December 2003 - cypherpunks-legacy

NEW ON THE NET
by goldencareers.com＠renoir.webservices.net 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> NEW ON THE NET. How would you like to have been part of the first group to join Amway in the 60s or purchased stock from a small company called Wal-Mart in the 70s or had invested in a small computer chip maker called Intel of the 80s. Anybody that made these decisions above are sitting pretty good at the moment Here in the 90s a new company, was launched on the net, This young company has positioned itself to be among the major players for years to come. This is not a get rich scheme. This is simply a new company, with fresh ideas, a new company that people are going to hear a lot about. If you would care to become a part of all the excitement, and learn more, just simply send e-mail to sales(a)scarlett.org Please put MORE INFO. in the subject field.You will have info. vary soon. THIS IS TRULY A COMPANY AHEAD OF IT'S TIME. Thank You For Your Time. </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Re: trusting the processor chip
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:01 AM 4/26/96, Christian Wettergren wrote: ... >They "promised" to build their own "processor tester" to try to find >the most obvious ones at least. But it will be very hard to find all of >these bugs, judging from the released bugs. Some of them are only >appearing sporadically under a pretty complicated set of circumstances, >like what is in the pipeline, the cache etc... > >The processor is ever important, if it is illdefined or flakey, it is >almost impossible to build security on top of it. Maybe true in theory, under special circumstances, but not something of immediate importance. Finding bugs is important, but no modern processor chip set (including the peripheral chips) is likely to be "100% secure," whatever that means. (The NSA and its minions put out the "Rainbow Books" to define this, and few machines come close to the top rating...) There was a British plan some years back to develop a "provably secure" microprocessor for life-critical applications, e.g. train controllers. It was called "Viper." Last I heard, the project was not progressing. It seems that most people would rather use the hundreds of MIPS of processing power of a modern, high-density processor that the sub-MIPS power of a Viper-type chip. (I'm not of course saying that processing power and security are inverses of each other, only noting that they haven't gone together so far.) The most famed chip flaw of all time had no security implications, nor would it ever have affected a single life. (Except stock market lives.) I'm glad Intel offered a recall and fixed the bug, but the plain fact is that the bug truly was obscure and could only be demonstrated under contrived conditions. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Click here to become an International Arms Trafficker
by Vincent Cate 17 Dec '03

17 Dec '03

"Click here to become an International Arms Trafficker" Offshore Information Services Ltd. has set up a web page to make it really easy for people to become International Arms Traffickers. All they have to do is fill in their name and email address and then click. Check out: http://online.offshore.com.ai/arms-trafficker/ If you think this is half as funny as I do, please make a link from one of your pages to this one. -- Vince

1 0

Re: US law - World Law - Secret Banking
by jim bell 17 Dec '03

17 Dec '03

At 02:13 AM 4/26/96 -0700, Rich Graves wrote: >On Fri, 26 Apr 1996, Michael Loomis wrote: > >> I have been reading this list to get an idea where Declan gets some >> of his lunatic ideas and what Rich Graves says when he is not up to >> Holocaust fetishism. Despite Timothy's claim to the contrary, it seems >> that the basic point of this list is some libertarian notion that tax >> evasion is a good thing. > >That might be one view, but not mine. I think people who evade income >taxes are bad -- they're stealing from the rest of society. If a criminal mugs you for $10 each morning for a month, and on the 32nd day you decide you've had enough and pull a gun and defend yourself, does that mean that you're stealing from him?!?

1 0

Re: trusting the processor chip
by Rick Smith 17 Dec '03

17 Dec '03

Having penned the response to Jeffrey Flinn on the unlikelihood of processor back doors, I'll comment on jim bell's response: >This analysis seems to assume that the entire production run of a standard >product is subverted. Actually, I perceived two models: either all processors are subverted or a subset of them are. Both require a reasonably complete design team to reliably achieve the objective of a well hidden and reliable back door. The cost effective thing to do is use the original design team since they have the knowledge you need to pull it off. A different and/or much smaller team has a lower likelihood of success. > More likely,I think, an organization like the NSA >might build a pin-compatible version of an existing, commonly-used product >like a keyboard encoder chip that is designed to transmit (by RFI signals) >the contents of what is typed at the keyboard. It's simple, it's hard to >detect, and it gets what they want. Simple, no. Hard to detect, somewhat. Gets what they want, unclear. My experience with processor design and development is rather ancient and my knowledge of IC work is third hand, so I'll gladly defer to someone with closer knowledge of the process (Tim?). However, I've never heard anything to imply that a processor architecture can be cleverly and reliably dinked with in this manner without lots of expensive engineering. Where does the chip real estate come from? Is there room in the microcode for this? Will it destabilize other behaviors? Will the victim detect it through RFI testing? No, it's not impossible. The risk vs reward tradeoff is shaky. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: trusting the processor chip
by tcmay＠got.net 17 Dec '03

17 Dec '03

My 9th grade classmate Rick Smith wrote: >Having penned the response to Jeffrey Flinn on the unlikelihood of >processor back doors, I'll comment on jim bell's response: >> More likely,I think, an organization like the NSA >>might build a pin-compatible version of an existing, commonly-used product >>like a keyboard encoder chip that is designed to transmit (by RFI signals) >>the contents of what is typed at the keyboard. It's simple, it's hard to >>detect, and it gets what they want. > >Simple, no. Hard to detect, somewhat. Gets what they want, unclear. I haven't been commenting on this part of the thread, but since I am asked to (below), I'll say that I agree with Rick on these points. Though there have been fictional accounts--e.g. the French novel "Softwar"--about replacement of chips with TLA versions, this tack is very hard to pull off. (The Infoworld "April Fool's Day" 1991 report that the NSA had arranged for printers entering Iraq to be modified so as to send intelligence info was gullibly picked up by several outfits that should've known better and reported as fact.) >My experience with processor design and development is rather ancient >and my knowledge of IC work is third hand, so I'll gladly defer to >someone with closer knowledge of the process (Tim?). However, I've >never heard anything to imply that a processor architecture can be >cleverly and reliably dinked with in this manner without lots of >expensive engineering. Where does the chip real estate come from? Is >there room in the microcode for this? Will it destabilize other >behaviors? Will the victim detect it through RFI testing? For high-volume parts, such as the chips in the usual PCs we all use, such a replacement would almost certainly need the cooperation of the chip makers. Not impossible to obtain, but not easy. A new "stepping" of the chip would probably be needed, though I suppose a chip with downloadable microcode could be used. Much more like, in my opinion, would be subversion of the software, a la Thompson's point about subverting compilers. And the work already done on "subliminal channels" that leak information (deliberately in this case) is apropos. I know that such channels were a major concern during the discussions of nuclear arms treaties. Speculatively, if such a hardware replacement is likely, this is where I would look first; but of course the parties to nuclear arms agreements know this as well. Anyway, there are all sorts of "maybes" and "possibles" here. Certainly there is no _technical_ reason why a "Pentium--NSA-enabled" variant of the Pentium could not be made...all things are possible. But how likely? And where in the spectrum of real concerns does it lie? And would Intel dare to cooperate with such a plan? And so on. This'll have to be my last word on this topic. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Guardian angels, anonymity, and the decency brigade
by Declan B. McCullagh 17 Dec '03

17 Dec '03

Thanks, Colin, for replying. I'm glad to learn that you made no legal threats against Jim's CuD. I understand that SafeSurf does not make sofware; I meant that a PICS/SafeSurf-compliant browser is necessary to read and act on such ratings. A few months ago, I went through the back archives of the fight-censorship list and looked for possibly "indecent" material. I found relatively few examples of this language, and all of them had clearly socially redeeming value, like the American Reporter's rather heated essay. The alt.sex.pedophilia story I cited was circulated among the anti-porn groups who fought for the CDA; in context, it was perfectly appropriate for us to discuss here. Further, I believe quite strongly that minors should be allowed and encouraged to participate in discussions on this list -- overbroad net-censorship affects them as well as adults. Yet you write: "Clearly a site with a message like this would not be suitable for children to read." What if I rate <http://fight-censorship.dementia.org/top/> as suitable for children, and a CyberAngel volunteer visits and stumbles onto that alt.sex.pedophilia story. Will my rating be yanked? This is what bothers me -- the undocumented, arbitrary, and capricious nature of ratings by the CyberAngels volunteer decency brigade. I support your right to censor my web site, but I don't have to like it. -Declan (who still wants to be a CyberSeraphim) ---------------------------------------------------------------------- [Another reply attached] ---------------------------------------------------------------------- Date: Fri, 26 Apr 1996 11:20:12 -0400 From: Tom Betz <tbetz(a)pobox.com> Subject: Re: Guardian angels, the decency brigade, and cyberseraphim Colin Gabriel Hatcher wrote: > As for press, we didnt even send a press release until 4 months after we > started, and then only to announce our website. And we've only sent one > more press release out since then. We do believe however that we have > helped to bring the issue of children and the Internet to the forefront and > that is a good thing too. This claim is totally disingenuous. They have the biggest PR whore on the face of the Earth flacking their efforts almost daily on NYC talk radio, and they dare to pretend to have only sent out one press release? What kind of training do these people receive? I heard an NPR story on this organization where every telecommunications term of art a CyberAngel used was used incorrectly, always with a sick misinterpretation. I'll dig up citations if anyone is interested. Despite what they 'believe', CyberAngels have helped to do nothing but inflame the passions of the ignoranti against the Internet, and to make a nearly non-existent threat into a major political football. Oh, and to give Curtis Sliwa one more dead horse to flog on the air. The whole thing disgusts me. -- ---- Tom Betz --------- <http://www.pobox.com/~tbetz> ------ (914) 375-1510 -- tbetz(a)pobox.com | We have tried ignorance for a very long | tbetz(a)panix.com ------------------+ time, and it's time we tried education. +----------------- -- Computers help us to solve problems we never had before they came along. --

1 0

Re: trusting the processor chip
by smith＠sctc.com 17 Dec '03

17 Dec '03

At 10:23 AM 4/26/96, jim bell wrote: > By NSA standards, it is simple. NSA has probably had its own > semiconductor fabs for 30+ years. Yep. Regardless of whether the fabs are government property or not, it's a sure thing that some contractors have appropriately SCIFfed fabs and appropriately cleared staffs. > Even if we assume that > their capabilities lag commercial production in terms of > density or quality, keyboard encoder chips were trivial 20+ > years ago and could presumably be easily > duplicated/modified today by even the oldest operating fabs. > They probably had far less than 10,000 transistors. Even > modern keyboard controllers probably "waste" a > microcontroller with far more capability than you'd need > for the task, and microcontrollers usually have > substantially more code area than would be necessary to add > some sort of surreptitious function. Agree. Keyboard controllers (and other peripheral components of a system) are a much more tractable target than the CPU and may be within the capbailities of such organizations. I'm more inclined towards disk controller subversion myself. Of course, there's also the apocryphal story of the so called "Iraqi printer virus" that disabled the Iraqi air defense system. Subverting the CPU is not simple even by NSA standards. Rick. smith(a)sctc.com secure computing corporation

1 0

Re: [NOISE] What is "laser material"?
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:05 PM 4/25/96 -0700, Bill Frantz wrote: >> Moreover, a laser shot costs $3,000, compared to several >> million dollars for a missile. Army officials envision the >> Nautilus would be beamed from a truck capable of firing 50 >> shots before requiring more laser material. > >Does anyone have any idea what "more laser material" means? It means that the laser burns itself up when fired. Either they are pumping gas into the laser and eventually run out or they are using something that is solid or semi-solid (yes, you can make a laser out of Jello!) that becomes non-functional after a certain number of uses. The plans I have for a somewhat high powered laser (10 watts) requires nitrogen pumped through the tube. Run out of nitrogen and you run out of laser... The problem with laser based weapons is they are weather dependant. Try using a laser in the rain and see how coherent a beam you get. What this has to do with crypto, I have no idea... (Maybe they are going to try and etch RSA in four lines of Perl into the side of the whitehouse.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

2 1

Re: An idea for refining penet-style anonymous servers
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:15 AM 4/25/96 -0700, Alan Bostick wrote: >The other night, while sick and feverish with the flu, a scheme popped >into my head that would seem to make penet-style anonymous servers less >vulnerable to compromise through seizure of the remailer equipment or of >the address database... > >My scheme is the design of the address database. It consists of two >hash tables, one for sending messages (which maps anonymous IDs onto >sender's addresses), and one for receiving them (mapping recipient's >addresses onto anonymous IDs). A cryptographically secure hash (say, >MD5) is used for the index of both tables. > >The index of the sending message table is the MD5 hash of the sender's >address. The table entry the index points to is the sender's anonymous >ID, encrypted by a symmetric algorithm (maybe IDEA). The encryption key >would be a different hash, by another algorithm (let's suppose it's >SHA), of that same address. > >... > >The receiving message hash table is designed similarly, in reverse. The >index of the hash table is the MD5 hash of the anonymous ID; the entry >in the table is the recipient's email address, encrypted with the SHA >hash of the anonymous ID... Assuming you have obtained the address database, it seems to me that this scheme is subject to known address attacks: (1) If you want to find out what newbie(a)slowresponse.com's anon ID is, you just look it up. (2) If you want to find out the real email addresses of all the users, you test all the anon-ids with the reverse lookup table. This attack could be defeated by using sufficiently long random anon-ids. If we assume 5 bits of information/character, a 96 bit anon-id (sufficient to preclude exhaustive search attacks) would require 19 character anon-ids. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: The Joy of Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Tim May and Mike Duvos have expresses an enthusiasm for Java which I share. There are a few practical issues which should be addresses. Mike says: >Indeed, with Java, I can put up a Web page which teaches someone >about a cryptographic algorithm, allows him to try it out and run >sample data through it, and provides him with a >platform-independent implementation of it to use as he wishes. >All in one fell swoop. That's a pretty powerful concept. But with the #$%^& ITAR you have to do it outside the USA/Canada, or limit it to USA/Canadians. The patent situation with RSA doesn't help making applications inter-operate with the existing PGP based infrastructure. Perhaps all these applications will appear first on the outside, where these problems do not exist for the developers. (The patent problem would still exist for US/Canadian users. I will be interested to see the patent holder's response.) Tim says: >One interesting remark I read from someone was that the Java distribution >model returns us to an era of easier distribution of small programs. The >"application bloat" of very large programs may be at least partly fixed. >We'll see. I have my doubts about this one. I think application bloat comes from market forces and from the kind of bundling you see in XYZCorpOffice products where you get 4 applications packaged together. This marketing approach maximizes revenue by selling you products you don't need as a matter of convenience. But, we shall see. There are some features of Java which make it less than ideal for crypto applications. These features can be overcome, but they will affect implementors and users. (1) There are not many sources of high-quality entropy available to Java applets. Keystroke timings and scribble windows are probably the best sources, but may represent an inconvenience for users. (2) Java doesn't allow you to define operators as methods of classes. This feature has the advantage that you don't have strange uses of the operators, the classic example being the left shift operator being used to do output. However, if you need to do arithmetic on numbers larger than 64 bits, you can't use common, infix notation. This feature only affects developers, and at worst, qualifies as a pain in the rear and not a show stopper. I too hope to soon see high-quality crypto applications on my desktop in Java. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: [NOISE] What is "laser material"?
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:56 AM 04/26/96 -0700, Alan Olsen <alano(a)teleport.com> wrote: >>Does anyone have any idea what "more laser material" means? > >It means that the laser burns itself up when fired. Either they are pumping >gas into the laser and eventually run out or they are using something that >is solid or semi-solid (yes, you can make a laser out of Jello!) that >becomes non-functional after a certain number of uses. > >The plans I have for a somewhat high powered laser (10 watts) requires >nitrogen pumped through the tube. Run out of nitrogen and you run out of >laser... > >The problem with laser based weapons is they are weather dependant. Try >using a laser in the rain and see how coherent a beam you get. To _some_ extent, that's a function of the laser's frequency. An X-ray laser, for example..... :-) Dave "Do not look into laser with remaining eyeball" Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYBbiMVrTvyYOzAZAQEYogQAsmRIer5N2emPQ5t37WzzmMisHNbgduWS q80aA15xJLkZY62q2IGpvTqUDaY7D2ETfi1rUDs2CC1vYRRmjz5RathGAiLfzfmQ XWIXi1xHxwNxnsa5oPcm7xpQd8LWnZgsbRvvB4NIoU/1ScMZ+qhXQMaUanuU+kbZ KlvmTfom81A= =GYM8 -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

What Wired proposes, NetlyNews Disposes ;-).
by Robert Hettinga 17 Dec '03

17 Dec '03

I just sent a third (from scratch) iteration of the OpEd article Wired wanted this afternoon. Meanwhile, I sold the first (from scratch) iteration to NetlyNews, viz, http://www.netlynews.com/ I believe I'm having fun now... No. I'm *not* an economist. I don't even play one on the net... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

You are now an International Arms Trafficker
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

OK, I'm guilty.... :) http://online.offshore.com.ai/cgi-bin/munitions.pl?itar > You are now an International Arms Trafficker > > Thanks for the munitions package. > > You are trafficker number: 4 > > Offshore Information Services Ltd. -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

[Fwd: SafE Mail Encryption] got this today, anyone heard of it?
by Jack Mott 17 Dec '03

17 Dec '03

anyone heard of this? it was just sent to me. -- thecrow(a)iconn.net "It can't rain all the time" RSA ENCRYPTION IN 3 LINES OF PERL --------------------------------------------------------- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/) To: thecrow(a)iconn.net Subject: SafE Mail Encryption From: safemail(a)ntrnet.net (Mike Wagoner (1)) Date: Fri, 26 Apr 1996 16:45:29 -0400 HI! Please look at our web address; http://www.sfmc.com We are information security technoligy through encyption, compresion, error correction and we are compatible with any open network or electronic mailing system. We use a public/private key approach. We work on Windows/DOS platform. The gentleman, DR. Vladyslave Oleynik, who created this software moved to The Research Triangle Park from St. Petersburg, Russia. His unique mathematical approach gives this software the longest encryption key length on the market today. This software also offers compression of up to 85% of all computer generated files as well as correct statistical errors up to 30% in a file.Because of its encryption strength, the highest compression on the market today, its error correction capability that no one else offers, and it is one of the easiest to use, this Russian technoligy will prove to change the standard of software security as we know it. Our E-mail address is safemail(a)nternet.net 1-800-252-9938-office 1-919-676-3810-fax Thanks, we awaite your response! Randy Estridge/ Mike Wagoner

1 0

Re: Click here to become an International Arms Trafficker
by David K. Merriman 17 Dec '03

17 Dec '03

At 02:46 PM 04/26/96 -0400, Vince Cate wrote: > > "Click here to become an International Arms Trafficker" > >Offshore Information Services Ltd. has set up a web page to make it really >easy for people to become International Arms Traffickers. All they have to >do is fill in their name and email address and then click. Check out: > > http://online.offshore.com.ai/arms-trafficker/ > >If you think this is half as funny as I do, please make a link from >one of your pages to this one. > Well, I'm ITAR violator # 6 :-) Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

3 2

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:51 PM 4/26/96, Bill Frantz wrote: >Tim May and Mike Duvos have expresses an enthusiasm for Java which I share. > There are a few practical issues which should be addresses. And bear in mind that "enthusiasm" does not mean certitude. We've all gotten enthusiastic at times about some Next Big Thing. I count this enthusiasm as part of the larger Web picture, which is unlikely to fizzle out. >Tim says: >>One interesting remark I read from someone was that the Java distribution >>model returns us to an era of easier distribution of small programs. The >>"application bloat" of very large programs may be at least partly fixed. >>We'll see. > >I have my doubts about this one. I think application bloat comes from >market forces and from the kind of bundling you see in XYZCorpOffice >products where you get 4 applications packaged together. This marketing >approach maximizes revenue by selling you products you don't need as a >matter of convenience. But, we shall see. If you mean "Microsoft Office," I wasn't really thinking of this. The point this person I cited (I don't remember who it was) was that this makes it easier for a application to get "shelf space," because the shelf is the Web. Payment is problematic, but distribution should be easy. Obviously, Mosaic (and then Netscape) was a good example of this. A small team, or even a single person, with a Good Idea, gets distribution. The Net and Unix have long had this (with Unix tools and languages), but the Web and applets may well extend this to a broader base. We'll see. >There are some features of Java which make it less than ideal for crypto >applications. These features can be overcome, but they will affect >implementors and users. I think the interesting target date to plan for is a year from now. >(1) There are not many sources of high-quality entropy available to Java >applets. Keystroke timings and scribble windows are probably the best >sources, but may represent an inconvenience for users. Shouldn't be any worse or any better than with the status quo, right? I'm not sure I see the Java issue. (I've been looking at SoundClip and AudioClip, but only cursorily.) By the way, Hal Finney is working on a bignum package. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Mixmaster message formats
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I know Raph already answered this, but I want to toss my few cents in. It is important to understand the threat model of Mixmaster. I assumed that all links and some remailers would be compromised. My goal was to ensure that no information about the message was revealed except to the first and last remailers in the chain. To borrow from physics (black hole) terminology, the message must have no hair. Any active padding by the remailer implies that it knows an upper limit on the size of the actual message. If each remailer removes some information, which must be replaced, then conspiring remailers can obtain information about the where messages are going, by comparing size, and knowing that the "kernel" of the message can only shrink. This last statement is true unless remailers add extra hops, which they encrypt. The reason this is not effective has been thoroughly discussed on this list. Take a look at the essay on my home page. It explains most of the design decisions. -Lance Cottrell At 5:25 PM 4/25/96, Mark M. wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >I was thinking about how Mixmaster needs a separate message format so it >can make messages a fixed size and add a packet ID. However, couldn't all >this be done with PGP? With PGP, the length of the file being encrypted is >encrypted itself, so it would be possible to append random data to the end >of the file to make the message a fixed length like Mixmaster. Also, the >packet-ID could be implemented by putting a line such as the following in the >message: > >:: >Packet-ID: foobar > >The only other thing that would have to be taken care of is chaining. The >way I could see this working is to have a header in the encrypted message that >tells the remailer whether it should de-armor the message at the next layer, >append random data, then re-armor, and pass it to the next remailer. Am I >missing something? > >- -- Mark > >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 >http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 >"The concept of normalcy is just a conspiracy of the majority" -me > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3 >Charset: noconv > >iQCVAwUBMYAXxLZc+sv5siulAQG5CwP/Qbgune3sjNyB7Y8xNxNW6hCahtgBNJDk >oT+hZHdlmcB6CZXjgDUSczIfAnygS71PBBysB4DJnugluMTMTGfqmgeikXdvL1zt >vnwx5xlG0HQeTbVE2+c1uW4uamkdb0MZmNLR06S9M+2i0ROaWzGwNO6WEHqoEL3W >qwXZ7zPtId0= >=MaO4 >-----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMYFHQfPzr81BVjMVAQH0qgf8DbhHB2rHxYAAMBKoOAiDRW7zy+UViknf 2BmIv6NDW2MYtTHNSLykDVx3XQCeGG4QuuFcmdveD3livQizC9Tb5Rj8cMNI/Qb6 R7RYEAsaraluxBYNxHxFPejZUy/r9jjJm+LzSVaYVfEdzgt5jjNrm2YV53nOinD8 4sfgBtWNKWAyiyl7lTFWKAhLdfYsp3klTecnEBuPetZlv1V3b4RR2xZi4ggIK4VR lFkASSQUp/c+JhkJWRcNw6z+Df2XJ59ORUGC+MuJp/W56YoTGicca3mI64qGwg7J 745XF8oAOuD3OCvreWiOYU/LScG3lKKMYfhCyWnGXpt32BJyM5hm1w== =WD5g -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

RSA129
by Black Unicorn 17 Dec '03

17 Dec '03

At one point someone asked about how the breaking of RSA129 might impact on the calculation of MIPSyears to crack a 512 bit RSA key (i.e. a PGP 512 bit key). Was there ever an answer to this question? Are there current guesses for 1024 and 512 bit keys out there? --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

2 1

WWW proxies?
by Black Unicorn 17 Dec '03

17 Dec '03

Has anyone developed such a beast yet? Will we have as extensive a WWW proxy network as remailer network? --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

4 3

Re: Is the public involved in the crypto policy debate?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Alex Strasheim sent me a private message, which I did not realize was not also addressed to the list as a whole. I'll remove any of his quoted comments so I can post my comments here. (This is an important issue. I think most people who write thoughtful essays, as Alex did in his private message to me, should post their thoughts publically. "Saving bandwidth" is hardly a good thing to do when the issues are so central to why we exist as a group.) About whether we and people like us have had an influence, or are seen by Washington, Bonn, Moscow, etc. as a bunch of meddlers and spoiled children: The "vocal public sector" consists of: - the attendess at CFP and similar conferences - many of the readers of "Wired" and similar mags - nearly all members of the Cypherpunks and similar lists - a huge fraction of the readers of Usenet - various "public interest" lobbying groups, including the ACLU, EFF, EPIC, etc. - many members of the press who write articles critical of crypto policy - nearly all libertarians (and Libertarians) - professors and policy analysts who write articles critical of crypto policy - many leftists who fear government snooping, COINTELPRO, etc. - many rightists who fear government snooping, anti-militia laws, Waco, etc. This is a powerful "axis." Do Americans support our position? Some say yes. I'm not so sure we should rest easy. If the issue is rephrased as: "Should nuclear terrorists be free to plot the destruction of New York City with unbreakable cryptography the FBI is powerless to do anything about?," the answer will be "Of course not." (Well, maybe not if New York City is the exemplar....) This is why I am so skeptical of public opinion polls on crypto. Those who live by the sword shall die by the sword. And if this round of crypto regulation is "lost" by the Administration, or if a major new terrorist incident occurs, or if PGP is involved in a heinous incident, or if a more statist Administration comes to power, I fully expect a campaign invoking the Four Horsemen of the Infocalypse. Then we will likely find that "most Americans" support "reasonable restrictions" on communications privacy, including limits on crypto strength, mandatory escrow, major limits on anonymous digital cash, etc. This is why we must get to the "point of no return," the point of the phase transition, before "they" do. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

alias servers (al la alias.c2.org)
by Black Unicorn 17 Dec '03

17 Dec '03

Is anyone besides c2.org running an alias server? --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

2 1

Re: The Joy of Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:57 PM 4/26/96 -0700, Timothy C. May wrote: >I think the interesting target date to plan for is a year from now. I said a few months ago that I thought Java would be ready for prime time in a couple of years. I think we are in complete agreement here. >>(1) There are not many sources of high-quality entropy available to Java >>applets. Keystroke timings and scribble windows are probably the best >>sources, but may represent an inconvenience for users. > >Shouldn't be any worse or any better than with the status quo, right? I'm >not sure I see the Java issue. (I've been looking at SoundClip and >AudioClip, but only cursorily.) I think it is a bit worse since an applet doesn't get access to a lot of stuff a C program, or even better an OS gets. A C program has a lot of environmental queries that might produce some entropy, although they would also be available to an attacker on the same system. The OS has access to interrupt times, mouse movements, and keyboard timings for ALL the applications that have run since boot. >By the way, Hal Finney is working on a bignum package. I know. I have an (old) version on my disk. AFAIK, Hal is the most active person developing crypto and crypto related Java code. He deserves thanks from all of us. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

code vs cypher
by hochiminh＠alpha.c2.org 17 Dec '03

17 Dec '03

Perry E. Metzger" <perry(a)piermont.com> writes: pm> tm> Timothy C. May writes: pm> tm> Well, I was not invited to join the elite and secret pm> tm> coderpunks list, pm> It is neither elite nor secret. It is fairly high signal to noise. pm> I think only about one in every fifty or so cypherpunks pm> messages has any content at all worth mentioning. Agreed! I wasn't "invited". I simply requested access and was quickly welcomed to the list. pm> tm> but I still have some thoughts on coding and, pm> tm> especially, on the opportunities offered by Java. pm> tm> Sorry if this interferes with discussions of Rabbi pm> tm> Heir and Morris Dees. pm> You have no right to grumble about the situation here. pm> It is exactly what you wanted. Here you were, a person pm> of some personal gravitas and moral authority, and you pm> put your stamp on the "post whatever you like; don't let pm> the grumbling censors stop you". Well, as you sow, so pm> shall you reap. Its your fault, more than anyone else's. TC May was not the first person to substantialy digress from chartered topics but he certainly "ran with the ball" when he got his chance to expose his ignorance and intolerance of other races and religions ( the cypher-relevance or "charter topicality of which always escaped me). I was discouraged by the encouragement given to the murder advocating moron, Jim Bell to post his insance littany. pm> If Cypherpunks has become a cesspit, well, its YOUR cesspit, pm> Tim. Its the list you always strove to create, but it appears pm> that you now don't like the smell of your own wallow. Well, pm> sorry. Deal with it. Well put, Perry!

2 1

Reminder: PDX Physical Cypherpunks Meeting Saturday
by Alan Olsen 17 Dec '03

17 Dec '03

A reminder for those who are intending to show up.... If you are intending on being involved with the key signing, please send me your public key(s) so that they can be included. -----BEGIN PGP SIGNED MESSAGE----- There will be another physical meeting on the Cypherpunks in Portland, OR. The particulars: Location: Powell's Technical Bookstore 33 NW Park Portland, OR 97209 (Just north of Burnside off of the Park blocks.) Date: April 27th, 1996 Time: 5:23pm Discussions will cover: ** A Portland Remailer ** Various Coding Projects ** Events in the News ** Other Projects related to Crypto (Web sites and Documentation) ** Possible PGP Keysigning (Depends on the response) ** General Discussion Devolving into Chaos If you have any other topics for discussion, bring them up at the meeting or you can e-mail me in advance. Powell's Technical Book has a good selection of crypto books, so you might want to be prepared. (Do not bring money you cannot afford to spend. Powell's has an evil force that seduces people into buying books.) A PGP keysigning will be held if there are enough interested people. If you are interested in participating, please send me your public key via e-mail. Any comments, suggestions, ideas, and/or complains can be sent to me at alano(a)teleport.com. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMXMZZeQCP3v30CeZAQG0/Af/To2q0fuLk8Q6KquP+6LX1/1EOqGGoxBZ jWfCJoz40Wk1EHMJMis+XpiPgcXg2nAZNeQXubS4Q9se8uGG57UbzpX8rv5GnzdV HWimufNeL/bfxSn+OYswTEQExSwG2V/TSWZNwfFf5Xl/6V0zy1Xa5qY8CEtXn1fr 3/vXicYexd3NwSvToN5udYYtUe2kH14O3RIoXAnaJwMZLvS+oiDzw8LWXI7UMdsf akUbhisfgf/lu3wiMVQkN2hdP15rioIlAhryA0skvl1fxh3OkFC8/GDJpRBRWD+K RjO5VgRRXYrQUG4PKAK8Y1/PSINzandOkaMc2duaSshslZYyI3YRmg== =zD1a -----END PGP SIGNATURE----- --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

re: Joy of Java
by dp＠world.std.com 17 Dec '03

17 Dec '03

Scott Brickner <sjb(a)universe.digex.net> wrote: > >And later: > > The Java bytecode is where the security properties must ultimately > be verified . . . . Unfortunately, it is rather difficult to verify > the bytecode. . . . The present type verifier cannot be proven > correct, because there is not a formal description of the type > system. Object-oriented type systems are a current research topic; > it seems unwise for the system's security to rely on such a > mechanism without a strong theoretical foundation. It is not > certain that an informally specified system as large and complicated > as Java bytecode is consistent. > >And in the conclusions: > > We conclude that the Java system in its current form cannot easily > be made secure. Significant redesign of the language, the bytecode > format, and the runtime system appear to be necessary steps toward > building a higher-assurance system. . . . Execution of remotely- > loaded code is a relatively new phenomenon, and more work is > required to make it safe. > >I do think that the ideas embodied in Java are very important, and will >significantly shape the future of computing, but Java itself may be just >a stepping stone on the way. Given the crowd here, this is likely stating the obvious, but it has never failed to provoke spluttering from the Sun employees I have tried it on. The thing not mentioned in this excerpt is that at best, the verification will have been done for the Sun implementation of the byte code engine. There have been announcements of competing implementations of the the engine, and any assumptions of safety are out the window in that case. Sun doesn't have any control over Java the byte code engine, anyone who wants can build one. (and at 40kb total size, it is a tractable thing for an undergrad that didn't manage to find a summer job). Sun does control Java the logo, and can deny a license to use it. That is likely to become a meaningless distinction -- If somone will install a disk recieved unsolicited in the mail, or handed to them at a trade show (how hard can it be to re-seal AOL packaging, such that a casual recipient won't notice), they aren't bright enough to insist on genuine Sun brand Java. If it becomes an expected thing, that all browsers/os's/toaster-ovens have a java byte code engine in them, there will be a sizable number sold without "benifit" of trademark (at the low end if nothing else, Sun does expect to be paid to use the steaming cup). Not all of them will have sufficient rigor applied to their development. Once common, then things get interesting. The press will (for lack of anything else to do, as all the engines are supposed to act identically) start to benchmark the competing implementations. At that point, under pressure to "get good numbers", some of the more "expensive" operations will be "tuned". Other restrictions might be sacrificed in order to have something ready for Comdex... Can't happen you say? I still remember when some of the PC video makers got caught special casing the strings in one of the big magazines benchmarks. Unfortunately, Sun has designed a fine example of a "Square Peg". As OAK, it was a moderately good fit for the intended use. With zillions of set top boxes, and a limited number of sources of product (national/regional controlled entry broadcaster model), you had to have remote execution, nobody could build a big enough set of servers. Since it was coming from a broadcaster, you could get away with trusting signed code -- not just any bozo can get video broadcast nationally (unless it is violent, and even then they time base correct it), the same would be true of set top code. Since it meant selling hardware (engine in rom), there would be a limited number of sources of system code -- the above mentioned undergrad would find it difficult to find enough capital to get a mass market hardware product to market. And when you get down to it, with only a few meg of ram, and no disk, there really wasn't a huge amount of data to compromise. Now lets examine what they are trying to do with it. It is a software only item currently, thus it has very low entry barriers. Code can be put up by any bozo with $10/month to pay a local web provider -- even if the code is signed, you may not be able to get at the author of an applet, either because of national boundries, or anonymity. And you get to run the stuff on a machine with a lot of state (all the dells and gateways sold today had at least a gig of state spinning there to browse), and a live net connection (back to the source if nothing else) to transmit interesting things back with. Looks like a bad fit to me. But the PR department does have a big hammer, and they are beating on it, and the hole is starting to give a bit -- they have it forced about halfway now... To get a round peg, they have to build a system at the A2 trust level. That means a verified design, and an implementation checked against that design. Sun hasn't done the design side of the game, if the comments made about the design by the Princeton group are accurate. Lacking a verifiable design, even Sun's implementation must be doubted. But it doesn't end there, the browser that surrounds the byte code engine can compromise even a good implementation (as netscape has demonstrated), and last, Sun has no way to ensure that everything that executes the byte codes is a "good" implementation. We don't even have to assume malicious intent on the engine builder, accidents have already supplied us with enough examples of how it can go wrong. (tho it is easier if you put the hole there -- you don't have to be skilled enough to find a hole to exploit, just good enough to add a hole to an existing implementation) <dp>

1 0

Re: US law - World Law - Secret Banking
by Duncan Frissell 17 Dec '03

17 Dec '03

At 04:55 PM 4/26/96 -0400, Black Unicorn wrote: >First of all, and as one of the only western powers to do so, the United >States taxes its citizens on _worldwide income_. While this in itself, >with a proper foreign tax credit system, is not offensive, when the Unites >States adds to this a very wide scope of extraterratorial jurisdiction and >compelled process, it becomes more than tax. Further, the United States >implements policy it cannot directly legislate constiutionally through >taxation. Just to make it perfectly clear... The US (and the Philippines) are the only countries in the *civilized world* that tax non-resident citizens. This means, par example, that if you are born in the US and leave at the age of 2 days, never return, never get any services from any US government, you are subject to full US federal taxation. If you happen to reside in a country with no tax treaty with the US, you will owe local country taxes *plus* US federal taxes simply because of citizenship. In any of the European countries, you can eliminate your tax liability for foreign (out-of-country) source income simply by moving overseas. They tax all residents but only non-resident citizens who have domestic source income. The US grabs everything even if you've had virtually no US contacts. This is why some rich Americans have renounced their citizenship to avoid taxes on their non-US income, rich Brits don't have to renounce they can keep their citizenship and just move. >It is partly the arrogance of many U.S. citizens, and the view that their >government knows the one single way to conduct economic and foreign >affairs, that empowers the United States to impose her tax and >economic policy on unconnected sovereigns thousands of miles away. Note the other areas this has applied as well. Roosevelt's outlawry of private posession of gold by Americans made it a crime for Americans to own gold anywhere on earth. And the proposed regs on licensing of space launches prohibited Americans from committing unlicensed space launches anywhere on earth. DCF "Note that no woman has ever conquered Europe but several men have. No point, I just thought it was interesting."

1 0

Re: WWW proxies?
by David Wagner 17 Dec '03

17 Dec '03

In article <Pine.SUN.3.93.960426191223.12146D-100000(a)polaris.mindport.net> you write: > > Has anyone developed such a beast yet? > > Will we have as extensive a WWW proxy network as remailer network? > Here's what I know of. You could get an anonymous www.c2.org account and websurf from it. You can also publish web pages anonymously from c2. See http://www.c2.org/anon.phtml It looks like there's an experimental anonymizing proxy up in France (if you can tolerate the link delay): http://hplyot.obspm.fr:6661/ http://hplyot.obspm.fr:80/~dl/anonproxy.txt I haven't tested it myself, though. CMU has a web anonymizer at http://anonymizer.cs.cmu.edu:8080/ Unfortunately, it's not useable by the public yet. (They promise to release it in early 1996.) Decense is a early prototype of a double-blind penet-style "re-webserver": http://www.clark.net/pub/rjc/decense.html Wei Dai has talked about PipeNet, a network of "re-routers" for general Internet traffic. Unfortunately, at this point, it's only a pipe dream on the whiteboard (as far as I know-- correct me if I'm wrong!). If I left any out, let me know. I hope to get a chance to play with these things (and possibly install one on my machine) during the summer, when I'll have some more free time. Whee!

1 0

Re: RSAREF dos not give you access to RSA
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:48 PM 4/26/96 -0400, David Mazieres <dm(a)amsterdam.lcs.mit.edu> wrote: >> 5) the price of RSA is fairly low, once free RSAREF came out >RSAREF does not give you RSA. Do not think that you can write and >distribute free software that uses RSA encryption in the US just >because of the existence of RSAREF. If you don't believe me, let me >tell you a little story. [ really atrocious story of RSA's non-responsiveness, deleted] >The RSAREF license strictly requires that you only use the documented >RSAREF interface, which does not include direct access to the RSA functions. Yeah, that's a good point, and it'd slipped my mind since the PGP permission was eventually granted. For some applications of RSA, you can use RSAREF to do them; you may have to not mind an extra DES layer thrown in where you really don't need it, and the resulting ugliness. (But at least encrypting a random session key with a random DES key doesn't provide much hook for a DES-cracker.) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

www.WhosWhere.com selling access to my employer's passwd file
by rich＠c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- If you are involved with the affairs of a large organization, I urge you to check www.whoswhere.com to see if they have a bunch of user email addresses that they shouldn't. Of course there is little that one can do about this kind of invasion of privacy. But they don't have to be so fucking blatant and stupid about it. They have the email addresses of DAEMONS from our password files in their database. There is no need for mailbombing, or anything like that. Our lawyers are simply going to nuke them from orbit. Please check them out before they go offline, so that you will have a shot at whatever is left. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYHku43DXUbM57SdAQGQpwP/U9TzWE2vEjHYZo4eniVctFe3pVe0KIQe FvdNOWTykqfgEyhagKuifmRwUgjjIcIZONzRDw1Hi7UrJbOghH3j9sW5wxsphbxU 3U0hHuKumAczUHn03IVkkF4JpobawEgHqqP1Y++PhNopAvqnVSu+hnf5aIS1R390 MlUiwpoo0OE= =+Mm2 -----END PGP SIGNATURE-----

5 4

Re: The Joy of Java
by Bill Stewart 17 Dec '03

17 Dec '03

>From my perspective, the biggest win of Java isn't the security, though that's certainly important. It's that it's a reasonably powerful virtual machine that doesn't need to run on Microsoft operating systems, though it can (except Win3.1, of course.) That means that decent small application software can be written that doesn't have to be locked into the far less secure/reliable DOS/Windows/95 architectures, and can run on Macs and Linux and Unix, a bit slowly, but with a lot less baggage. (Maybe 16-bit code is gone from NT 4.0, but it's not going to run on 386s!?!) Yes, you may want to be careful with code that autoloads from web pages, but you don't have to be quite as paranoid with Java from ftp sites as you did with MS binaries, and you can be more comfortable with applets like word processors and data-crunchers knowing they won't be doing all the "helpful" things MSOffice likes to help you with. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: trusting the processor chip
by Bill Stewart 17 Dec '03

17 Dec '03

>> By NSA standards, it is simple. NSA has probably had its own >> semiconductor fabs for 30+ years. >Yep. Regardless of whether the fabs are government property or not, >it's a sure thing that some contractors have appropriately SCIFfed >fabs and appropriately cleared staffs. There's an interesting Moore's Law wrinkle to this. Not only does processor speed double every 18 months, but the cost of the chip fab plant for each generation of technology also doubles. Intel's building some $2B plants now, and who knows what the x886 CPU and 256MB memory fab plants will cost. While the costs are somewhat lower for a low-volume plant than a high-volume one, at some point it will be much harder (as a percentage of their total budget) for the NSA to stay ahead of the power curve, and they'll have to switch over to designs like highly-custom applications on commercial FPGAs and such. And "appropriately cleared staffs" are also harder to find as the chip business internationalizes. Back when I was a tool of the military-industrial complex, I was working on an RFP that had a heavy-duty "buy American" policy, not only for economic protectionism but to make sure that UnAmerican Foreigners didn't subvert the designs for critical components to add security leaks. For instance, the controller chips for disk drives, and raw EPROM. We eventually got them to let us use imported commercial products as long as any design and construction that was actually specific to the customer was done in the US, on the assumption that the Singaporean Espionage Service wasn't going to put back-doors in all the disk drives their city exported, and the Korean CIA wasn't going to put extra pins in their EPROMS that would replace the contents with hacked versions designed to steal US Secrets :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: WWW proxies?
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:13 PM 4/26/96 -0400, Black Unicorn <unicorn(a)schloss.li> wrote: >Has anyone developed such a beast yet? Good timing for the question! As Perry pointed out, the CERN httpd provides basic proxy functions, but it doesn't do the anonymizing job of deleting/replacing information your browser may output to a CGI script, so it's only a partial solution. The pre-beta-test anonymizer proxy Sameer mentioned does the main protocols, though doesn't anonymize https: yet; doing the job right is difficult or impossible without support in the browser for features such as double-encrypted SSL sessions (one layer of encryption between the browser and proxy, and an end-to-end connection between the browser and the destination server.) [Jeff - any chance of this unlikely feature being supported?] I tried doing an https: connection to the proxy, but something wasn't in the directory it expected; that's what betas are for :-) Alternatively, maybe an SSH connection could work? >Will we have as extensive a WWW proxy network as remailer network? That's partly a technical question, and partly a social/economic one. The technical parts are whether it's easy to install an anonymizer on your web server (at least for Unix and maybe NT users), and whether there's a big drawback if you do, like performance hit or extra charges from your ISP. There's also a technical issue of whether anon-proxies will be quiet underground things, or whether there'll be some convenient coordination mechanism, such as random.anonymizer.com being a DNS hack that picks a random anonymous server that can be temporarily registered by just starting an anonymizer application. The social parts of the question are how we get people to _want_ to install it, and how we get them to keep running it once it gets annoying. A good PR job can help, especially if installation+registration is a one-or-two-button thing; using one anonymizer nags you to install your own. Perhaps somebody will find a convenient way to add only-mildly-annoying advertising to the anonymizers, or to collect digicash without discouraging users, giving some tradeoff between social responsibiity and crass profit motives, and allowing a spectrum of anonymizers to operate. Of course, especially with some profit-making services (e.g. the Anonymous Porn Proxy or the Hemp Buyers' Privacy Connection) the server may have trouble convincing customers that the anonymity is really being preserved, whether from government subpoenas, junkmail and credit card fraud, or future resale to Blacknet. The other side of the propagation problem is keeping proxy providers willing to run their services after they have problems because of how their service is used. One problem is spammers and other abusers. Suppose somebody uses your anonymizer to connect to a web-posting page or mailto: and spams a big mailing list or newsgroup with objectionable material, like the <perjorative deleted> spammer who sent hate mail from my remailer to the various gay newsgroups signed with some innocent bystander's name. At best you get flamed; at worst your ISP drops your service. Or the spammer signs the guestbook at whitehouse.gov in an interesting manner. Another problem is users whose behaviour attracts attention. Maybe it's the highly legitimate user who checks out the tax forms on irs.gov for taxable activities the IRS didn't know were involved in, like overseas banking and stocks when _your_ tax returns all said "broke college student" (just _try_ explaining anonymizers to the compuer-illiterate IRS clerk.) Maybe it's the user who wants to avoid junk email when she checks out the Make.Money.Fast.multilevel.religious.technology stockbroker service. Guess who's now on Their lists. Maybe they used the anonymizer to view child pornography from kidporn.sting.postalinspector.memphis.usps.gov, and the Post Office Police come kick your door down. Or maybe they were checking out the schedule at the Cannabis Buyer's Club using your anonymizer just in case the FBI wiretappers wanted to enforce laws that the S.F. Police don't bother people about. Some of these problems can be helped by things like transient proxy servers, if we build a convenient way for them to hook in for a while and drop back out. On the other hand, if you're waiting for me to write all this code I'm suggesting we need, you'd be better off hacking some more easy partial solutions that can be deployed, tested, and replaced with the next edition :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Re: Click here to become an International Arms Trafficker
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:46 PM 4/26/96 -0700, Sandy wrote: >> Well, I'm ITAR violator # 6 :-) >I am #3. Who is #1? Gee, that sounds sorta familiar. I hope >we don't end up as Prisoners. You are in the Village. A low crawl leads off to the north.... I was #21 and #22, though the first one didn't actually export crypto, and the second one exported code for rot13 instead of perl. So there's now some rot13 hanging out in the Caribbean, waiting for Hostile Foreigners and NarcoTerrorist Tax Evaders to protect their privacy with it. (This is _illegal_??) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0

Cell Kill 2
by John Young 17 Dec '03

17 Dec '03

4-27-96 NYT op-ed claims: On April 21, two Russian laser-guided missiles reportedly zeroed in on the cellular phone of Dzhokhar M. Dudayev, leader of the Chechen rebels, and killed him. According to the Russian newspaper Izvestia, Mr. Dudayev died while phoning an aide to King Hassan II of Morocco, who had been asked by President Yeltsin to help mediate an end to the war. Will any leader ever again be so gullible?

4 4

CryptoAnarchy: What's wrong with this picture?
by mkj＠october.segno.com 17 Dec '03

17 Dec '03

Please forgive what may be a stupid question, but I've been wondering about this for a long time, and today I'm tired of wondering. A consistent theme here is "crypto-anarchy", which appears to be essentially the idea that widespread cryptography will make tax collection impossible, bringing down governments. I don't see how this will work. The logical flaw in this argument seems so obvious (and at least some of the people who buy into it seem so obviously intelligent), that I can't help but think I must be missing something. Certainly the widespread use of cryptography will frustrate modern systems of taxation, such as income taxes, sales taxes, etc., which are based on the monitoring of financial transactions. But these systems are a mere flash in the pan; taxes existed, and governments sustained themselves perfectly well, long before these systems arose. Why then shouldn't we expect that modern governments, in the face of widespread cryptography, will simply revert to more traditional (and brutal) systems such as head taxes, land taxes, travel tolls, etc.? --- mkj

6 5

[;)]
by Dave Del Torto 17 Dec '03

17 Dec '03

<http://www.well.com/user/ddt/info/jet-reply.html>

1 0

Re: Cell Kill 2
by David K. Merriman 17 Dec '03

17 Dec '03

At 07:27 AM 04/27/96 -0400, John Young <jya(a)pipeline.com> wrote: > 4-27-96 NYT op-ed claims: > > On April 21, two Russian laser-guided missiles > reportedly zeroed in on the cellular phone of Dzhokhar > M. Dudayev, leader of the Chechen rebels, and killed Okay, I'll play: are we supposed to believe that a laser(optically)-guided missile homed in on a cellular(RF) phone? C'mon now. Who was driving the *real* targeting laser? Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: www.WhosWhere.com selling access to my employer's passwd file
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:30 AM 4/27/96 -0700, Mark Allyn 206-860-9454 wrote: >They are gone now. > >mark.allyn.com% lynx http://www.WhosWhere.com Try http://www.whowhere.com/ . (Rich Graves mistyped the address.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

8 12

Re: www.WhosWhere.com selling access to my employer's passwd file
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:12 AM 4/27/96 -0700, Rich Graves wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >If you are involved with the affairs of a large organization, I urge you >to check www.whoswhere.com to see if they have a bunch of user email >addresses that they shouldn't. They also have some information that is seriously outdated. They have two e-mail addresses for me that are about 2-3 years out of date. (I wonder how some of this information was collected. One was from my Fidonet point address of years back. Not something accesable from finger.) >Of course there is little that one can do about this kind of invasion of >privacy. But they don't have to be so fucking blatant and stupid about it. >They have the email addresses of DAEMONS from our password files in their >database. I wonder if those addresses are from a "finger @sitename.org" hack. It becomes worrysome when the methods of hackers intersect with those of database compilers. >There is no need for mailbombing, or anything like that. Our lawyers are >simply going to nuke them from orbit. Please check them out before they go >offline, so that you will have a shot at whatever is left. Keep us informed as to the fireworks. it will be fun to watch. --- | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

3 2

Re: trusting the processor chip
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 9:53 AM 4/25/96, Jeffrey C. Flynn wrote: .... > >It looks like I may have no other option than to give some processor some >degree of trust. Which processor I should choose, and why that one? .... In the days of microcode this was my best (worst?) scenario. Setting up for fast divide has been an art long before Pentium divide fame. In microcode you don't spend time testing for cases that you can prove won't happen. Some obscure cases can arise only with a rare combinations of two 48 bit operands. The microcode flaw would be to put the processor into privileged mode even while getting the right answer. There would plausible deniability even if the flaw were discovered. (Gosh, I didn't test for this fall thru case because here is the proof that it can't happen.) Of course there is a bug in the proof but no one reads proofs. This can now be exploited by anyone that knows what division leaves the machine in privileged state. This is an attack on those systems that are rated to run untrusted machine code, using privileged mode code to limit the operation of the untrusted code. Only one person is necessary to pull this off. He must be trusted to produce microcode and the implementer of the divide algorithm. Test code will not find the transition to privileged code just because you can't test the whole machine state after every tested instruction. Normally the bogus privileged state of the machine will quickly expire (on the next interrupt) and will cause no permanent state change even in those few cases where a magic division occurs naturally.

1 0

Re: www.WhosWhere.com selling access to my employer's passwd fi
by Lou Zirko 17 Dec '03

17 Dec '03

DNS lookups fail currently for www.whoswhere.com and whoswhere.com. Gee, this is quick work. Who are those masked men, opps lawyers? > Date: Sat, 27 Apr 1996 02:12:20 -0700 > From: rich(a)c2.org (Rich Graves) > To: cypherpunks(a)toad.com > Subject: www.WhosWhere.com selling access to my employer's passwd file > Organization: Uncensored Internet, http://www.c2.org/uncensored/ > -----BEGIN PGP SIGNED MESSAGE----- > > If you are involved with the affairs of a large organization, I urge you > to check www.whoswhere.com to see if they have a bunch of user email > addresses that they shouldn't. > > Of course there is little that one can do about this kind of invasion of > privacy. But they don't have to be so fucking blatant and stupid about it. > They have the email addresses of DAEMONS from our password files in their > database. > > There is no need for mailbombing, or anything like that. Our lawyers are > simply going to nuke them from orbit. Please check them out before they go > offline, so that you will have a shot at whatever is left. > > - -rich > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > > iQCVAwUBMYHku43DXUbM57SdAQGQpwP/U9TzWE2vEjHYZo4eniVctFe3pVe0KIQe > FvdNOWTykqfgEyhagKuifmRwUgjjIcIZONzRDw1Hi7UrJbOghH3j9sW5wxsphbxU > 3U0hHuKumAczUHn03IVkkF4JpobawEgHqqP1Y++PhNopAvqnVSu+hnf5aIS1R390 > MlUiwpoo0OE= > =+Mm2 > -----END PGP SIGNATURE----- > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzFseHQAAAEH/2gtDJSlsDvTo7m+Caj5zKuLO4dVl6L9e4xxFOAqKMtkHDIh 2z6NqqGnAKDai3eDXInBuOTGoyb82pkV7wD7naQDx7bppfwmJNguOPvlrErOZHcA NbAkyXCoKHgDxeXLq0MMcyC8+kBxYNKhMPm17g7tny4DKD+fzat4k3UiSAves6Y7 jLgQwwQ7TLYIGg7iPAsbMTnOF5iP51Ib47Ozjb3suJvJjUOTSUdl4V3e9EHWiniH G6kI1cfOdUmLXIgNZ34utTwwb2H/LhEDYrydmXJG6FfUolAThCwCbTG++Hq7/Ywr BOawFj3BhySTvpp/bSCJt1Mz/eELEq9xwQCaVD0ABRG0G0xvdSBaaXJrbyA8bHpp cmtvQGlzZG4ubmV0PokBFQMFEDFsfBcSr3HBAJpUPQEBRHoH/R+rkuMa9Vw+Civd 5QQM0tBMEPDUa7G2qNLKO0FBmVHoqq+VGeD9X2X+EBld0AwuWvshQfsViG2uBNxk Cr44y+Q0tXByCZqR8snTZG12BtFaCZv51XVieo2ygWQdmNp5DyMEyIOXUByORT2m 2Jx2VngcFt5rpzZLRALqwBDkV00Xcm8MPQzqGq8ZQA3nmExQkdpnSJIJX0irWjDM OueDrn9mBz2NwIZmddShYGUdhRXgpLYPHLMpo2fxE0dXiWkaDlyx47k4MIWaDoF4 nnTXxmEcS98AkT2PfqU4dT3UfZpZnHqkWQ7d4JqvXs9RmmH9K/NyBB+LykOvA1/t W6deAaWJAJUDBRAxbHtD30Eh39zrXZUBAYPsA/0dIEjlSuc8wrX5KJzAhXqUKBbg e3toQJk8RZwm4f80SC2DopEXYdmwAVrhOou7vezeu29mYVunKaDKg5xjnUfVR1WS ZXy54ZfYEG4Zrdi4vJgydb96AwoF3VAYyAbV45XBTfy3ujZjZRxpZS96X7iKk+6l quslrTmMFLhju4vWKw== =wksf -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: The Joy of Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:51 AM 4/27/96, Dan Busarow wrote: >At Usenix 96 in San Diego it was pointed out that applets are an abberation. >This is a complete language designed to displace C++, Visual Basic and >other OO languages. Thinking of Java as simpy a Web enhancement tool >is short sighted. > >Personally it is more attractive than C++ for product development and >we are trying to get it on FreeBSD, SCO UnixWare and SCO OSR5. Using >Java for applets _only_ is like fucking your mother... Most of us are >not into it. Ignoring the gross violation of the CDA, I agree. I think of it (and so do a lot of others) as: - a cleaned-up C++, with features of Smalltalk, Objective-C, and Lisp - a tool with built-in hooks for Net-centric computing - some safety features that distinguish it from C++ and the like - a bytecode/virtual machine approach that means the same code can be run on any platform for which a VM exists (the key to applets, but also the key to portability...what the world might have looked like for the past 15 years has the UCSD p-system succeeded instead of MS-DOS) Is it safe to run untrusted applets on your machine? Probably not. Running strange programs probably is never safe. I don't view this as something any new language is likely to solve, unless it's a language with such limited expressability as to be "safe and boring." As Perry has noted, financial institutions can ill afford to have applets being dropped into their main computers unless they are safe and secure. Not too surprising. But, then, they also have other security issues they constantly have to deal with that others don't. I suspect the safety issues will continue to crop up, but will be dealt with in other ways. The signed classes approach, the approaches used in E, etc. Netscape's limits on what applets can do, for example, may be extended in other ways (a kind of firewall approach?). To borrow a viewpoint, I don't expect the Java-based gargoyles in "True Names" to be "trustworthy"...TANSTAAFL. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 6

Re: trusting the processor chip
by tcmay＠got.net 17 Dec '03

17 Dec '03

First, there ain't no way that electromagnetic radiation is going to be detected coming from the surface of a ULSI chip. Radiated power levels are going to be in nanowatt or picowatt level from any one metal or poly line, and of course will be undetectable at any distance. Not to mention the size of the radiator implies inefficient launch of pulses (the lines are likely to be rarely longer than a millimeter). At 11:04 AM 4/27/96, David Lesher wrote: (quoting someone else) >> > More likely,I think, an organization like the NSA >> I thought that most (all?) chips already radiated on the >> electromagnetic spectrum? Isn't that what tempest is about? TEMPEST is not about emissions from the surface of a ULSI chip, for example, but about the emissions (and controlling them, shielding them, detecting them) from equipment in general. Most of the "van Eck" radiation (so-called because he wrote the first major public papers on this mode) comes from the deflection circuitry for CRTs, where the radiated power levels (and lengths of radiating elements) are considerably larger than what I mentioned above. It is the CRTs that mostly cause problems. The PCBs inside modern computers also emit wideband pulses, and this may be detectable and usable to an adversary. Good shielding practice helps (those little FCC stickers....). TEMPEST deals with suppressing the emission even more. >B) Sure the Fort has Fab facilities. But Acme Gas & Grocery fixes >cars, yet they do NOT have the diagnostic computer for my [in my >dreams..] new BMW. > >Preventium & leading edge chips requires MASSIVE amounts of >money for the infrastructure, and yesterday's versions do not cut >it. [Tim, got any real $$ here?] I suspect it's like monitors: 14" >SVGA's cost $200; 16" $650; 19" $1200 & 21", don't ask. Sure, >tomorrow the 16" is $500, but you need it TODAY. I hate to say it, but all this stuff has been covered extensively in the past, in the archives. Yes, the NSA has its own wafer fab. Or, more precisely, the most recent example I know of is that National Semiconductor accepted a contract to build a fab at Fort Meade. This is not surprising, as the NSA is responsible for supplying coding and ciphering materials to U.S. forces worldwide, and so must generate ROMs, PLAs, and other special chips to cipher machines around the world. Having the fab at the Fort helps security. (Sandia Labs also makes such gizmos for them, and has pretty good security, I suspect.) These wafer fabs are probably 1.25 micron fabs, far from the .35 micron fabs now being used to make the 166 MHz Pentiums you can buy at Price Club. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Click here to become an International Arms Trafficker
by Lou Zirko 17 Dec '03

17 Dec '03

# 37 > At 02:46 PM 04/26/96 -0400, Vince Cate wrote: > > > > "Click here to become an International Arms Trafficker" > > > > Well, I'm ITAR violator # 6 :-) > > Dave Merriman > ------------------------------------------------------------- > "Giving money and power to government is like giving > whiskey and car keys to teenage boys." > P. J. O'Rourke (b. 1947), U.S. journalist. > <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> > http://www.shellback.com/personal/merriman/index.htm > > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzFseHQAAAEH/2gtDJSlsDvTo7m+Caj5zKuLO4dVl6L9e4xxFOAqKMtkHDIh 2z6NqqGnAKDai3eDXInBuOTGoyb82pkV7wD7naQDx7bppfwmJNguOPvlrErOZHcA NbAkyXCoKHgDxeXLq0MMcyC8+kBxYNKhMPm17g7tny4DKD+fzat4k3UiSAves6Y7 jLgQwwQ7TLYIGg7iPAsbMTnOF5iP51Ib47Ozjb3suJvJjUOTSUdl4V3e9EHWiniH G6kI1cfOdUmLXIgNZ34utTwwb2H/LhEDYrydmXJG6FfUolAThCwCbTG++Hq7/Ywr BOawFj3BhySTvpp/bSCJt1Mz/eELEq9xwQCaVD0ABRG0G0xvdSBaaXJrbyA8bHpp cmtvQGlzZG4ubmV0PokBFQMFEDFsfBcSr3HBAJpUPQEBRHoH/R+rkuMa9Vw+Civd 5QQM0tBMEPDUa7G2qNLKO0FBmVHoqq+VGeD9X2X+EBld0AwuWvshQfsViG2uBNxk Cr44y+Q0tXByCZqR8snTZG12BtFaCZv51XVieo2ygWQdmNp5DyMEyIOXUByORT2m 2Jx2VngcFt5rpzZLRALqwBDkV00Xcm8MPQzqGq8ZQA3nmExQkdpnSJIJX0irWjDM OueDrn9mBz2NwIZmddShYGUdhRXgpLYPHLMpo2fxE0dXiWkaDlyx47k4MIWaDoF4 nnTXxmEcS98AkT2PfqU4dT3UfZpZnHqkWQ7d4JqvXs9RmmH9K/NyBB+LykOvA1/t W6deAaWJAJUDBRAxbHtD30Eh39zrXZUBAYPsA/0dIEjlSuc8wrX5KJzAhXqUKBbg e3toQJk8RZwm4f80SC2DopEXYdmwAVrhOou7vezeu29mYVunKaDKg5xjnUfVR1WS ZXy54ZfYEG4Zrdi4vJgydb96AwoF3VAYyAbV45XBTfy3ujZjZRxpZS96X7iKk+6l quslrTmMFLhju4vWKw== =wksf -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: US law - World Law - Secret Banking
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"ml3e+(a)andrew.cmu.edu" "Michael Loomis" 26-APR-1996 07:40:10.88 > I have been reading this list to get an idea where Declan gets some >of his lunatic ideas and what Rich Graves says when he is not up to >Holocaust fetishism. Despite Timothy's claim to the contrary, it seems >that the basic point of this list is some libertarian notion that tax >evasion is a good thing. Well, actually it's on a lot of other things also, including ones that those against censorship (I assume you're on the fight-censorship list, and thus encountered both Declan and Rich?) should favor. Examples include anonymous remailers and web pages (the deceanse (sp) project). Moreover, anonymous digital cash has applications to fighting censorship. Applications include paying someone to remail information or to put it on the web. c2.org, for instance, accepts even the present semi-anonymous digital cash and offers anonymous web page hosting. >While I am not clear how serious of threat, if one at all, to a system of >fair taxiation, That depends on how one defines "fair." >since much of the talk could be simply bluff, I have been made glad for the >first time for the War on Drugs. This silly war--tragic in terms of its >economic cost and its assault on liberty--at least has forces some >government agencies to take you seriously enough to figure out how to derail >your plans of tax evasion. Most of the tracking and other mechanisms discussed are even more of a threat to liberty - most significantly privacy, although there are other ones involved as well - and, indeed, to economic efficiency. A lot of the proposed and/or instituted regulations can also be used to discourage various politically unpopular but economically efficient operations; an example is "capital flight." In other words, unless you really want to live under a set of laws as restrictive as those in Communist China, support the cypherpunks. -Allen

1 0

Re: Fwd: RSAREF dos not give you access to RSA
by Christopher Allen 17 Dec '03

17 Dec '03

At 1:48 PM on 4/26/96 , David Mazieres <dm(a)amsterdam.lcs.mit.edu> wrote: >After many many messages, I got bounced around from RSA to Consensys >Corp. and back to RSA. Just an FYI, Consensus Development (not Consensys) can only offer a commercial licenses to RSAREF. Some such licenses we can grant waivers to user lower-level routines -- to date we've granted waivers for SSL and PGP compatible software. >Conclusion: You can't use the RSA algorithm in free software. The >RSAREF interface is too restrictive, and when RSA says in the license >that "RSA will grant all reasonable requests for permission to make >such modifications" to the interface, it is either an outright lie, or >something that only happens after so much delay that they might as >well not give you such permission. The problem is that only RSA Labs (not RSA Data Security) can offer this permission (as they have all the non-commercial rights) and they are not set up to handle such requests. I'll see what I can do as the commercial licensee to influence making this happen. RSAREF was released "to support standards" and SSH is a beginning of a standard, so I think it should be possible. ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<ChristopherA(a)consensus.com> 1563 Solano Avenue #355.. .. Berkeley, CA 94707-2116.. ..<http://www.consensus.com/> o510/559-1500 f510/559-1505..

1 0

Re: trusting the processor chip
by jim bell 17 Dec '03

17 Dec '03

At 12:25 AM 4/27/96 -0500, Snow wrote: >On Thu, 25 Apr 1996, jim bell wrote: >> >> This analysis seems to assume that the entire production run of a standard >> product is subverted. More likely,I think, an organization like the NSA >> might build a pin-compatible version of an existing, commonly-used product >> like a keyboard encoder chip that is designed to transmit (by RFI signals) >> the contents of what is typed at the keyboard. It's simple, it's hard to >> detect, and it gets what they want. > > I thought that most (all?) chips already radiated on the >electromagnetic spectrum? Isn't that what tempest is about? There's a difference between trying to find a needle in a haystack, and finding a day-glo, red-hot needle that plays music at 110 decibels in that same haystack. Digital logic chips do radiate EMI, but some radiate very little (because their are few logic transitions or they occur relatively infrequently) or are buried within other circuitry and they don't have a particularly good antenna. The Trojan horse chip I'm hypothesizing would be specifically designed to radiate a fairly loud, continuous signal, on wires that are long enough to make a good antenna. Ideally, the chip would have a crystal to produce a very constant frequency, so that other noise not on that frequency could be ignored. The best place to put such a chip would be a location outside the computer's case, or at least it would have access to the outside. I think that a keyboard controller would be optimum, because I suspect that there are a relatively small number of different designs. Jim Bell jimbell(a)pacifier.com

3 2

You're Invited
by JavaOne 17 Dec '03

17 Dec '03

1 0

You are now an International Arms Trafficker (#1) ???
by William Knowles 17 Dec '03

17 Dec '03

Yikes, Tell me that conspiracy to break ITAR isn't grounds for becoming arms trafficker #1 I don't even have the latest version of the shortened Perl-RSA code back from the screenprinters. Coming Soon! New fashionable Perl-RSA shirts! You are now an International Arms Trafficker Thanks for the munitions package. You are trafficker number: 1 Offshore Information Services Ltd. -William Knowles erehwon(a)c2.org --

1 0