CjJik0mdq+ pgJQr35wTgpOZb0vv5eEqUAzey870/IeWjP2m+0w90vh5oX9lbSrlkXlR3c+4jL8 6/kB2BqGQKi1ekbCWEg3v4heZPJaZxqG47sZ34xA0iHQ+D4nJIiQoF88WUNzkVzR b7PjQ779TME= =DdU5 -----END PGP SIGNATURE-----

1 0

Re: State Dept Response to my second CJ request
by Richard Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hal Finney mentions that the law is often forced to make absurd distinctions between OK and illegal acts, simply because the line must be drawn somewhere. It's a good point, and worth keeping in mind. It seems obvious to me that, for purposes of ITAR regs., the Dept. of State and Dept. of Defense here in the USA have drawn the line between printed text (OK) and ASCII text files on electronic media (illegal to export). Their line selection is probably based upon their interpretation of the self-contradictory ITAR regs. However, just because one part of "the law" has drawn a particular line, we shouldn't assume that line to be the final word. If we do indeed believe that electronic expression and electronic publishing are the moral and constitutional equivalents of paper publishing, there should be no line at all. A lawsuit could force the line-drawers to officially recognize this fundamental democratic truth. Richard -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLdHzPfobez3wRbTBAQHvVAP+KHGCFgSlMStgbomhggwSQeiymdOSpk03 xmNhds+VBcqb1m7ddzvp659Yqcwc+MmBoQrJ9d3rELYD4mxxLvYAwCinaJf04Arx SYr69+K0MHTvsKG2ilv8gTUaAdUzTkIgIE06S4+4gdkp4LH4UoEyH42QEAx3vvso fw/Boyqxp+k= =Yhex -----END PGP SIGNATURE-----

1 0

NSA & State Fears ITAR Lawsuits
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

With the talk about Phil Karn's latest encounter with the ITAR (International Trafficking in Arms Regulations) issue over Schneier's source code diskette, I thought I'd pass on an interesting comment I heard recently. Someone who's had dealings with the NSA and State over these issues saw some memos, but was not allowed to make copies of them, which indicated that State's lawyer's were very concerned that an ITAR case involving software *not* ever reach the courts, because they felt the government's case was very weak and that a probable loss would be a serious setback in other areas. Make of this what you wish, but I should note that Jim Bidzos or someone like him (I just don't remember whom) at the 2nd RSA Conference, January 1993, said something very similar to this. Namely, that the government has generally avoided ITAR cases involving written material and similar material because of the shaky Constitutional basis. (Shipping a few packing crates full of mag tapes of weapons designs, nuclear secrets, etc., would probably be prosecuted, but shipping a couple of diskettes of C code, based on and essentially identical (no matter what the letter to Phil K. says) to the code published in a freely available book, sounds like precisely the kind of ITAR case the governments fears the most.) Note however, that I am not prepared to make myself a test case here! Anybody who does so, should, in my opionion, be "judgement proof" (to use Duncan Frissell's term). (Suing the government is less dangerous, but probably pointless....and maybe not even possible. A "test case" would probably involved someone very publically and very in-your-facedly exporting the diskettes and then awaiting an ITAR prosecution. Which might never come...no precedent would be established, the ITAR laws would not be changed.) Just my opinion here, but I'm not sure this case is central to the real issues. I applaud Phil for trying to get the diskettes ruled exportable, but fighting a long legal battle is not necessarily a high priority, as I see things. (Usual caveats about people doing whatever they want to do, about Cypherpunks not being an organized group and hence can't have official projects, blah blah.) Good luck! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 5

FW: CEI's Internet Guide
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Competitive Enterprise Institute <cei(a)access.digex.net> The Competitive Enterprise Institute is pleased to announce: THE VIRTUAL HAND CEI'S FREE-MARKET GUIDE TO THE INFORMATION SUPERHIGHWAY Now, under one cover, all the Internet places of interest to free-marketeers. Do you want to find the complete electronic text of "The Wealth of Nations"? How many places can *you* list where you can discuss the words of Ayn Rand? (The Virtual Hand can name five.) Do you want to know the latest in conservative or libertarian politics, or would you rather sit around griping about gun control? All this -- and more! -- is available from the Competitive Enterprise Institute. TABLE OF CONTENTS 1. Policy chatter (mainly Republican and Libertarian politics) 2. Cultural and philosophical (Objectivism, free-market literary journals, "fan" newsgroups, electronic books) 3. Student-oriented (college groups) 4. Single-issue forums (taxes, land rights, firearms, telecommunications policy, education, health care, feminism, law, Congressional reform, kids' rights) 5. Of local interest (statewide free-market groups) 6. Internet addresses of free-market groups 7. Miscellaneous 8. Other computer systems (BBS'es) 9. Government resources (how to get White House press releases, text of legislation, Federal Register, C-SPAN schedules, etc.) To get your very own copy of "The Virtual Hand," send $5 to: Alexander "Sasha" Volokh Policy Analyst Competitive Enterprise Institute 1001 Connecticut Ave. NW Suite 1250 Washington, DC 20036

1 0

Cypherpunks Goals: Bad debate drives out good debate
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

(I sent this out on Saturday, apparently just after the Great Outage began. I never saw it, so I presume few if any of the rest of you did either. While we're only 200-strong now, down from our 700+ peak recently, I suppose the most diligent and interested readers have by now managed to get back on the list. The alternately clued readers will have to miss this one.) Cypherdenizens, I guess it's a fact of cyberspace that well-reasoned, well-written posts don't get the followup responses that clueless, inflammatory, or otherwise controversial posts do. This has been driven home to me recently as I sort many thousands of posts and many hundreds of threads accumulated these last 19 months (and I deleted some of the true crap long ago, so my sample is skewed toward the good stuff!). I look at recent examples, like the analysis by Greg Broiles of what "Cyperpunks write code" means, and I see no follow-ups. I look at the thoughtful words of Harry Bartholomew, including a book review, of what can go wrong in software and what this means for crypto protocol tools, and I see no follow-up commnents. I look at Ray Cromwell's detailed presentation of his WEB-based remailer, and I see only comments by a few of us (me, Hal Finney, as I recall). Plenty of similar examples. What is going on? Without getting into particulars, clueless posts generate flurries of denunciations, "your mother codes in Fortran" insults, and alien abduction responses. A nobody name Nabalandian drools all over the list, mailbombs us, and generates several dozen responses. (Including from me, so I'm not blameless.) The Detweiler Perversion nearly brought the list to its knees for over two months recently. (And lesser flame wars, involving Thomas Tso, Xenon, and now Nabalandian, have similarly distracted us.) Cypher version of Gresham's Law: bad posts drive out good posts. (The same is being seen in talk.politics.crypto, with the neverending Sternlight vs. Everybody Else dominating the traffic by a factor of 20-to-1. Detweiler recently reappeared (as tmp(a)netcom.com) and is back to debating _himself_ and answering his own delusional posts.) Some fine work is being done, both by those who are posting here and by those who are apparently holding their counsel for the time being. But the crumb bum posts are definitely winning out. To be sure, posts by the stronger posters--who I won't name now--can still generate significant debate, but not nearly as well as the inflammatory posts can. (Part of this is predictable: the stronger posts are often technically deeper, meaning that more of the reading population feels unable to add signicantly.) I hope there's something we can do about it. I may start reposting, at not too frequent intervals, interesting articles from the past. "Golden Oldies," I called them on the Extropians list. Newcomers to the list often publically speculate that the old-timers are not "interested" in debating what drew them, the newcomers, to the list in the first place....things like Clipper, PGP, the loss of privacy, etc. What they may not realize is that many of us have spent literally many hundreds of hours writing articles for this list. That we have no wish to repeat the widely-accepted reasons for why Clipper is bad, or why RSA has not been broken, or why income taxes are about to become obsolete, is not surprising. While I'm not predicting the imminent death of the Cypherpunks list, it seems clear we have to stop the slide into inconsequential chatter and paranoid speculation. Cypherpunks write code. Or at least they work on ways to *make things happen*. They don't fall into the trap both the Marxists and the Libertarians have fallen into, of idly discussing theory and hoping that somehow the glorious future will arrive. Cyperpunks understand that the genie of strong crypto is out of the bottle and that a relatively small number of people working on new tools and capabilities can produce a phase shift of immense proportions in the world. There's work to be done, and I know of no other groups even one tenth as prepared as we are to do this work. Let us get on with it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway." .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

No Subject
by Tommy the Tourist 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Wed, 11 May 1994 14:09:13 -0800 From: norm(a)netcom.com (Norman Hardy) There was a long article in April 11, 1994 Forbes: "AUCTIONING THE AIRWAYS", by George Gilder". It had a supprising amount of technical information about a new technology similar to spread spectrum. The article has a "too cheep to meter" flavor that I do not agree with but it does present some interesting information and ideas. It is about 43k bytes and is available via anonymous ftp at netcom.com:/pub/Silk/auction.txt By all means, please triple or quadruple check any alleged `data' coming from George Gilder. No matter what you might think of Susan Faludi, she has documented a tremendous amount of misrepresentation and outright lying on the part of Mr. Gilder. In *many* cases, very simple follow up on his attributions reveals that he has his head firmly wedged up his ass. Zeke -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdGWPRVg/9j67wWxAQEg2wP/ZzTtjzZ0SNiuEKV9SNI0XcOpKGQuUWnm OFqM8ZX2GZwEOI59vQhE8Up9OFKXAJEvALDSIqzb2jxEJvxOp5onXHLCeRD8sgZ1 vt8u9Ns9WjdzXSlm8OldkvU+20oHhWIX7bJdVYG4JkO7X6sn9yagzS1oJFgRsMW5 lTU4u49VkdQ= =mkpr -----END PGP SIGNATURE----- ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```$]S^P;+]AB?X9TW6\8WR:^P&2':U$*B?=.'X4H1"CCQM(F<(6Y-[4XT G.L)4B<E70K)4@"#+R#9'#G+JK<8<6D'^>3H-S><XUY#8)CP7$U6= ====Encrypted-Sender-End====

1 0

Re: Cypherpunks Goals: Bad debate drives out good debate
by dwitkow＠eis.calstate.edu 17 Dec '03

17 Dec '03

I agree that there is a lot of "static". In fact, I'm choosing to leave the cypherpunks list for that reason. Simply put, I'm spending a lot of time reading posts, many good, but some clueless. Example: Ten minutes after someone posted the location of PGP 2.5 we got three posts asking "Where can I get PGP 2.5?" and subsequent responses of "Yeah, me too!" The original poster had a legitimate question, assuming that he had JUST signed onto the list, but he could have directed his questions towards the original announcer, but those subsequent "votes" for information were completely unnecessary. These kinds of problems are inherent in the structure of network communication. (I long for the creation of artificial intelligence twit-filter daemons to help me separate the wheat from the chaff. Read David Brin's 'Earth' for an interesting portrayal of the future of such beasts.) Perhaps lessons can be found in the Usenet world. Knowing the location of some cypher-oriented FAQs and FTP sites upon subscription to this list might defer some of the more trivial traffic. Inclusion of some net-iquette guidelines in the list-server welcome message might defer even more. To be relevant, such things would have to be updated frequently, meaning more work for the keepers, but I think that the subsequent distillation of list traffic would pay off in better, more effective posting. In fairness, I'd have to say that I've learned many things in the past three days. But the original reason I joined this list was to ask for information on basic analog voice encryption techniques, a request that went completely unanswered. I find the subject interesting, I just can't justify the time I'm spending sorting through 40+ posts per day. ...dtw ---------------------------------------------------------------- Notice of address change: Please send mail to the following: dwitkow(a)eis.calstate.edu (Mail sent to dwitkows(a)nermal.santarosa.edu will be forwarded) ---------------------------------------------------------------- Transmitted via modified Eudora 1.4.2 over LINUX host dialup! ---------------------------------------------------------------- Finger dwitkows(a)nermal.santarosa.edu for PGP key ----------------------------------------------------------------

1 0

Bad debates...
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

Mr. May wrote an excellent piece regarding the lack of in-depth discussion of code...and, I believe he's put his finger on the problem when he mentions that the majority don't feel capable of adding to the post; indeed, I fear I may be guilty of hubris for commenting on the posting of someone who clearly knows far more than do I about crypto. Continuing the theme, I've just bought a copy of applied crypto...and even after Data Structures II and Assembly Language I, it's tough sledding. I still can't fix the PGP makefile to compile for the Sun4 machine at the university (although, thanks to this list, I was able to find an already compiled version). The problem, if I may say so, is that code at this level of complexity may be achievable for full-fledged cypherpunks...but it is not yet for those of us who remain mere "wanna-be's". This is, I suspect, why cryptography is not spreading as rapidly as we would prefer. Keep in mind that the better programs, while technically elegant, just aren't user friendly. As as example of what is being dealt with, I have a friend with a new 486DX 50Mhz machine with a 300 Meg drive...and he only uses it for one application. Word Perfect 5.0. I just installed Compuserve for him. And, this is a really intelligent person, he's just not computer oriented. He needs PGP, SecureDrive, and so forth, but he doesn't understand how to use them. How many others are out there, just like him? I suspect a bunch. To get crypto 'out there' it is going to have to be very, very easy to use...and with instructions equal to a single double spaced page (or less) ... all of this is just MHO. So, I probably won't be reasonably able to make intelligent comments on the in-depth posts for *_at-least_* a year; but, I DO know how to delete the more tedious posters! ;-) Since I do pick up a lot from the posts, I do hope Mr. May (and others) won't get TOO discouraged... Regards

1 0

Re: Message Havens
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > People could use anonymous remailers to send in messages, and use > pseudonyms to protect their privacy. It occured to me that perhaps getting messages to a message haven won't require anonymous mail to protect privacy (who you are communicating with. You would still need to use a remailer to hide the fact you are using the message haven!). In each message, the author could specify what to name the next reply. If messages are encrypted, then all a watcher would see is incoming messages from various people, but not be able to figure out who is reading what message, and what messages are responses to what other messages. This would require the service to reject unencrypted messages, which would be easy enough. But it would still require people to "download" everything and sift through it at home, to hide what messages they are interested in. Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdG1c4OA7OpLWtYzAQH2MQP/f5M/4QHHHl8qg85ikGCkmFiN6wrs+DHc 3iIpogSO5oj/tJZ0xnHzky8B3Ll2rjmHgW+vH5hxTONw+2TZ5+5aFjJbqCs1pL1a rYFFyUP6AOj3809G1gSuLwa85iw5jY5fT/JZsMH82uL2v5i2839jQDZo1SCHff/1 77gQgjP9Agk= =7p6A -----END PGP SIGNATURE-----

3 3

Re: MIT TOC SEMINAR--ADI SHAMIR--MONDAY--MAY 16--4:15pm
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:07 5/11/94 -0700, Paul E. Baclace wrote: >I'm very curious as to how humans can directly decode encrypted >pictures. Do they stare at it for 10 minutes and go "ah, there >it is". ... About 10 years ago there was a Scientific American article about visual encypherment. The decoder required no computing hardware. A one time pad was available at both ends in the form of an array of 1000 by 1000 random black or white pixels in the form of a transparency. When it was time to code a black and white image an array of pixels were produced with each pixel being black with a probility proportional to the darkness at that point of the 'plain-image'. That was exclusive ored with the one time pad. This yielded a random set of black and white pixels and was transmitted physically by insecure courrier. It it reached the destination it would ideally be exclusive ored with the other copy of the one time pad. The receiver could more easily align the cypher-image with the one time pad and see a fairly good image. This yields the 'and' function in place of the 'xor' and provides about half of the image quality in the information theortic sense.

1 0

No Subject
by mlshew＠netcom.com 17 Dec '03

17 Dec '03

Version 0.1--This will change in case of conflicts, etc. I'll post V1.0 on Wednesday 5/18/94. This is version 0.1 of this file. For the most recent version, try the following: o finger mlshew(a)netcom.com, to read my .plan. (This file.) o get "plan" by ftp in netcom.com:/pub/mlshew This was originally sent to the cypherpunks and extropians lists. If you would like to meet informally with other readers of these lists during next week's COMDEX, I would suggest meeting Tuesday (5/24/94) at noon, directly above the food court in CNN Center--------->+ | | Map: (Badly out of scale and oversimplified to make sense | for walkers but not drivers) | | | | | | | -------------------+ +---------------------------------|-------------- Marietta Street | -------------------+ +---------------------------------|-------------- | | | +----------------+ | | +----------+ +-------V-----------+ | World Congress | | | | The Omni | | CNN Center | | Center (COMDEX)| | | +----------+ | (Food Court here) | | Walk this way like the rest of the mobs of people | +----------------+ | | +-------------------+ | Inter- | +--------------------+ |national| | MARTA Rail Station| | Blvd. | | (The local subway) | | | +--------------------+ | | | | Lots of very expensive parking here for those | | who want to drive directly to COMDEX in the | | middle of incredible traffic and raise their More Parking | | blood pressure instead of taking a shuttle from | | their hotel, or parking at a free-parking MARTA | | lot and taking MARTA in, as is the sensible | | way to go about it. (For those who haven't been to an Atlanta COMDEX before, the CNN food court is a place where almost every COMDEX attendee is likely to eat at least once during the week. If you happen to forget, loose, or never receive the ASCII map originally above this paragraph, any random person you might ask for directions can probably point you in the direction of the "CNN Center food court.") The court is in the center of the floor you will (likely) come in on. So don't go getting confused when you see smaller sets of restaurants and tables and chairs as you enter. That's not the central court. You won't miss it, just keep going in. (Of course, you won't have much choice in the matter: There will be a mob of hungry Comdex attendies behind you, and stopping in their path is simply not a viable option.) Go to the food court, and look up. You will see a single pedestrian walkway one floor above you. That is where we'll all be. Take yourself and your food up one floor, and enjoy the pleasant conversation. (Note that up on the walkway there's no place to put your food, but that's okay, because there's no place down in the food court either--it's _really_ crowded. Down there there's hardly a place to stand, much less sit, but go up one floor, and it's a virtual dessert.) I'd like to make a publicly available list that includes the following. (To be appended to this file.) o Persons coming to Spring Comdex, interested in attending a meeting such as this, and wishing to let that and related information be known to the world. o Whether they can make the noon Tuesday meeting. o Where they heard this announcement. o Good/bad days and times. Be specific but brief. Please include this in any event, so if 3 people say only Wednesday, and 7 don't bother to mention that Wednesday is impossible for them, that I don't switch to Wednesday. No guarantees of course. o Personal interests. (Explained below) o Misc. other information they want known to the world. If you would like to enter or modify yourself in such a database, modify and mail a form such as one at the end of this file to mlshew(a)netcom.com, with this subject line or "comdex meeting info". Feel free to also add in: o Any job openings you know about. (Esp. EE/DSP/Programming) :-) If you would like to tell me and everyone to expect one more person, just mail the form with a number "1" in the "Name" column, so you needn't broadcast your name. If you'd like to tell no one anything and just show up, that's okay too. I'll append the information (edited!) to the end of this file. As to why I included a field about interests, it will allow everyone to mull over everyone else's idea of what would be nice to talk about, the theory being that it might help conversation naturally bend towards topics all are interested in. As to the other information, it's also to help other people who might want to get together to do so if they don't want to go to this meeting. (Or to remember remember to bring that book they borrowed from another person three years ago.) It is not a "vote" on what time the get-together will be. Appended are two sample forms (since this is the first version: V0.1). Delete everything else, put in your own info, and mail it back to me. See you soon! Mark Shewmaker mlshew(a)netcom.com Noon Tue. OK? Name Where heard Can Schedule at Interests ------------------------------------------------------------------------------- Y Mark Shewmaker extropians Flexible all days Schelling points of mlshew(a)netcom.com cypherpunks lunch meetings near conventions Thinks this is a great place to meet, and a nice place to watch everyone come and go. Need an employee? Apply now before prices go up. ------------------------------------------------------------------------------- N One fake anonymous never tell MWF 10-2 Mental Cryptography person just as an example I just kind of feel silly telling everyone that I'm going to be there; I look forward to meeting you there, though. ------------------------------------------------------------------------------

1 0

Re: Cypherpunks Goals: Bad debate drives out good debate
by Derek Upham 17 Dec '03

17 Dec '03

> Cypher version of Gresham's Law: bad posts drive out good posts. > (The same is being seen in talk.politics.crypto, with the neverending > Sternlight vs. Everybody Else dominating the traffic by a factor of > 20-to-1. Detweiler recently reappeared (as tmp(a)netcom.com) and is back > to debating _himself_ and answering his own delusional posts.) Let's face it: Usenet is inherently broken. There are two ways to filter for content: filter at the newsgroup source via moderators, or filter at the newsgroup destinations via killfiles. Moderating does seem to get rid of most of the cruft, but the moderators are required to read every post that comes through, and, worse, make judgements with some degree of impartiality (which is not always possible). On the other side, kill files are useful, but only to a certain degree. Blocking sertain key words in subjects doesn't help against topic drift; blocking Sternlight won't help you in the slightest when umpteen other people respond to his posts. The situation for most mailing lists is just as bad. Anyone can send a post to a mailing list, and there are usually no moderators to enforce content. A reader's only recourse is another kill file---and most mail killing facilities are pretty lousy when compared with their Usenet counterparts. The only thing mailing lists have going for them is that they tend to be less obvious than newsgroups. Harder to find. To fix them problem, then, we either have to either improve the kill files or improve the moderation. Personalized AI filters (see Moran's "The Long Run") will be spiffy when they arrive, but they're not going to be arriving any time soon. This leaves moderation. If we increase the number of moderators, we can reduce the load on each and take into account as many tastes as possible. In the best case, the moderators would consist of all the readers of the newsgroup. How would this work? Assume we're running a mailing list (Usenet v.2.0 will be just a special case of a mailing list). All posts are sent to the central site. The mailing list software picks one e-mail address from all of the list receivers, and forwards the post to that e-mail address (keeping the original post on file). The forwarded post will have a subject line something like: Subject: Post ACK, list cypherpunks, msg #435A77CF with the post contained in the body. The receiver reads the post, then replies to it. The reply subject line will be: Subject: Re: Post ACK, list cypherpunks, msg #435A77CF and the body will contain "ACK" or "NAK" or "post" or "dump" or whatever. This goes back to the list maintainer, who can check that: * The message in question is in fact outstanding. * The person who sent back the evaluation was the one who was supposed to. * Other sordid details. If the message was approved, it goes to everyone. Otherwise, the original poster is informed that the post did not meet standards. We might even want to forward the evaluation body to the original poster; this would allow the evalutors to send comments explaining why the post was rejected. The nice thing about this technique is that the more people a person pisses off, the less likely it is that his or her posts will ever see the light of day. Even better, aware readers can nip MAKE.MONEY.FAST and Green Card Lottery posts in the bud. Something very similar to this exists now in the Internet Oracle, so distributed moderation ought to be possible. I suspect that the mail- handling features could be incorporated entirely into "procmail" and "SmartList" (a filter program and a mailing list program), although the databases would need C maintenance programs for efficiency. I'll go to bed and await comments. Derek

4 4

Re: Cypherpunks Goals: Bad debate drives out good debate
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

You have a good summary of what's going on. Personally I've found it useful to create a filter for my cypherpunks mail to send posts from people whom I respect more into a seperate folder such that the signal-to-noise ratio in that folder is higher. When I have more time I read the folder with the lower signal-to-noise ratio, but I often do not have those resources. I don't really have to deal with bad posts because I don't see most of them unless I have some extra time on my hands... Others interested in rational discussion and debate and actual-doing-things might find this a useful technique. Ditto. Actually I gateway c'punks straight into a local 'mail.cypherpunks' group, with the hack script below (there might be an easier way, but I had the code around anyway). First, I created a user called 'cypher', then gave it this .forward: suilven% cd ~cypher suilven% cat .forward "|mail2news mail.cypherpunks cypherpunks(a)toad.com" Since I'm running the smrsh security wrappers, mail2news has to be in the special smrsh directory, /usr/adm/sm.bin. mail2news: #!/usr/contrib/bin/taintperl # # mail2news - Incredibly simple program to take a mail message from # stdin and insert it into a moderated newsgroup so you can # read mailing list messages via news instead of mail. # # Usage: mail2news <newsgroup> <reply-gateway> # # Author: Stephen Hebditch <steveh(a)orbital.demon.co.uk> # # Operation: # 1. Create a new local group (e.g. orbital.lists.uri) with moderated # status to contain the local messages. # 2. Make sure the newsgroup isn't going to propagate outside your # system. # 3. Modify mailpaths (C News) or moderators (INN) so that your local # replies get sent back to the mailing list. # 4. Use a mail filter program (such as comes with elm) to divert # messages arriving from the list to this program instead. # # Add local config info here # Make secure (from 'perl' man page) $ENV{'PATH'} = '/bin:/usr/bin:/usr/local/bin'; $ENV{'IFS'} = '' if $ENV{'IFS'} ne ''; $path = $ENV{'PATH'}; # Not tainted $domain = "suilven.an-teallach.com"; $rnews = "/bin/rnews"; $update = "/usr/local/bin/op updatetrn"; $user = "news"; # If badly installed, news will get the replies $newsgroup = $ARGV[0]; if (!$newsgroup) { die ("No newsgroup name supplied\n"); } $replyaddr = $ARGV[1]; if (!$replyaddr) { $replyaddr = $user; } $body = 0; $kill = 0; $subject = 0; open (NEWS, "|$rnews") || die ("Can't run $rnews: $!\n"); print (NEWS "Newsgroups: $newsgroup\nPath: $domain!not-for-mail\n"); print (NEWS "Followup-To: poster\nReply-To: $replyaddr\n"); while (<STDIN>) { chop; if (!$body) { if (/^Subject:\s+(.*)$/io) { if ($1 ne "") { $subject++; print (NEWS "$_\n"); } } # Add here any headers you wish to kill elsif (/^(Received|Return-Path|X400-Received|Newsgroups|Path|To|Reply-To):/io) { $kill++; } elsif (/^From\s.*$/io) { } elsif ((/^\s.*$/io) && ($kill)) { } elsif ($_ eq "") { $body++; if (!$subject) { print (NEWS "Subject: <no subject>\n") } print (NEWS "Approved: news@$domain\n\n"); } else { $kill = 0; print (NEWS "$_\n"); } } else { print (NEWS "$_\n"); } } close (NEWS); system($update); exit (0);

1 0

Re: PGP 2.5 available from Electronic Frontier Foundation ftp site
by Tommy the Tourist 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Stanton McCandlish <mech(a)eff.org> Date: Wed, 11 May 1994 16:46:49 -0400 (EDT) Despite the patent & licensing issues being resolved, PGP is still not legally exportable from the United States (except to Canada), due to ITAR export restrictions which categorize cryptographic materials as weapons of war. Thus, EFF can only make PGP and other crypto tools and source code available to US and Canadian nationals currently residing in the US or Canada and connecting to EFF's site from a US or Canadian site. I was under the impression that NAFTA is the reason that Canada is included. Am I misinformed? If NAFTA is the reason, isn't Mexico equivalent to Canada in this context? Could someone clarify this aspect of the export situation, or perhaps point me at a document that explains the situation? Zeke -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdJIuBVg/9j67wWxAQEebAP/flhqUugfCUJ9at1nI8kCbkXiF10NYfcE s+1+ZFNnvz16gwI/O7nEfrIHKQl6mqmqT8T4e2JCsMiw7uM7L3vYIKHJvRek45gk /6JoUE7sjVb8nyvyct9sKeExAGqKFLxAAsOZfYno88qOMAE4nc3QRxMoqLb3XDbI EbxPLyo8T/s= =RqOv -----END PGP SIGNATURE----- ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```$YS^P;+]AB?X9TW6\8WR:>P&2'9,7.YM5[D--('+[6(0O]013@CTWLQ FKWZ$M2G9>G1>/=5O1[0U.E)J&63=DHF($P$KX#I8T]5&9!GFQ]@` ====Encrypted-Sender-End====

3 2