December 2003 - cypherpunks-legacy

Re: Feds Seek PKI Bids
by geeman＠best.com 17 Dec '03

17 Dec '03

despite the CBD item, keep your eye on the key recovery demonstration projects; links at http://www.best.com/~geeman At 01:53 PM 8/11/97 -0400, A. Padgett Peterson P.E. Information Security wrote: > > >>USG published a solicitation today in the CBD for a >>Public Key Infrastructure which outlines the system >>requirements: > >> http://jya.com/pkicbd.htm > > >Interesting from what is *not* there - any mention of key recovery/key >escow. Looks like they may finally understand what a Certificate Authority >is (not holding breath). Do not think much of appelations (Classic & Gold) >and suspect they may need more than two but sounds like a good start. > > Warmly, > Padgett > > >

1 0

5881.html
by Damaged Justice 17 Dec '03

17 Dec '03

[1][Masthead] [] [2][Navigation bar] [3][Stocks] __________ ______________ [4][Search] [5][WIRED magazine] Matt Richtel --> [] [6][Back] He Tries to Draw Legal Borders in Cyberspace by [7]Matt Richtel 5:04am 11.Aug.97.PDT In one of the first undercover stings ever run on the Internet, Missouri Attorney General Jeremiah "Jay" Nixon in late June handed an 18-year-old intern a credit card and sat her down in front of a computer terminal. According to court records, the intern visited the World Wide Web site of [8]Hog's Head Beer Cellars of Greensboro, North Carolina. She succeeded in ordering a 12-pack of microbrews, which were duly delivered. Then Nixon swung into action. He filed a lawsuit against Hog's Head, alleging that the company had not asked for a driver's license number from the intern or taken other steps to prevent a minor from purchasing alcohol. "There was no mention on the Web site that you have to be of age," Nixon said. "It's safe to say that any establishment in the state of Missouri [that similarly served drinks to minors] would lose their license." Co-owner Jim Lowe concedes that Hog's Head lacked an age-checking mechanism when Nixon sicced the minor on him, and says that shortcoming has been remedied by requiring customers to fax a signed waiver form and copy of their drivers' license to get an order processed. Protecting sovereignty, defining borders Nixon's beef is not, however, merely about selling alcohol to minors. He speaks of protecting the sovereignty of states and of maintaining order in the increasingly borderless world created by the Net. His targets say, not surprisingly, that he has another agenda, too: waving the flag of supposed cyberspace lawlessness to win votes for his 1998 US Senate campaign. "He's using this as a political springboard," said Lowe. "People are emailing us saying: Doesn't the AG have anything better to do than surf the Internet?" Over the past three months, Nixon has made an increasingly visible effort to crack down on what he alleges are illegal businesses run by Web-based firms. He has twice sued online gambling businesses, in one case winning a fine. Nixon said that he has taken a tough stand on the issues, particularly in the case of Internet gaming, because the federal government has dropped the ball on regulation. "We're going to have to, as 50 different states, get very, very active that the protections afforded our constituents continue," Nixon said, adding that in the case of gaming, "The federal government has basically been AWOL." Interference with commerce? Legal entanglements aside, Lowe said he has a bigger problem with Nixon's approach. Instead of trying to clarify how the law might operate in cyberspace, Nixon is actually interfering with Internet-based commerce. And Lowe numbers himself among the growing number of merchants that feel they need the Internet to compete. Meanwhile, Nixon finds himself fighting perhaps more visible cases with two gaming businesses on the Internet. In April, he filed a lawsuit against Interactive Gaming & Communications Corp., accusing the Pennsylvania company of setting up a casino that violates Missouri gaming laws and fails to caution citizens of the Show Me state that what the site promotes is against the law. Nixon won an initial victory in May, when a court ordered Interactive Gaming to pay $66,050 in penalties and costs. Nixon said the firm refused to pay or to back down. So in June, he asked the grand jury in Springfield to indict Interactive Gaming president Michael Simone. In what is believed to be the first criminal indictment of its kind in the nation, the grand jury handed down a charge of promoting gambling in the first degree, a Missouri Class D felony that could carry a five-year prison sentence and $5,000 fine for Simone and a $10,000 fine for his company. Interactive Gaming's attorney, Lawrence Elliott Hirsch of Philadelphia, said in a statement that Missouri has no jurisdiction over them. "Michael Simone has never set foot within the state of Pennsylvania," said Hirsch. "Mr. Nixon should not be permitted to be a super-regulator/legislator of activities conducted lawfully on the Internet." Nixon's response was cool. "Missouri law makes only narrow exception for legal gambling, and the Internet is not one of those exceptions," he said. Battling a tribal lottery Nixon is also embroiled in a dispute with Idaho's Coeur d'Alene Indians. Early this summer, he filed suit to prevent the tribe from offering its Web-based US Lottery game in Missouri. As in the Interactive Gaming case, Nixon alleges that the Coeur d'Alene are violating Missouri law - this time because they have not received permission to operate a lottery. Uncertainty about who really has jurisdiction over Indian gambling complicates the case. The 1988 federal Indian Gaming Regulatory Act permits tribes to establish casinos on their land, with the permission of their home-state governments. The Coeur d'Alene argue that since they have permission from Idaho, and since the Net lottery is run exclusively on their land, they should be able to offer it anywhere they please. "All the gaming is happening on Indian land - the server is there, the random drawing is there, the game itself is played there, the customer service is there, the cash account is there," said Mike Yacenda, president of Unistar Entertainment, a Connecticut company that manages the Coeur d'Alene lottery. "This is the only legal lottery site on the Internet." David Matheson, chief executive officer for gaming for the Coeur d'Alene, accuses Missouri of trying to keep the tribe down. "You can stand in their lines and buy their lottery tickets," he said. "They're trying to make us a poster child for their political games." The legal nature of the Net Nixon's stance on the Coeur d'Alene puts him at odds with the many who argue that efforts to legislate Net activity - whether the subject is gambling, pornography, spam, or taxation - is doomed to failure because of the network's diffuse global nature. But the attorney general doesn't buy any of that. He said there's a big difference between Missouri's legal gaming, such as on riverboats, and the intrusions from the outside. He argues that Internet-based casinos are merely trying to excuse unregulated activity on the specious basis that technology makes everything different. Or that when an activity is legal in one area - for example, a reservation - it should be universally legal because of the Internet. Nixon said if that's the case, other states or countries will use the Net to import activities or substances that are illegal in Missouri but legal in their place of origin. That gets to what Nixon said is his larger point: Some Internet businesses are threatening Missouri's sovereignty and someone needs to "draw a line." "If we don't draw these lines," he said, "then there are no lines." Find related stories from the Web's top news sites with [9]NewBot [10][Back] [11][Navigation strip] [12]Rants & Raves: Send your rants and raves to Wired News. [13]Tips: Have a story or tip for Wired News? Send it. [14]Copyright © 1993-97 Wired Ventures Inc. and affiliated companies. All rights reserved. [15][HotWired and HotBot] [] [] [16]Oracle [Politics] POLITICS Today's Headlines [17]Info Watchdogs Challenge FBI Wiretap Plan [18]Amid Cycling Uproar, Evidence Goes Online [19]He Tries to Draw Legal Borders in Cyberspace [20]ACLU: Labeling May Lead to Lost Liberty [21]Scans: Spinning the FCC [22]Invitation to a Beheading [23]Oracle References 1. LYNXIMGMAP:http://www.wired.com/news/news/politics/story/5881.html#masthead… 2. LYNXIMGMAP:http://www.wired.com/news/news/politics/story/5881.html#nav1.map 3. http://www.hotwired.com/cgi-bin/redirect/10010/http://stocks.wired.com/ 4. LYNXIMGMAP:http://www.wired.com/news/news/politics/story/5881.html#nav2.map 5. http://www.hotwired.com/cgi-bin/redirect/10012/http://www.wired.com/wired/ 6. http://www.wired.com/news/news/top_stories/ 7. mailto:matrichtel@aol.com 8. http://www.hogshead.com/index.htm 9. http://www.hotwired.com/cgi-bin/redirect/10018/http://www.wired.com/newbot/ 10. http://www.wired.com/news/news/top_stories/ 11. LYNXIMGMAP:http://www.wired.com/news/news/politics/story/5881.html#navstrip… 12. http://www.wired.com/news/rantrave.html 13. mailto:tips@wired.com 14. http://www.wired.com/wired/full.copyright.html 15. LYNXIMGMAP:http://www.wired.com/news/news/politics/story/5881.html#nav3.map 16. http://www.wired.com/event.ng?Type=click&ProfileID=26&RunID=28&AdID=464&Red… 17. http://www.wired.com/news/news/politics/story/5958.html 18. http://www.wired.com/news/news/politics/story/5927.html 19. http://www.wired.com/news/news/politics/story/5881.html 20. http://www.wired.com/news/news/politics/story/5882.html 21. http://www.wired.com/news/news/politics/story/5761.html 22. http://www.wired.com/news/news/politics/story/5753.html 23. http://www.wired.com/event.ng?Type=click&ProfileID=26&RunID=28&AdID=464&Red…

2 1

HOPE and Wiretap News
by John Young 17 Dec '03

17 Dec '03

NYT had a front page story yesterday on the HOPE meet. Featuring hack of NYC's Metrocard, with wry commentary on new adventures "underground." A quote: Bruce Schneier, a highly regarded cryptography expert who spoke at the conference, said experience bad taught him that hackers often understood computer systems better than the engineers who designed them. "Hackers just have a much more holistic view," he said. Mr. Schneier, who is a consultant to Cubic on the next-generation Metrocard, said he believes someone will inevitably figure out a hack. "I believe that, fundamentally, a system as complicated as the Metrocard cannot be absolutely secure," he said. --------- See full report at: http://jya.com/beyond-hope2.htm Aptly, with Bruce's emphasis at HOPE on the need for laws to punish computer criminals and to close the global jurisdictional gap so there's no refuge for outlaws, there's Markoff's report yesterday on a petition to the FCC opposing the FBI's digital wiretap plan: http://jya.com/tap-opp.htm

1 0

The Easiest One Yet, By Far !
by 23933677＠compuserve.com 17 Dec '03

17 Dec '03

*To be removed please reply with "remove" in the subject line. ------------------------------------------------------------------------------------------------- I DON'T HAVE TIME FOR MLM AND I DON'T WANT TO TALK TO PEOPLE, YET I MADE $2300.00 LAST WEEK ( 4TH WEEK ) ! ******************************************************** **** CALL (800) 811-2141 CODE #15645 ***** ******************************************************** SIMPLY ADVERTISE THE ABOVE (800) NUMBER WITH YOUR OWN ID CODE! IT'S THAT EASY! We talk to them for you! We mail the materials! We close them! You get $100 EACH paid weekly! PAYS UP TO 85% TO INFINITY !!! "I made & received $2,300 my 4th week, $2,360 my 3rd week, and $2,110 my 2nd week." *** IF YOU CAN FIND A PROGRAM THAT'S EASIER THAN THIS ONE, WE WILL ENROLL YOU FOR FREE !!! YOU HAVE NOTHING TO LOSE. THE CALL IS FREE !!! CALL NOW !!! ******************************************************** **** CALL (800) 811-2141 CODE #15645 ***** ********************************************************

1 0

Let's change that image in the mirror for the last time !!!
by 51577362＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#00ff40"> DO YOU LIKE WHAT YOU SEE IN THE MIRROR? HAVE THINGS GONE SOUTH? DO YOU HAVE SAGGING SKIN? IS GRAVITY TAKING IT'S TOLL? INTRODUCING CALORAD(R) Now available in the U.S. for the first time! It Literally Melts Fat and Rebuilds Connective Tissue WHILE YOU SLEEP! NO KIDDING!! 10 Year Proven Track Record - 86% Success Rate Medical Test Results are coming in from all over the Country Health Practitioners are endorsing this product by the thousands! Cholestrol Levels are down! Triglycerides down! Blood Pressure down! Pain is leaving! Muscle is rebuilding while bodies are RESHAPING! Body Builders, Athletes, World Champions and Professional Trainers are endorsing this product! INCHES AND WEIGHT MELT OFF WHILE YOU SLEEP! 100% SAFE - 100% NATURAL Absolutely no SIDE EFFECTS, STIMULANTS OR DRUGS! Good for teenagers and adults alike! (No pregnant or lactating women) INCREDIBLE $$$$$$$$$ OPPORTUNITY AVAILABLE! Exclusive International Marketing Rights! England & Australia opening soon! My upline is ordering 52,000 bottles each week! We will help build your unlimited downline! Not MLM! You can reduplicate yourself up to 99 times! Many are earning $1750+ first week! (possible up to 99x!!!) Company has only been officially launched since April 1997 Unprecedented $6.1 million in 1st month! Follow These $imple $teps To $uccess: For More info: http://www.globalnet4u.com/calorad E~mail Assistance or Call : 888-550-1885 ( Press # 0 for our 24 hr. operator ) ~~~~~~~~~~~~~~ Remove Here ! Put "Remove" in Subject ! ----------------------- Headers -------------------------------- >From 71892800(a)iiname.com Mon Jun 9 21:58:57 1997 Return-Path: <71892800(a)iiname.com> Received: from globalnet4u.net (globalnet4u.net [999.777.40.1]) by emin04.mail.aol.com (8.8.5/8.8.5/AOL-4.0.0) with SMTP id VBB73458 for <globalnet(a)aol.com>; Mon, 9 Jun 1997 21:58:55 -0400 (EDT) From: 71892800(a)iiname.com Received: from ringer.net (245ohiomax1-88.globalnet4u.net [209.207.40.1]) by globalnet.net (8.2.12/8.0.12) with SMTP id ucc10583 for <globalnet4u(a)aol.com>; Mon, 9 Jun 1997 20:55:07 -0500 Received: from 2 by 3 (8.8.5/8.6.5) with SMTP id UAA01050 for <globalnet4u(a)aol.com6>; Mon, 09 Jun 1997 21:03:09 -0600 (EST) Date: Mon, 09 Jun 97 21:03:09 EST To: globalnet4u(a)aol.com 6globalnet4u.net [209.207.40.1]) Subject: DO YOU LIKE WHAT YOU SEE IN THE MIRROR? Message-ID: <77674624691643647471> Reply-To: 5@to the globalnet4u X-PMFLAGS: 747862781460264760231 X-UIDL: 8 Comments: Authenticated sender is <The total bulk solution> </PRE></HTML>

1 0

Re: Guy Polis
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Mon, 11 Aug 1997 19:27:36 -0600 > From: Peter Trei <trei(a)process.com> > Organization: Electronic Forgery Foundation > To: cypherpunks(a)toad.com > Subject: Re: Guy Polis > Reply-to: Peter Trei <trei(a)process.com> > Dr.Dimitri Vulis KOTM wrote: > > There's a crackpot by the name of Guy Polis (guy(a)panix.com, polis_guy@ > > jpmorgan.com) who posts a crackpot "cryptographic manifesto" and sounds > > like a bad troll intended to make the folks who promote the use of crypto > > look like, well, crackpots. Be warned. > > Tim May wrote: > > Yeah, and like we're gun-nuts, too! > > Rabid Wombat wrote: > >The mammalian jackass is also claiming that all crypto promoters > > are marsupials. > > As long as he doesn't accuse us of of being mathematicians... > Does anyone remember what 5 + 7 is equal to? (Send the answer by > encrypted, private email. Secrecy is essential to my work.) > > Peter Trei > trei(a)process.com Neat! I thought I was too boring a person to bother forging messages from. Of course, there's a subtext to the question I allegedly ask - 5 is a number whose signifcance is well known to devotees of Eris, and 7 shall not be spoken of. W .'. Peter Trei, MM, PM, RAM, 32' AASR(NJ) trei(a)process.com

1 0

Encrypting same data with many keys...
by Ray Arachelian 17 Dec '03

17 Dec '03

What are the dangers of taking a small block of data - say upto 1K in size, then producing many files, each being the same data encrypted by other keys? i.e.: Plain data: 1K in size or smaller File 1: Data encrypted with Key1 File 2: Data encrypted with Key2 File 3: Data encrypted with Key3 File 4: Data encrypted with Key4 File 5: Data encrypted with Key5 File 6: Data encrypted with Key6 File 8: Data encrypted with Key8 .... File N: Data encrypted with KeyN A known plaintext attack won't help you to break the keys unless you have one of the eight keys, but will having many keys that encrypt the same data significanltly weaken the security of that tiny chunk of data? And no, I don't mean, there's N keys so the odds of brute forcing the data is now N times easier. Assume we're using 128 bit Blowfish/Idea or better, and discarding weak keys. Are there any differential or other cryptanalysis methods to use the eight resulting cyphertexts to get at the data other than brute forcing it if you don't know any of the keys? What if instead of using a private key cypher, we used a public key cypher? Would that make any difference in attack methods? The data won't contain any text, or identifiers (i.e "GIF89" in GIF files, "MZ" in wintel executables, etc...) known or guessable to the attacker... =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ==========================

7 14

Your Credit Report
by 19807940＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"> \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ *AS SEEN ON TV * AS SEEN ON TV * AS SEEN ON TV* AS SEEN ON TV* ////////////////////////////////////////////////////////////////////// If you received this electronic mailing by mistake, please pardon our intrusion. Dear Friend, Are you or somebody that you know experiencing credit problems? If your answer is yes, I think you will be very interested in our special offer. No longer will you have to live like a second class citizen due to a bad credit report. Bad credit is caused by a variety of reasons: Health, divorce, termination of employment, loss of income and dozens of other reasons. The bottom line is that bad credit can happen to anybody. There is no specific profile of a person with credit problems. It can happen to doctors, lawyers, accountants, the mail man, truck drivers, housekeepers and salesmen. As a matter of fact, one in three Americans live with some form of bad credit. Fortunately, the United States Government has passed many laws under the Fair Credit Reporting Act, all of which protect your rights as a consumer. Our manuals will show you how to use these Federal laws to your advantage and repair or obtain a new credit report. ***** THE FRESH START PROGRAM (TM) ***** Have you seen your credit bureau report lately? Have you recently been denied credit because of a bad cedit report? If you have answered yes, then you need to take advantage of THE FRESH START PROGRAM (TM). THE FRESH START PROGRAM (TM) will guide you through the process of obtaining a BRAND NEW credit bureau report. Our easy-to-follow manual will put you on the fast track to obtaining your new credit bureau report and can be accomplished within 24 hours! Regardless of your credit rating, you can NOW obtain a brand new, fresh credit bureau report free of: * ANY bad credit * Bankruptcies * Judgements * Foreclosures * Charge-Off's * Tax Lien's * Repossessions * Late pays * Garnishments * Inquiries NOW, you can have a 'Clean Slate' and a 'FRESH START' with a brand new, credit bureau report. ////////////////////////////////////////////////////////////////////// ***** THE COMPLETE CREDIT REPAIR KIT (TM) ***** Good credit empowers you to qualify for personal loans, business loans, auto loans, credit cards, home loans and other types of credit you may apply for, at the best possible interest rate. As you know, if you don't have excellent credit, lenders will NEVER extend credit to you! The Fair Credit Reporting Act will allow you to legally and permanently ERASE the negative information on your credit bureau file. Anything that is damaging to your credit rating, may be removed: Inquiries, Foreclosures, Repossessions, Charge-Off's, Late Payments Student Loans, Bankruptcies and Judgements The 'Credit Repair' companies located in every city will charge from $500.00 and up to do what our easy-to-follow manual will teach you. Now, in the privacy of your own home, you can repair your own credit at your own pace. \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ***** PROOF ***** "Having bad credit was the one thing holding me back from starting my own business. After working your program, I qualified for a $45,000 Small Business Loan. My business is making me more money than I've ever made. Your program is truly priceless!" George S. - Fresno, CA. "Thank you, thank you, thank you! Before, my credit was totally trashed. After using your Fresh Start Program and using The Complete Credit Repair Kit, my wife and I qualified to purchase our first home with no down payment. These programs are worth thousands of dollars!" Kenneth T. - Ithica, NY "After being laid off, my creditors were not very understanding when I couldn't pay my bills and as a result, my credit was very badly damaged. Once I started working again, I couldn't qualify for any type of credit. After using the manuals, I qualified to buy a new car, with no down payment." Mr. Fred C. - Tampa, FL "After my divorce, I was forced to file bankruptcy. I was told my credit would be ruined for 10 years. After using the your manuals, I have great credit again. I even receive pre-approved credit cards in the mail. Thank you so much for your amazing program. I don't know what I could have done without it. I highly recommend your program to anyone who has credit problems." Ms. Anna S. - Tacoma, WA \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ YOU MAY BE ABLE TO EARN $1,500.00 FOR YOUR TESTIMONIAL ON OUR UPCOMING TV INFOMERCIAL. DETAILS INCLUDED WITH YOUR ORDER. ////////////////////////////////////////////////////////////////////// Don't let ANYONE tell you that you can not make the transition from a bad credit risk to that of preferred credit customer. Over 175,000 satisfied customers can't be wrong! each manual, THE FRESH START PROGRAM (TM) and THE COMPLETE CREDIT REPAIR KIT (TM) is normally $89.95 + $3.95 S&H. However, if you take advantage of this special offer within the NEXT 24 HOURS, you will pay only $34.95 + $3.95 S+H for one program or you can take both programs for $54.95 +$3.95 S&H (U.S. Funds Only). To place your order, simply mail the form below, along with your certified check, money order, personal check or cash to: \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ I.M.S. 5201 Kingston Pike, Suite 6-216 Knoxville, Tennessee 37919 Yes, please send the manual(s) checked below: $34.95 THE FRESH START PROGRAM (TM) $34.95 THE COMPLETE CREDIT REPAIR KIT (TM) $54.95 Both Programs $_____ Sub Total $ 3.95 Shipping and handling $(15.00) RUSH Delivery (Optional) $_____ Total Enclosed I have enclosed (Check One): _____Cashiers Check _____Money Order _____Personal Check _____Cash SHIPPING INFORMATION: Name:_________________________________________ Phone:_______--__________--___________________ Physical Street Address (NO P.O. BOXES):_______________________________________ City:______________________ State:____ Zip/Postal Code:_________________ Your E-Mail Address (Needed for order confirmation):________________________________ /////////////////////////////////////////////////// SAVE AN ADDITIONAL $5.00!!! FAX YOUR ORDER NOW!!! Please tape your completed check in the space below and fax it along with your order to IMS. That toll free number is 1-423-681-6520 ************************************************* FAX: 1-423-681-6520 Please Tape Your Check Here Please Sign Your check ************************************************* Thank You For Your Order-All orders shipped same day. 654657808038556

1 0

Re: Eternity Uncensorable?
by John Kelsey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks(a)algebra.com, Wei Dai ## Date: 08/08/97 10:37 pm ## Subject: Re: Eternity Uncensorable? ] >Subject: Re: Eternity Uncensorable? >To: Cypherpunks Lite <cp-lite(a)comsec.com> >From: Wei Dai <weidai(a)eskimo.com> >Date: Wed, 06 Aug 1997 11:33:55 -0700 (PDT) >I suggest using information dispersal to spread risk amongst >remailer operators. Use Rabin's information dispersal technique >to divide up a document into n shares such that k of them can >reconstruct the original, and post each share via a seperate >remailer. It would be hard for the government to single out an >operator to go after since an individual share by itself is >useless. I'm a little concerned with the usefulness of this idea in a legal sense. Imagine the physical analogue: Alice buys the guns and masks, and leaves them in a pre-arranged place. Bob anonymously buys a car and leaves it, with the keys inside, in another pre-arranged place. Carol and Dave collect the guns, masks, and the car, and use them to rob a bank or hijack an airplane. Do you suppose the feds will have any problem prosecuting Alice and Bob for their part in the conspiracy? >If n>k this also increases reliability and resilience of the >eternity service against technical attacks. This part is somewhat more useful. However, n copies of the message are probably better. I think the general problem here is unsolveable--running an Eternity server is just going to be a dangerous thing to do if you live somewhere where the police are likely to see possessing, distributing, or selling some of the information on it as a crime. There are two possible solutions I can see: Either make Eternity servers so widespread that taking down individual servers in individual jurisdictions is futile, or find some jurisdictions where virtually *nothing* will provoke the police to act. (Note that legal jurisdiction isn't the only issue here. Some groups may be willing to use terrorist tactics to shut down these servers.) Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBM/ChJUHx57Ag8goBAQFTdwP/cX/+SsXEkjmSrTYcvSBP9bHsAzRcXs+z FmPIq1dd9T7Mm6tlJGe8iC4lXmpm4JVqhmZMTGoJlkw6ld1MWGiOevpDWhycpAPQ 6ohDd/R2G3dRHkWCvPklyeKQx3v8GfWAhPrupJZNNAUCIJqDMlg6kJQv4BDiEukr G7C89qeaXqA= =WXLf -----END PGP SIGNATURE----- --John Kelsey, Counterpane Systems, kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36

4 4

Re: HIP hip hooray
by Mark Grant 17 Dec '03

17 Dec '03

Zooko Journeyman (zooko(a)xs4all.nl) wrote: >HIP rocked. I'm still trying to adjust to the mundanity >of everyday life. I loved meeting some cpunks in Real >Life. Hey, Zooko! You were the only Cypherpunk who made the article in the 'Independent' (by that blonde reporter who was wandering around), though Lucky Green was mentioned by name. '"[hacking] can be a wonderful thing", explained Zooco, a member of the CypherPunks. "Pretty much every useful aspect of modern computing was devised by hackers -- like the Internet and email."' So did she spell your name wrong, or were you using a pseudonym ;-) ? Mark

2 1

Dept. of Commerce Forum on CAs
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Tue, 12 Aug 1997 12:17:40 -0700 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: "John D. Muller" <jmuller(a)BROBECK.COM> Subject: Dept. of Commerce Forum on CAs To: DIGSIG(a)VM.TEMPLE.EDU The Department of Commerce has started to build up a Web site with content from its request for comment and July 24 forum on public certification authorities. Public comments submitted electronically are now online at http://csrc.nist.gov/ecforum. John Muller jmuller(a)brobeck.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: List of crypto-related courses
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: tnh(a)nepop.mediaone.net Mime-Version: 1.0 Date: Tue, 12 Aug 1997 16:35:22 -0400 To: Robert Hettinga <rah(a)shipwright.com> From: "Timothy N. Hill" <tnh(a)acm.org> Subject: Re: List of crypto-related courses Cc: dcsb(a)ai.mit.edu, Avi Rubin <rubin(a)research.att.com> Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: "Timothy N. Hill" <tnh(a)acm.org> At 14:51 -0400 97-08-12, Robert Hettinga wrote: >--- begin forwarded text > > >From: Avi Rubin <rubin(a)research.att.com> >... > > http:/www.cs.ny.edu/~rubin/courses.html Make that <http://www.cs.nyu.edu/~rubin/courses.html> ^ ^ - Tim Timothy N. Hill <tnh(a)acm.org> "Let me tell you something, son, Wellesley, Massachusetts, USA Before you get much older. <http://tnh.ne.mediaone.net/> You cannot hit the ball, my friend, PGP 3FAA C8B3 D7BB 9C93 882E With the bat upon your shoulder." 4221 2F66 EFF4 00C6 CF92 - Bill "Lord" Byron, The Singing Umpire For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

The Card!!!!!
by mornings＠concentric.net 17 Dec '03

17 Dec '03

CASH ADVANCE APPROVED: YES APPROVAL NUMBER: 000-458249 CREDIT LIMIT: $3,000.00 APPROVAL EXPIRES: 09/01/97 CREDIT PROVIDER: MORNINGSTAR BANK AFFILIATION: NONE CARD ISSUED: MORNINGSTARCARD MEMBER STATUS: PENDING ANNUAL FEE: NONE APR: 17.99% DEAR FUTURE CARDHOLDER, CONGRATULATIONS! YOU HAVE BEEN PRE-APPROVED FOR A $3,000.OOO UNSECURED CREDIT LINE FROM THE FINANCIAL DIVISION OF MORNINGSTAR ENTERPRISES REGARDLESS OF YOUR PAST CREDIT. YOUR APPROVAL NUMBER IS 000-458249 AND YOUR PRE-APPROVED CREDIT AMOUNT OF $3,000.00 FOR CREDIT PURCHASES AND CASH ADVANCES WILL BE AVAILABLE ONCE YOU RECIEVE YOUR MORNINGSTARCARD JUST BY CALLING NOW! AS A MEMBERSHIP BENEFIT, YOU WILL BE PROCESSED* AT NO COST FOR AN UNSECURED MAJOR CREDIT CARD WITH A CREDIT LINE OF UP TO $5,000.00 REGARDLESS OF PAST CREDIT. SEND NO MONEY NOW - THERE IS NO SECURITY OR MONEY DEPOSITS REQUIRED! CALL IMMEDIATELY WITH YOUR APPROVAL NUMBER TO ACTIVATE YOUR MEMBERSHIP AND ITS BENEFITS. BY ACTING NOW - WE'LL ASSIGN YOUR MORNINGSTARCARD WITHIN THE NEXT 48 HOURS AND THEN APPLY YOUR ONE TIME MEMBERSHIP FEE BY THE PAYMENT METHOD YOU PREFER. IN ADDITION, YOU'LL RECEIVE $100.00 OFF YOUR FIRST CREDIT PURCHASE OVER $200.OO WITH THE MORNINGSTARCARD JUST BY CALLING NOW! GETTING MORE CREDIT IS AS SIMPLE AS CALLING US TODAY T0 ACTIVATE YOUR MEMBERSHIP AND TO OBTAIN YOUR PIN CODE FOR CASH ADVANCES BEFORE YOUR APPROVAL EXPIRES. SO CALL NOW AND GET THE CREDIT YOU DESERVE. 100% QUALITY ASSURANCE AND NO LESS! CALL RIGHT NOW(IF BUSY KEEP TRYING) ********** 1-702-435-1930************** FOR IMMEDIATE ACTIVATION AND ESTABLISH FOR CREDIT TODAY! * YOU MUST CALL TO OBTAIN YOUR PIN CODE FOR CASH ADVANCES AND FOR MEMBERSHIP ACCEPTANCE ALONG WITH OBTAINING COMPLETE DETAILS OUTLINING OUR PROGRAM!

1 0

Re: Florida Drivers Permits and a Hello
by Alan Olsen 17 Dec '03

17 Dec '03

>What is the capacity of the mag strips. Do they carry much more than some >ID code for computer reference? It seems unlikely that there is enough >storage >for a thumbprint. Some vitals perhaps, but again it would most likely simply >be a speedier way of referencing the card holder's supposed True Name. (After >all they'd have to be checking driving record information as well.) Still >decrypting the cards would be amusing, just to aggravate those who become to >used to the convienience. 'Oh.. sorry Governor Wilson... my but you look >different up close'. They would not have to include an entire thumbprint. The actual code used to verify fingerprints is not very large. All that would be needed is enough information to ID into the "official" records and enough checksum type information to prevent alteration/counterfitting. Using magnetic media for this is a bit foolish as it can be changed/destroyed with the stroke of a magnet. I will not say by what means I would think should suit as a better encoding scheme because: 1) They are not using it and 2) I do not want to give them any ideas. | Visualize whirled keys! | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites | Disclaimer: | |all mankind free in one-key-stenography-privacy!"| Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

3 2

"Virtuosity" -- A New Movie
by tcmay＠got.net 17 Dec '03

17 Dec '03

I make no apologies for this not being "on topic," where "on topic" is defined as "coding in C." If you don't like my comments to our community, you know how to filter out my messages. I saw "Virtuosity" today, not expecting much. It's been called "a stinker" by at least one reviewer. But I enjoyed it. It had fairly impressive effects and fairly accurate treatments of: -- "microlocators" (implantable localizers) (The technology of which, in the real world, Bob Fleming and Cherie Kushner described at the "Cypherpunks Santa Cruz" meeting/party at my place on Saturday. By the way, the meeting was well-attended, with 22 attendees, including Greg Broiles from Eugene, Oregon, Jeff Simmons from San Luis Obispo, and a bunch of folks from the Santa Cruz area and Bay Area.) -- nanotechnology...well done -- genetic algorithms and evolving programs...very, very well done! -- virtual reality...less well done, especially as it's been done before There were a few disconnects, such as that the time for the movie seemed only a few years in the future, and yet certain technologies were very far advanced. I was impressed, much more so than with "The Net" or other recent high-tech movies. (I can' t wait for "Pulp Science Fiction"!) For those who think this off-topic, "Man does not live by coding alone." --Tim ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Cypherpunks are a bunch of happy people
by nobody＠replay.com 17 Dec '03

17 Dec '03

Cypherpunks are a bunch of happy people basr Discussed were, amongst many other subjects, PGP encryption, building personal anonymous remailers, encryption of IP packets, and a kind of anonymous remailing system for IP packets (http, ftp, ...) using 'onion' servers. These guys promised us some nice stuff for our homes and schools in the near future like your own nice 'n' small anonymous remailer. If many people put these up and a system of anonymous remailers who give messages to each other before delivering it to the addressee is established, you can always say that *your* remailer was just one of the middlemen, receiving stuff from other anonymous remailers. Next, we are going to get cheap (under US $1.000) linux routerboxes that encrypt all traffic you send out to the network. Specially designed for the school and the home. This makes surfing in the childrens bedroom perfectly safe again! On the anonymous remailing of IP packets project the cypherpunks are workng together with the naval security of the USA. Why? These naval security people are working on the same thing, and they need other traffic using the same protocols to hide their own traffic in. Otherwise everyone can see they are transmitting from A to B. However, the cypherpunks had to explain the naval security first that if they want this technique more widespread, they have to make it available for cheaper machines and morre widely used operating systems... something they had not thought of themselves. You might think: "Is all this not illegal?" No it's not (yet, in most countries), and making up laws costs more time than writing good encryption software, so say the cypherpunks. That is... if they can find enough people to write the software. Yes, you guessed right, they are hiring! http://magazine.dds.nl

1 0

Re: R.I.P. John Brunner
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:03 PM 8/28/95, Alan Bostick wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Science fiction writer John Brunner died last Friday, August 25, from >a massive stroke, while attending the World Science Fiction Convention >in Glasgow, Scotland. > >Among several other notable works, Brunner was the author of THE SHOCKWAVE >RIDER, a groundbreaking vision of the information age that inspired and >forsaw much that was pertinent to the Internet in general and the >Cypherpunks in particular. > >Let us pause a moment to note his passing and honor his life and >contributions. I am saddened to learn this. And, yes, this has a lot to do with Cypherpunks. I read "Stand on Zanzibar" with rapt attention in 1969 or so, and it had a big influence on me. Ditto for "The Shockwave Rider," one of the very first explications of how identities would be changed, how the State would insist on computerized identities. (Indeed, "1984" came first, and is an even more important work, by any standards, but Brunner still nailed the effects of computers in a way that Orwell could not possibly have.) Christ, what an imagination he had! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Searchnet
by The Gate 17 Dec '03

17 Dec '03

Some time ago, I posted a reply to an allegation that the Spotlight was a Klan paper. Of course, it is more Liberty Lobby/CIA, with Bo Gritz on the Board. The point of this post is that those who want to know what is up with the Spotlight need to subscribe to Searchnet, which covers all the information of like sort. There was also a wonderful post recently hailing hackers as the ones who are most likely to prevent government sponsored crypto-terror censorship. Those who would like the post, speak up. Those who want to subscribe to Searchnet, likewise. Hope this does not get in the way of PGP implementation. Onwards, Lee ____________________________|||||||||||||||||||||______________________________ R. Leland Lehrman@The Gate, New Haven, CT. http://id.wing.net/~gate/gate.html God, Art, Technology and Ecology Research and Development >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Do you love the Mother?>>>>>>>>>>>>>>>>>>>>>>>>

2 1

Correction: List of crypto-related courses
by Avi Rubin 17 Dec '03

17 Dec '03

Oops, I got the URL a bit wrong in my last posting. Here it is again with the corrected URL. For the last year or so, I have built and maintained a list of graduate level courses on cryptography and security. The current list can be found at http://www.cs.nyu.edu/~rubin/courses.html I would like to keep this list as current as possible, so if you have any additions/corrections, etc, please let me know. I am only interested in full-semester courses at universities. Thank you, Avi ********************************************************************* Aviel D. Rubin rubin(a)research.att.com Secure Systems Research Dept. Adjunct Professor at NYU AT&T Labs - Research 180 Park Avenue http://www.research.att.com/~rubin/ Florham Park, NJ 07932-0971 Voice: +1 973 360-8356 USA FAX: +1 973 360-8809 --> Check out http://www.clark.net/pub/mjr/websec/ for a new book on web security (The Web Security Sourcebook). *********************************************************************

1 0

Re: Florida Drivers Permits and a Hello
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:47 PM 8/29/95 -0500, you wrote: >Alan Olsen writes >>They would not have to include an entire thumbprint. The actual code used >>to verify fingerprints is not very large. All that would be needed is >>enough information to ID into the "official" records and enough checksum >>type information to prevent alteration/counterfitting. Using magnetic media >>for this is a bit foolish as it can be changed/destroyed with the stroke of >>a magnet. I will not say by what means I would think should suit as a >>better encoding scheme because: 1) They are not using it and 2) I do not >>want to give them any ideas. > >What possible value could the LEAs get by having your thumbprint digitally >encoded on your driver's license? It's not like the average cop-on-the-beat >is qualified to lift a fingerprint and compare it. Even if he was, how >does it benefit that the fingerprint is on the license? > >This seems silly. I was pointing out that it was possible. I was not trying to make the point that there was any *USE* for such a thing. (Evidently some ID cards now carry such prints. California does, if memory serves me correctly.) Just because something is silly does not mean it will not be tried by someone in law enforcement. In fact, there seems to be a corelation between silly acts and law enforcement... (Or at least those making the rules about law enforcement.) And if you think it cannot get any worse, Pete "I want to seal the borders" Wilson has announced he is running for president. We will be getting a large number of silly laws and pronouncements if the American people are stupid enough to elect him to high office. > > | Visualize whirled keys! | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites | Disclaimer: | |all mankind free in one-key-stenography-privacy!"| Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

Re: Florida Drivers Permits and a Hello
by d-jones＠ix.netcom.com 17 Dec '03

17 Dec '03

>What possible value could the LEAs get by having your thumbprint digitally >encoded on your driver's license? It's not like the average cop-on-the-beat >is qualified to lift a fingerprint and compare it. Even if he was, how >does it benefit that the fingerprint is on the license? > >This seems silly. There are device that will electronicly read fingerprints available now. So with such a device, the LEO would know instantly if you were who you said that you were.

4 3

Why the government should protect our privacy
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 12 Aug 1997 20:15:33 -0400 From: Marc Rotenberg <rotenberg(a)epic.org> To: declan(a)well.com, Michael Sims <jellicle(a)inch.com> Cc: fight-censorship(a)vorlon.mit.edu Subject: Re: trustee, shmustee At 7:46 PM -0400 8/12/97, Declan McCullagh wrote: >On Tue, 12 Aug 1997, Michael Sims wrote: >> >> What groups want for privacy of individuals: >> >> Government: Lots > >Michael, thank you for reminding us of the Clinton administration's >valiant efforts to protect individual privacy. > >I agree that we should blissfully ignore that we're talking about the >Clipper Chip president, the Digital Telephony guy, the same fellow who >will veto any pro-privacy crypto bill. We should try to forget last >year's anti-terrorism bill, push for roving and multipoint wiretaps, and >FBI desires to ban nonescrowed domestic crypto. No longer should I be >concerned about the administration's quest for enormous voracious >databanks that will be tied together -- airport security, travel records, >national id cards. And of course ACLU legislative counsel Don Haines is a >fool when he speaks of "the Clinton-Gore effort to hardwire Big Brother >into the information age. > >Silly me. > Declan is absolutely right. Good thing there are no real privacy officials in the federal government and no privacy laws for the Internet to get in the way of these efforts. Has anyone else noticed that the most sweeping proposals for surveillance are coming from the administration that has backed the fewest privacy laws of any administration in 30 years? Mere coincidence? I don't think so. Marc. ================================================================== Marc Rotenberg, director * +1 202 544 9240 (tel) Electronic Privacy Information Center * +1 202 547 5482 (fax) 666 Pennsylvania Ave., SE Suite 301 * rotenberg(a)epic.org Washington, DC 20003 USA + http://www.epic.org ==================================================================

2 1

SSL keyspace etc.
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

regarding SSL challenge, I am not following this close enough to understand completely, but I thought I would offer a few suggestions for tweaking the code: -- the issue of grabbing keyspace has been raised. what if someone malicious just yanked huge areas of keyspace and didn't search them? it seems that the clients need to return to the server some evidence that they have searched their keyspace in question. the server could verify this evidence. for those that don't return the "evidence", that keyspace could be reallocated to other comers. the simple approach to all this, if you don't have "evidence", is to just have the server keep reallocating the same space over and over to different crackers. hopefully eventually every part of the keyspace would be allocated to a "legitimate" worker. -- the issue of efficiency is very fascinating for this project. essentially the server has no idea what the block size of key blocks it should dole out. obviously the server would want to try to dole out equal *processing chunks* such that the remote machine reports back in a certain amount of time, no matter what architecture. the problem of course is that remote machines all have different efficiency. two possibilities: a sort of "bogomip" calculation is done in the client, and its processor speed is reported to the server. the server uses this in a calculation to determine how much to dole out. it could try to derive a best fit linear relationship between space covered and processor spead, or build up a table of results and interpolate for new requests. note that the efficiency issue also ties into "what if people take keys they don't solve". if the server knows roughly how long a client should take to report back, and it never reports back, it could then reallocate that key space. -- another problem of efficiency is that the server is clearly a bottleneck for servicing requests. the question arises: suppose that the server could determine the precise interval between which machines would go back to it for new keys. what is the optimum interval over the whole project? in other words, give the number of machines participating, and their processor speeds, what size of key space should be parceled out to the next request so that the bottleneck at the server is minimized? this optimum interval must be very hard to derive, because it depends on the contention based on many incoming connections. it would involve some probabilistic approximations of the likelihood of collisions. to model it, you might consider a request as taking [n] seconds of time, and consider that if any two requests are in contention, a retry happens after [m] seconds. you could build up models that would try to minimize the time based on empirical simulations. however I would be exceedingly impressed if someone could derive a formula for this, or give it from some textbook. -- adaptive algorithms for all these situations are possible. the server could use a "hypothesis" in the sense of partitioning out a starting size of keyspace, and then watch how long it took the client machine to respond, and then assume a linear relationship or something to compute the size of the next keyspace to hand out to the machine. the server could continually watch how closely its "hypothesis" (i.e. its estimations of how long a given machine will take) match the actual returns. -- more on the idea of evidence: we are working with a hashing algorithm, right? as evidence the client machines could return checksums of all the hashes of all the keyspace it searched. it could break up its own search space into blocks and return the checksums on the hashes for each block. the server, if it wanted to, could verify these blocks running its own computations. if it ever found a client was "unreliable", it could then diminish the keys sent to the unreliable client, or even send it areas of search space it didn't care about anymore (i.e. areas that have already been confirmed searched by a more "reliable" client). -- in fact all this reminds me of the process of intelligence gathering by an agency, which could be formalized as follows: suppose that the agency wishes to identify "quality information". it has a set of sources, A,B,C,D.... now, it can send questions out to these sources and get information from them. some of them however would be "unreliable". the agency must devise some means by which it can weed out the unreliable sources. note that this may even involve sending them bogus instructions to keep them busy so they do not themselves suspect they have been "discovered" and then change their defective plans. obviously, one of the most important intelligence tools in this matter is that of *correlation*. you have to determine "truth" (or "quality information") via the correlation between answers that the different sources give you. also important to correlation is *redundancy*. you sometimes have to ask more than one source the same question, and test the answer. in this model, if A and B give different answers, you know that one of A or B is "unreliable". what is very interesting in our case of cracking keys is that the server can verify the information on its own. in other words, it has a *control* that it knows is correct that it can judge against the answers "out there". unfortunately, in contrast, real intelligence agencies are not always privy to this kind of certain "control" and in fact have to determine "truth" entirely from a set of sources, any of which might be unreliable. in this case one has to have a hypothesis about what is the "truth" and test it to see if it holds up consistently with all information. the approaches of attackers are obvious. the most obvious is that of collusion and infiltration. but I will save the rest for some NSA spook to elaborate. there are certainly enough colluding and infiltrating on this list <g> -- one of the reasons all this interests me is that it really reminds me of some projects I have worked on in the past. in high school I wrote a network mandelbrot set program (client/host). the issue of contention arose and it appeared to me to look like an upside-down parabola after I plotted some points (curving up, that is). i.e. the optimum was at the pit of the parabola, and when too few or too many requests happened, the speed over the overall simulation was increased above the optimum. some very ingenious readers may actually be able to locate this code, which I put in the public domain over 5 years ago. -- another thing I worked on was trying to find the optimal block size of communications protocols such as Zmodem, which generally instead just pick arbitrary block sizes 2^n. I actually was able to attack this problem analytically through the observations of the properties of infinite series and calculus techniques. it is a similar problem but the idea of contention really complicates this issue. (for what I studied, there was only one client and one server, so to speak). I still have this paper in Latex format and if anyone is interested I would be happy to send it to you. it's a really nice example, IMHO, of how if you use your brain and some mathematics, you can really get a far more elegant approach than brute force, and know with much greater certainty that what you are doing makes sense mathematically. an awful lot of programmer just tend to bang on the keyboard with out thinking of the theoretical implications of their work. this is understandable given that the theoretical implications of even trivial programs (such as the SSL client/server interactions) can be mathematically extremely daunting, requiring even differential equations to model fairly simple pieces of code. -- well, that is my contribution of the moment into the cypherpunk annals. one never knows what a little combination of boredom and inspiration can lead to. --V.Z.Nuri

1 0

Re: Guy Polis (fwd)
by Rabid Wombat 17 Dec '03

17 Dec '03

Lame forgery. -r.w. ---------- Forwarded message ---------- Received: from sirius.infonex.com (sirius.infonex.com [206.170.114.2]) by mcfeely.bsfs.org (8.6.12/8.6.12) with ESMTP id AAA19634 for <wombat(a)mcfeely.bsfs.org>; Tue, 12 Aug 1997 00:48:20 -0400 Received: (from majordom@localhost) by sirius.infonex.com (8.8.5/8.7.3) id SAA11251 for cypherpunks-outgoing; Mon, 11 Aug 1997 18:52:35 -0700 (PDT) Received: (from cpunks@localhost) by sirius.infonex.com (8.8.5/8.7.3) id SAA11069 for cypherpunks(a)infonex.com; Mon, 11 Aug 1997 18:51:57 -0700 (PDT) Received: from rigel.cyberpass.net (root(a)rigel.infonex.com [206.170.114.3]) by sirius.infonex.com (8.8.5/8.7.3) with ESMTP id SAA11040 for <cpunks(a)sirius.infonex.com>; Mon, 11 Aug 1997 18:51:47 -0700 (PDT) Received: from toad.com (toad.com [140.174.2.1]) by rigel.cyberpass.net (8.8.5/8.7.3) with ESMTP id SAA16287 for <cypherpunks(a)cyberpass.net>; Mon, 11 Aug 1997 18:49:20 -0700 (PDT) Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id SAA24951 for cypherpunks-unedited-outgoing; Mon, 11 Aug 1997 18:31:39 -0700 (PDT) Received: from wombat.sk.sympatico.ca (wombat.sk.sympatico.ca [142.165.5.136]) by toad.com (8.7.5/8.7.3) with ESMTP id SAA24939 for <cypherpunks(a)toad.com>; Mon, 11 Aug 1997 18:31:33 -0700 (PDT) Received: from default (lohner24.sk.sympatico.ca [142.165.98.24]) by wombat.sk.sympatico.ca with SMTP (8.7.1/8.7.1) id TAA03761 for <cypherpunks(a)toad.com>; Mon, 11 Aug 1997 19:27:46 -0600 (CST) Message-ID: <33EFBCAD.5D8(a)mcfeely.bsfs.org> Date: Mon, 11 Aug 1997 19:30:21 -0600 From: Rabid Wombat <wombat(a)mcfeely.bsfs.org> Organization: Electronic Forgery Foundation X-Mailer: Mozilla 3.01C-SYMPA (Win95; U) MIME-Version: 1.0 To: cypherpunks(a)toad.com Subject: Re: Guy Polis References: <g6maBe1w165w(a)bwalk.dm.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)cyberpass.net Precedence: bulk Reply-To: Rabid Wombat <wombat(a)mcfeely.bsfs.org> X-List: cypherpunks(a)cyberpass.net X-Loop: cypherpunks(a)cyberpass.net Dr.Dimitri Vulis KOTM wrote: > There's a crackpot by the name of Guy Polis (guy(a)panix.com, polis_guy@ > jpmorgan.com) who posts a crackpot "cryptographic manifesto" and sounds > like a bad troll intended to make the folks who promote the use of crypto > look like, well, crackpots. Be warned. Tim May wrote: > Yeah, and like we're gun-nuts, too! The mammalian jackass is also claiming that all crypto promoters are marsupials. -rw

1 0

Poisson numbers for random keyspace assignment
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:03 PM 8/29/95, Damien Doligez wrote: ... >But you fail to take into account the probability that the search will >have to go that far. > > >This is how I compute the expected cost of the random search. > >The probability of finding the key upon searching the k-th segment is: > > k-1 > p(k) = (1 - 1/n) . 1/n > >The expected cost is the sum of all possible costs, weighted by their >probability: > ___ ___ > \ \ i-1 >e = > i p(i) = 1/n > i (1 - 1/n) > /__ /__ > i = 1..oo i = 1..oo ... I haven't checked Damien's notation and confirmed the results, but I have another way of looking at it, which I think produces the same results. Last night (but it didn't arrive at my site until moments ago, for some reason) I wrote: >On the positive side, let everyone simply attack the keyspace as they see >fit, picking random parts to attack. This should not be "worse" than a >factor of several from a "perfectly coordinated" attack. (I haven't spent >time calculating this, but my intuition is that a random attack, with >overlapping keyspace, is not a lot less efficiently attacked than >attempting to arrange for no overlaps...just based on my mental picture of >dropping line segments randomly on some interval and figuring coverage of >the line segment.) Here's what I meant, in more detail: Imagine the overall keyspace to be searched as a line segment of some length: [------------------------------------------------] Now imagine various people randomly picking starting points and doing some segment, depending on their compute power: [---] [--] [--------] [------] [-] [--------] ...and so on, with the various line segments scattered randomly. Some will overlap, meaning the same keyspace segment is being searched by two or more people. If the total length (summation) of these line segments is the same as the "brute force exhaustion" of the keyspace, we can do some interesting calculations. For example, the "expected" number of hits per point is "1". But some points will be hit 0 times, others will be once, twice, three times, etc. (This is in the nature of random processes, as each line segment is random and "independent" of what other people may have independently picked.) The Poisson distribution fits this situation exactly, with the _actual_ number of hits computed by: P(s;m) = (e ^ -m) (m ^ s) / s! where s is the actual number of hits and m is the expected number. P(s;m) is the probability of seeing s hits when m are expected. s m P(s;m) 0 1 1/e, or .368 1 1 1/e, or .368 2 1 .184 etc. That is, with the "total exhaustion" amount of computation there will be 36.8% of the keyspace left unsearched, simply because nobody's random segments landed on this fraction of the overall segment. If twice, three times, four times, etc. as much effort is put into it (enough to brute force the search space twice, using nonrandom assignment), then s m P(s;m) 0 2 .135 0 3 .0498 0 4 .0183 For s = 0, P(s;m) = e ^ -m Several conclusions can be drawn. Here's what I conclude: * For opportunistic attacks on keys in challenges, the odds are 95% that a key will be found with only twice the total effort (or time) using a totally random method of picking up keyspace to search. * This is probably good enough. (And if one only wants to be 90% sure of finding the key, even less effort is needed.) * And this affects several of the "denial of service" attacks mentioned here by others, including finding the key but not reporting it (for whatever reasons), claiming too much keyspace, etc. This is because some of the same regions are actually being searched two or more times. * This of course gets rid of the assignment problems. * If the intent is to show that keys can opportunistically be found, the random assignment method works pretty well and is "good enough." If, for some reason, a key _had_ to found, then a more careful, nonrandom assignment method would be best. As assignment methods get better, a crossover will occur, and the random assignment method will lose its advantages. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0