December 2003 - cypherpunks-legacy

Anyone going to "Computers & The Law III"?
by Alex Newman 17 Dec '03

17 Dec '03

Hi all, I'm Alex Newman, on of the conference organizers for "Computers & The Law III", Dec 1-4, 1996 in San Jose, CA. The theme this year is "Assessing the Internet Threat". I was wondering if there was anyone in the San Francisco/Silicon Valley area who was going to be there who wanted to sit on a panel about the CDA. Drop me a line if your interested. If you just want more information about the conference, take a look at www.sug.org/CL3 or send mail to conference(a)sug.org --a Alexander Newman Sun User Group troll(a)sug.org 1330 Beacon St., Remember, to die with honor (617) 232-0514 voice Suite #344 ...you still have to die. (617) 232-1347 fax Brookline, MA 02146

1 0

Rumours of NSA breakin
by hallam＠ai.mit.edu 17 Dec '03

17 Dec '03

Hi, I've been hearing rumours of an alledged compromise of the NSA Web server but no hard evidence. The claim made is that several Mb of files were downloaded from the server and posted to the "Internet". I can't see it in sci.crypt or alt.conspiracy though. I am more than a little skeptical of the claim, unless the files in question were not considered sensitive - and there is no reason to believe that the NSA would be keeing anything secret on their Web server. Banks do not keep money stuffed under mattresses and the NSA does not keep secrets on Internet servers. The origin of the rumour may be an "observation" that the DOJ hack was on the 19th August, the CIA one on the 19th of September. It is no secret that several sites were watching out for attacks on the 19th October. Has anyone heard anything more than a rumour of this alledged event? Phill

3 2

**Call for Authors**
by Marcus.Goncalves＠mars.process.com 17 Dec '03

17 Dec '03

Publisher is seeking authors in the areas of Internet, Web security, networking and emerging technologies. If you have a book idea, an outline and a conviction about it, please let me know. All submissions will be considered. Send e-mail to mg(a)manning.com or goncalvesv(a)aol.com. We'll reply quickly. _____________________________________________________ M. Goncalves, Editor - mg(a)manning.com Manning Publications Co., 3 Lewis Street, Greenwich, CT 06830 508-460-8084, fax 508-460-8085 http://www.browsebooks.com, http://www.spindoczine.com _____________________________________________________

1 0

Fortezza web site in Huntsville
by John Gilmore 17 Dec '03

17 Dec '03

Check out http://www.armadillo.huntsville.al.us. Bonus points for the first people to identify who actually runs the site. John

3 2

Montgolfiering, the Hot Air Balloon of Cryptography
by nobody＠replay.com 17 Dec '03

17 Dec '03

Fie on the small minds that cackle at my brilliance! As a Mensa member and founder of the Society for Superintelligent Former NSA Employees, I chortle at the baseness of callow criticisms by those doubters and dilletantous denigrators of virtual one-time pads and PRNGs (perfect random number generators). Montgolfiering. What is it, you ask? It is demonstrably a new paradigm in the evolution of homo sapiens (Parry Messger excepted) toward Shannon's dream of a one-time pad needing only a single, easily memorizable number as a seed. I have heard only silence when I challenged the so-called superbrains of this latargial list to try to determine which number I am using as the seed of my system. If you are such great smarty pants, far smarter than my colleagues at the NSA and at Mauchly-Wood, why can you not then determine this number? Could it be because I have outsmarted you? Could it be because I understand the Sufi secrets of picking random numbers truly randomly? I submit this to you: 8 31 26 3 19. Now, oh great ones, tell me, what is the next number in this sequence? Ha, you cannot predict this next number, can you, oh gibbering greatnesses? Ths proves that my perfect random number genarator (PRNG, for those of you too stupid to remember) cannot be broken. Q.E.D. I question the issue of Parry Messger's objectivity in assessing the brilliance of my importations and acidulous assertations. I question whether Parry may have a peculiarly pecuniary interest in these affairs? Does Parry have an insider, or other position, or interest in one or more of the RSA interest? If, this explains his fantastical faith in the core of this so-called "RSA" system, which I proved to my colleagues at NSA could not possibly be valid. Why, you ask? Because it contains no virtual seed, and that which has no seed cannot grow. Q.E.D.--it has been debunked. Entropy, you quibble? Ha! What is entropy but thermodynamics? And what is the topic of thermodynamics, you small-minded ensemble (Gibbs) people who never worked for the NSA may ask? Thermodynamics is about hot air. Hot air is in balloons. Balloons were pioneered by the Montgolfiers. Thus we come full circle (can you understand this, you mental midgets?). Q.E.D.--it has been demystified. Montgolfiering = a new virtual one time pad based on hot air. Eureka! I have found it. P Information = P * log_base_infinity P As my colleague Dr. Bronner told me on my last balloon trip to his institute in Escondido, "NATURAL! NATURAL! NATURAL! YOU AND THE PLANET - CLEAN AND HEALTHY! PURE AND NATURAL CRYPTO COMES FROM WITHIN THE AGENCY." I pity your eupatrid minds for not accepting the wisdom of the Virtual Montgolfiering System (which I have dubbed "VMS"). I guess unintelligent creatures such as petty selves are too much like Parry Messger! Your mendacious misrepresentations of my brilliance are wounding me deeply--NOT! Only Dr. Bronner and Dr. Vulis seem capable of understanding the immmense mental breakthrough my IQ measured at 207 has provided the world. I laugh at your sanctimonious snivelings, your bombastic bombardings, and your fatuous flatulations. Remember, they laughed at Galileo. They laughed at Bozo. They laughed at Von Daniken. They laughed at Ludwig Plutonium! All of those who leaped at the opportunity to take me apart before are now displaying contemptuous intellectual pap, that is pap not the other similar word though that also applies. Their misleading inculcations did not work so what are they trying now. Montgolfiering into the hot air, I am, --KVFP, Esquire, KOTM (Montgolfiering. Q.E.D.--"it has been deflated") -- --

2 1

Sex, drugs, and libertarianism
by Steve Edwards 17 Dec '03

17 Dec '03

This isn't about crypto but since cypherpunks is the most interesting libertarian forum I know, I thought I'd throw it out. I live in a sort of urban pioneer zone, a historical district in Nashville wedged between low income housing projects. We have an interesting mix of people here, black, white, asian, redneck, yuppies, country star wannabes, drug addicts etc. I was walking back from the convenience store the other day, when I began talking to a young lady. She offered to give me a blow job for $2. I don't patronize prostitutes, less from moral concerns, than from concerns for my health and safety. Nonetheless, $2 for a blow job says to me that the market for sex acts has hit rock bottom. Forthrightly, she told me she wanted the money for crack, which has also become very cheap here. It has been said many times in this forum that prostitution and drugs are victimless crimes. Is this really so? Although I am generally in concert with libertarian views, I would say that the young lady I talked to was definitely a victim. Also, if we are a society, rather than fortress-like individuals, we should be concerned with the inevitable spread of disease and insanity that is the result of "victimless" crimes. On a similar note, I read an interesting article that connected the recent drop in the crime rate to the rather startling increase in drug use among young people. The claim that was made is that drugs have become so cheap that people don't have to steal as much to buy them. Based on the evidence of the $2 blow job, I'm inclined to believe it. SAlanEd(a)concentric.net, SAlanEd(a)aol.com, http://users.aol.com/salaned/cyberplace.html "Life, he himself said once, (his biografiend, in fact, kills him verysoon, if yet not, after) is a wake, livit or krikit, and on the bunk of our breadwinning, lies the cropse of our seedfather..."

4 3

No Subject
by FWJZ05A＠prodigy.com 17 Dec '03

17 Dec '03

I want to be a cypherpunk, E-mail me back i want to know

1 0

Re: First Union Ahead of Curve with Sun's "JavaStation"
by Lawrence.Hughes＠Software.com 17 Dec '03

17 Dec '03

At 11:30 AM 10/28/96 -0800, you wrote: >When Sun Microsystems unveils today what it is touting as a radical advance >in business computing, First Union Corp. will be in the vanguard of those >adopting it. Dunno - sounds to me like an act of desperation that is at least 99.44% hype, from a company that has refused to acknowledge that the UNIX market is crashing even as we speak. While I was Intergraph HQ in 1989-1993, we saw projections of that coming demise from IDC, etc. Which had a lot to do with the big switch there to Intel/NT. Especially love the way they don't figure the price of any of those "fat $ervers" (from guess what California company) into the overall costs.... seems to be mostly a way to dupe folks into shifting funds from all those wonderful, independence granting PCs into paying for it-was-good-enough-for-my-dad-it's-good-enough-for-me big iron at the center, with dumb terminals (no matter what you call 'em) tethered to it. And $1500 is a lot for a dumb terminal. And that dazzling array of nearly 500 craplets.. I mean Java apps... that's sure a lot of eye candy, but I'd hate to try to run a business with them. Get real. No one, including a badly aging Sun, will ever put the distributed computing genie back in the "glass house" bottle that PC's allowed us to escape from DECADES ago. Lawrence E. Hughes Software.com, Inc. Principal Software Engineer 525 Anacapa Street Email: Lawrence.Hughes(a)Software.com Santa Barbara 93101 805-882-2470 x259 Fax: 805-882-2473 People's Republic of California www.software.com - purveyors of fine Internet Infrastructure to the trade "Those who would order the life of their nation must first set about ordering their home life" - Kung Fu Tse (Confucius), roughly 500 BC

1 0

Re: FDA_dis
by Hallam-Baker 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > > I'll have to reread John's piece tomorrow (I'm on vacation right now), but > it doesn't surprise me. He and I have been arguing about this topic via > email for the last week or so. He takes the traditional liberal view of > government regulation of drugs is necessary; I take the more libertarian one. > > The Cato Institute, BTW, will be putting together a roundtable on this soon. > > -Declan Characterising this as the "traditional liberal view" is somewhat misleading, its not as if Bob Dole or Newt Gingrich would disagree much. The argument is more over which special interest group is to be advantaged by changes in regulation. If I was a citizen of a country where the government was elected by a billion dollars of corporate contributions I might be a libertarian. Its important to remember that its the World Wide Web and not simply limited to the US. As long as US companies set up subsidiaries in Europe they will be constrained by European law. In the net.age law is becomming a major export for many countries. Regulation is not necessarily anti-commerce. UK beef farmers would be better off today if there had been more regulation, a weak "free-market" attitude to public health has destroyed the entire industry. It is often in a companies commercial interest to voluntarily agree to be regulated. Microsoft recently signed an agreement to be bound by the European computer privacy regulations because by doing so they gained a business advantage - people would trust them with their data. Much of the advertising regulation being discussed is private, agreement on standard formats for image placements for example. There is existing government regulation of advertising in many countries however. In particular much stricter control over advertising of drugs, making misleading statements in advertising and so on.In the UK there is regulation of advertising through the advertising standards council which is a voluntary body in the sense that it has no statutory enforcement powers but has practical authority because the publishers will not publishe ads that fall foul of its decisions. A more serious problem however is likely to be dramatically different cultural norms. In the US people expect to be lied to in adverts. In countries where there is regulation of advertising there is a general expectation for comparisons to be fair and for ads to be truthful. I'm just waiting for a major corporation to create an Intel scale PR disaster by applying sleasly US style marketing techniques in markets where the downside is very large. One recent example is Hoover which had a $30 odd million debacle over a "free flights" giveaway that was based on sleasly US style marketing techniques. The company ended up having to live up to the spirit of its offer rather than the letter as it intended simply to preserve the value of the brand. If you don't believe in anti trust laws there is no basis on which you can object to the sort of regulation by cabal that the advertising standards council represents. Of course such cabals cannot exist in the libertarian belief system since their existence is denied a-priori by invoking the spirit of Milton Freedman. Milton Freedmen is of course a rightwing ecconomist whose theories are widely admired by free market ecconomists who admire Mitlon Freedman. Phill

1 0

USENIX Annual Conference & USELINUX, January 6-10, 1997
by Cynthia Deno 17 Dec '03

17 Dec '03

January 6-10, 1997 USENIX 1997 TECHNICAL CONFERENCE Anaheim, California, Marriott Hotel USELINUX Linux Applications Development & Deployment Conference Co-located with USENIX 1997 Technical Conference Co-sponsored by Linux International Attendees may pay one fee and attend both conferences. There are 20 day-long tutorials offered on January 6-7. Topics include: IPv6 Kerberos Approach to Network Security Secure Java Programming Introduction to Java Windows NT and Windows 95 UNIX Network Programming How Networks Work Topics in System Administration Web Security System and Network Performance Tuning Inside the Linux 2.0 Kernel Java Applets and the AWT UNIX Security Tools CGI and WWW Programming in Perl Administering a Web Server Device Drivers under Linux Solaris System Administration Beginning Perl Programming Writing Secure Code Creating Effective User Interfaces Java, the Web, Intranets, Security, Windows NT are among the topics of the Technical Program which takes place January 8-10. It begins with a keynote address by James Gosling, a creator of Java. 23 refereed papers present up-to-the-minute research. A second track of invited talks cover cryptography, Inktomi and AltaVista Search Engines, IPv6, benchmarks, and a new networked operating system from Bell Labs that offers unprecedented portability for applications and services. Linux Torvalds speaking on the future of Linux, is one of the highlights at the Linux Applications Development and Deployment Conference. USELINUX will offer tutorials and technical presentations for developers. Concurrently, those interested in the Linux marketplace may attend case studies and expert presentations on how to create a Linux-based business. An Exhibition on January 8-9 offers presentations of the latest hardware, software, and networking products from 55 vendors. ADMISSION TO THE EXHIBITION IS FREE. If you cannot make it to the conference but would like to visit the exhibition, please contact Cynthia Deno at 408 335 9445 or cynthia(a)usenix.org. For more program and registration information: Access our Resource Center on the World Wide Web--http://www.usenix.org Email to: info(a)usenix.org. In the body of your message state "send usenix97 conference"

1 0

Re: When did Mondex ever claim to be anonymous?
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Asgaard wrote: > > If you doubt that disinformation, including rumour campaigns, can be > effective, read the book on CIA by the renegade Phillip Agee. Yes, it's an excellent example. Or did you mean something else? - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMnbBbyoZzwIn1bdtAQH8tgGAkveB3XGlT+E6//V6pRIKzSz6cJ8ZWW+E ZjYtrPNIB/msT7f1tfdEXSgZ2EmB9Yac =Eswk -----END PGP SIGNATURE-----

2 1

Re: Fortezza web site in Huntsville
by Jeff Ubois 17 Dec '03

17 Dec '03

Looks to be LJL Enterprises, run by Larry J. Layten, which has deals with Nortel and the US military for secure email (e.g. its ArmorMail product) and Fortezza products. Check out www.ljl.com for info on LJL. From their page: LJL Enterprises got its start by supporting Department of Defense agencies with electronic mail and security products and services. Currently, we are shipping security products that plug in to existing versions of cc:Mail and Microsoft Mail. These products offer seamless integration so users can benefit from our line of security products without having to learn a new interface. We're also hard at work developing products for Lotus Notes, Microsoft Exchange, and Qualcomm's Eudora. LJL products work with the Entrust and Fortezza security subsystems, giving you a choice between hardware and software security. Contact us at: LJL Enterprises, Inc. 4825 University Square, Suite 6 Huntsville, AL 35816 Phone: (205) 830-8991 Fax: (205) 830-5702 E-Mail: info(a)ljl.com If you're asking who runs Larry Layten, well... At 12:28 PM 10/29/96 -0800, you wrote: >Check out http://www.armadillo.huntsville.al.us. Bonus points for the first >people to identify who actually runs the site. > > John > > >

2 1

Re: When did Mondex ever claim to be anonymous?
by Sean Roach 17 Dec '03

17 Dec '03

>On Mon, 28 Oct 1996, R.J.Blakemore wrote: > >> As for the Bank, they get details on the item the student has purchased, >> purchase location (the building and exact 'Mondex point' in the bar/shop >> where the transaction took place), the exact time and date the >> transaction was carried out, together with (obviously) the name and ID >> of the purchaser, etc. > Relax, bandwidth is limited, all transactions over certain amounts and in certain areas have been logged for a long time, these will continue to be logged. Records made on the chip will probably have a shorter life than the memories of those people present, still admissible in court. Because the computers logging the details, either on site or at the finantial institution, have limited storage capacity, less useful data will be continuously overwritten by more current data. On site, this may be nightly, at the bank, possibly weakly, maybe even monthly. All records, except those already logged, will have a fairly short halflife, this will be especially true of locations which enjoy heavy traffic. As for the "smart card", it will have a half life as well, especially if you purposely flood it. Go to the ATM with the lowest rates, 0 if possible. Pick one heavily visited, the nearest to a coin-op laundry would have a particular poetic justice to it, and transfer funds back and forth for several cycles to overwrite the data on the card. Suddenly, the card has been through too many transactions to recall what happened 500 transactions back. Someone with experience with the technology might also modify an electronic wallet to blank transaction records, this could be as basic as transferring funds repeatedly between two cards.

1 0

PDF417 2-D barcode specs needed
by Lucky Green 17 Dec '03

17 Dec '03

Who knows where to find the specs for PDF417 2-D barcode? Any idea where on USENET barcodes are being discussed? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Montgolfiering, the Hot Air Balloon of Cryptography
by L. Patrick Elam, III 17 Dec '03

17 Dec '03

To nobody(a)replay.com (Anonymous): I will use simple words so you can understand. My IQ is not 207 but I know BS when I see it. Too much bravado without substance. Too much hot air without mass. You claim that thermodynamics is about hot air. Anyone with a basic course in physics knows that thermodynamics is not just about hot air. Present the algorithm and it's proof if you want someone to listen or stop wasting everyones time with your rantings. Pat At 10:17 PM 10/29/96 +0100, nobody(a)replay.com (Anonymous), wrote: > >Fie on the small minds that cackle at my brilliance! As a Mensa member and >founder of the Society for Superintelligent Former NSA Employees, I chortle >at the baseness of callow criticisms by those doubters and dilletantous >denigrators of virtual one-time pads and PRNGs (perfect random number >generators). > >Montgolfiering. What is it, you ask? It is demonstrably a new paradigm in >the evolution of homo sapiens (Parry Messger excepted) toward Shannon's >dream of a one-time pad needing only a single, easily memorizable number as >a seed. I have heard only silence when I challenged the so-called >superbrains of this latargial list to try to determine which number I am >using as the seed of my system. If you are such great smarty pants, far >smarter than my colleagues at the NSA and at Mauchly-Wood, why can you not >then determine this number? Could it be because I have outsmarted you? >Could it be because I understand the Sufi secrets of picking random numbers >truly randomly? I submit this to you: 8 31 26 3 19. Now, oh great ones, >tell me, what is the next number in this sequence? > >Ha, you cannot predict this next number, can you, oh gibbering greatnesses? >Ths proves that my perfect random number genarator (PRNG, for those of you >too stupid to remember) cannot be broken. Q.E.D. > >I question the issue of Parry Messger's objectivity in assessing the >brilliance of my importations and acidulous assertations. I question >whether Parry may have a peculiarly pecuniary interest in these affairs? >Does Parry have an insider, or other position, or interest in one or more >of the RSA interest? If, this explains his fantastical faith in the core of >this so-called "RSA" system, which I proved to my colleagues at NSA could >not possibly be valid. Why, you ask? Because it contains no virtual seed, >and that which has no seed cannot grow. Q.E.D.--it has been debunked. > >Entropy, you quibble? Ha! What is entropy but thermodynamics? And what is >the topic of thermodynamics, you small-minded ensemble (Gibbs) people who >never worked for the NSA may ask? Thermodynamics is about hot air. Hot air >is in balloons. Balloons were pioneered by the Montgolfiers. Thus we come >full circle (can you understand this, you mental midgets?). Q.E.D.--it has >been demystified. > >Montgolfiering = a new virtual one time pad based on hot air. Eureka! I >have found it. > >P Information = P * log_base_infinity P > >As my colleague Dr. Bronner told me on my last balloon trip to his >institute in Escondido, "NATURAL! NATURAL! NATURAL! YOU AND THE PLANET - >CLEAN AND HEALTHY! PURE AND NATURAL CRYPTO COMES FROM WITHIN THE AGENCY." > >I pity your eupatrid minds for not accepting the wisdom of the Virtual >Montgolfiering System (which I have dubbed "VMS"). I guess unintelligent >creatures such as petty selves are too much like Parry Messger! Your >mendacious misrepresentations of my brilliance are wounding me deeply--NOT! > >Only Dr. Bronner and Dr. Vulis seem capable of understanding the immmense >mental breakthrough my IQ measured at 207 has provided the world. > >I laugh at your sanctimonious snivelings, your bombastic bombardings, and >your fatuous flatulations. > >Remember, they laughed at Galileo. They laughed at Bozo. They laughed at >Von Daniken. They laughed at Ludwig Plutonium! All of those who leaped at >the opportunity to take me apart before are now displaying contemptuous >intellectual pap, that is pap not the other similar word though that also >applies. Their misleading inculcations did not work so what are they trying >now. > >Montgolfiering into the hot air, I am, > >--KVFP, Esquire, KOTM > >(Montgolfiering. Q.E.D.--"it has been deflated") > -----BEGIN PGP SIGNED MESSAGE----- ------------------------------------------------------- Patrick Elam patelam3(a)atl.mindspring.com Engineering at its finest! http://www.mindspring.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMfwmggBXLW8oj+lZAQHCiwP+La/CLNY/yRvrH8TZQdvTxHK7Dgf0e1Dp j1xsa0h4VoWXrM4v5LYHbjyFYcpJGpOY7s6yIl1vFj2HGaix6DTv222/dHleMZZp lUJtAoJAW7AmbwA51skDc5EZZ0oSBh2BRXUfuAEzicm709SmKUKn0oH0vtKoS4Z2 xaGZ7952BX8= =MM2Y -----END PGP SIGNATURE-----

1 0

nytsnoop
by John Young 17 Dec '03

17 Dec '03

News: By far the top snoop at jya.com: gatekeeper.nytimes.com Extra surprise: the site's logging 13,000 hits per month, mostly crypto-related. Odd, jya.com knows squat about such hot rods.

1 0

Re: considering internet/privacy periodical
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 28 Oct 1996 07:42:37 -0500 (EST), Adam Shostack wrote: >| >I'm considering putting together a periodic publication about the technical >| >and legal aspects of privacy and the Internet. My "business model" would >| >feature free WWW/email access with a charge for fax or postal delivery. I'm >| >curious to know if this strikes people as interesting or just Yet Another >| >Email Newsletter Of No Real Consequence. (no offense taken if it's the >| >latter.) >| >| If you did a real noise-removal job, this could be very useful. Sort of a >| privacy-RISKs digest, if you will. > You mean like the PRIVACY digest, as occiasonally hyped in >RISKS? Yeah... Reinvent the wheel, why not? <g> # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: When did Mondex ever claim to be anonymous?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 29 Oct 1996 20:13:04 +0100 (MET), Asgaard wrote: >> I don't think spreading false rumours is a good idea - it can discredit >> the spreader if anyone bothers to check any details. > >Disinformation is a time-honoured weapon in political struggle. >A rumour is called just that because it can't easily be checked >- somebody heard from somebody, who heard from somebody etc. The >spreader is hardly ever discredited since he does not guarantee >the validity of the information. 'It's just a rumour, but...' And don't forget the old he-denied-a-wild-claim: "Mr. Politician denied reports that he spent several days in the Lovebird Inn with a goldren retriever, six gallons of coolwhip and a hoover vacuum." # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

How can I get this book: "Secret Power"
by Ernest Hua 17 Dec '03

17 Dec '03

1 0

How can I get this book: "Secret Power"
by Ernest Hua 17 Dec '03

17 Dec '03

From EE Times October 21, 1996 Issue: 924 Section: Design -- Computers & Communications Required reading By Loring Wirbel What was I thinking? It's been more than six months since I wasted column space with a good intelligence community rant. It's not as though nothing much has been happening. The New York Times and other media outlets have laid out the Cellular Telephone Industry Association's significant complaints against the Digital Telephony Act, portions of which will allow the FBI and National Security Agency to determine location of roaming telephone or IP addresses in a network. And we here at EE Times have been filling you in on the NSA's questionable involvement in an Internet backbone program called Project Monet. Truth be told, it's hard to keep sending up warning flares about the vast expansion of intelligence agencies' reach in an election year as hopeless as this one. President Clinton, of course, called for "wiretaps, many more wiretaps" during his acceptance speech at the Democratic Convention, and tried to sneak in a quadrupling of the Digital Telephony Act tapping slush fund during the waning days of Congress's budget negotiations. Everyone from Wired to The Progressive is now suggesting that President Nixon actually was more liberal than Clinton along the civil-liberties axis. And Bob Dole? The Republican Party quashed the efforts by budget hawks like John Kasich to carefully analyze NSA and National Reconnaissance Office budgets. The Repub gospel now is to give the Defense Department everything it asks for, and then some. Cryptography buffs have been waiting for relief in the form of the third edition of James Bamford's classic The Puzzle Palace, on the workings of the NSA. The new edition is supposed to contain material from co-author Wayne Madsen detailing NSA presence at Internet switching centers, and cipherpunks have been disappointed that the book didn't meet its June release date. Rumor has it that squabbles between the two authors and the publisher may push the book out well into 1997. But fear not, if you're willing to go chasing afar for good fireside reading! Researcher Nicky Hager in New Zealand has just published an amazing tome, Secret Power, that might do more damage to the NSA than Bamford's work. Hager is a bold activist, working with producers of the New Zealand version of "20/20" to go inside the secret signals base at Waihopai and take unprecedented video footage of the inside of the radomes, which are alleged to spy on international civilian Intelsat traffic. Hager isn't just a crank, however. His work on New Zealand's Government Communications Security Bureau is incredibly well-researched. Respected defense analyst Jeff Richelson wrote the foreword and British journalist Duncan Campbell claims in the Observer that the book has created quite a stir inside NSA headquarters. The most damning information details a global computer network, run by NSA on behalf of all the U.K./U.S. Treaty allies, called the Echelon/ Dictionary network. Echelon allows NSA to snare traffic intercepted by any ally into a unified database, without the ally having the slightest idea of what NSA is taking. And Hager is certain that civilian telex and Internet traffic is a prime target of the system. Don't look for a U.S. distributor for Secret Power-everyone here is afraid to touch it. His publisher doesn't even list a phone or e-mail. But if we all write to Craig Potton Publishers, Box 555, Nelson, New Zealand, perhaps we can free up enough copies of the book to scare the U.S. signal-intelligence community into having a minimum modicum of respect for civil liberties. But then again, I doubt it.

1 0

ITAR / S 1726 / Civil Disobedience
by Cypherpunks 17 Dec '03

17 Dec '03

Dear Mr. President, I am writing to express my disapproval of the Clinton Administration's position on the ITAR restrictions for encryption software. This is an important issue to me. 1) Software is writing, so it is protected by the first amendment, so the ITAR is unconstitutional. The idea that only paper books are first amendment protected, and electronic books are not, is just plain wrong. 2) The ITAR does not help National Security, but in fact greatly reduces our nations security because the Internet, and the computers and information connected to it, are kept from using good Encryption. 3) I feel that encryption is very important for doing commerce on the Internet, and that commerce on the Internet is important for our economy (Internet is the fastest growing sizable segment). You say you like the "Information Super Highway" and you are "going to focus on the economy like a laser". You should be removing the ITAR restrictions on American businesses. Otherwise the business for commerce software will go to companies in other countries. 4) The Clinton Clipper III proposal to have government key escrow is not acceptable. Also, it will never work, since people will always be able to buy and use software from the rest of the world. This proposal is just slowing down Internet progress. Please cancel Clipper III. 4) I really don't want to vote for a president who would continue this type of regulation of the Internet. The Republican candidate Bob Dole and the Libertarian candidate Harry Browne support Senator Burns Pro-CODE bill S 1726 that would end this foolishness. The current law, (see http://www.law.cornell.edu/uscode/22/2778.html) says that "The President shall periodically review the items on the United States Munitions List to determine what items, if any, no longer warrant export controls under this section. The results of such reviews shall be reported to the Speaker of the House [...] at least 30 days before any item is removed from the Munitions List [...]." It seems either of your two rivals would, if president, end the control of software. Will we have to elect one of them president to remove software from the Munitions list? 5) As an act of civil disobedience I have personally exported an encryption program (it is 3 lines of writing) using the web page at http://online.offshore.com.ai/arms-trafficker/ Yours sincerely, Cypherpunks cypherpunks(a)toad.com Sent from host niobe.c2.net with IP 140.174.185.17

1 0

Re: ITAR / S 1726 / Civil Disobedience
by autoresponder＠WhiteHouse.gov 17 Dec '03

17 Dec '03

Thank you for writing to President Clinton via electronic mail. Since June, 1993, whitehouse.gov has received over one million messages from people across the country and around the world. Because so many of you write, the President cannot personally review each message. The mail is first read by White House Correspondence staff. Your concerns, ideas, and suggestions are carefully recorded and communicated to the President weekly with a representative sampling of the mail. We are excited about the progress of online communication as a tool to bring government and the people closer together. Your continued interest and participation are very important to that goal. Sincerely, Stephen K. Horn Director, Presidential Email The Office of Correspondence P.S. Please read on - you may find the following information useful. -- This is the only electronic message you will receive from whitehouse.gov. No other message purporting to be from the President or his staff with an address at whitehouse.gov is authentic. If you have received such a message, you have been spoofed. -- You will receive only one autoresponder message per day. -- The only personal addresses at whitehouse.gov are the following: President(a)whitehouse.gov Vice.President(a)whitehouse.gov First.Lady(a)whitehouse.gov Please write to Mrs. Gore and other White House staff by regular mail. The address is: The White House, Washington, D.C. 20500. -- On October 20, 1994, President Clinton and Vice President Gore opened a World Wide Web home page called "Welcome to the White House: An Interactive Citizens' Handbook" and it remains one of the more popular spots on the Web. The White House home page provides, among other things, a single point of access to all government information available electronically on the Internet. "Welcome to the White House" can be accessed at: http://www.whitehouse.gov -- White House documents and publications are available on the World Wide Web (see above) and by email. To receive instructions on retrieving documents by email, please send a message to the following address: publications(a)whitehouse.gov In the body of your message, type "Send Info" (without quotes); do not include other text (such as message headers or signature lines (.sig files)). The instructions will be sent to you automatically. **************************************************************** List of Clinton Administration Accomplishments (three documents compose the whole): To: publications(a)whitehouse.gov Message body: send file 317571 send file 317573 send file 317575 **************************************************************** -- The White House Public Access Email FAQ (Frequently Asked Questions) document is available at the following address. The FAQ, among other things, lists alternate sources of government information, i.e., the Congressional email projects. Send an email message (no text necessary) to: faq(a)whitehouse.gov (This FAQ address is an autoresponder only; any comment sent to this address will not be acknowledged.)

1 0

News: Sony/Philips has trouble exporting TV's
by Ernest Hua 17 Dec '03

17 Dec '03

They're just TV's, for crying out loud!! C-Cube patrons may remember Tom Lookabaugh (Christie Cadwell's husband) who is quoted below. I don't recall his title being "sales manager", though, unless he got a recent "promotion" (frequently a C-Cube management speak for "pushed aside"). Ern -------- From Electronic Buyers' News: October 28, 1996 Issue: 1030 Section: News CODE LIMIT EXCEEDED By Jack Robertson Washington - New Internet-television systems from Sony Corp. and Philips Electronics Co. are technically munitions under U.S. export controls and cannot be shipped to the companies' worldwide sales networks, it was disclosed last week. Sony officials said the company's TV set-top box designed by WebTV of Palo Alto, Calif., includes a state-of-the-art 128-bit code encryption system for electronic commerce. This far exceeds the 40-bit encryption code permissible for export under the U.S. Munitions Control List. Philips also makes a WebTV set-top Internet box at its Magnavox TV plant in Knoxville, Tenn., and is similarly barred from shipping the unit to sales channels around the world. Both global electronic giants face immediate competition in the emerging TV-Internet surfing market from other Japanese, South Korean, and European set-makers that don't face the U.S. encryption controls. They now join the U.S. computer industry, which has long protested that the outmoded encryption export curbs are causing them to forfeit overseas sales of PCs and workstations to foreign rivals. President Clinton last month proposed lifting the level of encryption export controls from the present 40-bit code word to 56 bits, but only if a trap door is embedded in the cipher to allow law enforcement agencies to decode wiretapped messages. Clinton is expected shortly to sign an executive order putting the new control limits into effect. The pending 56-bit-code threshold doesn't help the Sony or Philips Web-surfing TV systems - nor most U.S. computer companies that build systems with encryption exceeding even the new control limit. Both Netscape and Microsoft Web-browsing software includes 128-bit code encryption, surpassing export curbs. Zenith Electronics Co., maker of a Web-surfing TV set, isn't concerned about the encryption controls, since it sells only in the U.S. market where the curbs don't apply. Divicom Inc., based in Milpitas, Calif., must get an export license from the U.S. State Department for every exported cable TV front-end encoder, which includes 128-bit code word, according to Tom Lookabough, the company's sales manager. He said the license review process can take eight weeks or more, a troublesome delay that foreign competitors don't face. Divicom and Scientific Atlanta both said their new digital TV set-top boxes include encryption that exceeds allowable export limits - but virtually all sales so far are in the U.S. market. As digital-box production ramps up, the companies would like to sell overseas, but run into the export control ban that puts them at a severe disadvantage against the foreign competitors aggressively entering the set-top market. President Clinton's encryption export control changes include an industry-favored provision to take the category off the State Department's Munitions Control List and shift responsibility to the Commerce Department.

3 2

News: TIA to
by Ernest Hua 17 Dec '03

17 Dec '03

From Communications Week October 28, 1996 Issue: 635 Section: Telepath -- Top Sories TIA TO ISSUE DRAFT WIRETAP SPECS By Peter Cassidy The Telecommunications Industries Association next month will issue draft standards allowing manufacturers to make equipment that complies with the most recent federal wiretapping law. If and when those draft standards are ultimately approved, however, equipment makers will still face a troubling dilemma: The U.S. Justice Department, which in large part wrote the new law, is also the agency that will enforce it. President Clinton signed the Communications Assistance for Law Enforcement Act in October 1994 after a last-ditch, sub-rosa lobbying effort by the National Security Agency and the Federal Bureau of Investigation pushed the bill through a Senate committee. In essence, the law says that the U.S. Attorney General will dictate how the law will carry out its job of tapping into switches. As of October 1998, manufacturers will have to build their switches to meet the industry specs, and carriers will have to maintain the switches accordingly. Switches in place before Jan. 1, 1995, are nominally exempted from compliance. Modifications intended to fulfill the capabilities the Justice Department mandates will be required only if companies are reimbursed for the changes-the exception being equipment that has been "substantially" modified. Despite these protections, concern persists: Because many of the technical features in place before the January 1995 cutoff will have been updated in some way, conflicts with the Justice Department may ensue over whether to consider them "pre-existing" technologies under the law. And companies on the losing end will suffer major penalties: The law specifies that the FBI can define which companies are not in compliance and bring civil actions against them, with fines of up to $10,000 per violation. Accordingly, the ambiguity in the legislative language could end up as costly both for modifications that are not reimbursed and for court challenges. "What is not really addressed is what 'a significant upgrade' really means," said Dan Bart, standards and technology vice president at the TIA. "Ultimately, some test case will come and some judge will make the final decision." Given the relationship between the industry and Justice over wiretapping capability thus far, a court challenge hardly seems far-fetched. In fact the act was proposed only after the FBI and telecom industry groups wrangled for years in consultative committees. The FBI had argued that advanced telephony technologies were making it difficult to wiretap and capture call data. Finally, the agency turned to a legislative solution. The TIA's draft standards, due to be issued next month by the group's TR 45.2 committee, will contain the technical specifications required to build-in the features for the Electronic Surveillance Interface that the act defines. Following a comment period of up to 90 days, the standards will be placed on a ballot for a vote by committee members, said committee chairwoman Cheryl Blum. If substantial changes are made to the draft during the comment period, the standards may have to go back to the committee, she noted. Cellular data removed At a standards meeting last month, the committee removed language that would have defined a standard for forwarding the location data of cellular phones when the instrument is powered up-but not actively transmitting and receiving-information the FBI indicated it should have if available. Ms. Blum said the committee decided such a capability exceeds the requirements of the the act. This point is important because, under the law, companies are reimbursed only for those modifications of existing technologies expressly spelled out in the act. Clearly, the FBI holds the whip, even in this standards-making process. Should the standards be found deficient under the law, the FCC can step in and replace those standards with its own. Justice is the most visible proponent, but the act is also of great interest to the NSA, which introduces a potentially troubling level of complexity as the industry attempts to comply with the law. Commerce Department memos obtained by Telepath show that the NSA was involved in sculpting the language of the act as far back as 1992. A Senate committee staff attorney, now in private industry, told Telepath that the NSA's interest was that the act introduce the opportunity to build wiretap access points into switches outside the United States. Equipment built to specifications in this country-and by offshore manufacturers for the U.S. market-would thus find its way into foreign telephone networks, allowing the NSA a simpler means to tap into targeted subjects. What liabilities this introduces to equipment makers remains unclear, as these are the early days of the act-the first law to give the government the power to demand design changes in telephony technologies. Peter Cassidy is a freelance writer. Send your reactions to this article to telepath(a)cmp.com.

1 0

Re: When did Mondex ever claim to be anonymous?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>>> I don't think spreading false rumours is a good idea - it can discredit >>> the spreader if anyone bothers to check any details. >>Disinformation is a time-honoured weapon in political struggle. Foo. There's so much totally outrageous stuff the government _does_ that we don't have to go giving them ideas about _more_ things to do. And ethics aside (:-), bogus rumours get you lumped in with the folks who think Space Aliens fired that shot from the Grassy Knoll in a plot to kidnap Elvis. It's hard enough not to get treated like that when you're telling the truth, especially about issues where the government knows it's cheating. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: ITAR / S 1726 / Civil Disobedience
by c62op27＠ibx.com 17 Dec '03

17 Dec '03

Would it be appropriate for other users to forward this message to the prez with their signatures?

2 1

"Montgolfiering" mindlessness
by c62op27＠ibx.com 17 Dec '03

17 Dec '03

What bombastic dribble is this? Me thinks our good yet crazy friend has been ingesting Dr. Bronner's Pure Peppermint Castille far beyond the recommended quantities. You are montgolfiering into the hot air that swells your brain. I joined this list to learn about cryptology and its related topics, not to have my inbox filled with the ramblings of impotents. Victor

2 1

Re: Sex, drugs, and libertarianism
by Steve Edwards 17 Dec '03

17 Dec '03

I urge people to think carefully about issues of morality, ethics, free will, and the type of society we wish to have. People make choices every day. To use or not to use drugs is just another choice. --Tim May True. I agree that the war on drugs is useless, and that prohibiting prostitution is even more mindless. Still, the libertarian ideal seems even worse. Think about Thailand, where sex is bought and sold openly. The AIDs infection rate has gone from near zero to 2.5% in a couple of years, and promises to devastate the whole country. Burmese kids are sold into sex slavery. Is this the future? People make choices every day, but few people make INFORMED choices, and a lot of people, believe it or not, have very little choice. They are caught between the Devil and the Deep Blue Sea. SAlanEd(a)concentric.net, SAlanEd(a)aol.com, http://users.aol.com/salaned/cyberplace.html "Life, he himself said once, (his biografiend, in fact, kills him verysoon, if yet not, after) is a wake, livit or krikit, and on the bunk of our breadwinning, lies the cropse of our seedfather..."

1 0

RE: Rumours of NSA breakin
by Alex Filacchione 17 Dec '03

17 Dec '03

I've been hearing rumours of an alledged compromise of the NSA Web server but no hard evidence. The claim made is that several Mb of files were downloaded from the server and posted to the "Internet". I can't see it in sci.crypt or alt.conspiracy though. I am more than a little skeptical of the claim, unless the files in question were not considered sensitive - and there is no reason to believe that the NSA would be keeing anything secret on their Web server. =-=-=-=-=- *if* the page was hacked indeed, then I seriously doubt that files of any significance were taken. I would think that they would not keep any classified info on a web server (!). If someone hacked into the page, got the files, and then posted them to the internet they probably would *not* have posted these to sci.crypt, etc. (I like the addition of alt.conspiracy though). My guess is that they would end up on a private mailing list, or end up getting posted to one of the "warez" groups or something. If this were true, I would be interested to know just what it was that they were keeping on their website and why. Could they be trojaned files? Would the NSA go to so much trouble when there are easier ways of doing things? Just curious about this.... Alex F alexf(a)iss.net

3 2

[CRYPTO] Cryptography Of A Sort (COAS) update
by Dale Thorn 17 Dec '03

17 Dec '03

[note: last post didn't have attachment] Per suggestions received for this project, I've added code to "pad" 8th bits in a "7-bit" text file, i.e., to "normalize" the ratio of zero-bits and one-bits somewhat. Bit-padding prior to encryption does not change the central imperative of the program, which is to never change any bits in a file, since bit-padding is a separate option. Attached are: CCRP.H ('C'-language header) CCRP.C ('C'-language code) CCRP.DOC (instructions) CCRP.FAQ (f.a.q.) Suggested procedure: Start with any file; if "7-bit" ASCII, try bit-padding first. Next, perform encryption at least half a dozen times, with different pass-phrases. To decrypt, perform all steps in reverse, per documentation. Comments and questions are welcome. /* CCRP.H 28.10.1996 */ typedef char C; /* char (strings, null-terminated) */ typedef double D; /* double float (double precision) */ typedef float F; /* float (single precision) */ typedef int I; /* short integer (signed) */ typedef long L; /* long integer (signed) */ typedef unsigned int U; /* short integer (unsigned) */ typedef unsigned char UC; /* unsigned character */ typedef void V; /* void data type */ I bitget(C *cstr, I ibit); V bitput(C *cstr, I ibit, I iput); V ifn_cryp(I *int1, I *int2, I *istk, C *cbuf, C *ctmp, I ibit, I ilen, I iopr); V ifn_msgs(C *cmsg, I iofs, I irow, I icol, I ibrp, I iext); V ifn_pack(C *cbuf, L llof, U ibuf, I iopr, struct _iobuf *ebuf); V ifn_read(C *cbuf, L lbyt, U ibuf, struct _iobuf *ebuf); V ifn_sort(I *int1, I *int2, I *istk, I imax); V ifn_write(C *cbuf, L lbyt, U ibuf, struct _iobuf *ebuf); U io_vadr(I inop); V io_vcls(I iclr); V io_vcsr(I irow, I icol, I icsr); V io_vdsp(C *cdat, I irow, I icol, I iclr); union REGS rg; /* DOS registers declaration (video) */ U _far *uvadr = 0; /* video display pointer */ ******************************************************************************* ******************************************************************************* ******************************************************************************* /* CCRP.C Encrypt/Decrypt a DOS file */ /* By: Dale Thorn */ /* Version 3.1 */ /* Rev. 29.10.1996 */ #include "stdlib.h" #include "string.h" #include "stdio.h" #include "dos.h" #include "io.h" #include "ccrp.h" V main(I argc, C **argv) { /* command-line arguments (input file/offset) */ C cmsg[23]; /* initialize the User message string */ U ibit = 0; /* initialize the bit offset in cbuf */ U ibuf = 2048; /* set maximum file buffer length */ U idot; /* initialize the filename extension separator */ I ieof = 0; /* initialize the EOF flag */ U ilen; /* initialize a temporary length variable */ U indx; /* initialize a temporary loop variable */ I iopr; /* initialize the operation code */ U irnd = 0; /* initialize the randomizer seed */ L lbyt; /* initialize the file pointer variable */ L llof; /* initialize the file length variable */ L lrnd = 0; /* initialize the randomizer accumulator */ U _far *uvadr = 0; /* video display pointer */ struct _iobuf *ebuf; /* source file access structure */ C *cbuf = (C *)malloc(2048); /* initialize the file buffer */ C *ctmp = (C *)malloc(2048); /* initialize the temp buffer */ I *int1 = (I *)malloc(3074); /* allocate the sort index array */ I *int2 = (I *)malloc(3074); /* allocate the sort random number array */ I *istk = (I *)malloc(3074); /* allocate the sort stack array */ if (argc == 1) { /* a command line was not supplied */ ifn_msgs("Usage: CCRP(v3.1) filename [/e /d /p /u] [key]",\ 4, 24, 79, 0, 1); /* display usage message [above] and exit */ } if (argc < 3 || argc > 4) { /* no. of parameters should be one or two */ ifn_msgs("Invalid number of parameters", 4, 24, 79, 1, 1); } /* display no.-of-parameters message [above] and exit */ if (argv[2][0] != '/') { /* slash preceding parameter missing */ ifn_msgs("Invalid operation parameter", 4, 24, 79, 1, 1); } /* display invalid-parameter message [above] and exit */ strupr(argv[1]); /* uppercase the filename */ strupr(argv[2]); /* uppercase the operation code */ if (strchr("DEPU", argv[2][1]) == NULL) { /* invalid parameter */ ifn_msgs("Invalid operation parameter", 4, 24, 79, 1, 1); } /* display invalid-parameter message [above] and exit */ idot = strcspn(argv[1], "."); /* position of filename extension separator */ ilen = strlen(argv[1]); /* length of filename */ if (idot == 0 || idot > 8 || ilen - idot > 4) { /* filename tests bad */ ifn_msgs("Invalid filename", 4, 24, 79, 1, 1); } /* display invalid-filename message [above] and exit */ if (idot < ilen) { /* filename extension separator found! */ if (strcspn(argv[1] + idot + 1, ".") < ilen - idot - 1) {/* 2nd found! */ ifn_msgs("Invalid filename", 4, 24, 79, 1, 1); } /* display invalid-filename message [above] and exit */ } strcpy(cmsg, argv[1]); /* copy filename to message */ strcat(cmsg, " not found"); /* add "not found" to message */ ebuf = fopen(argv[1], "rb+"); /* open the selected file */ llof = filelength(fileno(ebuf)); /* filelength of selected file */ if (ebuf == NULL || llof == -1L || llof == 0) {/* length=0 or call failed */ fclose(ebuf); /* close the file */ remove(argv[1]); /* kill the zero-length file */ ifn_msgs(cmsg, 4, 24, 79, 1, 1); /* display message and exit */ } iopr = argv[2][1] - 68; /* opcode (1=encrypt, 0=decrypt, 12=pad bits) */ if (argc == 4) { /* a seed key was supplied */ ilen = strlen(argv[3]); /* length of optional seed key */ for (indx = 0; indx < ilen; indx++) { /* loop through the seed key */ irnd = argv[3][indx]; /* character at byte position */ switch (indx % 3) { /* select on byte significance */ case 0: /* least significant byte */ lrnd += irnd; /* add to randomizer accum. */ break; case 1: /* 2nd least significant byte */ lrnd += (L)irnd * 256; /* add to randomizer accum. */ break; case 2: /* most significant byte */ lrnd += (L)irnd * 65536; /* add to randomizer accum. */ break; default: break; } } irnd = (U)(lrnd % 32640) + 1; /* mod randomizer seed to <= 32640 */ } ifn_msgs("Please standby", 4, 24, 79, 0, 0); /* standby message */ if (iopr > 1) { /* operation code is 'P' or 'U' */ ifn_pack(cbuf, llof, ibuf, iopr, ebuf); /* add 8th bits if 7-bit file */ } /* NOTE: ifn_pack does NOT return here */ srand(irnd); /* initialize the random number generator */ for (lbyt = 0; lbyt < llof; lbyt += ibuf) { /* process in ibuf segments */ if (lbyt + ibuf >= llof) { /* current file pointer + ibuf spans EOF */ ibuf = (U)(llof - lbyt); /* reset maximum file buffer length */ ieof = 1; /* set the EOF flag ON */ } ifn_read(cbuf, lbyt, ibuf, ebuf); /* read data into the file buffer */ while (1) { /* loop to process bit groups in cbuf */ ilen = (rand() / 26) + 256;/* buffer seg. bit-len.: 256<=ilen<=1536 */ if (ibit + ilen > ibuf * 8) {/* current bit-pointer+ilen spans cbuf */ if (ieof) { /* EOF flag is ON */ ilen = ibuf * 8 - ibit; /* reset bit-length of buffer segment */ } else { /* EOF flag is OFF; adjust file pointer */ ifn_write(cbuf, lbyt, ibuf, ebuf); /* write data to the file */ lbyt -= (ibuf - ibit / 8);/* set file ptr to reload from ibit */ ibit %= 8; /* set ibit to first byte of <new> cbuf */ break; /* exit loop to reload cbuf from lbyt */ } } /* encrypt or decrypt the current segment [below] */ ifn_cryp(int1, int2, istk, cbuf, ctmp, (I)ibit, ilen, iopr); ibit += ilen; /* increment ibit to next bit-segment */ if (ibit == ibuf * 8) { /* loop until ibit == length of cbuf */ ifn_write(cbuf, lbyt, ibuf, ebuf); /* write data to the file */ ibit = 0; /* set ibit to first byte of <new> cbuf */ break; } } } ifn_msgs("Translation complete", 4, 24, 79, 0, 1);/* disp. message & exit */ } I bitget(C *cstr, I ibit) { /* get a bit-value from a string */ I ival; /* initialize the bit value */ switch (ibit % 8) { /* switch on bit# within character */ case 0: /* bit #0 in target character */ ival = 1; /* value of bit #0 */ break; case 1: /* bit #1 in target character */ ival = 2; /* value of bit #1 */ break; case 2: /* bit #2 in target character */ ival = 4; /* value of bit #2 */ break; case 3: /* bit #3 in target character */ ival = 8; /* value of bit #3 */ break; case 4: /* bit #4 in target character */ ival = 16; /* value of bit #4 */ break; case 5: /* bit #5 in target character */ ival = 32; /* value of bit #5 */ break; case 6: /* bit #6 in target character */ ival = 64; /* value of bit #6 */ break; case 7: /* bit #7 in target character */ ival = 128; /* value of bit #7 */ break; default: break; } return ((cstr[ibit / 8] & ival) != 0); /* return value of target bit */ } V bitput(C *cstr, I ibit, I iput) { /* put a bit-value to a string */ I ival; /* initialize the bit value */ I ipos = ibit / 8; /* position of 8-bit char. in cstr */ switch (ibit % 8) { /* switch on bit# within character */ case 0: /* bit #0 in target character */ ival = 1; /* value of bit #0 */ break; case 1: /* bit #1 in target character */ ival = 2; /* value of bit #1 */ break; case 2: /* bit #2 in target character */ ival = 4; /* value of bit #2 */ break; case 3: /* bit #3 in target character */ ival = 8; /* value of bit #3 */ break; case 4: /* bit #4 in target character */ ival = 16; /* value of bit #4 */ break; case 5: /* bit #5 in target character */ ival = 32; /* value of bit #5 */ break; case 6: /* bit #6 in target character */ ival = 64; /* value of bit #6 */ break; case 7: /* bit #7 in target character */ ival = 128; /* value of bit #7 */ break; default: break; } if (iput) { /* OK to set the bit ON */ if (!(cstr[ipos] & ival)) { /* bit is NOT already ON */ cstr[ipos] += ival; /* set bit ON by adding ival */ } } else { /* OK to set the bit OFF */ if (cstr[ipos] & ival) { /* bit is NOT already OFF */ cstr[ipos] -= ival; /* set bit OFF by subt. ival */ } } } V ifn_cryp(I *int1, I *int2, I *istk, C *cbuf, C *ctmp, I ibit, I ilen, I iopr) { I indx; /* initialize the for-next loop counter */ for (indx = 0; indx < ilen; indx++) { /* loop through ilen array elements */ int1[indx] = indx; /* bit offsets from current ibit offset */ int2[indx] = rand(); /* random number values for sort function */ } ifn_sort(int1, int2, istk, ilen - 1); /* Quicksort by random no. array */ memcpy(ctmp, cbuf, 2048); /* copy data buffer to temp destination buffer */ if (iopr) { /* encrypt operation */ for (indx = 0; indx < ilen; indx++) { /* loop thru ilen array elements */ bitput(ctmp, indx + ibit, bitget(cbuf, int1[indx] + ibit));/*encrypt*/ } } else { /* decrypt operation */ for (indx = 0; indx < ilen; indx++) { /* loop thru ilen array elements */ bitput(ctmp, int1[indx] + ibit, bitget(cbuf, indx + ibit));/*decrypt*/ } } memcpy(cbuf, ctmp, 2048); /* copy temp destination buffer to data buffer */ } V ifn_msgs(C *cmsg, I iofs, I irow, I icol, I ibrp, I iext) {/* display msgs */ io_vcls(7); /* clear the screen */ io_vdsp(cmsg, 4, iofs, 7); /* display the user message */ if (ibrp) { /* OK to sound user-alert (beep) */ printf("\a"); /* sound the user-alert */ } if (iext) { /* OK to exit the program */ io_vcsr(5, 0, 0); /* relocate the cursor */ fcloseall(); /* close all open files */ exit(0); /* return to DOS */ } else { /* do NOT exit the program */ io_vcsr(irow, icol, 0); /* 'hide' the cursor */ } } V ifn_pack(C *cbuf, L llof, U ibuf, I iopr, struct _iobuf *ebuf) { I ibit; /* initialize a temporary loop variable */ U ichr; /* initialize a temporary loop variable */ U incr; /* initialize the bit-pad loop increment */ U itmp = ibuf; /* make a copy of the file buffer length */ L lbyt; /* initialize the file pointer variable */ L lcnt = 0; /* initialize the current total one-bits */ L ltmp; /* initialize a copy of current total one-bits */ L ltot; /* initialize the no. of 8th bits to set ON */ for (lbyt = 0; lbyt < llof; lbyt += itmp) { /* process in itmp segments */ if (lbyt + itmp > llof) { /* current file pointer + itmp spans EOF */ itmp = (U)(llof - lbyt); /* reset maximum file buffer length */ } ifn_read(cbuf, lbyt, itmp, ebuf); /* read data into the file buffer */ if (iopr == 17) { /* opcode == unpad bits */ for (ichr = 0; ichr < itmp; ichr++) { /* process bytes in cbuf */ bitput(cbuf, ichr * 8 + 7, 0); /* set each 8th bit OFF */ } ifn_write(cbuf, lbyt, itmp, ebuf); /* save current buffer to file */ } else { /* opcode == pad bits - validation pass */ for (ichr = 0; ichr < itmp; ichr++) { /* process bytes in cbuf */ for (ibit = 0; ibit < 8; ibit++) { /* process bits in cbuf */ lcnt += bitget(cbuf, ichr * 8 + ibit);/* add 0/1 bit to total */ if (ibit == 7) { /* this is the 8th bit of ichr */ if (bitget(cbuf, ichr * 8 + ibit)) { /* the 8th bit is ON */ ifn_msgs("8th bit(s) are ON - can't do bit-pad", 4, 24, 79, 1, 1); } /* can't add bits - display message (above) and exit */ } } } } } if (iopr == 17) { /* opcode == unpad bits */ ifn_msgs("Bit-unpadding complete", 4, 24, 79, 0, 1); /* message & exit */ } ltot = llof * 4 - lcnt; /* set ltot as the no. of 8th bits to set ON */ if (ltot > 0) { /* one-bits < zero bits; commence padding */ if (ltot > llof) { /* one-bits required exceed total bytes */ ltot = llof; /* reset one-bits to equal total bytes */ } itmp = ibuf; /* reset the copy of the file buffer length */ ltmp = ltot; /* make a copy of the 8th bits to set ON */ for (lbyt = 0; lbyt < llof; lbyt += itmp) {/* process in itmp segments */ if (lbyt + itmp > llof) { /* current file pointer + itmp spans EOF */ itmp = (U)(llof - lbyt); /* reset maximum file buffer length */ } ifn_read(cbuf, lbyt, itmp, ebuf); /* read data into the file buffer */ incr = (U)((llof - lbyt) / ltmp); /* set the bit-pad loop increment */ for (ichr = 0; ichr < itmp; ichr += incr) { /* loop to set 8th bits */ bitput(cbuf, ichr * 8 + 7, 1); /* set each 8th bit ON */ ltmp--; /* decrement the total one-bits padded */ if (ltmp == 0) { /* all 8th bits are now set ON */ break; /* all 8th bits are ON - exit ichr loop */ } } ifn_write(cbuf, lbyt, itmp, ebuf); /* save current buffer to file */ if (ltmp == 0) { /* all 8th bits are now set ON */ break; /* all 8th bits are ON - exit lbyt loop */ } } ifn_msgs("Bit-padding complete", 4, 24, 79, 0, 0);/* disp.message only */ } else { /* one-bits >= zero bits; padding not needed */ ifn_msgs("Bit-padding not needed", 4, 24, 79, 1, 0);/* disp.msg.& exit */ ltot = 0; /* reset one-bits required for below message */ } io_vcsr(6, 0, 0); /* relocate the cursor */ printf("%s%ld", "Total bits in source: ", llof * 8);/* total bits in file */ io_vcsr(8, 0, 0); /* relocate the cursor */ printf("%s%ld", "Total one-bits begin: ", lcnt); /* one-bits before pad */ io_vcsr(10, 0, 0); /* relocate the cursor */ printf("%s%ld\n", "Total one-bits added: ", ltot); /* no. one-bits added */ fcloseall(); /* close all open files */ exit(0); /* return to DOS */ } V ifn_sort(I *int1, I *int2, I *istk, I imax) { /* array Quicksort function */ I iext; /* initialize the outer-loop exit flag */ I ilow; /* initialize the low array pointer */ I irdx = 0; /* initialize the sort radix */ I isp1; /* initialize the low stack pointer */ I isp2; /* initialize the top stack pointer */ I itop; /* initialize the top array pointer */ I iva1; /* initialize array value from low stack pointer */ I iva2; /* initialize array value from low stack pointer */ istk[0] = 0; /* initialize the low array pointer */ istk[1] = imax; /* initialize the top array pointer */ while (irdx >= 0) { /* loop until sort radix < 0 */ isp1 = istk[irdx + irdx]; /* set the low stack pointer */ isp2 = istk[irdx + irdx + 1]; /* set the top stack pointer */ irdx--; /* decrement the sort radix */ iva1 = int1[isp1]; /* get array value from low stack pointer */ iva2 = int2[isp1]; /* get array value from low stack pointer */ itop = isp2 + 1; /* set the top array pointer */ ilow = isp1; /* set the low array pointer */ while (1) { /* loop to sort within the radix limit */ itop--; /* decrement the top array pointer */ if (itop == ilow) { /* top array pointer==low array pointer */ break; /* skip to next radix value */ } if (iva2 > int2[itop]) { /* value @low pointer>value @top pointer */ int1[ilow] = int1[itop]; /* swap low and top array values */ int2[ilow] = int2[itop]; /* swap low and top array values */ iext = 0; /* initialize outer-loop exit flag */ while (1) { /* loop to compare and swap array values */ ilow++; /* increment the low array pointer */ if (itop == ilow) { /* top array pointer==low array pointer */ iext = 1; /* set outer-loop exit flag ON */ break; /* skip to next radix value */ } if (iva2 < int2[ilow]) { /* value @low ptr.<value @low ptr. */ int1[itop] = int1[ilow]; /* swap top and low array values */ int2[itop] = int2[ilow]; /* swap top and low array values */ break; /* repeat sort within the radix limit */ } } if (iext) { /* outer-loop exit flag is ON */ break; /* skip to next radix value */ } } } int1[ilow] = iva1; /* put array value from low stack pointer */ int2[ilow] = iva2; /* put array value from low stack pointer */ if (isp2 - ilow > 1) { /* low segment-width is > 1 */ irdx++; /* increment the sort radix */ istk[irdx + irdx] = ilow + 1; /* reset low array pointer */ istk[irdx + irdx + 1] = isp2; /* reset top array pointer */ } if (itop - isp1 > 1) { /* top segment-width is > 1 */ irdx++; /* increment the sort radix */ istk[irdx + irdx] = isp1; /* reset low array pointer */ istk[irdx + irdx + 1] = itop - 1; /* reset top array pointer */ } } } V ifn_read(C *cbuf, L lbyt, U ibuf, struct _iobuf *ebuf) { /* read f/binary */ fseek(ebuf, lbyt, SEEK_SET); /* set the buffer-read pointer */ fread((V *)cbuf, 1, ibuf, ebuf); /* read data from the binary file */ } V ifn_write(C *cbuf, L lbyt, U ibuf, struct _iobuf *ebuf) {/* write t/binary */ fseek(ebuf, lbyt, SEEK_SET); /* set the buffer-write pointer */ fwrite((V *)cbuf, 1, ibuf, ebuf); /* write data to the binary file */ } U io_vadr(I inop) { /* get video address (color or b/w) */ rg.h.ah = 15; /* video-address function */ int86(0x10, &rg, &rg); /* call DOS for video address */ if (rg.h.al == 7) { /* register A-low is 7 */ return(0xb000); /* return b/w address */ } else { /* register A-low is NOT 7 */ return(0xb800); /* return color address */ } } V io_vcls(I iclr) { /* clear screen function */ I irow; /* initialize the row number variable */ C cdat[81]; /* initialize the row data buffer */ memset(cdat, ' ', 80); /* clear the row data buffer */ cdat[80] = '\0'; /* terminate the row data buffer */ for (irow = 0; irow < 25; irow++) { /* loop thru the screen rows */ io_vdsp(cdat, irow, 0, iclr); /* display each <blank> screen row */ } } V io_vcsr(I irow, I icol, I icsr) { /* set cursor position [and size] */ rg.h.ah = 2; /* cursor-position function */ rg.h.bh = 0; /* video page zero */ rg.h.dh = (C)irow; /* row number */ rg.h.dl = (C)icol; /* column number */ int86(0x10, &rg, &rg); /* call DOS to position cursor */ if (icsr) { /* cursor-size specified */ rg.h.ah = 1; /* cursor-size function */ rg.h.ch = (C)(13 - icsr); /* set cursor-begin line */ rg.h.cl = 12; /* set cursor-end line */ int86(0x10, &rg, &rg); /* call DOS to set cursor size */ } } V io_vdsp(C *cdat, I irow, I icol, I iclr) { /* display data on screen */ I ilen = strlen(cdat); /* length of string to be displayed */ I iptr; /* byte-counter for displayed string */ U uclr = iclr * 256; /* unsigned attribute high-byte value */ if (!uvadr) { /* video pointer segment not set */ FP_SEG(uvadr) = io_vadr(0); /* set video pointer segment */ } FP_OFF(uvadr) = irow * 160 + icol * 2; /* set video pointer offset */ for (iptr = 0; iptr < ilen; iptr ++) { /* loop thru displayed string */ *uvadr = uclr + (UC)cdat[iptr]; /* put data to video memory */ uvadr++; /* increment video display pointer */ } } ******************************************************************************* ******************************************************************************* ******************************************************************************* New CCRP documentation - changes as of 29.10.1996 ----------Command---------- ------------------Output------------------- CCRP Usage parameters. CCRP filename /e Encrypt each byte in 'filename' so that the data cannot be seen, or, if the file was an executable file, it cannot be executed. CCRP filename /d Decrypt (restore) each byte in 'filename'. CCRP filename /e key Encrypt or decrypt 'filename', but add an CCRP filename /d key additional factor (a key, or a password) to the encryption and decryption. NOTE 1: The key/password (if used) must be a contiguous string of characters with no blank spaces between any characters. NOTE 2: If a key is entered for encryption, the same key must be entered for decryption. NOTE 3: Encryption may be performed 2 or more times in sequence before decryption, using a different key each time, for additional encryption security. In such case, the decryption steps must be performed in the reverse order (last encryption/first decryption). NOTE 4: Encryption and decryption are mere complementary processes, so that if the decryption step were performed first, followed by encryption, the end effect would be the same. CCRP filename /p 'Pad' 8th bits in 'filename', which must be a '7-bit' ASCII file. If any 8th bits were set before this option is invoked, a message will be displayed to that effect and changes will not occur. If all bytes in 'filename' have ASCII values less than 128, then no 8th bits are currently set in that file. If the total number of 1-bits in 'filename' are greater than or equal to the number of 0-bits in the file, a message will be displayed to that effect and, as above, changes will not occur. This option will set only enough 8th bits to equalize the 1-bits and 0-bits in the file, or as many 8th bits as possible if the total bytes in the file (only the 8th bit can be set) are less than the number of 0-bits minus the number of 1-bits in the file. The purpose of bit-padding is to 'normalize' the number of 1-bits in a file before encryption, to further obscure the nature of the source text. The intent of CCRP is actually to NOT alter any bits during encryption, but rather to move them into random positions within the file, so that attackers cannot determine which bits belong to which bytes, etc. Bit-padding gets around this requirement in that it can only be invoked as a command option separate from an encryption step. Note further that if bit-padding or un-padding is attempted on a file which is in an encrypted state, the file will be damaged beyond repair. CCRP filename /u 'Unpad' 8th bits in 'filename', which must have been a '7-bit' ASCII file prior to padding with 8th bits. This option has no warnings, and when used on a file which was not originally '7-bit' ASCII text, will damage the file beyond repair, since the exact 8th bits to change back to 1's cannot be determined. WARNING(!) Encryption changes the contents of a file, and if you cannot perform the decryption process properly, including the use of keys/passwords, you won't be able to recover the file at all. Normally, before making changes to a file, you are advised to make a backup copy of the file, but since the purpose of encryption is to make the file unreadable and unusable, to have a usable backup copy of the file on the same computer, or even in the same area that the computer is located in, wouldn't suit the primary purpose of encryption. NOTES: If maximum security is the objective, you might want to encrypt a file several times (in several passes) with a different encryption key each pass, using different programs, and mixing the encryption/decryption order (OK as long as different keys are used). Examples: ENCRYPT.BAT (encrypt the file; see Note 4 above concerning the /d switch) ccrp filename /p bcrp filename /d Little_Miss_Muffet_Sat_On_Her_Tuffet ccrp filename /e The_Quick_Brown_Fox_Jumped_Over_The_Lazy_Dog bcrp filename /e We_Have_Met_The_Enemy_And_They_Are_Us ccrp filename /d Let_Him_That_Hath_Understanding_Count_The_Number_Of_The_Beast DECRYPT.BAT (decrypt the file; see Note 4 above concerning the /e switch) ccrp filename /e Let_Him_That_Hath_Understanding_Count_The_Number_Of_The_Beast bcrp filename /d We_Have_Met_The_Enemy_And_They_Are_Us ccrp filename /d The_Quick_Brown_Fox_Jumped_Over_The_Lazy_Dog bcrp filename /e Little_Miss_Muffet_Sat_On_Her_Tuffet ccrp filename /u ******************************************************************************* ******************************************************************************* ******************************************************************************* FAQ for Cryptography Of A Sort (COAS) Author : Dale Thorn <dthorn(a)gte.net> Revised : 27 Oct 1996 Q: Is COAS an actual product? A: COAS is an encryption engine supplied in source-code format, which calls some commonly-available (and replaceable) functions included with commercial computer-language libraries, which in turn perform some of the rudimentary tasks required by the program. Public Key features are not currently supported in COAS, therefore, messaging applications are not as well supported as is local file encryption. Q: What are the main differences between COAS and other non-messaging-oriented crypto products? A: 1. COAS repositions bits based on multiple encoding passes using one or more Pseudo-Random Number Generators (PRNG's). Since COAS is provided only in source code format, and since the source code calls the PRNG function in the compiler library(s), COAS is actually independent of specific PRNG's. NOTE: PRNG limitations, as described in the popular literature, do not necessarily apply when repositioning bits in multiple passes, as opposed to modifying bits as is normally done in other software. Think of "brute force encryption" (more on this below). 2. COAS does not use a "key" as such, and thus does not "encrypt" the bits in a text bitstream. Instead, it uses an input value (text or numeric) as an entry point into a common PRN sequence. Since the entry point is a secret, and since bits are moved using random block sizes, from their original bytes into unrelated destination bytes, cryptanalytic attempts must necessarily begin with brute-force guessing as to the entry points in the PRN sequences, in order to associate the correct bits with their original bytes of text. Multiple encoding passes raise the number of guesses exponentially. 3. COAS source code is extremely small, the primary intent for which was to provide a sample encoding engine for local/personal computer files. Due to its small size and simplicity, the source code can be easily modified by casual users, who may add in their own custom routines. NOTE: It cannot be overemphasized, that crypto programs which have a widely-respected reputation must also be held suspect when A) The very nature of those programs is to deceive, -and- B) The source code is either not available, or is so complex as to discourage ordinary people from working with it. Q: But if COAS uses a common, ordinary PRNG, how can it possibly be secure? A: I can think of two arguments against using PRNG's: 1. Encoded text is easy to decode by brute force on most computers, -and- 2. Encoded text can be seen as having regular patterns when "viewed" from the vantage point of programs employing higher-dimensional mathematics. Addressing the former, a single-pass encryption of a text file using the typical PRNG might be breakable in as little as .000001 second on one of the larger, faster computers available, however, the same approach might require as many as 10^24 years if the number of encoding passes reaches ten or more. To simplify: try to guess the number I'm thinking between zero and 32,000. You can make 16 billion guesses per second, so it will take only .000001 second (on average) to get the correct answer. If you had to guess ten numbers correctly (and sequentially), it would require roughly (16,000^10) / 16,000,000,000 seconds, approximately 10^24 years. Addressing the latter, the ability to "view" the text as a lattice in a higher dimension is likewise diminished by the discontinuities inherent in multi-pass encoding, when bit-group sizes are determined dynamically by PRN's following the secret entry points into the PRNG sequences. Q: Since COAS only moves bits and doesn't change any of them, wouldn't that make cryptanalysis much easier, since the number of 0-bits and 1-bits in the encrypted file would be identical to the numbers in the source file? A: While the COAS encryption processes don't actually change any bits, the bit-padding and de-padding options in versions 3.x and above will allow you to change 8th bits to 1's in "7-bit" ASCII text, after which you do any encryption steps followed (eventually) by decryption and de-padding. Q: What about the possibility that two or more encryption passes could be decrypted in a single pass, as in the scenario where a third key K3 is functionally equivalent to two separate encrypting keys K1 and K2? A: Since COAS encoding is controlled through entry points into a PRNG's number sequences (adjacent encryptions may also use different PRNG's and/or bit-move logic), searching for a "key" or algorithm which can unpack two or more layers of coding will prove futile when all entry points into the PRNG's are different, and different PRNG's are used. A couple of points to consider: One, the output of the PRNG (or any number series) does not describe the bit move-to locations; those are determined by sorting the PRN's then moving the bits according to the sequence of the original array positions of the PRN's prior to sorting. Since some of the PRN's are duplicates, the original array positions relative to each other will be determined by chance, i.e., the vagaries of the sort process, etc. Two, since the bits are moved rather than modified, and since groups of bits vary in size, an attempt to find particular bits that belong to specific bytes after multi-move shuffling, using any compound key or algorithm in a single decoding pass, will certainly prove futile. Q: Since the personal computer implementation of COAS uses 16-bit integers to initialize (set entry points into) the PRNG's, would ten encryption passes be somehow equivalent to the use of a 160-bit key in conventional programs? A: If the conventional program used a 160-bit key in a manner similar to COAS, it would still have to: 1) move bits, not change them. 2) use an indirect method for specifying move locations. 3) model the processes used in COAS quite closely, since there's no straightforward mathematical approach that can duplicate the conditions described in the previous question and answer. Q: What's the difference between the techniques used by COAS and the use of a One-Time Pad (OTP)? A: The theory behind the OTP assumes that (unlike the use of a Public/Private key) subsequent encryptions using the same OTP key would reveal the nature of the OTP, i.e., any newly-encoded files and messages would share certain common identifiable characteristics which could be exploited to facilitate the decryption of all files using that pad. COAS, on the other hand, doesn't alter any of a file's bits, and therefore does not "add" its PRNG entry points' characteristics to a file other than shuffling bits in accordance with the original physical positions of PRN's which have been sorted by size. Q: Is it possible for anyone to alter the contents of files encrypted by COAS so that a person performing the eventual decryption would not realize that the file(s) were indeed altered? A: Less likely than incidental or brute-force decryption. Each bit is moved once in each encryption pass, and if any bits were moved or changed, that many bytes (or nearly as many, since bits are not moved in byte-divisible groups, so most will end up in unrelated bytes after encryption) would be affected, and the resulting bytes would not likely pass even the simplest checksum test. Q: Is COAS a "weak" product (cryptographically speaking), either because of limitations in its own internal algorithms, or in the commercial library functions it calls? A: COAS can be used in ways that produce weak encryption, which is really an advantage in encouraging beginners to get started, given its simple user interface. Whether it can produce "strong" encryption or not is a matter of opinion, where said opinion is not so much a function of the product's alleged weaknesses, as it is the fact that cryptography grew up from a long history of hand-ciphering and the mathematics attending that growth, and the obvious resistance to new paradigms in this field. While mathematical proof of encryption strength is highly desirable in most applications (some would argue essential in certain applications), I see things this way: Computer software of any kind, which cannot be analyzed by common persons (average programmers), whose innards cannot be exposed to the masses for whatever reason, should not be used where it could effect control over the lives of those people. Looking at it a different way, it's wise for any individual or group to evaluate the software that's available, and make their own judgements independently of "expert opinion" in the field.

1 0

2nd edition Puzzle Palace?
by William I. MacGregor 17 Dec '03

17 Dec '03

Applied Cryptography references a 2nd edition of The Puzzle Palace by Bamford and Madsen, 1995, but I can't seem to find it in any of the bookstores in Austin. Has it been published? Thanks, - Bill ...... "Do, or do not. There is no try." - Yoda ..... William I. MacGregor Austin Product Center - Research phone (1-512) 331-3733 P.O. Box 200015 fax (1-512) 331-3760 Austin, TX 78720

3 3

RE: Montgolfiering, the Hot Air Balloon of Cryptography
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

My IQ is not 207 either, but at least I know satire when I see it. (Perhaps it says something that Mr. Wood is difficult to parody without some folks missing the joke!) Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ====================================================================== ---------- From: L. Patrick Elam, III[SMTP:patelam3@mindspring.com] Sent: Tuesday, October 29, 1996 9:32 PM To: cypherpunks(a)toad.com Subject: Re: Montgolfiering, the Hot Air Balloon of Cryptography To nobody(a)replay.com (Anonymous): I will use simple words so you can understand. My IQ is not 207 but I know BS when I see it. Too much bravado without substance. Too much hot air without mass. You claim that thermodynamics is about hot air. Anyone with a basic course in physics knows that thermodynamics is not just about hot air. Present the algorithm and it's proof if you want someone to listen or stop wasting everyones time with your rantings. Pat At 10:17 PM 10/29/96 +0100, nobody(a)replay.com (Anonymous), wrote: > >Fie on the small minds that cackle at my brilliance! As a Mensa member and >founder of the Society for Superintelligent Former NSA Employees, I chortle >at the baseness of callow criticisms by those doubters and dilletantous >denigrators of virtual one-time pads and PRNGs (perfect random number >generators). > >Montgolfiering. What is it, you ask? It is demonstrably a new paradigm in >the evolution of homo sapiens (Parry Messger excepted) toward Shannon's >dream of a one-time pad needing only a single, easily memorizable number as >a seed. [...remaining hilarity removed...] begin 600 WINMAIL.DAT M>)\^(C$/`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <` M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`06 `P`.````S <*`!X` M!P`@`"X``P!3`0$@@ ,`#@```,P'"@`>``<`( `N``,`4P$!"8 !`"$```!# M-C(a)R.#<W,T)#,S%$,#$Q.3,P03 P04$P,$$U1C8P1 ``!P$-@ 0``@````(` M`@`!!( !`#@```!213H@36]N=&=O;&9I97)I;F<L('1H92!(;W0@06ER($)A M;&QO;VX@;V8@0W)Y<'1O9W)A<&AY`-$3`0.0!@","0``&@````,`)@`````` M`P`V```````>`' ``0```#0```!-;VYT9V]L9FEE<FEN9RP@=&AE($AO="!! M:7(@0F%L;&]O;B!O9B!#<GEP=&]G<F%P:'D``@%Q``$````;`````;O&.@?X M<X=]!S&\$="3"@"J`*7V#0`/$.$!``,`+@```````P`&$-"9C[ #``<0P@4` M`!X`"! !````90```$U925%)4TY/5#(P-T5)5$A%4BQ"551!5$Q%05-424M. M3U=3051)4D572$5.25-%14E4*%!%4DA!4%-)5%-!65-33TU%5$A)3D=42$%4 M35)73T]$25-$249&24-53%143U!!4D\``````P`0$ `````#`!$0! ````(! M"1 !````7P8``%L&``"@"@``3%I&=3#@SRS_``H!#P(5`J0#Y 7K`H,`4!,# M5 (`8V@*P'-E=.XR!@`&PP*#,@/&!Q,"@P8S!$8"`'!R<3$@UPA5![("@S03 M#7T*@ C/Q0G9.Q?_,C4U`H *@8,-L0M@;F<Q,#,4(#<+"A+R# %C`$ %T'D@ MB$E1( 0`(&YO!4"!`= W(&5I=&@$D% L(&)U!4!A!4!LB&5A<P5 22!K'7"5 M!^!S'K!I& `@=QX@'P.@'T 1\" `'@`N("#L*% $D!' < 0@'@`?H5IY!"!S M`W 2`&@+@&<F(!X0'K%-<B#P5V\+!' =,F0&D&9I8W7B; 5 =&\@"K$$<!SP M7P/P'A (8"'!(D$(a)`A!L.FL$(&T$`2*4( !J;S!K92$I"H4*A51UZ&YN>0J% M/2D?*B\K/T4L3ST*A2!*80>"07<@\"A2)"!L(_$@`"$`?(,C4"^ 96(Z(&@" M0*!P.B\O=S!@+@N 0R\0& !N8V4N!:!M>"]^="AI'0`PMA41<AYP!; ?P0(@ M+T)01U"\($8BD020%- +@'0OT(DA`$-!': S($42(!)&-6!!0QV@1" PV37P M-S<M=C&30#)G,3+/+S$O43B?(0`S-C8P'="L1#DYP#5@,S8@,Q(@\C4U8#E# M**\\3SU?/F^/+.XG? KT+N Q.# "T>!I+3$T- WP#-!"8]D+63$V"J #8'0% MD 5 OBU$APJ'0SL,,$0&1@-A3R_00Q]$) R"($P@\%"S'K %$&-K-7 +8&T> M4 ))2E!;4TU44#HG"K!$,$H!,T F4&YDZG,TDF<Q,EU%+T8]!F#?-,)'CTB9 M*% 'D&0A\!Y0DD]$4&]B%7$R.1Y02#$Y.3G@.3HZP5!F34QO1CU4;TZO2'MC MM'EP'B%P*& F($ D@!QA9#$R4I]-?G5B:J=$052_2'M292_030(A?F<&\"00 M!G$;`!Y0)M)(Y1V!01_@($('0!>0,Y'T;V85$')6H"2 "< A</YH*)9 _3G0 M0P<6(@P!5!BW'6$&X"3P0!@`"U%Y. ,<*$$=<"B !&!U<RG>.B=\'T #\%Y M(&1@( !]`)!M"U @`06P2Z B(2#^>0A@5H #D2A@!($?$ !PWU> )WP<[QYR M'T5"!? @+G-4D"20;741L!Y@,U!V[U=P)) E)0J%<UG@: (Q$?]L&250'I%= M\24F`, $$"#Q?EEG0(a)MA.# BTQX2!&%Y[FXN`"0@(9%S"H4!H"5B[V]U(/%C M\&<P;B !'@$>H/\>8!\`)"!6@ AA9@$+@"2@_U]P=5$$(!]B!" BT@J%<=^] M'6-J9& >D7-K)WQ0& #_$? ",";#!T!<H 40'A X,/MH(2#!)P0@1 %>H0:0 M9R/^=P!P)81T@B2!+N ?$"!!\P6Q'Q!O< J%?? ?$"*2_&5V!)!T<G;Q!W%T MM&<Q_P7 ,U ","*1<*!Z77<W"H7F005 &R Z,1W04G"$\4HO49 O4?$K,!L@ M,&\>4&+/8]H>4'=$$F26/M^(YC0P( `SD2;2<P# 9<&_2W,BQ&=P2<!F<1ZQ M;1SP[VS 9;$',#$!(1-P!"!U$.Y-"? ?L"9 90;0%7%H(1^(Y@(09[->DB;2 M4V]CO0B0=!SP`A %P%G0<%SR[TL!+N T8'N!1@6P!X 5@4I3-3!%9E%O>0G@ M<_]*,5: )5 `(![(a)B.9QI'4B_PGP!Y $(%ZA9W!>00?@!0'O']"0$(J0!"!B M'/ E068!_VT06>!$,!'@?(,CX%Y $@#_?@%D48CF#; #`%\Q)("7<3U>H78? MX#&0!T"*$64M#X%C"K!FT7R24%).1_T$("B0T2\01%&"46T0.#!\;G6.`HCF MD7$$D)F#*?]H5HE77&PC02+B'4$>`!Y0\V<R'P!K/QT`H.,-L 1@]P" 29 ! MH&P<\'40=) 'X/\*L5=PD6 X, N B.8FTH# ?P;P'H S@EZA)5 $8!^A</$ MD 8Q(2 *P%[@C7$$$#1AW1W@>#$0!3 )@"DD<7WP_PL@!@`1P"AP`B!\$BG M& #_+@!>DG40FIJC00F (I("(/^C`R:"'N >4![Q`Q <$WA_7PA>J+A( "= M%*&A8 ]A'S]$%90@(()7@%@W'#E;+O^RP!@``, +@"*2(H +8'PQNQSPLO%O M@-!7@++ 70M&+Q0A8=H*A1<A`+;P`$ `.0!@\6Z9=\:[`0,`\3$! ```@%' M``$````Q````8SU54SMA/2 [<#U);F9E<F5N8V4[;#U,04Y$4E4M.38Q,#,P M,34S,C0V6BTW-S0W``````(!^3\!````2@````````#<IT#(P$(0&K2Y" `K M+^&"`0`````````O3SU)3D9%4D5.0T4O3U4]3D]6051/+T-./5)%0TE0245. M5%,O0TX]5%5.3ED````>`/@_`0```!4```!*86UE<R!!+B!4=6YN:6-L:69F M90`````"`?L_`0```$H`````````W*= R,!"$!JTN0@`*R_A@@$````````` M+T\]24Y&15)%3D-%+T]5/4Y/5D%43R]#3CU214-)4$E%3E13+T-./5153DY9 M````'@#Z/P$````5````2F%M97,@02X@5'5N;FEC;&EF9F4`````0 `',#![ M#>!VQKL!0 `(,#"IYYEWQKL!`P`--/T_```"`10T`0```! ```!4E*' *7\0 M&Z6'" `K*B47'@`]``$````%````4D4Z( `````+`"D```````L`(P`````` M`@%_``$```!0````/&,]55,E83U?)7 ]26YF97)E;F-E)6P]3$%.1%)5+3DV M,3 S,#$U,S(T-EHM-S<T-T!L86YD<G4N;F]V871O+FEN9F5R96YC93(N8V]M $/@!>WS$U ` end

1 0

GAS_sed
by John Young 17 Dec '03

17 Dec '03

10-30-96. NYR Page One: "Ex-CIA Analysts Assert Cover-Up. Contend Agency Knew of Risk From Chemicals in Gulf War." When they insisted on pursuing the inquiry over the protests of senior officials, their promising careers were effectively destroyed. Their inquiry attracted concern at the highest levels of the agencies, including DCI Deutch. Government officials who had overseen investigations of gulf war illnesses "are continuing to lie, are continuing to withhold information." The couple met when they were both studying at the agency's photo-analysis school. She was placed in a fellowship program that singles out fast-rising female employees and offers experience in other agencies of the Government. She found work on Capitol Hill in the offices of the Senate Banking Committee. She was assigned to interview the gulf veterans who were calling the committee. She took home one report. She handed it to her husband, with the announcement, "Hey, we got gassed." He decided to start his own unauthorized investigation on the issue, gathering information from within the C.I.A. He said he had prevailed upon friends working in other parts of the agency to search through computers banks. "We just plugged in key words dealing with chemical and munitions storage," he said, "and we just began to pull up all this cable traffic." ----- http://jya.com/gassed.txt (16 kb) GAS_sed

1 0

Good Netkeeping seal of approval????
by Robert Hettinga 17 Dec '03

17 Dec '03

Sheesh.! Cheers, Bob Hettinga --- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Rodney Thayer <rodney(a)sabletech.com> Mime-Version: 1.0 Precedence: Bulk Date: Wed, 30 Oct 1996 09:01:46 -0500 From: Rodney Thayer <rodney(a)sabletech.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: eTrust -- EFF+CommerceNet (from the ISOC newsletter) * ELECTRONIC-COMMERCE STANDARDS GROUP FORMED In a push to encourage online commerce, the Electronic Frontier Foundation and CommerceNet have teamed up to implement eTrust, a global initiative that would allow qualified merchants to bear the eTrust logo. The initiative has thus far formed a standards body made up of such companies as Coopers & Lybrand, the Firefly Network, and Test Drive. This body, dubbed the Commercial Guidelines and Auditing Standards Committee, has developed a series of guidelines for an accreditation program, which the group will take through a pilot phase towards the end of the year. A commercial offering and a pricing structure are expected in the first quarter of 1997. More information is available at http://www.etrust.org. (Cowles/SIMBA Media Daily 10/17/96). Rodney Thayer <rodney(a)sabletech.com> +1 617 332 7292 Sable Technology Corp, 246 Walnut St., Newton MA 02160 USA Fax: +1 617 332 7970 http://www.shore.net/~sable Communications Software Development --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Anti-Bayesian algorithms for Montgolfiering reputation capital
by abostick＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Reputation capital is becoming increasingly important in the online community. A key problem facing new entrants to cyberspace, as well as the people who deal with them, is how much capital these new entrants can be said to posess. A typical solution proposed might be described as "Bayesian", whereby new entrants to the community are assigned a quantity of reputation capital that reflects the expectation value of their future reputation capital. This is unsatisfactory, because, like all Bayesian statistical methods, it ultimately relies on the very fallible judgment of the entities who make such assignments (or that of the implementors of the automated agents which make such assignments). It is clear that an effective measure of the initial reputation capital of new entrants to the online community is greatly to be desired. It is felt by the author that anti-Bayesian methods, methods that make no *a priori* assumptions about the reputations of new entrants, show great promise as means for achieving this result. The pioneering work of Parry et al. in the use of test messages to inspire rapid responses from a community's new entrants. This method, which Parry and his colleagues name in their typically colloquial style as "trolling for newbies", is described in detail in a review article by Suter (1994). In this article the author proposes the use of Parry test messages and the responses generated thereby as a means of rapidly establishing initial reputation capital for an online community's new entrants. By evaluating new entrants' responses to the test messages, messages which can be carefully designed to virtually guarantee that a useful response will be elicited. These responses can be reviewed by individuals or tabulated and evaluated by software agents to estimate the new entrants' most likely reputation capital without resorting to arbitrary assignment of an initial value. Established members of a community may use existing filtering agents to eliminate Parry test messages and the responses thereto from their own datastreams; or they may elect to allow these messages through and review the Parry tests and resulting responses themselves. There are indications in the literature that other researchers are at work on this technology. For example, messages that resemble Parry test messages have appeared recently which contain coding very similar to work of May's (1993, 1994, 1995, 1996) that have generated responses that are ideally suited for reputation capital establishment from new community members. This fertile field for study holds significant promise, and the author welcomes further developments from any who chooses to work here. - -- Alan Bostick | "Dole is so unpopular, he couldn't sell beer on mailto:abostick@netcom.com | a troop ship." (Ohio Republican Senator William news:alt.grelb | Saxbe on Bob Dole's early career in the Senate) http://www.alumni.caltech.edu/~abostick http://www.theangle.com/ The first site with a brain. Yours. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMneUvuVevBgtmhnpAQEE4wL+PnPHAIjYv77ad3xDYUM/WMFMqGubduyH vs5veTK0BlqdFSChvponVpXGmP9fHXBnTVxlipj8To12DfFgFzYy1gqkQ0NgUrud UHygCOU503ZIx2u5FpifLY95VR0u5HqG =EU+x -----END PGP SIGNATURE-----

1 0

Internet Expert John Hardie on ISP-TV's "Real Time"
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: Internet Expert John Hardie Interview *** *** Monday, Nov. 4 *** *** 9:00 PM ET *** Internetworking expert John Hardie will be the guest on ISP-TV's "Real Time" interview series this week. Hardie has helped magnage the MAE East, one of the major Internet access points where Internet service providers peer and exchange traffic. He has also spent four years managing national Internet sales for MFS Communications, and helped the company to become a major pvider of Internet infrastructure. Hardie is currently Director of Sales for DIGEX's Private Networks Group. We will be asking Hardie questions about the history and growth of the Internet, what the MAE's and other NAPs do to exchange Internet traffic, and questions about the Internet business. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0

Re: ITAR / S 1726 / Civil Disobedience
by Alexander Chislenko 17 Dec '03

17 Dec '03

Cypherpunks wrote: > > 1) Software is writing, so it is protected by the first amendment, > so the ITAR is unconstitutional. The idea that only paper books > are first amendment protected, and electronic books are not, is just > plain wrong. > [ I don't usually CC: my messages to 'president(a)whitehouse.gov', but since it popped up there, I'll leave it. Feels funny though. ] Writing is expressing yourself in the external medium, in order to influence other people. So is any other non-coercive action/work. There has never been a fundamental functional difference between different forms of expression, but since low technology allowed only a few of such forms, and they stood apart from each other, it *looked* like there was a difference. Now the space of possible ways of expression is getting increasingly populated, which confuses the decent thinkers who are trying to fit the richness of the new world into the old conceptual frameworks. Most people are not "decent thinkers" though - and the issues debated are not semantic. "Books", electrons (that, BTW, play a much greater role in keeping paper together than in transmitting data over optic cables), and references to Constitution are just traditional incantations that people use to express their positions on who they want to have control over what. These issues are decided by social forces and available technologies. Distinctions in semantics and delivery methods between books and speech, electrons and photons, descriptions, imitations or snapshots of reality, feelings delivered through drugs or through art, etc. have little to do with the *effects* of these actions - and that's what everybody is fighting to control. Making sneaky semantic constructs (e.g., "electronic books") to make positions look more "legitimate" is a usual tactic on both sides, but everybody is just being hypocritical pretending that these things matter. This hypocrisy may work - a little - for both sides. However, I think that for serious practical purposes, people should engage in direct social action and implement necessary technologies that may change the battleground. Philosophically, there are lots of interesting things to discuss here as well - and I would be very happy to take part in the debates - but electrons, books, and Constitution have little relevance here. --------------------------------------------------------------------------- Alexander Chislenko <sasha1(a)netcom.com> www.lucifer.com/~sasha/home.html Firefly Network, Inc.: <alexc(a)firefly.net> www.ffly.com 617-234-5452 ---------------------------------------------------------------------------

1 0

Re: FDA_dis
by Gary Howland 17 Dec '03

17 Dec '03

Hallam-Baker wrote: > > Regulation is not necessarily anti-commerce. UK beef farmers would be > better > off today if there had been more regulation, a weak "free-market" > attitude > to public health has destroyed the entire industry. Really? Nothing to do with EC MPs preventing them from selling the stuff to willing buyers outside of the EC then? Do you really believe the government "knows better" than the farmers? Do you believe regulation is free? And how can you honestly call the UK agricultural industry a "free-market"? Gary -- "People who love the law and sausages should watch neither being made" - Otto Von Bismarck pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

Montgolfier was a JOKE
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

The Montgolfier post sent anonymously was a joke and I thought quite a good one. (It wasn't me and I don't know who it was.) It was poking fun at the QED pest at cyberstation who really was writing drivel. So far 2 people have missed the point and let us know about it. -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Financial Cryptography 1997 (FC97): General Announcement
by Robert Hettinga 17 Dec '03

17 Dec '03

Financial Cryptography 1997 (FC97): The world's first financial cryptography conference, workshop, and exhibition! General Announcement Conference, and Exhibition, February 24-28, 1997 Workshop for Senior Managers and IS Professionals February 17-21, 1997 The Inter-Island Hotel Anguilla, BWI The world's first peer-reviewed conference on financial cryptography, FC97, will be held Monday through Friday, February 24-28, 1997, from 8:30am until 12:30pm, at the Inter-Island Hotel on the Carribbean island of Anguilla. In conjunction with the conference, the Inter-Island Hotel will also be the site of an intensive 40-hour workshop for senior managers and IS professionals, during the week preceeding the conference (February 17-21), and an exhibition for financial cryptography vendors, from 10am-6pm during the week of conference itself. The goals of the combined conference, workshop, and exhibition are to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, and to showcase the newest products in the field. In addition, plenty of time has been left open in the afternoon and evening for sponsored corporate functions and activities, for business networking, and, of course, for recreational activities on Anguilla itself. As one of the principals of the conference joked, "We hope that people will treat the conference and the other activities more as a working vacation, rather than, er, vacating work." Conference participants are encouraged to bring their families. The Conference Ray Hirschfeld, the conference chair, has picked an outstanding group of professionals and researchers, in financial cryptography, and in related fields, to review the papers for this conference. They are: Chairman: Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA Some of the names may be recognizable to you. But, if they're not, included in that list are the inventor of Millicent, the head of EU's CAFE digital cash project, the holders of Citicorp's digital cash patent, two famous scholars in cryptography and digital commerce law, the Chair of Eurocrypt '96, and the Chairman of the Taskforce on the Security of Electronic Money for the Bank for International Settlements. If we'd gotten any more talent, we couldn't have had a conference, because the committee can't review the work of it's own members! The actual agenda of the conference will be determined by the papers the program committee selects, so we won't have a final schedule for the conference until the middle of January. However, the conference committee is selecting papers in what it considers the union, and not the intersection, of the fields of finance and cryptography. Examples of topics it will consider are: Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published on the web by the Journal for Internet Banking and Commerce. <http://www.arraydev.com/commerce/JIBC/>. For further information on submitting a paper to the FC97, and other details about the program of the conference, please see program committee's web-page at <http://www.cwi.nl/conferences/FC97>. On the lighter side, the conference will be covered by Wired Magazine, and will be the featured conference in it's January 1997, (ahem...) "Deductible Junkets" section. So, you might want to register, and make your plane and hotel reservations, before the rush begins... The price of a pass to the conference sessions and exhibits is $1,000 U.S. (Since we're on Anguilla, and there are no taxes of any kind, we thought we'd keep prices in nice round numbers, just to make things interesting. :-).) The price includes breakfast at the conference, some stipends for presenters who need them, and the logistics of having a professional conference with high-bandwidth internet connectivity in a location like Anguilla. In looking around, however, the conference organizers *did* notice that FC97 price is in keeping with other business and professional technology conferences of similar total session length, so everything seems to work out. The market *is* efficient, after all. You can register, and pay for, your conference ticket at: <http://www.offshore.com.ai/fc97/> The Exhibition Concurrent with the conference will be the the FC97 Exhibition, a small trade show for financial cryptography products and services. Each booth will have high bandwidth access to the internet (yes, there *are* T1s in Anguilla), and will get 2 conference passes. Booth prices start at $5,000 US. Please contact Julie Rackliffe at <mailto: rackliffe(a)tcm.org> for further information . As space is limited, please register as soon as possible if you plan to be there. The Workshop We are especially honored to have Ian Goldberg as the leader of the FC97 Workshop, which will run one week prior to the conference, February 17-21, 1997. Ian, the cryptographer at Berkeley who was made famous last year (in articles in both the Wall Street Journal and the New York Times) for breaking Netscape's transaction security protocols, will be running an intensive, 5-day workshop for senior managers and technology professionals. While the workshop is still being developed, and will depend on the skills of the planned participants, workshop topics will include, but not be limited to: The Internet (depending on the background of the participants) Overview and background of cryptography Survey of existing and proposed Internet payment systems Details on some specific payment systems Issues involved in setting up a secure Internet site And, depending on whether Ian finishes coding it (it looks likely), a step-by-step walkthrough of setting up an ecash-enabled Web server. Ian has recruited strong roster of instructors with credentials similar to his own, and, as he plans to maintain a 5-1 student/teacher ratio, the size of the workshop will be restricted and 2 months advance registration well be required. Further information about the workshop can be found at: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> The planned price for the workshop is $5,000. This covers lab space, hardware, network access, software, and, of course, 40 hours of instruction and structured lab activity. The lab itself will be open 24 hours a day, if demand warrants it. Sponsorship Opportunities FC97 offers many exciting sponsorship opportunities at all levels. Corporations are encouraged to to be an exclusive sponsor for lunch or dinner, each of which will be followed by a recreational activity of some kind. Sponsors will have the opportunity to permanently attach their name to these important networking functions, which the organizers hope will be a large part of the conference experience. There are 10 such events being planned, and 10 corporations will be accepted for sponsorship. Corporate sponsors of these events will also get a substantial initial discount on exhibit space, and complementary conference tickets. In-kind sponsorship is available at all levels of support, with opportunities for companies to provide networking, bandwidth, hardware, radio pocket modems and equipment, as well as design and print services, transportation, entertainment, catering, sunscreen and, well, if you've got it and you think we'll need it, let us know about it -- we probably do. Please contact Julie Rackliffe at <mailto: rackliffe(a)tcm.org> for further sponsorship information. Air Transportation and Hotels Air travel to Anguilla is typically done through either St. Thomas for US flights, or St. Maarten/Martin for flights from Europe. Several non-stop flights a day from various US and European locations can be made to either destination. Connection through to Anguilla can be made through American Eagle, or through LIAT. See your travel agent for details. American Eagle Airlines has agreed to increase their flights as needed to accomodate any extra traffic the conference brings to the island. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your own FBO for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave you won't pay taxes for leaving it there. Hotels range from spartan to luxurious, and more information about hotels on Anquilla can be obtained from your travel agent, or at <http://offshore.com.ai/>. Why Anguilla? We picked Anguilla for two reasons, both of them mildly political. The first is, of course, the US ITARs, which classify cryptography as a "munition" and restrict it's export. Thus, every effort will be made to highlight the absurdity of these regulations through the use of foriegn software, "leaked" software, and, of course, where necessary, US-exportable "crippleware", in the networking and server software of the conference and workshop. Of course, the conference content itself is not a violation of the ITARs, as the "munitions" being exported are in the heads of the attendees, or on paper, and thus not (typically!) subject to the US ITARs. Consider it a mild tweak on the nose of the Clinton Administration, in an era of 56-bit exportable keysize maxima. The other mildly political reason is that Anguilla is a tax haven. There are no taxes except import duties. None. No income, capital gains, sales, excise, or property taxes -- none. Anguilla's banking secrecy laws are about the finest there are anywhere. This is important to the organizers of the conference because most of the other proposed regulations of financial cryptography, particularly those of "token", or "note" based systems, are because they enable cash settlement, even perfectly anonymous cash settlement, of transactions of practically any size. Economic reality is not optional; if, in fact, the significantly reduced cost of these technologies make auditable "book-entry" transaction settlement obsolete, then there isn't much that the taxation or law-enforcement authorities of the world's nation-states can do about it. We consider countries like Anguilla an existance proof of the concept. Any attempt to restrict these technologies will only backfire on nations attempting to do so. Nation-states will simply have to develop taxation and law enforcement methods other than auditing book-entries. In fact, most central bankers and financial crime enforcement professionals who understand the technology also realize this, so, of course, our point is only *mildly* political, at this stage of the argument, anyway. Of course, the fact that Anguilla's average daytime temperature in February is in the low 80's farenheit, and that of, say, Boston, is in the low 20's, and the fact that cyclonic storms are in the *other* hemisphere that time of year, has *nothing*, we say, *nothing* to do with our decision to hold a conference there. We're simply shocked you would suggest such a thing. Neither, for that matter, does the fact that the average water visibility on Anguilla's coral reefs can be measured in hundreds of feet (if you can see that far for the blinding riot of color, that is...). Registration for FC97 Again, if you're interested in coming to FC97 see: <http://www.offshore.com.ai/fc97/> For information on presenting papers at FC97 see: <http://www.cwi.nl/conferences/FC97> If you're interested in Exhibit space, please contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in sponsoring FC97, also contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in the FC97 Workshop for Senior Managers and IS Professionals, see: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> See you in Anguilla! The FC97 Organizing Committee Vince Cate and Bob Hettinga, General Chairs Ray Hirschfeld, Conference Chair Ian Goldberg, Workshop Chair Julie Rackliffe, Conference, Exhibit, and Sponsorship Manager ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/ ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: ITAR / S 1726 / Civil Disobedience
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 08:03 AM 10/30/96 EST, you wrote: >Would it be appropriate for other users to forward this >message to the prez with their signatures? The message was sent from "cypherpunks(a)toad.com" and signed "Cypherpunks", which was highly inappropriate. (Wasn't a bad message, but cypherpunks is a bunch of individuals, it's not an anonymous collective...) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

2 1

mailing list
by captain_loogie＠juno.com 17 Dec '03

17 Dec '03

put me on your mailing list

1 0

Re: slander and call for lawyers. :)
by Michael Mattsson 17 Dec '03

17 Dec '03

Armenia never entered the war (whether they were sympathetic or not is another matter), Japan (although i believe never formally 'declared war') pushed USA's button i guess, something to do with an incident at Pearl Harbor <g>.Canada likewise decided to move Canadians of Japanese decent into 'holding' camps for reasons of national security... those were enlightened times....I'll end this before we slid further off topic, ----------Michael Mattsson - ProgrammerMomentis Systems michaelmattsson(a)momentis.com - http://www.momentis.com ----------> From: Dr.Dimitri Vulis KOTM <dlv(a)bwalk.dm.com>> To: cypherpunks(a)toad.com> Subject: Re: slander and call for lawyers. :)> Date: Wednesday, October 30, 1996 7:16 AM> > Note: I am not subscribed to this mailing list. I've been forcibly> unsubscribed and not permittecd to resubscribe.> > frantz(a)netcom.com (Bill Frantz) writes:> > I am quite willing to transfer my pledge of $50 (which was given in the> > hope that the event would attract Attila, not Dimitri) to Ray's legal> > defense fund.> >> > I want to be clear that this transfer is only valid for defense. If the> > fund will be used to legally attack Dimitri, I'd like my money back. That> > falls in the category of inviting the courts to rule on net-disputes,> > something I would like to discourage. (Attacking Dimitri seems also to> > fall into the category of bullshit suits, something else I would like to> > discourage.)> > You seem to be confused. No one suggested that I have any plans to sue> Ray Arachelian. Some of the lies he and Tim May posted to this mailing> list are probably actionable, but I don't believe in suing over something> said on the net.> > Ray Arachelian has repeatedly threatened to sue me over my posts to this> mailing list, and that's what his legal fund is for. It is by no means a> legal "defense" fund.> > A related question: when persons of Japanese descent (including 3rd generation> U.S. citizens) were rounded up during WW2 and confined to concentration camps,> where many died from deprivation and disease, why weren't persons of Armenian> descent similarly "interned"? Weren't they even more sympathetic to the Nazis> that persons of German descent?> > --->

2 1

[NOISE]Re: Sex, drugs, and libertarianism
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: SAlanEd(a)concentric.net, cypherpunks(a)toad.com Date: Thu Oct 31 06:51:05 1996 Steve Edwards writes: ... <snip> >I agree that the war on drugs is useless, and that prohibiting > prostitution is even more mindless. Still, the libertarian ideal seems > even > worse. Think about Thailand, where sex is bought and sold openly. The > AIDs > infection rate has gone from near zero to 2.5% in a couple of years, and > promises to devastate the whole country. Burmese kids are sold into sex > slavery. Is this the future? People make choices every day, but few > people make INFORMED choices, and a lot of people, believe it or not, > have > very little choice. They are caught between the Devil and the Deep Blue > Sea. 1. Prostitution is (nominally) illegal in Thailand. 2. So, what would you do? (I'd still make it legal.) The issue is more complex than many would make it out to be. Where prostitution is legal in this country (Nevada) the marketplace seems, without the help of Dr. Kessler and his minions, to have dictated the universal use of condoms, and the spread of all STDs is slower than in other areas, like here in Miami (where prostitution is (nominally) illegal. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "They never say: 'Please vote for me because I have an obsessive, all-consuming need, bordering on mental illness, to live in the White House and fly around in Air Force One and have a vast entourage of lackeys.'" -- Dave Barry, describes Bill, Bob, and Ross in the Miami Herald, September 22, 1996 Defeat the Duopoly! Vote Harry & Jo http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. jmr(a)shopmiami.com ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMniSrm1lp8bpvW01AQGGxAP/b72K+0PXT9xxE1E2KCgls5iXSvVvlnoa aqG3mJuVjPDbPLVCav5ajHjdO8IoNyk7B6LnoBRH0haTn+3yd0tHYI/yMRKwmaJR 4FjmoTKDOF45obWtynqalfHetkAfZtBzVfyM4iLHG5YHnGiEgKg8baiffr6AGxYp me6gehTq1p8= =296o -----END PGP SIGNATURE-----

1 0

update.293 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From physnews(a)aip.org Wed Oct 30 17:36:20 1996 Date: Wed, 30 Oct 96 13:58:39 EST From: physnews(a)aip.org (AIP listserver) Message-Id: <9610301858.AA27601(a)aip.org> To: physnews-mailing(a)aip.org Subject: update.293 PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 293 October 30, 1996 by Phillip F. Schewe and Ben Stein SIGNAL TRANSMISSION THROUGH A MAMMALIAN NERVE-CELL NETWORK can be enhanced with the help of electrical noise, a new experiment has shown. First proposed to explain the periodicity of ancient ice ages (in which the random "noise" of climate variations may have augmented the effects of predictable Earth-Sun distance variations from year to year) and first experimentally demonstrated in lasers (in which the direction of laser light traveling around a loop was switched from clockwise to counterclockwise by adding acoustical noise to the crystal from which the light emerged), the phenomenon of "stochastic resonance" (SR) describes how introducing a certain amount of noise into a system can actually enhance the transmission or detection of a weak signal so as to maximize the ratio of signal to noise. In the first demonstration of SR in mammalian tissue, researchers (Mark Spano, Naval Surface Warfare Center, 301-227-4466) apply a weak electric signal (containing both signal and noise) to a slice of rat hippocampus, a brain region essential for memory and other tasks. With the slice parallel to the plane in which nerve cells convert incoming signals into electrical nerve impulses, the researchers could transmit a weak signal to all nerve cells in the network. At an optimal noise intensity a maximum in the signal-to-noise ratio was reached--a hallmark of SR. This experiment offers the intriguing possibility that SR may potentially be exploited to aid transmission, detection and processing of signals in neuronal networks. (B.J. Gluckman et al., Physical Review Letters, 4 November 1996.) A QUANTUM COMPUTER COULD TOLERATE ERRORS while carrying out calculations, researchers at Los Alamos have now shown. Computers that operated according to the rules of quantum mechanics have the potential to perform powerful tasks (such as factoring huge numbers) because of their radically different approach to logic: unlike a conventional computer's bits, which exist either as a 0 or a 1, a quantum bit (or "qubit") could not only exist simultaneously as a 0 and a 1 but could interact with other qubits so that its properties became "entangled" with those of the other qubits. Yet some physicists argue quantum computers may be impossible to achieve on a practical level because the slightest amount of noise would destroy the entanglement and thus corrupt the state of the qubits. Up to now, proposed "quantum error correction" schemes have shown merely how to preserve the state of qubits. Now, Los Alamos researchers (Raymond Laflamme, 505-665-3394) have developed an algorithm for carrying out reliable calculations on a "qubyte" made of 7 entangled qubits while accounting for the possibility that one of the qubits is corrupt (upcoming paper in Phys Rev Lett). Experimentally, quantum computing is regarded as a long-term possibility: although quantum versions of logic gates have been constructed (see Update #250), researchers are still working to entangle more than two quantum systems at a time. A PHOTOELECTROCHROMIC (PEC) cell harnesses a photochromic layer, which changes color by absorbing light, with an electrochromic layer, which changes color under the influence of an electric field, to make a self-powered smart window. On a sunny day the one layer supplies the photovoltage needed by the other layer to darken the window, letting in less light and thus lowering air- conditioning costs. This photoelectrochromic process, developed by scientists at the National Renewable Energy Lab in Golden, Colorado, might also be useful in display applications. (C. Bechinger et al., Nature, 17 October 1996.)

1 0

silly putty
by sameer 17 Dec '03

17 Dec '03

Would anyone be interested in 50 pounds of silly putty? A friend of mine would be grateful if I could help him get rid of 50 pounds of silly putty. It would be $500. -- Sameer Parekh Voice: 510-986-8770 C2Net FAX: 510-986-8777 The Internet Privacy Provider http://www.c2.net/ sameer(a)c2.net

1 0

Risk Assesment Software?
by Ross Wright 17 Dec '03

17 Dec '03

Hi. I am about to do some marketing on a certain company's Risk Assessment Software. At this time I can't say who that firm is, but I need information on what other firms are offering this type of software. I figured someone on this list would know. Thanks, in advance. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

WWII & Japan
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > > > Armenia never entered the war (whether they were sympathetic or not is > > another matter), Japan (although i believe never formally 'declared war') > > pushed USA's button i guess, something to do with an incident at Pearl > > Harbor <g>. Japanese Ambassador Kichisaburo Nomura and Special Ambassador Saburo Kurusu were to present Secretary of State Cordell Hull a Declaration of War at 1pm Washington time on Dec. 7th. To achieve technical compliance with international rules it was intended to be delivered approx. 30 minutes prior to the actual attack. There were decoding difficulties however and it was delivered after the attack. Neither of the Ambassadors is thought to have had any knowledge of the actual attack and therefore did not understand the criticality of delivery. Japan intended to go to war with the United States, Great Britian, and Holland over their policies concerning the Japanese presence in China and Manchuria. (1) East Wind Rain: A pictorial history of the Pearl Harbor attack Stan Cohen ISBN 0-933126-15-8 (2> The Pacific War Atlas 1941 - 1945 David Smurthwaite ISBN 0-8160-3286-6 Jim Choate

1 0

Release of premail 0.45
by Raph Levien 17 Dec '03

17 Dec '03

This is to announce the release of premail 0.45, an e-mail privacy tool for Unix. The major new feature is support for the nym.alias.net style nymservers. Most of this code was contributed by the admin of nym.alias.net. Thanks! Other than that, it's a minor maintenance release. Several small bugs have been fixed. Thanks to all who wrote in with bug reports. For more information, see: http://www.c2.net/~raph/premail.html Raph Levien

1 0

Re: "Montgolfiering" mindlessness
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Gee, I put that post in the same place I carefully keep my back issues of the Cypherpunks Enquirer. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

2 1