December 2003 - cypherpunks-legacy

WORK ONLINE...PART TIME
by Success 17 Dec '03

17 Dec '03

WORK ONLINE...PART TIME! National Software Company is currently seeking independent agents for marketing their services. If you're reading this, you have what it takes, (a computer and modem), to start your own business, work part-time or full-time. The commissions are great, the products are great, and it sells itself. You will be sent all the materials it takes to take orders in the convenience of your own home,-manual, order forms, software, etc. This is a real company, desiring real people worldwide who want in on the ground floor. With all the people getting online via AOL, Compuserve, Netscape, the marketing and need is great. You must be a self-starter, ready to handle in-bound calls, and make between $700-to-$1000 per week to start. Our average agents yearly salary is six figures. Be your own boss! Join us and become an independent sales agent. For more information and signing up contact: DOWNLOAD YOUR FREE INFORMATION DISK FROM THIS WEB SITE. http://www.geocities.com/WallStreet/3151/ You simply point and click - just like you do in windows. It is a breeze to work with. See for yourself what all the excitement is about... download it! Please note: This is a one time mailing only and you have NOT been added to any lists for future mailings.

1 0

Another animal isolation idea ...
by Ernest Hua 17 Dec '03

17 Dec '03

How about putting the list o' bad animals in a separate list where the list server will specially recognize and will not broadcast messages except back to the sender? This will be an effective stealth censorship mechanism, which some of us would like to see happen to the few "animals" contributing the trash. Ern

1 0

Oh fun ... another mass spam mailer ...
by Ernest Hua 17 Dec '03

17 Dec '03

Why don't these people take a hint? Ern ------- Forwarded Message Return-Path: name(a)worldnet.att.net Received: from mtigwc02.worldnet.att.net (mailhost.worldnet.att.net [204.127.129.4]) by xenon.chromatic.com (8.7.5/8.7.3) with ESMTP id NAA24359 for <hua(a)chromatic.com>; Fri, 22 Nov 1996 13:52:28 -0800 (PST) Received: from Default ([153.35.19.61]) by mtigwc02.worldnet.att.net (post.office MTA v2.0 0613 ) with SMTP id ANQ13190; Fri, 22 Nov 1996 19:35:25 +0000 From: removenow(a)hotmail.com Date: Fri, 22 Nov 1996 14:36:56 PST Subject: As featured in Business Week Message-ID: <19961122174156.ANQ13190@Default> Press reply for removal As Featured in BUSINESS WEEK MAGAZINE & ENTREPENURE MAGAZINE ..December issue. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx SPECIAL OFFER GOOD UNTIL DECEMBER 26th 1996 ONLY xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx free free free free free free free free free free free free free free free E-MAIL WORKS v3.1a FREE!! WITH PURCHACE OF SECURE BULK E-MAILING AND WEB SITE HOSTING SERVICES!!!!!!!!!!!!! free free free free free free free free free free free free free free free That's Right!! When you order our secure bulk e mail hosting services you get the best & most advanced bulk e-mail package for FREE. This product sold for $499 is now free!!!!. Not just a demo, the fully functional version!!! Just e mail your request to 1webguy(a)slip.net E Mail Works v3.1 is by far the most advanced bulk e-mail software available on the market. It's power and depth are only matched by it' s ease of use. Features I Sends at 13000 to 15000 per hour with 14.4 modem II Posts to thousands of news groups automatically III Collects at 75000 per 24 hours Collect from Aol, Comp-U-Serve, Prodigy & all others IV Works while your computer is-surfing-getting e mail or word processing. V Easy to use remove name feature. VI Parsing table 45000 to 100,000 per hour VII Stand alone - NO Pegasus-Eudora-Freedom- or other email program needed VIII Sends & Gathers & Parsing at the same time! IX Marketing Tables X Time & date stamp on all mailings XI Filtering system XII Send live links XIII Repair data base XIV Merge data base XV View data base XVI Pull down help menu's xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx THE FIRST WEB SITE HOSTING SERVICE FOR PROFESSIONAL BULK E-MAIL MARKETERS!!!! Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ONLY $149 per month With this unique service you send mail using your local dial-up through our secure SMTP port. The mail you send is first filtered through our remove name list and then sent. I SECURE T3 CONNECTION WEB SITE HOSTING When SoftCell becomes you postmaster you will never have your site ripped down again or have you e mail address change II 10 MG WEB DOMAIN We transfer or register your domain with internic III POP ACCOUNT REMOVE NAMES All mail is parsed against several large remove name lists as you mail IV 5 MG FLAME PROOF E-MAIL BOX We will not except multiple message or unmarked attachments from any user. V FIRE WALL Over 70,000 e mail addresses that can not access our server VI AUTO RESPONDER Easy and fast responder ------- End of Forwarded Message

1 0

Constraining the Program Counter
by ph＠netcom.com 17 Dec '03

17 Dec '03

You could build a fairly secure system if all of the executable code were confined to ROMs. Is there a way to confine the PC of any popular processors so that it can only execute code in the ROM? Ideally, it would be possible to do this with cheap off the shelf hardware. Peter Hendrickson ph(a)netcom.com

1 0

HP-48G is a perfect toy, thanks to all
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Thanks to all who recommended me to buy an HP-48G calculator. It is one of the most perfect toys that an adult can play with. I used a programmable stack calculator when I was in high school and it is a true pleasure. - Igor.

2 1

RE: Mass-market crypto phones
by Mullen Patrick 17 Dec '03

17 Dec '03

_______________________________________________________________________________ From: Lucky Green on Fri, Nov 22, 1996 14:52 <snip> >quality is fine. Note that a fast IP connection may or may not suffice. ^^^^^^^^^^^^^ <snip> >sending UDP packets over the Internet new problems arise. One packet ^^^^^^^^^^^ ^^^^^^^^ <snip> >--Lucky I was going to just listen to the way this thread is going because I find it fascinating, but now that it has been spelled out, I must make a very important distinction between my idea and PGPFone, WebPhone, etc. -- These are Web-based programs designed to speak over very long distances for "free" (neglecting ISP charges, etc.), adding the extra functionality of encrypting your data along the way so sniffers, etc can't listen in on your conversation. My encryptophone(tm) :-) is purely a modem-modem protocol. This way, even at 14.4k you get all of your throughput. No TCP/IP overhead. No busy Net. No "Why won't my ISP hold a connection longer than TWO MINUTES!?!?". The idea I was tossing around was a simple modem program which takes digitized voice, encrypts it, pumps it through the phone line directly to the modem on the other side which undoes it all. (Yes, I know this is a simplified view.) I also know it may not be as useful as the web-based products, but I also know you don't have to worry about the aforementioned problems and neither party has to have a Net account. This eliminates some of the problems which have been sent to me. Of course, some of the problems still apply and must be addressed. I guess now's the time to admit that the first and foremost problem is that I have never programmed my soundcard... I appreciate the tips and pointers everyone has been giving me tremendously. Hopefully, this thread doesn't do a complete reversal, because I am storing all hints/suggestions/tips to be used when I can finally get this project going. (I'm stubborn. I need to at least try it, if for no other reason than to get the knowledge... :-) Thanks! PM

3 2

Re: Mass-market crypto phones
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:50 AM 11/22/96 -0800, Sean Roach wrote: >At 09:10 AM 11/21/96 -0500, Clay Olbon II wrote: >>A while back, Eric Blossom posted a URL for a mass-market, phone encyrption >>device (http://www.comsec.com/) >At first this seemed to be a challenging goal as public key encryption (at >least the type of which I am aware) requires a public key ring, but then I >thought, what would be the point in real time communitation? Both Eric's product and PGPhone use Diffie-Hellman key exchange. They protect against man-in-the-middle attacks by displaying (part of) the resulting symmetric key and having the phone's users verify they are both working with the same key in the conversation. Until the AIs/eavesdroppers get good enough to imitate a person on the phone, this verification technique is good enough. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

FAQ on legalities SSLeay, &c.
by P. J. Ponder 17 Dec '03

17 Dec '03

the recently posted FAQ on crytpo patent expiration dates etc. stated that MD5 and SHA were not export-restricted anywhere. The FIPS Pub for SHA (which I think is numbered 180-1) specifically states that SHA is export controlled (by ITAR). I asked this list why it would be controlled, since it was a signature function, and Perry Metzger replied that crypto hash functions make good starting points for building a block cipher program. there is a section in Schneier's _Applied Crypto_ on this, too. anybody heard from the old Perry-grammer on his list project? I miss him. He would be having a field day with all this noise. surprised there hasn't been more chatter about the improved differential fault analysis (IDFA). That is pretty powerful stuff. They just don't make tamper-proof like they used to. Forget chomping on the keyspace, read the modulus and divide by the public key. I like the reference to the 'Mafia EFT/POS'. ObSciFi: Go back and read the Preface (by Bruce Sterling) to Gibson's _Burning Chrome_ collection. He talks about the sorry state of SF in the 1980's and how Gibson, among others, was turning out something new. Hmph.

1 0

Software distribution the cypherpunks way? Was: Patent Fight Could Add to Cost of Inter
by Phillip M Hallam-Baker 17 Dec '03

17 Dec '03

This turned into a long article on software distribution. > NEW YORK (AP) _ A little-known patent could raise the cost of > doing business over the Internet for companies selling software, > video or other digital products delivered online. > > E-Data Corp. of Secaucus, N.J., is suing 17 companies, including > McGraw-Hill and CompuServe, to collect licensing fees on the > patent, which protects downloading of encrypted digital > information. A court hearing is scheduled Dec. 6 in New York on the > company's claims. Although this is one of the most bogus and indefensible patent claims about I don't think it has any material bearing on the Web. Any that it does have is likely to be beneficial since the Freeny model is inherently broken and non-Web. What Freeny does is to claim the idea of encrypting an information product, delivering it through a computer network (though not a physical medium, there is another patent that claims that), and selling the decryption key rather than the product. It is a hot idea if you are trapped in traditional, pre-Web thinking but not if you understand the dynamics of the net. The problem is that encryption is not such a great barrier to preventing proliferation of software. If encryption is free than you might as well add it in, if there are patent costs then you have to ask what precisely you gain from encryption. The problem is that the information good has to be decrypted before use. Since it is very difficult to prevent copying after the decryption has occurred all that the encryption is really doing is to slow down the process of proliferation. A more important question is what if anything one gains from preventing proliferation. Microsoft has not been hurt by the massive bootleg copying of its software, far from it. Many business users are keen to buy non copy protected software because they can then obtain a "free" copy for their home machine at no cost to themselves. This minor peculation is in my view the principle reason for the dominance of the PC in the home market. There is no good reason why a person would buy a $2000 business machine rather than a $500 home machine when the latter plays much better games. But add the idea that one can use the software bought by one's employer and the PC looks the better buy. I believe that the success of Netscape demonstrates that copy protection is a bad idea. If you believe in free markets then the price of any given product is going to come down to the marginal cost of production. For software sold via the net the marginal cost is pretty close to zero. The price of the various "Office" bundles sold via the stores is astonishingly low. $200 for MSOffice or Corel Office is a silly price. If the product is bundled with the machine the price gets even sillier - a few dollars. I expect that before long we will see machines coming bundled with more than one office suite because the prices are just too low to make the choice irrelevant. An important fact to bear in mind is that companies are in general interested in being honest. There is little incentive for an employee to cheat the software vendor. The cost of lawsuits is a good deterrence since the type of company where management are likely to encourage software theft is also the type of company that is likely to have disgruntled ex-employees willing to inform. As a system manager my principle interest in net O/S such as WNT and VMS is that they have good, centralized and standardized licensing mechanisms that allow me to make sure that the software has been paid for. Its another reason why site licenses are useful! The price of net software is likely to be close to the price the OEM pays, a few dollars. This is likely to be structured somewhat differently however. I expect to see growth of two trends, software rental and componentware. Componentware, selling the package in small increments is a poor proposition if selling via physical media. The cost of a CDROM is low, (few cents), but the cost of post and packing is high. Selling componentware via the net is considerably more interesting. Just as I paid a few bucks for my XV program, I'm willing to pay a couple of bucks for additional input filters. I'd certainly be willing to pay a couple of bucks for specialized document tools or specialized canned document formats (e.g. IDEF0, ESA-Requirements whatever). I see the potential for componentware being primarily low cost, high volume. Componentware is now on the brink of being practical for three reasons. First as previously stated the net makes distribution costs lower. Second modern software applications are considerably more "open" to extension than previously. In the past most software houses attempted to produce products that satisfied every need. Today the large software houses realize that they cannot hope to satisfy every need but that if they can cover 95% of a persons needs in a way that allows them to add in the remaining 5% everyone is happy. Finally, Java has legitimized the componentware idea. Its worth noting that the technical suitability of Java to the task is irrelevant. What is important is the fact that several hundred startup companies have been created to do nothing else than make Java applets. Such companies are effectively committed to make componentware work and it is inevitable that at least one will succeed in establishing a paradigm for the others to copy. The second interesting development is software rental. To an extent this already occurs since the rapid rate of software development means that software rapidly becomes obsolete. Anyone who is using WordPerfect 3.1 for more than a few hours a year should probably upgrade to the latest version simply because it offers so much more functionality. The recent move by Microsoft to incorporate the year into their products is intended to encourage frequent software upgrades. It is a small step from this model to one in which software is "leased" for a period of a year or more at a time. Of course both componentware and rental strategies have been around before the net existed. What the net does is to change the economics so that low cost, high volume is the mainstream strategy. Software rental traditionally involves expensive agreements, typically brokered by lawyers on both sides. The network means that it will become economic to rent software in low volume and for short periods. Joining the componentware and rental strategies together would point to a distribution strategy in which a corporation would lease a certain number of seats worth of fully updated packages. The seats would be continuously updated on a daily basis as additional components passed the supplier's QA. In this model the purchaser is buying the up-todateness of the package. There would be little value in bootlegging the software since its unlikely that the bootleg version would be anything like as convenient. There would also be scope for different levels of uptodateness. Just as the Microsoft developer network delivers a bulging binder full of CDs to my desk each quarter there will inevitably be a large number of developers willing to risk buggy software to have access to the cutting edge technology. On the other hand there will be people who prefer to wait until others have found the bugs, waiting a judicious length of time before updating unless a patch is a response to a known bug. Encrypting the distribution process might be worthwhile to reduce fraud but the main vulnerability is probably unauthorized copying after distribution. What the Freeny patent covers is thus the old model of software distribution in the new sales paradigm. There is little point in taking costly measures to protect the copyright of products being sold for small dollar amounts. First Virtual proves this. Where more expensive software is concerned it would ideally be best to use the net. But here the price of the patent is simply too much. The 1% extorted under the patent would easily pay an intern to stuff a CD in an envelope and send it. The role for encryption in the software distribution process is in authenticating the delivered goods. The role of encryption is to provide privacy. It is very hard to keep a secret that every one knows about, still harder to sell information that is public knowledge. The net is not an information economy, it is an access to information technology. Nobody will profit from merely selling information, they will have to sell the ability to access information in better ways, better indexing, faster access, lower publication delays and so on. comments? Phill PS in checking this document Microsoft's spellchecker suggested "Mosaic" when checking the word MSOffice!

1 0

Report on Net Tax Policy
by John Young 17 Dec '03

17 Dec '03

The US Treasury Department's report "Selected Tax Policy Implications of Global Electronic Commerce," reported this morning in the NYT, is available at: ftp://ftp.fedworld.gov/pub/tel/internet.wp (260 kb; WordPerfect 6.1) We've prepared an HTML version at: http://jya.com/taxpolicy.htm (140 kb) Here's the TOC Section I: Introduction Executive Summary 1. Introduction Section II: Technical Background 2. An Overview of the Global Information Infrastructure or "Information Superhighway" 3. The World Wide Web and Electronic Commerce 4. Security and Encryption 5. Payment Mechanisms Section III: Tax Policy and Administration Issues 6. Tax Policy and Administration Issues: General Considerations 7. Substantive Tax Law Issues 8. Tax Administration and Compliance Issues 9. Conclusion Glossary Notes

2 1

CNET News Dispatch November 22, 1996
by The CNET newsletter 17 Dec '03

17 Dec '03

************************************* CNET NEWS DISPATCH/SPECIAL COMDEX ISSUE Friday, November 22, 1996 San Francisco, California, USA ************************************* Welcome to the sixth and last in a series of SPECIAL COMDEX ISSUES of the CNET NEWS DISPATCH, bringing you the latest on the people, products, and parties at this exciting event. Check out our Comdex page at: http://www.news.com/Categories/Index/0%2C3%2C38%2C00.html?nd ************************************* CNET NEWS DISPATCH is a daily newsletter that summarizes the up-to-the minute technology news presented by CNET's NEWS.COM. It tempts readers with coverage of today's hottest stories, news in the making, (in)credible rumors, and other indispensable information. For complete versions of the stories updated all day long, head over to: http://www.news.com/?nd ************************************* CONTENTS SCOOPS AND TOP STORIES AOL tries to play "The Price is Right" with customers Microsoft catches up to its own browser in Macland Gates & Grove prove great minds think and clink alike It puts the whole...world...in your lap Despite IPO mishaps, tech firms still getting VC $$$ ANNOUNCEMENTS An easy way for you to customize NEWS.COM Search the site for particular topics and articles Send us your questions, comments, flotsam, and jetsam How to subscribe and unsubscribe Late-breaking stories just a click away with Desk Top News ************************************* AOL TRIES TO PLAY "THE PRICE IS RIGHT" WITH CUSTOMERS As if he didn't have enough to worry about--blackouts, churn, the growth of the Web--Steve Case and friends are also wrangling with attorneys generals in 17 states. The problem is AOL's new pricing policy, which can be summed up as: "Unless you say 'no,' your rate goes from $9.95 to $19.95." At pixel time (previously "press time"), the skirmishes were just beginning. http://www.news.com/News/Item/0%2C4%2C5674%2C00.html?nd MICROSOFT CATCHES UP TO ITS OWN BROWSER IN MACLAND Explorer for Mac users rejoice! Your hybrid platform/browser choice has just been significantly enhanced by the arrival of Microsoft's Java Virtual Machine. Some of the Web's most bleeding-edge firms are now rushing to embrace this new entrant into the market. http://www.news.com/News/Item/0%2C4%2C5675%2C00.html?nd GATES & GROVE PROVE GREAT MINDS THINK AND CLINK ALIKE First his friend and business buddy Bill Gates misses, then frantically swerves to catch, the opportunities of the exploding Internet market. Now Intel chief Andy Grove seems to have jumped into an exploding market late enough to possibly fall off. Ironically, the product at the center of this battle is Windows CE, made by none other than Microsoft itself. http://www.news.com/News/Item/0%2C4%2C5676%2C00.html?nd IT PUTS THE WHOLE...WORLD...IN YOUR LAP People will buy 190,000 of them this year and 4.1 million by 2000. They come in 20 varieties and move four times faster than analog modem speeds. It fits in your pocket, but can take you thousands of miles in seconds. http://www.news.com/News/Item/0%2C4%2C5669%2C00.html DESPITE IPO MISHAPS, TECH FIRMS STILL GETTING VC $$$ You've heard about Wired canceling its IPO. Twice. You've heard that the VC-money-for-neat-Net-ideas bubble has burst. You've heard about apocalyptic traffic jams that could choke the Web. But to get the real story on how investors and venture capitalists feel about Net-related firms nowadays, the old adage of "follow the money" yields interesting results. http://www.news.com/News/Item/0%2C4%2C5673%2C00.html?nd ************************************* ANNOUNCEMENTS AN EASY WAY FOR YOU TO CUSTOMIZE NEWS.COM So many bits, so little time? Sounds like you need Custom News. Identify the topics, keywords, or sections you're most interested in, and Custom News will a create a page of headlines and summaries for all stories that match your criteria. Check it out at: http://www.news.com/Personalization/Entry/1%2C21%2C%2C00.html?nocache=1 SEARCH THE SITE FOR PARTICULAR TOPICS AND ARTICLES Search the entire NEWS.COM database for stories you saw in News Dispatch, or track any story we've run. http://www.news.com/Searching/Entry/0%2C17%2C0%2C00.html?nd SEND US QUESTIONS, COMMENTS, FLOTSAM, AND JETSAM If you have any questions, suggestions or remarks, send us a message: newsdispatch(a)cnet.com HOW TO SUBSCRIBE AND TO UNSUBSCRIBE To subscribe to News Dispatch: Send mail to listserv(a)dispatch.cnet.com with the message: subscribe news-dispatch (your name) in the message body. To unsubscribe send the message: unsubscribe news-dispatch LATE-BREAKING STORIES A CLICK AWAY WITH DESK TOP NEWS How would you like having split-second access to the very latest news on the Net? Our Desk Top News feature puts our 20 most recent stories right there on your desktop for you to review at any time. Here's how it works: 1. From any story, click Desk Top News in the top right. 2. A window will open showing our last 20 stories. 3. Click on a headline to display the story. 4. Desk Top News updates itself every 30 minutes. 5. You become known as Ms./Mr. Cyber-Info. It feels good. http://www.news.com/Help/Item/0%2C24%2C12%2C00.html?nd ************************************* CNET: The Computer Network http://www.cnet.com/ http://www.news.com/ http://www.gamecenter.com/ http://www.download.com/ http://www.search.com/ http://www.shareware.com/

1 0

Star Trek: First Contact
by frantz＠netcom.com 17 Dec '03

17 Dec '03

For the fans of E.E.(Doc) Smith, go see this movie. OBCrypto: Data locks the main computer with a fractal cypher. OBMoney: Picard states the they don't have money in the 24th century. Instead they work for the good of mankind. Nanotechnology must have made everything material possible, so the only reward left is status (aka reputation). ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

10 10

Re: IPG Algorith Broken!
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Nov 24 09:59:36 1996 Uni wrote: > On Sat, 23 Nov 1996 wichita(a)cyberstation.net wrote: > > > To obtain your organization free operational demonstration copy, > please > > send an e-mail request to: > > > > ipgsales(a)cyberstation.net > > > > You must include your snail-mail address and telephone number in said > > request. > > Now THIS has potential! Indeed. Note that he calls it "organization free" above. Obviously, his operation's entire marketing department is an excellent source of randomness.:) JMR Regards, Jim Ray DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Please note new 2000bit PGPkey & address <jmr(a)shopmiami.com> PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMphi3DUhsGSn1j2pAQHJ0gfQzgWGEb2lJ3KSPWGn3td/k2veuxZDjkHu OlITK3W6zT9MUWqh4KrdvQkt7Z/RzRls+uJPr7ZChS8f6FSHHvGWSmnTBZb+Bav8 JGJqcq+b/BwuUJ0RmVbGL9N7BCCXICroIdGQc1R+DmUuTMcqaAxD9bYWYbs/JSr0 Q00u3L/w8djc74sR2dS3PWmwF9PGLlmKrVQijY/q7WUNhKJDoZR4w511hswVHn1N BMjR49s+5Gh3N6eaRnKx/B2GnByhvL5Sgai2uPAqT5tFiA7R1nxnHZIlgMplYKsw 27nUWGYFpM+gP/wppw1neZqJcu4xKzg25IN4QIe86T78oA== =WUGy -----END PGP SIGNATURE-----

1 0

how much entropy in common answers
by Pat Farrell 17 Dec '03

17 Dec '03

I've been playing arround with some code to implement CME's secret sharing using low entropy answers. (His write-up is in http://www.clark.net/pub/cme/html/rump96.html) In the write-up, Carl says " That means that it has very low entropy. For example, a person's first name has only about 8 bits of entropy. Car makes and models have only 2 to 4 bits of entropy -- especially if one is naming cars desirable to a teenager." Further on, he says "Therefore, if each answer has entropy E, the attacker must correctly guess T=(EK) bits of answers. If T exceeds 90 bits or so, then the user is reasonably secure from answer-guessing attacks." (where K is the number of questions) My question is, how do we measure the entropy of each answer so we can calculate when we've got 90 or so bits. I know when I was a teenager, the list of car lust objects was short, and everyone wanted a Mustang or Camaro, so the entropy of those two choices was much less than half a bit. A similar idea was mentioned in a critique of the plot of West Side Story. The question is, on a hot night in Spanish Harlem, what percentage of women are named "Maria"? Clearly there are cultural issues involved. The entropy in a question such as "what is your favorite brother's name?" is low in an Irish family like mine where names cluster arround choices such as are Patrick, John, Sean, and Dan. So how do we measure the entropy objectively? Thanks Pat Pat Farrell CyberCash, Inc. (703) 715-7834 pfarrell(a)cybercash.com #include standard.disclaimer

1 0

RE: Mass-market crypto phones
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:40 AM 11/22/96 -0800, Lucky Green wrote: >The LEA's are not intested in saving the public money. They are >interested in preserving and expanding their power. If it costs >$1,000,000 per wiretap, who cares? The government has men with guns that >can always go out and extort more cash from the population. > >--Lucky They could if they would; but they can't so they won't. Governments (like real people) always collect as much revenue as they possibly can at a given time. If they could figure out a way to get more they would. To argue otherwise is to imply that they are not maximizing their total monetary and psychic income and are forebearing to grab all they could. I don't think members of this list should pay The Great Enemy such a compliment. Remember the findings of the Public Choice school. DCF

1 0

A.Word.A.Day--syncope (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, For those of you who don't get Word.A.Day, you might enjoy the unatributed quote at the bottom of the post. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: Sat, 23 Nov 1996 01:52:20 -0500 From: Wordsmith <wsmith(a)wordsmith.org> To: linguaphile(a)wordsmith.org Subject: A.Word.A.Day--syncope syn.co.pe \'sin-k*-(.)pe-, 'sin-\ n [LL, fr Gk synkope-, lit., cutting short, fr. synkoptein to cut]short, fr. syn- + koptein to cut - more at CAPON 1: a partial or complete temporary suspension of respiration and circulation due to cerebral ischemia : FAINT 2: the loss of one or more sounds or letters in the interior of a word (as in fo'c'sle for forecastle) ........................................................................... The generation of random numbers is too important to be left to chance. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ To subscribe or unsubscribe, please send a message to wsmith(a)wordsmith.org with "Subject:" line as "subscribe <Your Real Name>" or "unsubscribe". Email anu(a)wordsmith.org if you have any questions, comments or suggestions. Archives, FAQ, words and more at the WWW site: http://www.wordsmith.org/awad/

1 0

Re: wealth and property rights
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 21 Nov 96 at 18:35, Dave Hayes wrote: > However, I would question the implication that "socialists" are > responsible for the higher tax rates you currently experience. > > For example, I could make a strong case that you really have some > clever "capitalists" who have learned how to express their > "capitalism" quite effectively across the space of all people in a > "country". OK. I am not on Cypherpunks anymore but this leftover of the mail queue landed in my mailbox. So, please, reply directly. I just couldn't let this one pass by me without jumping on it. :) Your second paragraph is attacking a straw man. You even included the word 'capitalist' in double quotes ("). The common point between socialists and theses so-called "capitalists" is that they both use that fact that some coercion is enacted on a given population to get rich an/or powerful. The socialists seek, as a value, power over producers and your "capitalists" seek to get rich and/or powerfull. But both blank out the cause of the obtention of their goals: legally exerted coercion (via govt rules and powers). To use terms coined by a well known writer, one is a Witch Doctor, the other is an Attila (morally sanctionned by the Witch Doctor). They natures are not opposite, they are simply both sides of the same coin. I sometimes wish peoples would use words for what they really mean... jfa Please reply or Cc. directly to me. Jean-Francois Avon, Pierrefonds (Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

2 1

Re: IPG Algorith Broken!
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 8:09 AM 11/23/1996, Eric Murray wrote: >No, you can't. It's impossible to prove an algorithim unbreakable. No? Please prove your assertion. Your claim is similar to IPG's - nobody has done it yet. Your claim is stronger - hardly anybody has worked on IPG's algorithm, nor are they likely to. diGriz

8 8

Announce PGP263UI (long message)
by Steve Crompton 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To All PGP Users: I am happy to announce the availability of PGP 2.63ui, the successor to PGP 2.6ui and 2.62ui, an unofficial international release of the famous public key encryption program, based originally on version 2.3a. This version is being made available for a number of reasons: * It is the only version fully compatible with *all* versions of PGP from 2.0 to 2.7 * It incorporates a number of bug fixes and features not available in the MIT release (see below) or in Stale Schumaker's 2.6.x.i releases based on the MIT release. * This version, like 2.3a and 2.6xui before it, is published under the terms of the GPL. Consequently: - You are not bound by the RSADSI licence since this version does not use RSAREF (which forbids commercial use and unauthorised use of the cryptograpgic routines), as you are with MIT PGP - You are not bound by the MIT licence (which requires the program to produce output that cannot be read by earlier versions), as you are with both MIT PGP and Staale Schumacher's PGP 2.6.xi. - you can therefore do what you like with the code of the program provided any derivative work is also GPL'd. - The only relevant patent for users outside the USA is Ascom-Tech's patent on IDEA. For non-commercial use it's free, anywhere. For commercial use you need a license, but Ascom-Tech offers a single- user license for a modest fee. See http://www.ascom.ch/systec Users inside the USA may not legally use 2.63ui, because the RSA patent is in effect there. USA residents are advised to obtain one of the MIT versions which have a license for non-commercial use of RSA. However, I note in passing that by using the armor_version parameter in CONFIG.TXT, that armored output from PGP 2.63ui can be made difficult or impossible to distinguish from other versions. Note that I personally have not done very much of the actual coding on this version. However if bugs are reported or constructive suggestions for improvements made I will pass them on to the individual(s) who have done the bulk of the work to make this release possible. I am assured that continuing support will be provided. This is a partial list of the changes and fixes since 2.62ui. A complete list is in file 263UICHG.ASC, which is inside both ZIP distribution files. Added CONFIG.TXT Parameters: LabelEncrypt = on # Label Encrypted Armored files with Recipient(s) This will add readable text in front of an encrypted and armored file listing the public keys used to encrypt it. The format of the text is similar to what appears on the console during (-l) decryption. PrePendSigV=on # Prepend Signature Verification msg to output text When verifying the signature on a text (not binary) file, and a detached signature (-b) is not requested, PGP 2.63ui will prepend a message with the results of the signature verification (good or bad) similar to what appears on the console. Expanded Compatibility with Early PGP Versions. version_byte=3 is usually set to Emulate PGP 2.6 after 9/1/94 Version_byte must be set to 2 before encrypting/signing messages to be decrypted/verified by PGP 2.2 or 2.3a. Also, unique to PGP 2.63ui, is the ability to set version_byte to 2 in extracted keys (-kx[a]). This allows PGP 2.63ui to extract keys which may have been created and/or signed by MIT PGP or by a ui version with version_byte set to 3 and create an extracted key which may be added (-ka) by PGP 2.3a. Note that the reverse is not true. If version_byte=3, keys created with version_byte=2 are -not- changed when extracted. Expanded Error Checking Most disk writes are now checked for errors or running out of disk space. Key Generation and other Keyring maintenance operations check for write access to public and (where required) secret keyrings before lengthy processing starts. Previous versions were not checking if the keyrings were set to read-only, which led to invalid results. PGP 2.63ui allows you to change UserID's of keys not your own (corresponding secret key not present). You can sign the new ID with your own secret key but (obviously) not with the other person's secret key. PGP 2.63ui is distributed in two ZIP files pg263ui.zip [executables & documentation] pg263uis.zip [source code & documentation] They are currently available at: ftp://ftp.funet.fi/pub/mirrors/utopia.hacktic.nl/pgp/pc/dos/ ftp://utopia.hacktic.nl/pub/replay/pub/pgp/pc/dos/ Each zip file contains a MANIFEST signed by me which gives the MD5 digests of all other files within the ZIP. You can use the MD5SUM.EXE program included in pg263ui.zip to verify the MANIFEST (after using PGP to strip the signature). Here is the MANIFEST for pg263ui.zip 840317378232e54d03424e7e49a9bd4a *263UICHG.ASC 7408f5f49f74e0209f7a712a10c95e8e *CONFIG.TXT 83c8d06f39a0984066464e9a70e62550 *ES.HLP 64fa593bc5f188cf5a3cda03f3ed0ea5 *FR.HLP 480f583a2ac6776a4de7df6e7382545e *KEYS.ASC 5ba7143bad4739a4b749e492b5eee1ce *LANGUAGE.TXT ecec59110e8a3bfd7fb195ec5964d5ce *MD5SUM.EXE ca537810f4fdf5f359ec6583eeb176bb *PGP.EXE 3e2afe9edfc197554e9de9e3d433cdd0 *PGP.HLP e1ef684d67c7e23143bca9163ce04966 *README.1ST 473d455178341f5f6e5f53394fd5a1d9 *README.2ND a7491b03c6e87d57e34ec03ace211509 *README23.DOC 01a94cd84d68ea1cb905ce29caf0961e *DOC\BLURB23.TXT ad4652e2dcfd4a0ecf91a2c01a7defd5 *DOC\COPYING fbdd95ba04c9d2be5c4b8e2769482c32 *DOC\KEYSERV.DOC 8ab813656498102101d55b9ecfddde98 *DOC\NEWFOR22.DOC cf12a2daac04470b6ad2b311cc514431 *DOC\NEWFOR23.DOC 5413061db46b1379a5489296c214ee38 *DOC\PGFORMAT.DOC 2a6c84401fc0c3b9febd77dd965c7b4f *DOC\PGP.1 33eeab5a938d0d33b8ca8ecf97038d73 *DOC\PGPDOC1.TXT ff0d028f72c4632c2b87c099dce92180 *DOC\PGPDOC2.TXT ca6253109c92944d44a9a1767f0b58ff *DOC\POLITIC.DOC b648ac7c1c3aa7b0c92f80dc18dc9bcc *DOC\README.VMS e4cfe2f3c28aab747f2396ae5e0a8ba8 *DOC\SETUP.DOC Here is the MANIFEST for pg263uis.zip 840317378232e54d03424e7e49a9bd4a *263UICHG.ASC 7408f5f49f74e0209f7a712a10c95e8e *CONFIG.TXT 83c8d06f39a0984066464e9a70e62550 *ES.HLP 64fa593bc5f188cf5a3cda03f3ed0ea5 *FR.HLP 480f583a2ac6776a4de7df6e7382545e *KEYS.ASC 5ba7143bad4739a4b749e492b5eee1ce *LANGUAGE.TXT 3e2afe9edfc197554e9de9e3d433cdd0 *PGP.HLP a7491b03c6e87d57e34ec03ace211509 *README23.DOC e1ef684d67c7e23143bca9163ce04966 *README.1ST 473d455178341f5f6e5f53394fd5a1d9 *README.2ND 1a22a466840f14025a5de0118d6daa0d *CONTRIB\README e8e9f513a273e86170e886c730a73307 *CONTRIB\ELM_NN\MAILPGP 56776ba15d847d005da2c95caa13744f *CONTRIB\ELM_NN\MOREPGP 8ae0fd91ea7ca5e041a5da4b78dce2c1 *CONTRIB\ELM_NN\POSTPGP a2e4b46d2b0a6613a19061e8755024ca *CONTRIB\ELM_NN\README 0bf0ac13b4d019ed8b010ac3c0d30241 *CONTRIB\EMACS\PGP.EL1 52f5921095dd385796ae5fe6b2badbc6 *CONTRIB\EMACS\PGP.EL2 8de46004960bbca27de290a814fa6585 *CONTRIB\EMACS\RAT-PGP.EL 0188d65c58e003d50871a60412a86e58 *CONTRIB\EMACS\PGPEMACS.DOC 3a256a88091276b667a8283614122a76 *CONTRIB\IDEA\IDEA.ASM fb995ab5c86fd45fcccc9c385d03c551 *CONTRIB\IDEA\README 1061623e095426e6ece416f75a15c643 *CONTRIB\IDEA\TEST.C 488b1cece84dd0853f491a5d10362ca4 *CONTRIB\MAIL_TIN\MAILPGP 994c5848ed0457eaf60ec086ad86048e *CONTRIB\MAIL_TIN\MOREPGP f3afdb4e57ea645e7bfdbb1eb969a48c *CONTRIB\MAIL_TIN\POSTPGP 746f7fcfb23fc18974f06243201957eb *CONTRIB\MAIL_TIN\README c037a9119d14999dc445ea47a75e7d48 *CONTRIB\MAILX\MAILER 06cebf8214342e286a7f3245c724ff4d *CONTRIB\MAILX\PGPMAIL2 eac85d75f64fef85da9afa399368890d *CONTRIB\MD5SUM\MD5SUM.C 5ca3e58ba621523b0d3feb026820fa63 *CONTRIB\MD5SUM\PGP23.MD5 6242095b32ea68409929194ad7e157bd *CONTRIB\MD5SUM\README 7bf7d12fe520767019a71d4f963fa6c8 *CONTRIB\MD5SUM\PGP26UI.MD5 501fc6ccb4e8405d75a72d9acb6a019c *CONTRIB\MH\PGPMAIL.MH bff01f6723fac1145074f6cce81ef1b8 *CONTRIB\MIME\MIMEPGP.DOC ded0f233729d58e001746708fb0ecec6 *CONTRIB\MISC\PGPNOHDR.SH a860741049e3b3285c4d96996a7e59f0 *CONTRIB\MISC\PGPPAGER.C 3af9ddacbe85b67fd3a02ce8a9421a04 *CONTRIB\VI\VIPGP.DOC 01a94cd84d68ea1cb905ce29caf0961e *DOC\BLURB23.TXT ad4652e2dcfd4a0ecf91a2c01a7defd5 *DOC\COPYING fbdd95ba04c9d2be5c4b8e2769482c32 *DOC\KEYSERV.DOC 8ab813656498102101d55b9ecfddde98 *DOC\NEWFOR22.DOC cf12a2daac04470b6ad2b311cc514431 *DOC\NEWFOR23.DOC 5413061db46b1379a5489296c214ee38 *DOC\PGFORMAT.DOC 2a6c84401fc0c3b9febd77dd965c7b4f *DOC\PGP.1 33eeab5a938d0d33b8ca8ecf97038d73 *DOC\PGPDOC1.TXT ff0d028f72c4632c2b87c099dce92180 *DOC\PGPDOC2.TXT ca6253109c92944d44a9a1767f0b58ff *DOC\POLITIC.DOC b648ac7c1c3aa7b0c92f80dc18dc9bcc *DOC\README.VMS e4cfe2f3c28aab747f2396ae5e0a8ba8 *DOC\SETUP.DOC a75c34297e3915242232242aa0147bb8 *SRC\3B1_6800.S baf854e4fd40d02a7b7b7fa2911382be *SRC\68000.S 557168162e418489bc245ab5c4030add *SRC\68000_32.S 57900fde67a6039f1b218972e74bf806 *SRC\80386.S de3f8236644a00ca45d1c41f400b2fc3 *SRC\8086.ASM 69f8d2757e5c13a1ebf17998a756e8ba *SRC\ARMOR.C 80f3854e9b76eee4167503893135839e *SRC\ARMOR.H 5b9cd4b55699685f37dd594382dda8a7 *SRC\CCC 7fb0b40db91d6da79d38b2f475110fc4 *SRC\CCC.X28 66b7d0786b5d426644591fa347a7e205 *SRC\CHARSET.C 35bbbe1de78008abae59bf12fed41291 *SRC\CHARSET.H 04b95ec3860bc3ecaf56d2fe5d837a68 *SRC\CONFIG.C eb57f96eea26bee3152fb82a5006e133 *SRC\CONFIG.H c0741f9f07cb9f7f7dff2be9ac6ed3a0 *SRC\CRYPTO.H df233c3e5793cae25adc82bd51ffe9c5 *SRC\CRYPTO.C 1c51db6958288d475e066f4b428d1324 *SRC\DESCRIP.MMS 067b372f3f13365acca772f307dd73c9 *SRC\EXITPGP.H 243453889c70b37d7444d29a162ba9bb *SRC\FILEIO.C bc273e19f5900cac30bfe8d1bc29907a *SRC\FILEIO.H a0bebb371176f8fd5ea2c34e14be8106 *SRC\GENPRIME.H 4f3f1ca25c8ad16536ba9fa4f2fa07ba *SRC\GENPRIME.C 12fb2c21d044f5cc1264d4e2f8e35d17 *SRC\GETOPT.C 70bc995b674a1041f006e0c85ad128bc *SRC\GETOPT.H 891c95125020cc39df1cfaf531baeac4 *SRC\IDEA.C cbf974a9968d4cccb3dbbb8c6e197fb3 *SRC\IDEA.H be2862fa4e729caed7f5284d0a068c2d *SRC\KEYADD.C a31d39f665562103f27fd51943eb9f80 *SRC\KEYADD.H fcd92da1ef03062aaaf4a32e9c0bfe1c *SRC\KEYMAINT.C e8b97adb23122b1e61d1c876d44405f5 *SRC\KEYMAINT.H b51b6f358baecddf27d2af1f1325b8a8 *SRC\KEYMGMT.H 55f0e339489a329813568e9e43d44087 *SRC\KEYMGMT.C 378c2c04399840ff19a1c428c86b31a3 *SRC\LANGUAGE.C fa3757f2e65cce62ccd16cf4fa71f0dc *SRC\LANGUAGE.H 2194f583f62eff5db4dacc1d032fd391 *SRC\LMUL.H 465c44debfabb9433c6b0d6416d29ff9 *SRC\M.BAT 46377c4b4ff7deb2bac93c5eee2bbbad *SRC\MAKEFILE.TC 5a7e71d8c85f7cd95825c55cd3f1bae7 *SRC\MAKEFILE.AMY 625825b93e4230440371ee2bc32616e8 *SRC\MAKEFILE.MSC 0fd62dae064f53b0c9caa7ac9302a926 *SRC\MAKEFILE.UNX 08781b63fa78e8743be80da9aace6f9f *SRC\MC68020.S 021582f73d3324be77267a0c60890e6e *SRC\MD5.C 3b254fd2c035f3081ca2ec96ea120f9a *SRC\MD5.H 517550a4f55b76767a524f8997310bae *SRC\MDFILE.C f54f6dc8ab01cb256d23f59824c38ee7 *SRC\MDFILE.H 5fbaf7195aadb77916f02c6fe3260a45 *SRC\MORE.C ad3274da77b334827113f23ba7e85730 *SRC\MORE.H 9cb7caf58ca015e4a2a88deb056c539d *SRC\MPIIO.C 4d1446ac5992abe2cf1ea12a8f2d9310 *SRC\MPIIO.H 5b5f0174cdc8d2dcf6c48240ea4bf055 *SRC\MPILIB.H f86467788e24b8484c9f9c71b8bfb692 *SRC\MPILIB.C 5db4340956609ac9debb9a517371bf9e *SRC\PASSWD.C 9344f7fe246c52d04105ddfae09de625 *SRC\PASSWD.H 8fe5084f2924836c655e84ef7f835674 *SRC\PGP.C 614f9234b18231bf92219c8a257e78cc *SRC\PGP.DEF 88c06903fc5386160e34291da980c421 *SRC\PGP.H 851e15e93234d3c466af5f9c9c932d79 *SRC\PGP.MAK 64459d86a1069f98ed6d471b39614561 *SRC\PGP.OPT 2def18122c0cf2b56e0e8caff3e3ecb5 *SRC\PGP.PRJ abf28ba7832d89abeac494e3cec45a7c *SRC\PGPPWB.MAK dbb569238f082bb4048264ffd0eb117a *SRC\PLATFORM.H 19be9bade48954274b84408fa18d4ad0 *SRC\R3000.C e64d1a208d148cd3c2400f9301360df2 *SRC\R3000.S 766825310519ca3c70395c2ccf986aa7 *SRC\R3KD.S ba19b4d87c1f1d36f00e1f180b4b9a72 *SRC\RANDOM.C 1aad27b13005436b9e2e9c7537a641e0 *SRC\RANDOM.H 62542804547db44fabdf36bc31d0802e *SRC\RSAGEN.C 6d3eb1bb77e53c7020dc6180c95adeb2 *SRC\RSAGEN.H d026b1e2ef561bf20790c81578159449 *SRC\RSAGLUE.C a62a4b12a3837571e13419559c385747 *SRC\RSAGLUE.H b13fc1755a4d36109604dd027d9a5d36 *SRC\SPARC.S e01ca7bf8ff1b5fb55b95b762569430d *SRC\SPARC5.S 9d47b06b192c264dcbf2184c1890f05f *SRC\STDLIB.H 1efd1412a867be2b00a0cd66f036c314 *SRC\SYSTEM.H 329e9a279a9cdd4ae241d03839970a6d *SRC\SYSTEM.C 270fa89c0ff884ee10d1a02a1ff9040d *SRC\USUALS.H 30861dd65fdde4a5980b7d4cdf77ffdf *SRC\VAX.MAR 4d38b8dd3fa590edac0c2c9ccbfa2c0f *SRC\VAXCRTL.OPT 0bfbf4243329095d8bedb43e9222c6f4 *SRC\VMSBUILD.COM 1f09c5096052dd04a23f82fbfbf3f735 *SRC\ZBITS.C 9ff737184ab3697105e63c314ee291bb *SRC\ZDEFLATE.C 6ce4f6a3d9a62c1f188a2c22c171242a *SRC\ZFILE_IO.C 20cc87c569e4a1ef96b700f733190201 *SRC\ZGLOBALS.C 7cf642c7a28dab19b5b257d6f06fa3a4 *SRC\ZINFLATE.C 28d41c5aea7551e8c6c3d12e69141adb *SRC\ZIP.C 6e4e3f4ae03d0d6a9d466716bafe719f *SRC\ZIP.H 1602f1e2f0836b7d2af3e071fca8a47e *SRC\ZIPERR.H d196f856bc08b1740b2679c5f5fd1411 *SRC\ZIPUP.C 988ca6b0f63791ca02524048e666cb72 *SRC\ZIPUP.H fb27196aa99cf8b47fba10581db5aa24 *SRC\ZMATCH.S 8f5d690f2652a4d4ceab1b41d1b40d01 *SRC\ZMATCH.ASM 56b97156406d0adb0e9b714c2d5bf6c6 *SRC\ZREVISIO.H 7c2f8a376a30a72eb71eff212f1a8b14 *SRC\ZTAILOR.H 17fac9f3271a8650256da28bf31b584b *SRC\ZTREES.C 3f114dac8098c09167d2d2c540520415 *SRC\ZUNZIP.C d211d2be3334c216808c376cc5b5812e *SRC\ZUNZIP.H This version of PGP has not been approved by MIT or Phil Zimmerman. Please do NOT send any questions or bug reports about this version to either pgp-bugs at MIT or directly to Phil, but rather to me, Steve Crompton <100645.1716(a)CompuServe.COM> London, 23rd November 1996 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. iQCVAwUBMpc+1Qc2DukbwCfhAQHi8gP+LCT2tFyzHf54CCkzeqQKbfQdFlldddtO RwwyVLOE6R7HnHuwz8HPFOEKjz85z158Rq0RbpmZqG+G0ynChuqm/80ocEfB83PI PXLjgTzeOxqdEum9tWpa45UUlMEuC4Puni7t9AUMyNlTmNrunbRMFdcDxIajsV+j U/0r1tRhPA4= =G+nz -----END PGP SIGNATURE-----

3 2

Re: Sameer R.I.P.
by azur＠netcom.com 17 Dec '03

17 Dec '03

>C2 has a nice corporate-style fig leaf on its site. Sameer has decided, it >seems, to get out of the anonymity business and pursue other interests. > >Nice run while it lasted. > >FYI, Sameer does mention that his recent legal brouhaha had nothing to do >with this decision. C2 is still appears comitted to anonymity, they just don't want consumer accounts which were unprofitable. C2 will still support anonymous Web pages and offers the Web-access Anonmizer.

1 0

Re: Star Trek: First Contact
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:02 AM 11/23/96 -0500, Black Unicorn wrote: >On Sat, 23 Nov 1996, Bill Frantz wrote: >> OBMoney: Picard states the they don't have money in the 24th century. >> Instead they work for the good of mankind. Nanotechnology must have made >> everything material possible, so the only reward left is status (aka >> reputation). > >Why doesn't everyone have a starship? (Tongue firmly in cheek) It seems some feel that their best route to high status is to be the crew member who beams down and dies. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

Re: how much entropy in common answers
by Hal Finney 17 Dec '03

17 Dec '03

From: Pat Farrell <pfarrell(a)netcom.com> > Clearly there are cultural issues involved. The entropy in a question > such as "what is your favorite brother's name?" is low in an Irish > family like mine where names cluster arround choices such as are Patrick, > John, Sean, and Dan. > > So how do we measure the entropy objectively? You have to estimate the probability that the attacker will guess what you have chosen. This will depend on how much the attacker knows about you. If he knows that you're Irish, it will help in the question above. If he knows the names of your brothers, it will help a lot more. Probably it is best to be conservative in assuming what your attacker knows. If you have four brothers and nobody whom the attacker could ask will know who is your favorite, but you think he could find out there names, then he has probably a 1/4 chance of guessing right. (Actually he might do better by preferring older brothers rather than younger, etc.) The amount of entropy is then negative log 2 of the probability, or 2 in this case (2**-2 is 1/4). For cars, if 50% of people like you would have chosen Mustangs, 40% Camaros, and the remaining 10% scattered among other brands, then if your favorite car was a Mustang that is only worth about 1 bit. But if your favorite car was an Oldsmobile there might be only 1/100 chance of the attacker guessing that, so it could be worth 6 or 7 bits. Hal

1 0

This is your last warning
by aga 17 Dec '03

17 Dec '03

On 23 Nov 1996, Firebeard wrote: > >>>>> aga writes: > > a> It just "looks" that way on the net. I do live-fucking, newsgroup > a> flooding, mailbombing, vote-tampering and defamation all legally, > a> and OPENLY on the InterNet. > To be truly honest about this, (since you keep putting that cypherpunks address in the header) I have not really done any of the above yet, but they are all perfectly legal in cyberspace. Just get the fucking point, there are no laws which can cross borders. > a> The more you PGP, the worse you look. Nobody reads your e-mail, so > a> stop being so paranoid. > > Hate to disabuse you, but I've had it done. I've had military > investigators hand me copies of email I've received, and ask me to > explain them, and the actions I took (and did not take) in response. > Just what kind of 'military investigators?' Since you are a civilian, they should not have even asked you that question. You answer by privete email. The net is clearly not military property but belongs solely to international anarchists which can not be stopped by any laws. > -- > #include <disclaimer.h> /* Sten Drescher */ > ObCDABait: For she doted upon their paramours, whose flesh is as the > flesh of asses, and whose issue is like the issue of horses. [Eze 23:20] > ObFelony: President Clinton, you suck, and those boys died! > Unsolicited solicitations will be proofread for a US$500/KB fee. > Now look, I have told you before. Stop writing to me and using the cypherpunks address as a cc in the header. I told you before that I am not going to write to that fucking list any more, and if I receive any more e-mail from you with their address in the header, well... You have been doing this for a number of days now. This is your last warning.

1 0

Re: how much entropy in common answers
by Pat Farrell 17 Dec '03

17 Dec '03

At 01:26 PM 11/23/96 -0800, Hal Finney wrote: >From: Pat Farrell <pfarrell(a)netcom.com> >> Clearly there are cultural issues involved. The entropy in a question >> such as "what is your favorite brother's name?" is low in an Irish >> family like mine where names cluster arround choices such as are Patrick, >> John, Sean, and Dan. >> So how do we measure the entropy objectively? > >You have to estimate the probability that the attacker will guess what you >have chosen. This will depend on how much the attacker knows about you. >If he knows that you're Irish, it will help in the question above. If he >knows the names of your brothers, it will help a lot more. Probably >it is best to be conservative in assuming what your attacker knows. I was really hoping for some insight into the general problem. If you knew that my family is Irish, that makes certain names much more likely. Obviously if you know that I've got five brothers, a little bit of work will probably let you know that they are Tom, Dick, Harry, Mike, and John. But that is an example of a terrible question for Carl's approach. I was asking the more general question. Carl suggested that in general a first name has about eight bits of entropy. But knowledge of the social environment can seriously reduce it. Jenifer was a hugely popular name for girls in the US ten to 20 years ago. You'd expect more Juan's and Jose's in a Hispanic community, just like you'd expect the Dan's, Pat's, Mike's, in an Irish community. I know that the classic definition of entropy is, but without knowledge of the statistical universe that we're dealing with, how can I measure it? The probability that a male's first name is Harry is probably pretty low in general, yet it is exactly 20% if you restrict the world to my brothers. Carl suggested "What was the name of the first person on whom I had a crush?" But if 33% of the women are named "Maria" in the local universe, then that is not much entropy. Yet a name of "Maria McGee" is probably fairly high entropy, as it is an unlikely combination. If you were raised in a small rural area, there might not be all that many possible answers to Carl's question. >If you have four brothers and nobody whom the attacker could ask will >know who is your favorite, but you think he could find out there names, >then he has probably a 1/4 chance of guessing right. (Actually he >might do better by preferring older brothers rather than younger, etc.) This is exactly the type of local social bias that I want to measure. We would expect that an older brother could be a role model, etc. and thus be more likely to be the "favorite" How do I know when I've got Carl's 90 bits of entropy? Pat Pat Farrell CyberCash, Inc. (703) 715-7834 pfarrell(a)cybercash.com #include standard.disclaimer

1 0

Re: IPG Algorith Broken!
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 12:33 PM 11/23/1996, Eric Murray wrote: >John Anonymous MacDonald writes: >> >> >> At 8:09 AM 11/23/1996, Eric Murray wrote: >> >No, you can't. It's impossible to prove an algorithim unbreakable. >> >> No? Please prove your assertion. > >You can't prove a negative. If it can't be proven, why do you believe it is true? The good news is that you can prove a negative. For example, it has been proven that there is no algorithm which can tell in all cases whether an algorithm will stop. >The best IPG could say is that >it can't be broken with current technology. >Next week someone might come up with a new way >to break ciphers that renders the IPG algorithim breakable. The best they can say is what they did say: they have a proof that their system is unbreakable. What you question, quite reasonably, is whether they have such a proof. >You point could have been that the same problem exists >for proofs- that next week someone could come up >with a way to prove, for all time, that an algorithim >really IS unbreakable. So, to cover that posibility >I should have said "it's currently impossible to >prove an algorithim unbreakable". :-) Or, more accurately, nobody credible has seen such a proof. But, a clever person might invent one. IPG is eager to demonstrate their proof. They should hire a professional skilled in the art to evaluate their proof and publicly announce the results. This costs less than $5000 and would be, presumably, a small part of their profits should they have invented such an algorithm. diGriz

7 6

Re: Sameer R.I.P.
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

On Sun, 24 Nov 1996 Sandy Sandfort <sandfort(a)crl.com> wrote: >On Sun, 24 Nov 1996 drose(a)AZStarNet.com wrote: > >> Sameer has decided, it seems, to get out of the anonymity >> business and pursue other interests. > >Well, I guess you could call privacy guaranteed by strong crypto, >"other interests." Seems right in the middle of what Cypherpunks >are all about. If you like strong crypto, you'll love what's >coming next from C2Net. Point well taken. Most people who are in the market for a Web server, however, are cognizant of the fact that along with Netscape, Microsoft, Open Market, O'Reilly et al, Sameer has been for some time now selling a well regarded product: namely, his proprietary version of Apache. I guess my point was that, notwithstanding Sameer's estimable commercial software offerings, the *news* is that he has, to repeat myself, abandoned the anonymity business with respect to many of his traditional public Internet services. Certainly, no slight was intended. I "like strong crypto", so I naturally look forward to stuff from C2Net that, in your opinion, I'll "love." David M. Rose drose(a)azstarnet.com

2 1

Re: IPG Algorith Broken!
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:21 PM 11/23/96 -0800, John Anonymous MacDonald wrote: >At 12:33 PM 11/23/1996, Eric Murray wrote: >>You point could have been that the same problem exists >>for proofs- that next week someone could come up >>with a way to prove, for all time, that an algorithim >>really IS unbreakable. So, to cover that posibility >>I should have said "it's currently impossible to >>prove an algorithim unbreakable". :-) > >Or, more accurately, nobody credible has seen such a proof. But, a >clever person might invent one. I thought Shannon proved one-time-pads to be unbreakable using information theory. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

5 5

RE: Symantec's claim.
by James D. Wilson 17 Dec '03

17 Dec '03

See: http://www.alw.nih.gov/Security/security.html, and the attachment re Irina, Good Times, etc. ---------- From: cracker(a)icon.co.za Sent: Monday, November 25, 1996 3:45 AM To: cypherpunks(a)toad.com Subject: Symantec's claim. In light of recent claims,i would like somebody to clear this up for me. There seems to be a great deal of conjecture over wether or not the Deeyenda Virus exhists. Symantec denies it's existence,although i hear differently?? Greatly appreciate anyone who can shed some light on the subject,even though C-punks list doesnt usually deal with this topic of thought ;) Anyone come across the pkz300 trojan,if you have it send it please. A student,a paper,and a possible future career are at stake here,so please dig deep into your pockets!!!!!! Asking a lot i know! J a m e s "Lead.Follow. Or get out of the way" ----------------------------------------------------------------------------------------------- Type Bits/KeyID Date User ID pub 1024/9E318AA5 1996/09/24 Cracker <cracker(a)icon.co.za> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzJHdKwAAAEEALl3A6auLG0JLdtgEzl6KfPNqbTTSDX4L4To2b7PLqGDVV5r BezC9dD/ITrCK9M64juiQ2p/DNjIihnXlEsJCy2btypStypQgU1fvAei3AnZ1cQ8 NiAnHNS+ImUAJgZjSHEQSevGE53IUovmWQ7YHUz9VpTTCtoJoUKxYuqeMYqlAAUR tBxDcmFja2VyIDxjcmFja2VyQGljb24uY28uemE+iQCVAwUQMkd0rkKxYuqeMYql AQEjagP/cYgGLAkWZJLeRcM4URwBX3J/0R54DadVnsvvoxDkzilv7U02IXZGZGnA CvXsu2sThS7qDBiHFop/OZs3WmlQbQ4BAZ/hiCs5tSU2e7fkk0EKxsGAD1pTbw/J rRU4WePLc++vv+6CBKw5NCSR5kMh8H3X4qtZZ9dYX9zsuzWKdpk= =YGH8 -----END PGP PUBLIC KEY BLOCK-----

1 0

Security of E-Money
by John Young 17 Dec '03

17 Dec '03

The Bank for International Settlements (BIS) published in August, 1996, "Security of Electronic Money," a long, detailed study. Compare this architecture to Anderson/Kuhn's and Biham/Shamir's recent demolition. The orginal is available at: http://www.bis.org/publ/cpss18.pdf Better, Ian Grigg has HTML-ed it at: http://www.systemics.com/docs/papers/BIS_smart_security.html

1 0

RE: Mass-market crypto phones
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:41 PM 11/22/96 -0800, Declan McCullagh wrote: >PS: Over margaritas and enchiladas tonight, I was talking with one of the >crypto-ITAR enforcers from State. I mentioned that I'd be going out of the >country soon and taking my PowerBook laptop. Quite sincerely, he urged me >to keep a record of when I left and when I returned for five years. You >see, I have domestic Netscape Navigator on it. Wacky stuff. Comments like that by Feds are meaningless absent the busts of a few "laptop smugglers." If they have never busted anyone, it's a dead letter (all the more so since they legalized casual carry with record keeping). DCF

1 0

Re: IPG Algorith Broken!
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 24 Nov 1996 02:20:25 -0600 (CST), snow wrote: >> > diGriz >> Use an anon. remailer and sign your posts. Brilliant. Just brilliant. > The Stainless Steel Rat. Harry Harrison. Just as an off-topic SF note, how many people on the list read this series during their formative years? How many of them thought it was a guide book? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: IPG Algorith Broken!
by eli+＠gs160.sp.cs.cmu.edu 17 Dec '03

17 Dec '03

Dale Thorn writes: >Is the concept here that: Whereas conventional crypto generates/hashes >a *key* with which to encode the text, IPG generates a *pad* from a key, >more or less the length of the text, with which to encode the text?? A cryptosystem is given a key by the user. A block cipher uses it to encrypt chunks of plaintext, perhaps 8 bytes long. (This is an oversimplification.) A stream cipher uses it to generate a pseudorandom sequence that is combined with the plaintext. IPG's product is a stream cipher. >It seems to me they're putting an additional layer of stuff ("OTP") between >the key generation and the actual encoding, so what's the problem with that, >as a concept? The first problem is the name "OTP". A one-time pad is a well-defined thing, and this isn't it; they'd like to be associated with the term because the one-time pad is in fact provably secure. So they have a stream cipher. Is it a good stream cipher? Well, nobody knows, because no cryptanalysts have taken the time to attack it. There aren't all that many who publish in the open literature, and there are thousands of amateur proprietary schemes out there -- who has the time? If it were designed by someone known to be competent (RC4), or if it were widely used (pkzip), somebody might think it worth looking at. If you're not a cryptanalyst yourself (and I'm not, but at least I know it!), all you have to go on is the history of similar schemes. This is not encouraging; there are outfits which for a moderate fee will crack the proprietary encryption offered by dozens of popular products. IPG's history is even less encouraging Maybe this one's different from all of those. How valuable a secret would you like to wager on that? If IPG wants credibility, they should retain a respected cryptographer, or several, to attack their scheme. (Or just publish Don's proof of unbreakability. Since the scheme is provably _not_ information-theoretically secure, this must be a proof of computational security, presumably a superpolynomial lower bound. And as the scheme is trivially breakable in NP time, Mr. Wood is sitting on a _major_ result, a resolution to the central problem in computational complexity theory: a proof that P != NP. Do publish, sir.) -- Eli Brandt eli+(a)cs.cmu.edu

2 1

Stewart Baker on HP-Intel-Microsoft Crypto Announcement
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 24 Nov 1996 22:14:34 -0500 From: Dave Farber <farber(a)cis.upenn.edu> To: interesting-people mailing list <interesting-people(a)eff.org> Subject: IP: HP-Intel-Microsoft Crypto Announcement Date: Sun, 24 Nov 96 21:43:47 EST From: "Stewart Baker" <sbaker(a)mail.steptoe.com> To: farber(a)cis.upenn.edu Subject: HP-Intel-Microsoft Crypto Announcement I also attended the Hewlett-Packard/Intel/Microsoft announcement, and I thought it might be useful to offer a slightly different perspective from Ross Stapleton-Gray's and Declan McCullagh's notes. It's understandable, given the coincidence of the two events, that Ross and Declan saw the announcement as tied to the government's key recovery initiative, but I think they may have been led astray by the timing. As I understand it, the HP framework is not so much an embrace of government regulation in this field as a recognition by some major companies that governments simply are not going to get out of the business of regulating encryption soon, or at least not soon enough for the people who want to build a secure global network right now. I see the announcement as an effort by business to sidestep the policy debate, to say to the politicians, "Whatever crypto policy you decide to adopt, this system will work with it." So, in my view, the HP technology is significant mainly for its flexibility rather than for supporting key recovery or any other particular policy. It allows PC manufacturers to build into their products virtually any form of encryption that a user could want and to ship those products around the world without falling afoul of export controls or domestic regulations on encryption. >From a security point of view, this is important because it allows commoditization of security hardware. One of the reasons why encryption hardware has not spread is that individualized licensing and local restrictions make it imprudent to include hardware security as a standard feature in PCs aimed at mass markets. The HP system has safeguards that have evidently persuaded governments that they can allow mass market sales of hardware encryption without giving up their current regulatory authority. What does this mean for the government's key escrow policy? First, as we heard at the news conference, HP's system will run the TIS commercial key recovery system (and presumably the CertCo./Bankers Trust system as well). So it will make key recovery products available to buyers. But it will also run 40-bit encryption, DES, and other strong algorithms without escrow. The customer decides what crypto to use; the framework doesn't favor one of those technologies over the other, except that it allows customers to buy strong key-recovery crypto today with the knowledge that the hardware won't become obsolete tomorrow if government policies change and something more attractive comes along. As a separate point, I'm not sure Declan is right to call this vaporware. The basic hardware has been available for a while. (I saw an early demo a few years ago.) It sounds as though the R&D is done; all that remains is engineering, and maybe not too much of that.

1 0

Re: Does John Gilmore eat ass?
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

aga <aga(a)dhp.com> writes: > The question is, does this John Gilmore really take it > up the ass? Whether or not he is a FAGGOT is a very relevant issue > here, and it must not be overlooked. The Evil Queen of Cypherpunks swings both ways. John Gilmore also eats Dorothy Denning's (clean-shaven) pussy. He won't eat Esther Dyson's pussy because it smells so bad.

2 1

Recovery after flood
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I'd appreciate a response from M.Aldrich and anyone else who's into disaster recovery: Someone I know had their (paper) files submerged in water. Now all the papers (most of them xerocopies, some photographs) are stuck together. They are, of course, confidential to some degree. Can someone refer us to someone in the Boston area who could assist in recovering the files? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 4

Re: IPG Algorith Broken!
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 6:56 PM 11/23/1996, The Deviant wrote: >On Sat, 23 Nov 1996, John Anonymous MacDonald wrote: >> The good news is that you can prove a negative. For example, it has >> been proven that there is no algorithm which can tell in all cases >> whether an algorithm will stop. > >No, he was right. They can't prove that their system is unbreakable. >They _might_ be able to prove that their system hasn't been broken, and >they _might_ be able to prove that it is _unlikely_ that it will be, but >they *CAN NOT* prove that it is unbreakable. This is the nature of >cryptosystems. Please prove your assertion. If you can't prove this, and you can't find anybody else who has, why should we believe it? >> diGriz > >Use an anon. remailer and sign your posts. Brilliant. Just brilliant. Oops! diGriz

4 6

Re: Does John Gilmore eat ass?
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

aga <aga(a)dhp.com> writes: > The question is, does this John Gilmore really take it > up the ass? Whether or not he is a FAGGOT is a very relevant issue > here, and it must not be overlooked. The Evil Queen of Cypherpunks swings both ways. John Gilmore also eats Dorothy Denning's (clean-shaven) pussy. He won't eat Esther Dyson's pussy because it smells so bad.

1 0

Re: Does John Gilmore eat ass?
by test 17 Dec '03

17 Dec '03

unsuscribe :-) ---------- > From: John Anonymous MacDonald <nobody(a)cypherpunks.ca> > To: cypherpunks(a)toad.com; freedom-knights(a)jetcafe.org; denning(a)cs.georgetown.edu; edyson(a)edventure.com > Subject: Re: Does John Gilmore eat ass? > Date: Sunday, November 24, 1996 10:31 AM > > aga <aga(a)dhp.com> writes: > > > The question is, does this John Gilmore really take it > > up the ass? Whether or not he is a FAGGOT is a very relevant issue > > here, and it must not be overlooked. > > The Evil Queen of Cypherpunks swings both ways. John Gilmore also > eats Dorothy Denning's (clean-shaven) pussy. He won't eat Esther > Dyson's pussy because it smells so bad.

1 0

Britannica Online Subscription Offer
by beta＠eb.com 17 Dec '03

17 Dec '03

Dear Pathfinder Free Trial Participant, Thank you for participating in this special free trial subscription offer of Britannica Online exclusively for Time Warner's Pathfinder users. This free trial will be ending soon, and I would like to extend you a special discount to encourage you to become a Britannica Online subscriber. I hope you have had ample opportunity to sample all Britannica has to offer, and if you haven't used our service recently, I encourage you to take these *final weeks* to experience the only information resource offering this degree of depth, breadth, and interactivity. As a Pathfinder reader you know that NASA recently sent a Mars probe to begin a 10-month interplanetary voyage. Read our "Mars" article to find out what scientists have already discovered about the Red Planet, then follow an Internet link to the Los Alamos National Laboratory to view craters on Mars. Are you interested in health and nutrition? Review the extensive "Nutrition" article in Britannica Online, and look for the nutrient content in what you had for breakfast. Planning a trip over the holidays? Visit our "Nations of the World" feature to review the history, map, flag, and national statistics of the country you're considering before you finalize those travel plans. So whether you're interested in learning more about Mars, troubles in Iraq, or the latest hurricane, Britannica Online is regularly updated to give you access to articles on people, places, and events around the world. It includes the text of the entire 32-volume Encyclopaedia Britannica, plus more than 2100 articles not available anywhere else. Articles are written by notable scholars in their fields of expertise, including more Nobel Prize winners than any other encyclopedia. For about 50 cents a day you'll have access to the only reference source that combines the information power of the world's premier encyclopedia with thousands of direct links to related information. To sign-up for Britannica Online -- * Access the registration form at http://www.eb.com:195/bol/ by selecting either the monthly or annual subscription option * Enter PTF149A in the promotion code box for an annual subscription of $149 (our normal $25 registration fee will be waived for you as a Pathfinder user) Enter PTF149M in the promotion code box for a monthly subscription of $14.95 * Review to make sure information is complete and accurate, then submit Every day you and your family can learn something new about the events that are making history now. Your free trial will end in two weeks, so please don't let this opportunity pass you by. I'm positive you'll discover that finding quality information has never been easier. Sincerely, Lisa Girolimetti Marketing Manager, Online Products Encyclopaedia Britannica, Inc.

1 0

Re: IPG Algorith Broken!
by Alan Olsen 17 Dec '03

17 Dec '03

At 04:00 AM 11/24/96 -0500, Black Unicorn wrote: >On Sun, 24 Nov 1996 eli+(a)gs160.sp.cs.cmu.edu wrote: > >> Maybe this one's different from all of those. How valuable a secret >> would you like to wager on that? If IPG wants credibility, they should >> retain a respected cryptographer, or several, to attack their scheme. > >"They" attempt this nearly daily by trying to taunt c'punks into >evaluating the product for free. Then someone should not do it for free. They should do it as a "data recovery tool", advertise widely, make a few bucks, and show what a piece of crap the IPG snakeoil is in the first place. Cracktools are starting to become a profitable business as more and more snakeoil products appear on the market. (Most are marketed to law enforcement, but that will probibly change...) There is a buck or two to be made here. --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

4 4

Don Woods -- Crypto Creationist
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:18 AM 11/24/96 -0600, snow wrote: > The algorythm cannot be considered secure until it has been >peer-reviewed. They refuse to release the algorythm for review, simply saying >that "you can't break the code" therefore "it is secure". Furthermore, in "Real Science", the burden of proof is on the one making the claim, not on the one everyone else to disprove it. So far Mr. Wood has not provided any *proof* as to the substance of his claims. He has provided some of the more interesting rants I have seen of late. (Analysis of his style of posting is probibly better left to the Psychceramics list than Cypherpunks.) Until he posts the algorythm (or at least some basis as to why we should trust his claims), his claims are worthless. (As they would say on talk.origins: "Evidence is the coin of the realm here!".) The reason that names like Shamir and Rivest and the host of others are trusted is because their material has been reviewed by the rest of the cryptographic community for errors. They have a reputation in the community. Mr. Woods does not. He has to earn it. So far he has not done so... --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

Re: IPG Algorith Broken!
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:21 AM 11/24/96 -0500, Black Unicorn wrote: > >> > On Sat, 23 Nov 1996, John Anonymous MacDonald wrote: >> > > diGriz >> > >> > Use an anon. remailer and sign your posts. Brilliant. Just brilliant. > >Actually, rather clever if you're trying to estlablish reputation. Just >make sure you use the right key. Reputation is not the only reason to use a "name" with an anon remailer. Sometimes you want to post (and have a reputation) that is entirely seperable from your "real life" persona. Maybe you have a job where being involved with "The Evil Cypherpunks(tm)" could result in hastles at work (or even firing) if known. (I recieved flack from one company I worked with for posting here... Until they needed a remailer set up and someone to explain how their software worked... But that is another story.) Cypherpunks is gated to a number of Usenet News servers. (Teleport is a good example.) It is also archived in a number of search engines. (Altavista if I remember correctly, is one of them.) Someone who does not want their words to come back any byte them might just use such a method to protect themselves. --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

Re: kickouts done the Cypherpunks way...
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

killfiles work fine with me too. that was not the point. i was not really interested in the practical problem that this list just had, but rather was wondering whether it was theoretically possible to identify and exclude one untrusted person from a trusted list. igor lcs Mixmaster Remailer wrote: > > ichudov(a)algebra.com (Igor Chudov @ home) writes: > > > Hi, > > > > Suppose Mr. X, owner of foobarpunks mailing list, wants to kick out Mr. Y, > > for his obnoxious letters to the mailing list. > > > > Mr. X, however, is concerned that Mr. Y would subscribe through some > > proxy address and would continue replying to messages to foobarpunks. > > > > It is assumed that the only person out of the whole universe, Mr. Y, > > cannot be trusted. The problem is that X does not know which of the > > subscribers is Mr. Y. > > > > The question is, is there a technical way to disable Mr. Y from > > reading the list, or detect which subscription address is a proxy for Y? > > The answer is no. Plenty of sites gate mailing lists to local > newsgroups, and allow open or relatively open NNTP access. It's also > silly to assume every other person in the universe is trustworthy. > > If Mr. Y sends lots of obnoxious mail to a mailing list or news group, > the proper thing to do is to put Mr. Y in your killfile and encourage > others to do so. That way you don't get bothered by his annoying > messages, and if enough people follow suit, people stop responding to > Mr. Y's messages. This can be even be extended to cover anonymous > posts using NoCeM-like systems. > > If you try to boot Mr. Y off the mailing list using technical means, > several bad things will happen: First of all you will fail, which > will give Mr. Y a great deal of satisfaction. Second of all, you will > drive Mr. Y to start posting under different names, making him > considerably harder to killfile. Third of all, you will double the > traffic on the mailing list by starting flamewars about whether this > failed booting attempt was ethical, legal, intelligent, homosexual, > scatological, or just plain useless. Since at this point tons of > people will be replying to threads, a killfile becomes even harder to > manage. > > So don't look for convoluted technical solutions to Mr. Y's > personality problems. Just use a little basic common sense. If you > don't like the way someone behaves on a mailing list, just ignore the > damn person. Anything else is just going to make matters worse, as > recent history clearly demonstrates. > - Igor.

1 0

Virus-Hoax
by nobody＠replay.com 17 Dec '03

17 Dec '03

> > Date: Sat, 23 Nov 1996 18:43:18 -0800 > From: "David Crawford by way of Fence-Walker(UNCL clicking in fm home)" <crawford(a)eek.llnl.gov> > Subject: CIAC Bulletin H-05: Internet Hoaxes > X-Digest: Volume 9 : Issue 230 > > - ----BEGIN PGP SIGNED MESSAGE----- > > > __________________________________________________________ > > The U.S. Department of Energy > Computer Incident Advisory Capability > ___ __ __ _ ___ > / | /_\ / > \___ __|__ / \ \___ > __________________________________________________________ > > INFORMATION BULLETIN > > Internet Hoaxes: PKZ300, Irina, Good Times, Deeyenda, Ghost > > November 20, 1996 15:00 GMT Number H-05 > ______________________________________________________________________________ > PROBLEM: This bulletin addresses the following hoaxes and erroneous > warnings: PKZ300 Warning, Irina, Good Times, Deeyenda, and > Ghost.exe > PLATFORM: All, via e-mail > DAMAGE: Time lost reading and responding to the messages > SOLUTION: Pass unvalidated warnings only to your computer security > department or incident response team. See below on how to > recognize validated and unvalidated warnings and hoaxes. > ______________________________________________________________________________ > VULNERABILITY New hoaxes and warnings have appeared on the Internet and old > ASSESSMENT: hoaxes are still being cirulated. > ______________________________________________________________________________ > > > Introduction > ============ > > The Internet is constantly being flooded with information about computer > viruses and Trojans. However, interspersed among real virus notices are > computer virus hoaxes. While these hoaxes do not infect systems, they are > still time consuming and costly to handle. At CIAC, we find that we are > spending much more time de-bunking hoaxes than handling real virus incidents. > This advisory addresses the most recent warnings that have appeared on the > Internet and are being circulated throughout world today. We will also address > the history behind virus hoaxes, how to identify a hoax, and what to do if you > think a message is or is not a hoax. Users are requested to please not spread > unconfirmed warnings about viruses and Trojans. If you receive an unvalidated > warning, don't pass it to all your friends, pass it to your computer security > manager to validate first. Validated warnings from the incident response teams > and antivirus vendors have valid return addresses and are usually PGP signed > with the organization's key. > > PKZ300 Warning > ============== > > The PKZ300 Trojan is a real Trojan program, but the initial warning about it > was released over a year ago. For information pertaining to PKZ300 Trojan > reference CIAC Notes issue 95-10, that was released in June of 1995. > > http://ciac.llnl.gov/ciac/notes/Notes10.shtml > > The warning itself, on the other hand, is gaining urban legend status. There > has been an extremely limited number of sightings of this Trojan and those > appeared over a year ago. Even though the Trojan warning is real, the repeated > circulation of the warning is a nuisance. Individuals who need the current > release of PKZIP should visit the PKWARE web page at http://www.pkware.com. > CIAC recommends that you DO NOT recirculate the warning about this particular > Trojan. > > Irina Virus Hoax > ================ > > The "Irina" virus warnings are a hoax. The former head of an electronic > publishing company circulated the warning to create publicity for a new > interactive book by the same name. The publishing company has apologized for > the publicity stunt that backfired and panicked Internet users worldwide. The > original warning claimed to be from a Professor Edward Pridedaux of the > College of Slavic Studies in London; there is no such person or college. > However, London's School of Slavonic and East European Studies has been > inundated with calls. This poorly thought-out publicity stunt was highly > irresponsible. For more information pertaining to this hoax, reference the > UK Daily Telegraph at http://www.telegraph.co.uk. > > Good Times Virus Hoax > ===================== > > The "Good Times" virus warnings are a hoax. There is no virus by that name in > existence today. These warnings have been circulating the Internet for years. > The user community must become aware that it is unlikely that a virus can be > constructed to behave in the manner ascribed in the "Good Times" virus > warning. For more information related to this urban legend, reference CIAC > Notes 95-09. > > http://ciac.llnl.gov/ciac/notes/Notes09.shtml > > Deeyenda Virus Hoax > =================== > > The "Deeyenda" virus warnings are a hoax. CIAC has received inqueries > regarding the validity of the Deeyenda virus. The warnings are very similar > to those for Good Times, stating that the FCC issued a warning about it, > and that it is self activating and can destroy the contents of a machine > just by being downloaded. Users should note that the FCC does not and will > not issue virus or Trojan warnings. It is not their job to do so. As of this > date, there are no known viruses with the name Deeyenda in existence. For a > virus to spread, it must be executed. Reading a mail message does not execute > the mail message. Trojans and viruses have been found as executable attachments > to mail messages, but they must be extracted and executed to do any harm. CIAC > still affirms that reading E-mail, using typical mail agents, can not activate > malicious code delivered in or with the message. > > Ghost.exe Warning > ================= > > The Ghost.exe program was originally distributed as a free screen saver > containing some advertising information for the author's company (Access > Softek). The program opens a window that shows a Halloween background with > ghosts flying around the screen. On any Friday the 13th, the program window > title changes and the ghosts fly off the window and around the screen. Someone > apparently got worried and sent a message indicating that this might be a > Trojan. The warning grew until the it said that Ghost.exe was a Trojan that > would destroy your hard drive and the developers got a lot of nasty phone > calls (their names and phone numbers were in the About box of the program.) > A simple phone call to the number listed in the program would have stopped > this warning from being sent out. The original ghost.exe program is just cute; > it does not do anything damaging. Note that this does not mean that ghost > could not be infected with a virus that does do damage, so the normal > antivirus procedure of scanning it before running it should be followed. > > History of Virus Hoaxes > ======================= > > Since 1988, computer virus hoaxes have been circulating the Internet. In > October of that year, according to Ferbrache ("A pathology of Computer > Viruses" Springer, London, 1992) one of the first virus hoaxes was the > 2400 baud modem virus: > > SUBJ: Really Nasty Virus > AREA: GENERAL (1) > > I've just discovered probably the world's worst computer virus > yet. I had just finished a late night session of BBS'ing and file > treading when I exited Telix 3 and attempted to run pkxarc to > unarc the software I had downloaded. Next thing I knew my hard > disk was seeking all over and it was apparently writing random > sectors. Thank god for strong coffee and a recent backup. > Everything was back to normal, so I called the BBS again and > downloaded a file. When I went to use ddir to list the directory, > my hard disk was getting trashed again. I tried Procomm Plus TD > and also PC Talk 3. Same results every time. Something was up so I > hooked up to my test equipment and different modems (I do research > and development for a local computer telecommunications company > and have an in-house lab at my disposal). After another hour of > corrupted hard drives I found what I think is the world's worst > computer virus yet. The virus distributes itself on the modem sub- > carrier present in all 2400 baud and up modems. The sub-carrier is > used for ROM and register debugging purposes only, and otherwise > serves no othr (sp) purpose. The virus sets a bit pattern in one > of the internal modem registers, but it seemed to screw up the > other registers on my USR. A modem that has been "infected" with > this virus will then transmit the virus to other modems that use a > subcarrier (I suppose those who use 300 and 1200 baud modems > should be immune). The virus then attaches itself to all binary > incoming data and infects the host computer's hard disk. The only > way to get rid of this virus is to completely reset all the modem > registers by hand, but I haven't found a way to vaccinate a modem > against the virus, but there is the possibility of building a > subcarrier filter. I am calling on a 1200 baud modem to enter this > message, and have advised the sysops of the two other boards > (names withheld). I don't know how this virus originated, but I'm > sure it is the work of someone in the computer telecommunications > field such as myself. Probably the best thing to do now is to > stick to 1200 baud until we figure this thing out. > > Mike RoChenle > > This bogus virus description spawned a humorous alert by Robert Morris III : > > Date: 11-31-88 (24:60) Number: 32769 > To: ALL Refer#: NONE > From: ROBERT MORRIS III Read: (N/A) > Subj: VIRUS ALERT Status: PUBLIC MESSAGE > > Warning: There's a new virus on the loose that's worse than > anything I've seen before! It gets in through the power line, > riding on the powerline 60 Hz subcarrier. It works by changing the > serial port pinouts, and by reversing the direction one's disks > spin. Over 300,000 systems have been hit by it here in Murphy, > West Dakota alone! And that's just in the last 12 minutes. > > It attacks DOS, Unix, TOPS-20, Apple-II, VMS, MVS, Multics, Mac, > RSX-11, ITS, TRS-80, and VHS systems. > > To prevent the spresd of the worm: > > 1) Don't use the powerline. > 2) Don't use batteries either, since there are rumors that this > virus has invaded most major battery plants and is infecting the > positive poles of the batteries. (You might try hooking up just > the negative pole.) > 3) Don't upload or download files. > 4) Don't store files on floppy disks or hard disks. > 5) Don't read messages. Not even this one! > 6) Don't use serial ports, modems, or phone lines. > 7) Don't use keyboards, screens, or printers. > 8) Don't use switches, CPUs, memories, microprocessors, or > mainframes. > 9) Don't use electric lights, electric or gas heat or > airconditioning, running water, writing, fire, clothing or the > wheel. > > I'm sure if we are all careful to follow these 9 easy steps, this > virus can be eradicated, and the precious electronic flui9ds of > our computers can be kept pure. > > ---RTM III > > Since that time virus hoaxes have flooded the Internet.With thousands of > viruses worldwide, virus paranoia in the community has risen to an extremely > high level. It is this paranoia that fuels virus hoaxes. A good example of > this behavior is the "Good Times" virus hoax which started in 1994 and is > still circulating the Internet today. Instead of spreading from one computer > to another by itself, Good Times relies on people to pass it along. > > How to Identify a Hoax > ====================== > > There are several methods to identify virus hoaxes, but first consider what > makes a successful hoax on the Internet. There are two known factors that make > a successful virus hoax, they are: (1) technical sounding language, and > (2) credibility by association. If the warning uses the proper technical > jargon, most individuals, including technologically savy individuals, tend to > believe the warning is real. For example, the Good Times hoax says that > "...if the program is not stopped, the computer's processor will be placed in > an nth-complexity infinite binary loop which can severely damage the > processor...". The first time you read this, it sounds like it might be > something real. With a little research, you find that there is no such thing > as an nth-complexity infinite binary loop and that processors are designed > to run loops for weeks at a time without damage. > > When we say credibility by association we are referring to whom sent the > warning. If the janitor at a large technological organization sends a warning > to someone outside of that organization, people on the outside tend to believe > the warning because the company should know about those things. Even though > the person sending the warning may not have a clue what he is talking about, > the prestigue of the company backs the warning, making it appear real. If a > manager at the company sends the warning, the message is doubly backed by the > company's and the manager's reputations. > > Individuals should also be especially alert if the warning urges you to pass > it on to your friends. This should raise a red flag that the warning may be > a hoax. Another flag to watch for is when the warning indicates that it is a > Federal Communication Commission (FCC) warning. According to the FCC, they > have not and never will disseminate warnings on viruses. It is not part of > their job. > > CIAC recommends that you DO NOT circulate virus warnings without first > checking with an authoritative source. Authoritative sources are your computer > system security administrator or a computer incident advisory team. Real > warnings about viruses and other network problems are issued by different > response teams (CIAC, CERT, ASSIST, NASIRC, etc.) and are digitally signed by > the sending team using PGP. If you download a warning from a teams web site or > validate the PGP signature, you can usually be assured that the warning is > real. Warnings without the name of the person sending the original notice, or > warnings with names, addresses and phone numbers that do not actually exist > are probably hoaxes. > > What to Do When You Receive a Warning > ===================================== > > Upon receiving a warning, you should examine its PGP signature to see that it > is from a real response team or antivirus organization. To do so, you will > need a copy of the PGP software and the public signature of the team that > sent the message. The CIAC signature is available from the CIAC web server > at: > > http://ciac.llnl.gov > > If there is no PGP signature, see if the warning includes the name of the > person submitting the original warning. Contact that person to see if he/she > really wrote the warning and if he/she really touched the virus. If he/she is > passing on a rumor or if the address of the person does not exist or if > there is any questions about theauthenticity or the warning, do not circulate > it to others. Instead, send the warning to your computer security manager or > incident response team and let them validate it. When in doubt, do not send > it out to the world. Your computer security managers and the incident response > teams teams have experts who try to stay current on viruses and their warnings. > In addition, most anti-virus companies have a web page containing information > about most known viruses and hoaxes. You can also call or check the web site > of the company that produces the product that is supposed to contain the virus. > Checking the PKWARE site for the current releases of PKZip would stop the > circulation of the warning about PKZ300 since there is no released version 3 > of PKZip. Another useful web site is the "Computer Virus Myths home page" > (http://www.kumite.com/myths/) which contains descriptions of several known > hoaxes. In most cases, common sense would eliminate Internet hoaxes. > > - ----------------------------------------------------------------------------- > > CIAC, the Computer Incident Advisory Capability, is the computer > security incident response team for the U.S. Department of Energy > (DOE) and the emergency backup response team for the National > Institutes of Health (NIH). CIAC is located at the Lawrence Livermore > National Laboratory in Livermore, California. CIAC is also a founding > member of FIRST, the Forum of Incident Response and Security Teams, a > global organization established to foster cooperation and coordination > among computer security teams worldwide. > > CIAC services are available to DOE, DOE contractors, and the NIH. CIAC > can be contacted at: > Voice: +1 510-422-8193 > FAX: +1 510-423-8002 > STU-III: +1 510-423-2604 > E-mail: ciac(a)llnl.gov > > For emergencies and off-hour assistance, DOE, DOE contractor sites, > and the NIH may contact CIAC 24-hours a day. During off hours (5PM - > 8AM PST), call the CIAC voice number 510-422-8193 and leave a message, > or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two > Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC > duty person, and the secondary PIN number, 8550074 is for the CIAC > Project Leader. > > Previous CIAC notices, anti-virus software, and other information are > available from the CIAC Computer Security Archive. > > World Wide Web: http://ciac.llnl.gov/ > Anonymous FTP: ciac.llnl.gov (128.115.19.53) > Modem access: +1 (510) 423-4753 (28.8K baud) > +1 (510) 423-3331 (28.8K baud) > > CIAC has several self-subscribing mailing lists for electronic > publications: > 1. CIAC-BULLETIN for Advisories, highest priority - time critical > information and Bulletins, important computer security information; > 2. CIAC-NOTES for Notes, a collection of computer security articles; > 3. SPI-ANNOUNCE for official news about Security Profile Inspector > (SPI) software updates, new features, distribution and > availability; > 4. SPI-NOTES, for discussion of problems and solutions regarding the > use of SPI products. > > Our mailing lists are managed by a public domain software package > called ListProcessor, which ignores E-mail header subject lines. To > subscribe (add yourself) to one of our mailing lists, send the > following request as the E-mail message body, substituting > CIAC-BULLETIN, CIAC-NOTES, SPI-ANNOUNCE or SPI-NOTES for list-name and > valid information for LastName FirstName and PhoneNumber when sending > > E-mail to ciac-listproc(a)llnl.gov: > subscribe list-name LastName, FirstName PhoneNumber > e.g., subscribe ciac-notes OHara, Scarlett W. 404-555-1212 x36 > > You will receive an acknowledgment containing address, initial PIN, > and information on how to change either of them, cancel your > subscription, or get help. > > PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing > communities receive CIAC bulletins. If you are not part of these > communities, please contact your agency's response team to report > incidents. Your agency's team will coordinate with CIAC. The Forum of > Incident Response and Security Teams (FIRST) is a world-wide > organization. A list of FIRST member organizations and their > constituencies can be obtained by sending email to > docserver(a)first.org with an empty subject line and a message body > containing the line: send first-contacts. > > This document was prepared as an account of work sponsored by an > agency of the United States Government. Neither the United States > Government nor the University of California nor any of their > employees, makes any warranty, express or implied, or assumes any > legal liability or responsibility for the accuracy, completeness, or > usefulness of any information, apparatus, product, or process > disclosed, or represents that its use would not infringe privately > owned rights. Reference herein to any specific commercial products, > process, or service by trade name, trademark, manufacturer, or > otherwise, does not necessarily constitute or imply its endorsement, > recommendation or favoring by the United States Government or the > University of California. The views and opinions of authors expressed > herein do not necessarily state or reflect those of the United States > Government or the University of California, and shall not be used for > advertising or product endorsement purposes. > > LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) > > G-43: Vulnerabilities in Sendmail > G-44: SCO Unix Vulnerability > G-45: Vulnerability in HP VUE > G-46: Vulnerabilities in Transarc DCE and DFS > G-47: Unix FLEXlm Vulnerabilities > G-48: TCP SYN Flooding and IP Spoofing Attacks > H-01: Vulnerabilities in bash > H-02: SUN's TCP SYN Flooding Solutions > H-03: HP-UX_suid_Vulnerabilities > H-04: HP-UX Ping Vulnerability > > RECENT CIAC NOTES ISSUED (Previous Notes available from CIAC) > > Notes 07 - 3/29/95 A comprehensive review of SATAN > > Notes 08 - 4/4/95 A Courtney update > > Notes 09 - 4/24/95 More on the "Good Times" virus urban legend > > Notes 10 - 6/16/95 PKZ300B Trojan, Logdaemon/FreeBSD, vulnerability > in S/Key, EBOLA Virus Hoax, and Caibua Virus > > Notes 11 - 7/31/95 Virus Update, Hats Off to Administrators, > America On-Line Virus Scare, SPI 3.2.2 Released, > The Die_Hard Virus > > Notes 12 - 9/12/95 Securely configuring Public Telnet Services, X > Windows, beta release of Merlin, Microsoft Word > Macro Viruses, Allegations of Inappropriate Data > Collection in Win95 > > Notes 96-01 - 3/18/96 Java and JavaScript Vulnerabilities, FIRST > Conference Announcement, Security and Web Search > Engines, Microsoft Word Macro Virus Update > > - ----BEGIN PGP SIGNATURE----- > Version: 2.6.1 > Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface > > iQCVAwUBMpN8qrnzJzdsy3QZAQHpZgP/V+NTN7AwEtWCM46sSBMFnEuz0NxmN9X2 > DMOFnATcUSNvukXBPAMc3LMYmnjhp+CrqDyfQCWVBUaHDTmb3yKTTsexYev5alyd > cSR4uZjQrMjO1pu16HG7BS+faxaP+E/FVEcbAof9a+tjX4aj9LTOM/Nt8Hb6Aazo > eRHTBH+AYy4= > =fBQM > - ----END PGP SIGNATURE----- > > ------------------------------ > >

1 0

[Noise] Re: Thanks/was:This is your last warning
by Black Unicorn 17 Dec '03

17 Dec '03

On Sun, 24 Nov 1996, aga wrote: > > > Not really, I had an I.Q. of 149, and a perfect 4.00 from > > > two different colleges, before I did my Doctorate in Law. > > > > 149 puts you at the low end of the scale, or used to, around here. > > > > True, they say genius only starts at 150; but I think I have > improved since then. This betrays your ignorance. I.Q. is scaled according to age. One does not "improve." > > The fact (if true) that you bothered to get a Doctorate in Law, rather > > than a Juris Doctor, tends to disprove the above however. > > > > Look dude, a Juris Doctor IS a Doctorate of Law. Incorrect. One can obtain a Doctorate in Law, (As in Dr.) but it is generally a pointless endeavor except in some civil law jurisdictions. (Liechtenstein is a good example, where many attornies have a Dr.Iur. (Dr.) while others merely have a Lic.Iur. (J.D.) ). A J.D. requires no dissertation. A Doctorate in Law does. I submit you know too little about any of these to have attained either one. > Do not confuse it with a L.L.D. which is a "Doctorate > of Legal Letters" A J.D. is the only current valid > Doctorate that you can do in plain "Law." Incorrect. A J.D. is not a true Doctorate, and even if it were, it would not be the only current valid "Doctorate" that you can "do" in "plain Law." Georgetown, as an example, offers a Doctorate in Law degree which requires a J.D., an LL.M. and three years of legal teaching experience simply to qualify for the program. A Doctor of Judicial Science program is also available with many of the same requirements. Both programs require a dissertation and a defense of same. San Marcos University is also known for an exceptional Doctor of Laws program. Incidently, LL.D.s are rare and generally useful only in European circles. As usual, you have overextended your bounds and now find yourself swimming in water over your head. > > > > > > > Go to law school. In the meantime, shut up. > > > > > > > > > > Go and eat your swiss cheese, as that is apparently all you > > > are good for. My mercenaries are too busy to go to europe > > > right now. > > > > I prefer Chedder. > > > > Be careful who you threaten. It might get you in trouble. > > > > Threatening to wipe out your location on the InterNet is > not against ANY law whatsoever, and I can mailbomb you, do > a DOS attack, fork-bomb attack and virus attack against you, > all of which are perfectly legal. Actually, they are not. Unauthorized access of a computer system is a crime. Anyone who had a "doctorate" in law would know this. I doubt your reference to mercenaries was merely a threat to my system, but keep pushing if you like. > > > Look asshole, I graduated from Law School with a Doctorate > > > in 1975. Now just go away and stop interfering with our > > > American Net. Which law school? And did you do a dissertation? What is its title? Do you practice? What state are you licensed in? > Face the real fact of life though dude. There is absolutely NO LAW > which prevents me from attacking and/or eliminating any address > outside of the USA, that is, even if there were any law which would > prevent me from doing the same thing to any non-government > computer right here, which there is not. Ok, do it. We'll see. > Your only protection on this Internet is to have a dozen different > addresses to access from. I can put a dozen computers up on > a dozen different T1's right now, if need be. I suggest a hobby which entails more physical activity. -- Forward complaints to : European Association of Envelope Manufactures Finger for Public Key Gutenbergstrasse 21;Postfach;CH-3001;Bern Vote Monarchist Switzerland

5 6

Re: GELP/was:Word List
by Sven 17 Dec '03

17 Dec '03

>That should be a "what" is GELP. It's a type of sea weed. GOAT |__ |--> SVEN: a.k.a. Chris Blanc Internet consulting/Web design [ http://www.loop.com/~sven/ ] Some only sample the dark wine of life's blood...

1 0

Photobuster to beat radar...
by Lynne L. Harrison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Nov 24 18:19:39 1996 At URL: http://www.havenofhope.org/photobuster/photob2.html Photobuster is a spin off from a specialty electronics company (Grand Systems) who saw the need for a system to foil the photo radar picture. We realize that people like your selves don't usually speed on purpose and can't afford to pay hundreds of semolies just because you look away from the speedometer from time to time. Our easily installed electronic Photobuster unit is a an electronically triggered device that mounts in the rear window with a satellite unit that mounts at the license plate. It watches the right side of the road for a photo radar setup. If you are driving at speeds in excess of the operators setting on the photo radar, it will attempt to photograph your car. When it does this the Photobuster senses the attempt and triggers a return response rendering the radar photo useless. It has an audible warning and a visual light to let you know each time you save 100 bucks. This unit only triggers if the photo radar attempts to photograph your car. NOTE: Photobuster has nothing covering your plate as is with other filter, poleroid and lenticular optical devices. We are told it is not legal in most areas, to install any kind of plastic cover over the plate, see through or not. ************************************************************ Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; lharrison(a)mhv.net | - Survive; http://www.dueprocess.com | - Go to bed." ************************************************************ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMpjYDD5A4+Z4Wnt9AQGEiwP+OwSodqT2IMQJIFxf/OPFIr7JSJJY7uWc tBfpskpydWvpcKe49PZMbflNOsTgjuW/MyRXLwu8j/mMIEKqwe7KvYPEVUIHNjx3 by3dLMglaihuObbAViewOTS2mjat2bWtB24cGwHI1/94gc8trLlXS3VTtCQYcnkl Btw1KpGDCek= =pfBU -----END PGP SIGNATURE-----

1 0

Re: IPG Algorith Broken!
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:16 PM 11/24/96 +0000, The Deviant wrote: >On Sat, 23 Nov 1996, Bill Frantz wrote: >> I thought Shannon proved one-time-pads to be unbreakable using information >> theory. > >Different ball game. OTP isn't "unbreakable" . OTPs are secure because >no matter what key you use, it _will_ decrypt, so your plaintext is still >hidden simply because it could decrypt to whatever the person trying to >decrypt it wants it to. Its not that its unbreakable, its that its >breakable in _so many ways_. I think we differ on the definition of "unbreakable". A quick stab at my (admittedly very vague) definition includes the inability of the analyst to determine (by the structure of the plaintext) that he has a correct decryption. When I look in AC2, Schneier uses "break" in many ways. Let me evaluate OTP against his taxonomy of attacks: Ciphertext-only: Unbreakable Known-plaintext: Unbreakable, since the pad is never reused Chosen-plaintext: Unbreakable, ditto Adaptive-chosen-plaintext: Unbreakable, ditto Chosen-ciphertext: This attack doesn't seem to apply Chosen-key: This attack requires that the OTP doesn't have 1-bit-of-entropy/bit which implies it isn't an OTP. Rubber-hose: Since any decryption is equally plausable, OTPs are resistant to this attack. OTOH, it means they may keep beating you even after you've given them the correct decryption. Purchase-key: This attack seems the only way to break an OTP. If you accept Purchase-key as a valid attack, and it certainly has worked in many real-life situations, then no system is "unbreakable" and there is not any point in using the term. If you leave it out of the valid forms of attack, because all systems are vulnerable to it so it doesn't help in selecting a cryptosystem, then the OTP is "unbreakable". How do you want to define "unbreakable"? ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

2 1

Aga is talking to himself
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:15 AM 11/24/96 -0500, aga <aga(a)dhp.com> wrote: >On Sun, 24 Nov 1996, John Anonymous MacDonald wrote: actually the message was from lucifer(a)dhp.com: >> aga <aga(a)dhp.com> writes: ... messages suppressed It looks like our juvenile "friend" is talking to himself. I am truely sorry that he feels a need to harass ladies who have actually made something of their lives. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> The algorythm cannot be considered secure until it has been > peer-reviewed. They refuse to release the algorythm for review, simply saying > that "you can't break the code" therefore "it is secure". This isn`t strictly true. Don Wood (spit) has actually released the algorithm details for review. It`s just that no-one considers it even worthy of looking at. I wearily downloaded the details then realised I had better things to do than sift through pages of pompous self important drivel about "software one time pads." Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 3