December 2003 - cypherpunks-legacy

Re: National Emergency
by amp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sat Nov 16 06:48:39 1996 > I know that the WhiteHouse.gov site has Clinton's EO's (searchable, or, > with a little finagling, a list of them), but I want *all* of them. > > I'd love to see a site which has all these things. as would i. i'd appreciate it if anyone with access to same could post a url or mail me about it. amp === amp(a)pobox.com Earth First! We'll strip mine the other planets later! === -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMo24KVUbR1RWr40pAQHgLwf+PJBccxl5eKIyxoK1AWodP5WYPioIP1SN zqXo1eNL3CiK/e+UOYJRO4anLpdaZvo/1KJZAsaBZue/OsWqXFkLa67ziGygfZqG fPCCR5yOuSNS/dKFCW4pbEHWDjw4mw59wmws+xQy5uuZp6seLfduuzdaGLS+HIYn Ad3weBoafThhtZ47w9DR71ZWFOL2FVvBJNJDhcdN/7zyhBGdhkMics+1EdbI1Z83 Ypu3Uyj9iMk68CrcdRfRTBa0tZq4vSRmFaifzYWgiocIlrit6Bdm4GYueS5Y2Dor kSLpBo34bgWx1bgofx8qCwKZZka+DE3IGixaeJUspVLL4GYIZSsADQ== =B+cq -----END PGP SIGNATURE-----

2 1

Re: PGP3.0 & ElGamal
by Clay Olbon II 17 Dec '03

17 Dec '03

At 08:06 PM 11/14/96 -0800, you wrote: >> >> I'm still mildly curious as to why support for >128 bit keys is not >> available in any form I know of. > > What do you mean? 3DES ships with Stronghold, and will ship >with C2Net's other products as well. Yes, but I believe 3DES has an effective key length of only 112 bits. Of course, even this is more than sufficient for a long time to come. Clay > >-- >Sameer Parekh Voice: 510-986-8770 >President FAX: 510-986-8777 >C2Net >http://www.c2.net/ sameer(a)c2.net > > ******************************************************* Clay Olbon clay.olbon(a)dynetics.com engineer, programmer, statistitian, etc. Dynetics, Inc. **********************************************tanstaafl

2 1

San Jose Mercury News declares encryption battle over
by Peter D. Junger 17 Dec '03

17 Dec '03

Headline: Encryption battle ends peacefully Technology will block circuitry in exports without U.S. licensing Byline: BY RORY J. O'CONNOR Mercury News Washington Bureau Date: Published: Nov. 16, 1996 Opening: WASHINGTON -- Computer companies and the federal government appear to have peacefully resolved a fierce battle over the export of powerful coding software in computers. The computer makers plan to use new technology that would block the use of code circuitry in exported computers unless both buyer and seller obtain licenses in this country. The coding software is designed to help people prevent their electronic mail, files, credit-card numbers and the like from being read by hackers and thieves. URL: http://www.sjmercury.com/business/compute/encrypt1115.htm -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu URL: http://samsara.law.cwru.edu

1 0

Executive Order establishing national emergency
by Peter D. Junger 17 Dec '03

17 Dec '03

Since apparently people are having some difficult in finding Executive Order No. 12924, which continued the authority for the Export Control Regulations that are administered by the Commerce Department, I am posting a copy here. This is taken from the entry for 50 USC 1701 in the House of Representatives internet law library. ----------------------begin quoted text----------------------------- EX. ORD. NO. 12924. CONTINUATION OF EXPORT CONTROL REGULATIONS Ex. Ord. No. 12924, Aug. 19, 1994, 59 F.R. 43437, provided: By the authority vested in me as President by the Constitution and the laws of the United States of America, including but not limited to section 203 of the International Emergency Economic Powers Act (''Act'') (50 U.S.C. 1702), I, WILLIAM J. CLINTON, President of the United States of America, find that the unrestricted access of foreign parties to U.S. goods, technology, and technical data and the existence of certain boycott practices of foreign nations, in light of the expiration of the Export Administration Act of 1979, as amended (50 U.S.C. App. 2401 et seq.), constitute an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States and hereby declare a national emergency with respect to that threat. Accordingly, in order (a) to exercise the necessary vigilance over exports and activities affecting the national security of the United States; (b) to further significantly the foreign policy of the United States, including its policy with respect to cooperation by U.S. persons with certain foreign boycott activities, and to fulfill its international responsibilities; and (c) to protect the domestic economy from the excessive drain of scarce materials and reduce the serious economic impact of foreign demand, it is hereby ordered as follows: Section 1. To the extent permitted by law, the provisions of the Export Administration Act of 1979, as amended, and the provisions for administration of the Export Administration Act of 1979, as amended, shall be carried out under this order so as to continue in full force and effect and amend, as necessary, the export control system heretofore maintained by the Export Administration regulations issued under the Export Administration Act of 1979, as amended. The delegations of authority set forth in Executive Order No. 12002 of July 7, 1977 (50 App. U.S.C. 2403 note), as amended by Executive Order No. 12755 of March 12, 1991; Executive Order No. 12214 of May 2, 1980 (50 App. U.S.C. 2403 note); Executive Order No. 12735 of November 16, 1990 (50 U.S.C. 1701 note); and Executive Order No. 12851 of June 11, 1993 (22 U.S.C. 2797 note), shall be incorporated in this order and shall apply to the exercise of authorities under this order. Sec. 2. All rules and regulations issued or continued in effect by the Secretary of Commerce under the authority of the Export Administration Act of 1979, as amended (50 App. U.S.C. 2401 et seq.), including those published in Title 15, Subtitle B, Chapter VII, Subchapter C, of the Code of Federal Regulations, Parts 768 through 799, and all orders, regulations, licenses, and other forms of administrative action issued, taken, or continued in effect pursuant thereto, shall, until amended or revoked by the Secretary of Commerce, remain in full force and effect as if issued or taken pursuant to this order, except that the provisions of sections 203(b)(2) and 206 of the Act (50 U.S.C. 1702(b)(2) and 1705) shall control over any inconsistent provisions in the regulations. Nothing in this section shall affect the continued applicability of administrative sanctions provided for by the regulations described above. Sec. 3. Provisions for administration of section 38(e) of the Arms Export Control Act (22 U.S.C. 2778(e)) may be made and shall continue in full force and effect until amended or revoked under the authority of section 203 of the Act (50 U.S.C. 1702). To the extent permitted by law, this order also shall constitute authority for the issuance and continuation in full force and effect of all rules and regulations by the President or his delegate, and all orders, licenses, and other forms of administrative actions issued, taken, or continued in effect pursuant thereto, relating to the administration of section 38(e). Sec. 4. Executive Order No. 12923 of June 30, 1994, is revoked, and that declaration of emergency is rescinded. The revocation of Executive Order No. 12923 shall not affect any violation of any rules, regulations, orders, licenses, and other forms of administrative action under that order that occurred during the period the order was in effect. Sec. 5. This order shall be effective as of midnight between August 20, 1994, and August 21, 1994, and shall remain in effect until terminated. William J. Clinton. ----------------------end quoted text------------------------------- -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu URL: http://samsara.law.cwru.edu

1 0

Re: Remailer Pricing
by Hal Finney 17 Dec '03

17 Dec '03

From: ph(a)netcom.com (Peter Hendrickson) > Right now the remailer network is a mess. There just aren't that many > remailers operating in a timely and reliable manner. I am not knocking > the remailer operators for this, it's just clear that "free" doesn't > make it worth their while to keep the remailers operating perfectly > at all times. I agree with this very much. For a long time we have had two contradictory notions floating around: nobody will pay for remailing services because free ones are available, and the remailer network can't be reliable because the operators don't have the resources to make them work better. Clearly if people understand that the choice is between free remailers that don't work well and for-pay ones which do, things look a little different. Peter's idea of having the remailers keep accounts for people receiving anonymous mail, possibly even sending them a monthly check, would completely change the spam equation. > Furthermore, many remailers don't use 2048-bit keys. Why not? Because > they don't want to spend money on the cycles. That's okay with me - > it's charity. But, if I pay a dollar for a remailer, I can expect > to be able to use a very strong key. Actually when I ran a remailer I had a small key because it was on a system which I did not control. The small key was meant as a signal to potential users that my system wasn't all that secure. The big problem that I always saw with the for-pay remailing model was the fear of greater liability when abusive mail goes through the remailer. I felt that operating a service for free would make it easier for me to argue that I was offering a public service, while running it for pay would mean that I would be profiting from the abuse. I don't know if this is really a valid argument, though. Hal

1 0

Output of your job "cypherpunks"
by L-Soft list server at CCI (1.8b) 17 Dec '03

17 Dec '03

> ok Confirming: > SIGNOFF NEWSLETTER You have been removed from the NEWSLETTER list. Summary of resource utilization ------------------------------- CPU time: 0.200 sec Device I/O: 0 Overhead CPU: 0.000 sec Paging I/O: 0 CPU model: Pentium 90/100 (30M)

2 1

Re: Gilmore Sucks! and so does the EFF !!/Censorship on cypherpunks?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Stephen Boursy <boursy(a)earthlink.net> writes: > aga wrote: > > > > On Wed, 13 Nov 1996, Dr.Dimitri Vulis KOTM wrote: > > > > > > Cypher-Censored > > > By Declan McCullagh (declan(a)well.com) > > > > The EFF is just a sham, and Gilmore is just another censor. > > Gilmore can now be known as the "plug-pulling punk." Very apt. > The EFF is owned and operated, heart, body and soul, by the > corporate interests of the net. They don't give a damn about > individual user rights at all--they are to my mind the opposition. That would be fine if they didn't pretend to be what they're not. They're welcome to support or oppose free speech for anyone they please, but they lie and pretend to support free speech not only for their corporate clients. Clearly, John Gilmore has no credibility. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: THAT is what makes John Gilmore an ASSHOLE!
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

aga <aga(a)dhp.com> writes: > > > > If you send mail to "cypherpunks(a)toad.com", either directly, OR > > in a "Cc:" which is a 'carbon copy', it will goto the the cypherpunks > > mailing list WETHER YOU ARE SUBSCRIBED OR NOT. It still goes. > > > > Well, that is really a fuck-up by John Gilmore, is it not? > Just when is the asshole going to learn how to run a mailing list? Never, but he might get some Cygnus support employee to do it for him. :-) John has the right to configure his private mailing list to reject submissions from non-subscribers or even sepecific people - but not the balls. > > In any case trying to reason with you is like trying to talk > > to a tree stump. It's giving me a headache. So I'm not going > > to accept any mail from you any more. Anything you send that > > get's to me via the cypherpunks mailing list, or via direct > > mail from yourself will be returned unread, to you. I'm not > > under any obligation to accept any traffic from you, so I won't. > > Good, just tell Gilmore what an asshole he is for letting > mail go to his mailing list that is not intended to go there. > And stop sending me your stupid e-mail. Send this shit to > usenet like Mr. Boursy told you to do. Again John Gilmore/EFF demonstrate their true agenda: they can filter out the e-mail they don't like, but they want to prevent others from reading it as well. Clearly their concern for free speech extends only to their corporate sponsors, such as net.pronography peddlers. > > You may have a right to a voice, but I have a right not to listen > > I'm not going to infringe on your right to rant, but damned if > > I have to listen to a single packet of it. The saw cuts both ways. > > time for the alt.asshole.john-gilmore newsgroup An excellent idea, Dr. Grubor! Shall we newgroup alt.flame.john-gilmore or alt.bonehead.john-gilmore or both? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

MSIE 128 Bit
by Steve Shelby 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sat Nov 16 11:56:26 1996 "WorkHorse's interface is pretty ugly and the rendition is buggy, but the SSL connection does work: I got through mbanx's "Sign in" link at http://www.mbanx.com/banxing/5welcome.html , whereas MSIE and NS3 were kicked out due to their 40-bit RC4 limit." - ---- Microsoft has a 128 bit version of their Explorer available. You have to jump through a few hoops, but they have it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMo3yP0F1dOf86f8dAQHs1QQAwYuTk5Lqvb2vBgvOVef1ToFIUtG5JN70 dBmD8JM23N0ZROsF03+wFGUT71pMAuu3BjuJQBOm0r9idPBwdcq6CaVf8QoU5+/Q tbj6b9PFx9EbpE4bZqoGPf3ePRFg6ImMSdyKDeM5vIMKJO8BwQZugqP2CgblkzlG yvEgPyiUlek= =ZlSn -----END PGP SIGNATURE-----

2 1

Re: Does John Gilmore...
by Rich Burroughs 17 Dec '03

17 Dec '03

At 08:37 AM 11/16/96 -0800, Sandy Sandfort <sandfort(a)crl.com> wrote: [snip] >I have a suggestion for "Aga" and others who believe this sort of >nonsense. Please do us all a favor and try to sue John. I'm sure >that among all jack-leg and wannabe lawyers on this list that they >can come up with a viable cause of action. And John has deep >pockets; you could (literally) make out like bandits AND rescue >"freedom of speech" on privately maintained mailing lists. Such a case would obviously fail. John has the right to ban anyone he wants from a list that he is hosting. I do question, though, whether or not it was the best way to handle the situation. As I have argued, the availability of end-user filtering made banning Dimitri from the list unnecessary, IMHO. And the list owner giving people the boot sure doesn't fit with the picture I have had of what cypherpunks was about. YMMV. I think that John is doing a lot of great things for crypto (his participation in the Bernstein case, S/WAN, etc.) and I agree with at least 90% of the things I see him doing. I think he made the wrong call with Dimitri, though. >You >could be heroes (or look ten times as foolish as you already do). Actually, if John was trying to cut down on the noise by banning the Kook, I think it's backfired. It seems like there is even more irrational chatter now... Rich -- Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb/

3 2

HP does it
by mael＠umcc.umcc.umich.edu 17 Dec '03

17 Dec '03

http://www.cnn.com/TECH/9611/15/encryption.reut/index.html Hewlett-Packard to unveil encryption 'breakthrough' encryption links November 15, 1996 Web posted at: 9:00 p.m. EST PALO ALTO, California (Reuter) -- Hewlett-Packard Co. said Friday that it will unveil technology Monday that will provide a breakthrough in the long-deadlocked debate over use of software encoding for secure data traffic. If the encryption technology has won the backing of industry and the U.S. and other governments -- which Hewlett-Packard officials say is the case -- the development could eliminate a key obstacle to the growth of electronic commerce via the Internet. Hewlett-Packard Chairman Lewis Platt will provide details on the technology, which includes technology patented by the Palo Alto computer giant as well as other technologies, a company spokesman said. Technology from RSA Data Corp. the de facto standard-setter for Internet security, will be involved Hewlett-Packard officials said. Senior Microsoft Corp. and Intel Corp. executives were also scheduled to attend Monday's news briefing at the National Press Club in Washington, Hewlett-Packard officials said. The technology will make it possible to export products containing so-called "strong encryption," which have not been exportable under national security laws dating back to the Cold War. Under national security law, the U.S. government has allowed the export of software and other computer products containing only "weaker" data encryption technologies. Encryption has been classified as a munition because of its potential for use by terrorists, spies or other criminals to conceal messages. Encryption programs use mathematical formulae to scramble confidential information, such as electronic mail messages or credit card numbers, rendering them unreadable to computer users without a password or "software key" that can decode the coded material. For years the domestic computer industry has complained that such government restrictions have hampered its competitiveness in world markets, and that its customers did not necessarily want the government to be able to decode internal data. The industry says the laws have prevented it from offering some of the most recent Internet technologies, even within the United States, because it is impossible to prevent computer users outside U.S. borders from gaining access to technologies publicly available on the Internet. Companies and their customers want to use encryption to protect confidential communications and electronic commerce. Silicon Valley executives recently noted that consumer devices, such as WebTV Network's Web-browsing television device that hit store shelves this autumn, use the same levels of strong encryption as used in military systems. WebTV said it is using keys composed of 128 bits, or characters, of data to encode and decode its communications to its set-top boxes providing consumers with the best level of security available over the Internet. The government recently proposed that the constraint be eliminated by providing a key recovery system, in which authorities could recover keys to crack messages if they received a court warrant to do so. Industry has rebuffed this as difficult to manage. The solution being offered by Hewlett-Packard would be flexible, allowing customers to use the levels of encryption required by different governments, the company said. "This is going to allow very strong encryption," said a spokeswoman. Hewlett-Packard said its technology would provide a means of "solving the data security and integrity issues that have impaired and frightened users and companies from exploiting the full power of the Internet." Copyright 1996 Reuters Limited. All rights reserved.

1 0

[NOISE] aga isn't on cypherpunks... (and I'm glad)
by Tim Scanlon 17 Dec '03

17 Dec '03

all, "aga(a)dhp.com", that 'aga' guy, is NOT subscribed to cypherpunks. What has and is going on is that he was blindly Cc'ing cypherpunks on everything he wrote that had to do with this... I exchanged some mail with the guy, he didn't understand AT ALL that "cypherpunks(a)toad.com" was a mailing list address. He seemed to think that he had to be "subscribed" to the list in order for any traffic to goto it. When I pointed out to him that this was not the case, his attitude was that it was not his fault and that the list was "broken" etc. If you havn't figured it out, BELIVE ME, talking to this guy is a definative waste of packets. He's ranting with basicly no clue about how he's doing the ranting... And this stuff has now been cross-posted to about 6 newsgroups by him, in addtion to the 3 mailing lists he's been sending it to. I ended up asking him why he wasn't jsut cutting to the chase and posting "Make Money Fast" stuff instead. (he didn't seem to get it.) I'd suggest ignoring him & hoping he goes away. As it is it was a MAJOR mistake of mine to even attempt to interject sanity into the whole stupid thread on this... Why? Because there's better things to worry about in life. Like this H/P crypto announcment... Or anything crypto related for that matter. As it is the thread continues like some bad crack-addled version of the energizer bunny. Tim PS, I just realized my dog does better at staying focused on doing tricks that this list does on staying focused on crypto... That's a bit scary.

3 2

Re: THAT is what makes John Gilmore an ASSHOLE!
by Dr. Jai Maharaj 17 Dec '03

17 Dec '03

>> time for the alt.asshole.john-gilmore newsgroup > An excellent idea, Dr. Grubor! Shall we newgroup > alt.flame.john-gilmore or alt.bonehead.john-gilmore > or both? In that case, can Gilmore's inclusion in the NetScum site at http://www.mindspring.com/~netscum be far behind? Jai Maharaj %:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:% Om Shanti %:%:%

1 0

More Euro Key Escrow
by Ben Laurie 17 Dec '03

17 Dec '03

I've looked more closely at the "Royal Holloway" protocol, supposedly under consideration by the EC for key escrow in Europe, though I must say that anyone who deploys it will get what they deserve. I have discovered some further weaknesses in the protocol, documented at: http://www.algroup.co.uk/crypto/rh.html Comments are welcome. Cheers, Ben. -- Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk Freelance Consultant and Fax: +44 (181) 994 6472 Technical Director URL: http://www.algroup.co.uk/Apache-SSL A.L. Digital Ltd, Apache Group member (http://www.apache.org) London, England. Apache-SSL author

2 1

Don't Feed the Animals!
by Timothy C. May 17 Dec '03

17 Dec '03

Fact is, I now have more people in my Eudora filter file that at any time in the four years this list has existed. Also a fact, there are more people on this list that at any time in history (despite what some of the New Wave journalists are writing about "the death of the Cypherpunks list"). Fact is, the attention being given to Vulis, Aga, Stathis, Boursy, and other list disruptors (or clueless cross-posters) is _exactly_ what they thrive on: controversy. Being the center of so much attention strokes their egos. I suspect John Gilmore made a tactical error in kicking Vulis off the list, as there are so _many_ workarounds. Vulis is clearly posting more messages, of even greater vitriol, than ever before. Dozens of messages just so far today. And his supporters and detractors are chiming in with equally juvenile taunts. This "aga" personna, for example, seems dead-set on doing whatever he can to get himself added to the "Unwelcome on Cypherpunks" list. A predictable effect, I'm afraid. Not that I question John's right to do as he pleases with his machines. This list is, after all, operated at his expense on his hardware. [A minor note, though. I disagree with the abstract notion that John "created" the list, and now "owns" the list. Eric Hughes, Hugh Daniel, and I proposed a mailing list after the first Cypherpunks meeting, and Hugh set it up. John volunteered his machine, toad, as he has volunteered it for so many other projects in the past. While John is in an important sense free to discontinue his hosting of the list, it is also true that traditional notions of "ownership" are not the full story. For example, if the San Francisco Marriot Hotel plays host to the CFP Conference, in any sense is it proper to say they "own" the conference? If a church volunteers space for a club meeting, do they "own" the club? However, in both cases the host may kick out an especially uncouth or disruptive attendee, modulo specific contract language agreed to by the parties, and this is, I think, all John has claimed to be doing with Vulis. Perhaps a mistake, but certainly within reason. I think John has taken a hands-off attitude toward the list, and has never imposed restrictions on topic, membership, etc. This one case involving Vulis was well-described by John: he asked Vulis to stop sending 50K byte rants about the Armenians and Turks to the list--consider that 50KB x 1500 destinations = 75 MB of outgoing traffic, modulo corrections for aliases, compression, etc. Vulis responded with more insults, basically saying "Make me!!!!" Gilmore said, "OK."] And the issue is not just killfiles and filters. It's a matter of not giving the juvenile disruptors the results they crave. Yes, this message is itself likely to trigger at least a couple of "More lies from Timmy [fart] May" spews from Vulis, and a couple of incoherent rants from newcomers Stathis and Aga. I've been saying little on this issue, compared to dozens of Vulis rants every day (ironic that he calls _me_ the main ranter!), but it's time to remind folks of a basic Net maxim: DON'T FEED THE ANIMALS. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 5

Re: Members of Parliament Problem
by Hal Finney 17 Dec '03

17 Dec '03

From: paul(a)fatmans.demon.co.uk > You could also have an arbitrated blind signature protocol whereby > trent shares a keypair with all users. bob encrypts his comment, M > with the key he shares with trent. On recieving it trent carries out > a blind signature on it and publishes it, as trent knows only bob has > the shared key, K he knows bob said M but as it is a blind sigature > and he is likely to be signing a lot of messages (trent is of course > a computer program) he doesn`t know which message came from bob. I don't quite follow how this would work. If Trent issues a blind signature, then that means (doesn't it?) that he doesn't see what he is signing. So how can he confirm that the message is actually from a member of the group when he doesn't see it? > Also Chaums group signatures could be used but unfortunately the > arbitrator can find out who said what, but does not normally know. > Also trent can forge digital signatures with this protocol. > Chaum further mentions protocols for this sort of thing that do not > even need an arbitrator but I don`t have the papers on this. Not all of Chaum's proposals in the original paper from Eurocrypt 91 have this property. Here is what he has, somewhat simplified. Z is the trusted party for those protocols which use one. 1) Each group member makes up a key which he will use for one signature. Z signs each key to certify that it is a member of the group. People don't re-use keys so that messages are unlinkable. Z can tell who sent which message since he knows the keys. 2) Z publishes an RSA modulus N, gives each group member a secret exponent si, and publishes v = the product of all the si. Members sign message m by producing m**si mod N. Then to confirm the signature they engage in a zero knowledge protocol to prove that the signature is of the proper form and that si divides v (without revealing si). Chaum gives a protocol for this. 3) Z again publishes an RSA modulus N, and each group member chooses his own RSA modulus Ni = pi * qi. To sign message m he produces m**pi mod N. He then proves in zero knowledge that the signature is of the proper form and that pi divides the product of all the Ni (without revealing pi). This is the same zero knowledge protocol as in (2) above. 4) Members agree on a large public prime p with generator g. Each member chooses a secret exponent si with public key ki = g**si mod p. (This is a standard discrete log cryptosystem setup.) To sign message m he produces m**si mod p. He must then prove in zero knowledge that the signature is of the proper form and that si is the private exponent corresponding to the public key of some group member, without revealing exactly which group member it is for. The protocol for this is not very efficient. It uses a cut and choose concept and has to be iterated multiple times. In methods 1, 2, and 3, Z can tell who made a signature. In method 2, Z can forge signatures for other members. Method 4 doesn't use a trusted party. Method number 4 is very similar to Chaum's original proposal for undeniable signatures, although the zero knowledge proof is very different since he doesn't want to reveal which particular key his exponent corresponds to. In the Eurocrypt 94 paper by Chen and Pederson they show a very nice protocol for proving that you know the exponent corresponding to one of a set of Diffie Hellman public keys. This is similar to the problem in (4) above. Given k1=g**s1, k2=g**s2, ..., you can prove that you know one of the si without revealing which one. The protocol is pretty simple and just requires one challenge and response, although the amount of data sent is proportional to the number of ki in the set. This could be used to prove group membership anonymously. If there were a list published of public keys of people on the cypherpunks list, you could prove you were on that list without revealing your identity. I think it could be made a signature protocol by having the challenge c depend on a hash of the message. But the authors don't do it that way, they do a more complicated protocol because they are seeking to achieve unconditional rather than cryptographic anonymity. Hal

2 1

Re: Remailer Abuse Solutions
by Hal Finney 17 Dec '03

17 Dec '03

From: Bryan Reece <reece(a)taz.nceye.net> > But what about Okamoto and Ohta's digital cash scheme published in > Crypto '91? It appears to be fully untraceable and transferable. Of > course, I haven't heard of anyone trying to use this scheme (has it > been broken?) This digital cash scheme has a big disadvantage which the authors try to play down. The problem is that all spending by a particular user is linkable. It can't be connected to his True Name but all of it is linked, in effect, to his nym. This is bad because it allows profiling and dossiers to be built up about nyms with interesting spending patterns, which could then be used to identify which ones should be candidates for intensive efforts to discover their identity. Most other digital cash schemes don't allow linkability of the payor's activities, which is a much better approach. Hal

1 0

Re: San Jose Mercury News declares encryption battle over
by Hal Finney 17 Dec '03

17 Dec '03

>From the article <URL:http://www.sjmercury.com/business/compute/encrypt1115.htm>: > Under the plan computer makers could equip their machines, including > personal computers, with electronic ''locks'' of almost any strength. A > single computer model with strong built-in encryption could legally be > sold in both domestic and foreign markets. > > The key is that the encryption circuitry would be inactive in exported > machines, unless both buyer and seller obtained all legally required > licenses to turn it on. > > Domestic customers, and export buyers with a license, would get a special > key card to turn on the encryption, according to HP. Manufacturers would > thus be relieved of the burden of making different computers for export > than for domestic use. So it sounds like the idea is to build crypto around card tokens. I think HP has been pushing this for some time. The question is, will this somehow become the only way to get access to crypto? Unlike the earlier IBM/CIA announcement, this time Netscape and Microsoft have apparently been brought on board. That is a lot worse because these companies are where most people are going to get their crypto in the future. If they have open standards, we can make good crypto available. But if this announcement signals some kind of closing of the system so that only hardware tokens will be used, it could become a lot harder to make strong crypto available. There are also the economic questions about how much these key cards are going to cost, and whether they are going to be routinely supplied with computers or an extra cost item that consumers have to go out and buy. If the latter, a lot of people won't bother, and we'll just have that much larger a barrier to widespread use of crypto. It is certainly very disturbing to see these new moves. Obviously a great deal of behind the scenes negotiations and pressure has been occuring. You have to wonder why Netscape, for example, would forego the opportunity to differentiate themselves from rival Microsoft by positioning their product as the one which refuses to bow to government pressure on crypto. It's also not clear what the hardware manufacturers get out of this. Their sales overseas have never been blocked. There has been no demand for custom crypto hardware. I don't see how they have been harmed by an inability to ship computers with built-in encryption hardware. Granted there are some possible applications for such systems but I don't see the market demand which would drive this decision. Hal

7 7

PGP acquires PrivNet
by Hal Finney 17 Dec '03

17 Dec '03

The company I work for, PGP, Inc., announced yesterday that it had bought PrivNet, makers of Internet Fast Forward cookie-blocking software. More info is on the PGP web site at http://www.pgp.com/. Personally I have a passionate and irrational hatred of cookies so I am very glad to see this move! I can accept them if I'm browsing through an online store and they're being used to keep track of what I've bought, but so many sites these days are just snoopy as far as I can tell. Down with cookies! Hal

1 0

Re: Giving Kill Files a Workout...
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:48 AM 11/16/96 -0800, Dale Thorn wrote: >Alan Olsen wrote: >> What a week! What is this? "Net Loon pig-pile on Cypherpunks day?" >> So far i have killfiled three people in the past two days. (That is the >> total number I filtered to trash before that date.) >> For those of you who are sick of wading through this mess, I am willing to >> show you what it will take to filter those of your choice to /dev/null or >> its local equivelent. (procmail can be your friend!) > >Thank you in advance for your filtering instructions (yawn). > >BTW, why would anyone give a shit whether you killfiled anyone or not? The point is not who or what I care to killfile. The idea is that it can be done by most people without a whole lot of hastle. There are a number of people who do not have experience in setting up procmail. I am offering to help them out in the hope that it will strain out some of the resultant noise from these "Freedom Knight" loons. (Or at least keep a number of people from dropping the list from the bogosity.) I suspect I am in a number of killfiles already... --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Validating SSNs
by Duncan Frissell 17 Dec '03

17 Dec '03

>Timothy C. May wrote: >> >> Indeed, I protected my privacy decades ago by discarding my issued SSN >> and substituting a different one. This "phony SSN" is what I use on my >> tax returns, my credit cards, and for my employers. >> >> Ha! None of them know that this is not my True Social Security Number! >> >> By this I protect my privacy. "The Iliad" and "The Odyssey" were not written by Homer but by another Greek of the same name. Old joke. Might I suggest though that you use varying SS numbers and varying names, addresses, and Dates of Birth so that you deny The Great Enemy a Key_field in the database of life. DCF

1 0

Re: Mirror of new export control regulations
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:10 PM 11/15/96 -0500, Alan Davidson wrote: > http://www.cdt.org/crypto/clipper311 > I'm holding out for Clipper '95 myself. DCF

1 0

RE: ideal secure personal computer system
by John Fricker 17 Dec '03

17 Dec '03

>Igor Chudov @ home (ichudov(a)algebra.com) said something about Re: ideal secure personal computer system on or about 11/16/96 7:41 AM > >Bill Frantz wrote: >> Protection against strangers walking up to your machine and using it is >> nice, and easy to do. Protection against viruses which install Trojan >> horses in your system would also be nice, but is very hard to do in systems >> where programs run with all the privileges of their users. Examples >> include (in alpha order): DOS, MacOS, Unix, and Windows (including NT). > >I wonder what are the operating systems where programs may be run with >_less_ privileges than the user who starts them? Is VMS one of such >systems? > >thanks > > - Igor. >End of message In WinNT a program may impersonate a user such as Guest. Also, trojan horses are ineffective in NT as typical users do not have write permission to system binaries. --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

1 0

Re: Why I shall never undescribe
by Sean Roach 17 Dec '03

17 Dec '03

At 08:50 AM 11/15/96 -0500, Alec wrote: >>From: Bovine Remailer <haystack(a)cow.net> >>To: cypherpunks(a)toad.com >> >>Foulmouthed Timothy May rehashes his lies like a rabid parrot >>choking on a stale mantra stuck in its poisonous beak. > >Where else today can one find such prose? Nay poetry! > >And they say poetry is dead! I thought they said that chivilry was dead.

2 1

Re: Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:38 PM 11/15/1996, Adam Back wrote: >Peter Hendrickson <ph(a)netcom.com> writes: >> However, if you restrict postings to an approved group of people, perhaps >> everybody on the mailing list, you can eliminate spam. How, then, do we >> allow anonymous postings to come through? Individual people on the list >> can receive the proposed post and forward it to the list if it is >> appropriate. They could even charge a fee for doing it. That's easy to >> do if there is a "paying" remailer which will handle the money for them. > Not necessarily a good idea. The post may be a hot potatoe, and the > forwarder may find themselves in legal trouble. (Say RC4 & RC2 source > code, NSA handbook, the results of the Mykotronic's dumpster diving > spree, etc). Exercising `editorial control' has landed some ISPs in > trouble, to the extent that some are specifically avoiding it for that > legal reason alone. Being _paid_ for forwarding the message may make > that even worse. Yes, this is the part of my proposal with which I felt least comfortable. Actually, not to flog a dead horse or anything, this is a perfect application for semi-anonymous authentication. Anybody on the list could forward the mail, but nobody need know exactly who sent it. > Howabout someone liberates skipjack and forwards it to you via > remailers with $50 for your trouble. Do you bite? I thought not, NSA > interviews, ITAR violation, etc. Well, there are ways to do this. For instance, you can send it to a bunch of other people anonymously at, say, a dollar each. It will get around quickly, albeit at greater inconvenience and a higher cost. But, for something this important that would be acceptable. > Ecash for email works better to stop spam sent directly to email > addresses where you don't cash the money as a curtesy, and your > software junks if it doesn't have valid ecash. Email spam itself is > getting mildly annoying lately, I get a couple a day average at the > moment. Except most people don't have e-cash accounts, software that handles e-cash, or the interest in keeping a site which is secure enough to handle e-cash. This is the feature of having the remailer operator deal with it. The technology can be introduced to the existing system with minimal hassle and cost. All you need is one remailer operator to do it. Incidentally, a similar idea can be used to handle flooding attacks on remailers. A bad person could take down a remailer by directing many encrypted packets to it that did not contain any payment. This is hard to solve, of course, because the mail all comes from other remailers. The solution is for the remailer itself to not accept mail from other machines that do not pay. The other remailers in the network make a payment themselves (out of money they already received) to make it worthwhile for the remailer to look inside the message and see if there is even more business. Does anybody know if military communications systems ever take this approach? I know that a highly redundant network is used when any part of it can be taken out. What is awkward about this is that everybody wants to send messages at the very same time the bandwidth is attenuated; i.e., during battle. I'm guessing that in practice everybody in the network - all of whom are basically trusted and identifiable - is ordered to send only urgent traffic. But, it would be neat if there was a way to budget bandwidth for every unit, just like we do for ammunition. Peter

1 0

Re: [REBUTTAL] Censorship on cypherpunks?, from The Netly News
by Sean Roach 17 Dec '03

17 Dec '03

At 08:29 PM 11/15/96 -0800, Timothy C. May wrote: >At 4:46 PM -0800 11/14/96, I wrote: >>>On Wed, 13 Nov 1996, Mark M. wrote: > >>To which, at 08:42 AM 11/14/96 -0500, aga wrote: >> >>>Why? Are you a criminal? >>>What are you hiding behind your PGP? >> >>Okay, I'll bite. Where is it said that a person who wants h[is,er] privacy >>is a criminal? Charlie McCarthy might have said that. > >You mean in his book "Crypto by Dummies"? > >Or were you perhaps thinking of Joe? > I was probably thinking of Joe. I keyed on McCarthy and Charlie was the first christian name to mind. I intended to give the name of the former Senator. I apologize for not checking the historical accuracy of the name I did use.

1 0

Re: Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:38 PM 11/15/1996, Adam Back wrote: >Peter Hendrickson <ph(a)netcom.com> writes: >> However, if you restrict postings to an approved group of people, perhaps >> everybody on the mailing list, you can eliminate spam. How, then, do we >> allow anonymous postings to come through? Individual people on the list >> can receive the proposed post and forward it to the list if it is >> appropriate. They could even charge a fee for doing it. That's easy to >> do if there is a "paying" remailer which will handle the money for them. > Not necessarily a good idea. The post may be a hot potatoe, and the > forwarder may find themselves in legal trouble. (Say RC4 & RC2 source > code, NSA handbook, the results of the Mykotronic's dumpster diving > spree, etc). Exercising `editorial control' has landed some ISPs in > trouble, to the extent that some are specifically avoiding it for that > legal reason alone. Being _paid_ for forwarding the message may make > that even worse. > Often the posts which would get the anonymous poster (or the true name > forwarder) into the most troublle, are the ones which are most > interesting, and also very on topic. (In case you get this out of order, this is my second response.) Another way to have anonymous posting but not be subjected to spam and the like is to dispense tokens every week to the subscribers. They can be signed blindly so that anonymity is preserved, just like e-cash. Peter Hendrickson ph(a)netcom.com

1 0

Crypto Chango
by P. J. Ponder 17 Dec '03

17 Dec '03

Steps to changing US encryption policies: (Note, you must be logged in as US President for this to work.) 1. Try to bug everyone's phone and computer with special chips. 2. Get your butt kicked at and missed by technical weenies, and eventually stomped on by your own national research council. 3. Wait for Congress to show leadership. (Lose two turns if you actually thought they would do something.) (Return) 4. Try to tap everything without using any special chips. (Goto 2) 5. See if any other governments want you to be able to tap their stuff, too. 6. Try to tap everything with half the key tied behind your back when you start. (Goto 2) 7. Issue the new policies. Play Again [Y/N]? Michael Foomkin and John Young have links to the edict. You may try: <A HREF="http://www.jya.com/" <John Young (look under Crypto)</A> <A HREF="http://www.law.miami.edu/~froomkin/" <Prof. Froomkin's Page[?]</A> please excuse the handmade-from-memory URLs above if they don't work. . . . a little snippet from the Internet Scout Report . . . New from Net Scout ------------------ 1. The Scout Toolkit Version 2.0 http://www.cs.wisc.edu/scout/toolkit/ http://wwwscout.cs.wisc.edu/scout/toolkit/ http://rs.internic.net/scout/toolkit/ The most trusted source for information on how to make the Internet work better for you is now available in extra strength. Version 2.0 of the Scout Toolkit debuts today, with a completely new interface, many new sections, and a focus on the future. In addition to the current awareness you've come to expect from Net Scout, we've added an increased emphasis on analysis and insight. Sections include: Searching the Internet, Latest Tools and Technologies, End User's Corner, Net Scout Sidekicks, a Selective Guide to Publications on the Internet, and Future Internet Directions. The new Toolkit is mirrored on three sites to allow Internauts unhindered access. . . . Copyright Susan Calcari, 1996. Permission is granted to make and distribute verbatim copies of the Scout Report provided the copyright notice and this paragraph is preserved on all copies. The InterNIC provides information about the Internet to the US research and education community under a cooperative agreement with the National Science Foundation: NCR-9218742. The Government has certain rights in this material. Any opinions, findings, and conclusions or recommendations expressed in this publication are those of the author(s) and do not necessarily reflect the views of the University of Wisconsin - Madison, the National Science Foundation, AT&T, or Network Solutions, Inc. . . .

1 0

Re: The TRILATERAL COMMISSION -was: [REBUTTAL] Censorship on...
by George A. Stathis 17 Dec '03

17 Dec '03

At 11:01 ðì 16/11/1996 -0600, snow wrote: >> As regards the "gullibility", it's plainly dangerous; And cultivated >> by the Media, apparently stronger in the U.S. than in many other places. >> (written by E. Francis, on the "Trilateral Commission", and distributed >> to all members of his own -private- mailing list, of which I'm a part). >> >THE LAND OF SHADOWS >> > >> > Early this month is the last presidential=20 >> >"election" before the year 2000. As of this writing and=20 >> >long before, the election was decided in favor of Bill=20 >> >Clinton. It works out astrologically, but the real=20 > ^^^^^^^^^^^^^^^^^^^^^^^^^ > I think this just about says it all. A ha ha ha!!! ROTFL. You forget that Astrology is... unsuitable for gullible children. :-) > Go talk to Don Wood. Don't know who the hell Don Wood is. However, I bet you _also_ don't know who Mr. Stringas is. Well, he is the author of several books about his experience as a prominent C.I.A. official working for the Trilateral Commission, a former NATO official who acted as a "link" between the Athens government and Washington, and he also (at the age of 70+) doesn't give a damn about anyone putting a bullet in his head (or so he says) which is unlikely anyway since it would be too "obvious". Mr. Stringas is not the only one who wrote thousands of pages about the Trilateral Commission's activities and members (e.g. Clinton). However, you seem to dismiss well-known facts for the simple reason that they were originally posted by an astrologer (E. Francis) and apparently you believe astrologers are by nature non-credible. That's fine with me. As a highly analytical Virgo with Venus in Libra, I understand you very well. :-) I will reply with a real life JOKE, in this case: Two days ago I had a rather official meeting with some nice people with whom we negotiated a contract (of details irrelevant here). Carrying my notebook computer (as I always do) with several astrology programs inside it, I actually took it out and made a horoscope for my... lawyer, who ALSO happens to be a Virgo with Venus in Libra, and this was hilarious, since we _now_ understood our... similarities. Then a gentleman came into the room who remarked that Astrology is only suitable for loonies and gullible morons. He added that for these people, the Greek word "zodion" applies except without the 'd' and the 'i' in the 3rd and 4rth places inside the word 'zodion' ('Zodion' means 'Zodiac sign'). (If you delete those characters, you are left with the word 'Zoon' which means 'animal'). An astrologer friend of mine, also in the same room, immediately replied: Aha! But the way you phrased it, Sir, makes you surely a virgo, too; probably with a Virgo ascendant, I would say. The guy stared at us in terror. He WAS a Virgo, and had a Virgo ascendant, as he himself said. He promptly stopped talking and looked rather thoughtful... Perhaps a... coincidence? :-) Have fun (with astrology). George

1 0

The Utility of Privacy
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Privacy is a hassle. Is it worth it? Which unfortunate situations does privacy prevent? What are the odds that they will occur? How much effort will it take to prevent these outcomes? As a model, use the present and future situation of a typical reader of this list.

2 2

Re: Censor John Gilmore -- EFF is a disgrace!
by George A. Stathis 17 Dec '03

17 Dec '03

At 05:24 ðì 16/11/1996 -0500, Tim Scanlon wrote: >Between >the 2 lists & various people I see represented here, with all due & >serious respect, you folks have GOT to have better, more important, >and far more deserving issues to devote your time to. I would hope >that you would take a few moments and think about those things, and >consider acting appropriatly in light of those thoughts. [...] >And it's >gotten way, way out of hand. I suggest that it might be better not >to spam cypherpunks with this stuff, and to give it a rest. >Tim Scanlon I think the expulsion of Dimitri Vulis is HIGHLY on-topic inside the Freedom Knights List. As it happens, it is ALSO on topic in the cypherpunks list, no matter how HARD you try to forget this. After censoring Dimitri, you will also NATURALLY try to censor others too, such as myself (receiving notices that I stop "cross-posting" to the cypherpunks list). However, you are a HYPOCRITICAL ASSHOLE, becayse you ALSO cross-post to your own (cypherpynks) list. What you CLEARLY want is to HAVE THE "LAST WORD" ABOUT THIS ISSUE. This is typical of all censorship. If your request was SINCERE, you would be the FIRST to NOT CROSS-POST IT to the cypherpunks list. Oh Gods of Olympus! :-) >Stephen Boursy wrote, along with a horde of others with no lives: >[lots of worthless crap snipped out] You mean whatever you disagree with, or perhaps don't bother to read, you dismiss as 'worthless crap'. It's funny, this attitude. I find it philosophically inexcusable. I never dismiss the opinions of others as "worthless crap" when they are expressed eloquently. What I said instead is that "VERY important ideas have been expressed from all sides". Perhaps you didn't notice. >> When a list gets as big as that, it it no longer to be considered >> a "mailing-list" but it is a _public_ forum. The whole problem >> here is the abuse of power by both the EFF and John Gilmore. >> >It's not an abuse of power. It was an effort to curtail inappropriate >SPAM. Much like this entire topic has become non-crypto SPAM on the >cypherpunks list. You have begun REDEFINING "SPAM" according to your personal feelings and opinions. "SPAM" as EVERYONE ELSE understands it, implies some kind of _gain_ (e.g. from advertising) inside a posting. Redefining "SPAM" is consistent with attempts to redefine other known words as well. Like the word "Censorship", which has been redefined to mean "ONLY official censorship". The tendency of closed-minded internet communities to REDEFINE common words as they deem fit, is RATHER WELL KNOWN, where I come from. I am a dictionary maker by profession, BTW. (I write some of the software for it, and run the business. OK, I also do spelling mistakes. It's not my job to know everything, ya know! :-) :-) ) However, if you take my own opinions for instance, they are expressed without ANY thought of gain (by definition impossible, since I don't advertise anything. I write these texts at the intervals of a very real life, involving a lot of swimming, and a lot of Research. When my friends and I meet, we laugh a lot with the situation thousands of miles across the ocean, where... EVEN a "cypherpunks" mailing list has evicted someone forcibly. Rather typical, as it happens. Gives you people a bad name you know... >> The first time is the time when you lose all credibility, and there >> is never any forgiveness for a plug-puller. > >All bullshit aside, this whole thing has NOTHING to do with crypto. >And it has very VERY little to do with censorship either. Which means you probably didn't read much of what was said anyway. Typical... George

1 0

It Used to Be Eric's Inscrutable Deficiency
by blanc 17 Dec '03

17 Dec '03

In glancing through and deleting so many messages about how blasphemous and perverted John Gilmore is for having "censored" one list afficionado (more symbolically than in actual fact), I am amused to recall that it used to be Eric Hughes who was the bad guy identified as the Egotistical Slave Master who abused his ownership privileges. Now he's left the list, it is JG who gets the drift & drivel about list management. Strange, too, that those who clamor for freedom of speech are accusing JG of being contrary to his principles. They expect that just because individuals should be at liberty to speak, everyone must therefore be prepared to tolerate all manner and kind of insults against themselves (or be a passive witness to it). In that case, it would mean that because individuals are to be free "to do" as they will, therefore that courtesy and manners are no longer valid, that high standards of personal behavior are not important, that self-command is not required, that exercising one's best judgement is of no practical value for life in the real world. It would mean that in the environment of liberty, it would be incorrect for individuals to prevent assaults against themselves or their morals, against their personal preferences, or against their choice of topics for a discussion list which they started. This would mean that, for instance, it wouldn't be right for free individuals to prevent from being sexually molested, because it would be "censorship" against the perpetrator. These complaintants against censorship must not understand the purpose for freedom of action, of expression, etc.; that they do not understand the need for being "free": it is so that one may, without interferance from uninvited participants, engage in arranging the elements of one's existence for the greatest benefit to oneself. Tolerating insulting drivel does not fall into that category. The environment of liberty to express oneself also permits the exercise of the highest logic possible to an unfettered intelligence. Filling up the mailing list with irrelevant accusations about bizarre sexual practices is not of any logical benefit towards enlightenment on the subjects of encryption or privacy. .. Blanc

3 2

Re: Censor John Gilmore -- EFF is a disgrace!
by George A. Stathis 17 Dec '03

17 Dec '03

At 05:24 ðì 16/11/1996 -0500, Tim Scanlon wrote: >Stephen Boursy wrote, along with a horde of others with no lives: >[lots of worthless crap snipped out] As an aside, some of this "worthless crap" written by Stephen Boursy and "others with no lives", happens to contain jewels of wisdom and humility such as the following: (cut and pasted from another posting): >> P.S. I never understood the (American?) preoccupation about... "putting >> out flames". If I find flame-messages boring, I don't read them! >> If anyone insults me, I reply; If anyone speaks nicely, I also do. >> The (American?) preoccupation about flames conceals a deep _fear_ >> of freedom, freedom of the other person's freedom. > > > This is very true. I'm worried about the US--our lack of respect >for free speech--our extremely poor social services for the poor, etc. >It is not a country I'm proud of at the moment. Much of what is >praised about the US--our stability of government--is our downfall--we >should be able to toss a government like we have out on its ass and >string up the leaders on telephone polls. Are you aware... tiny Tim, that Stephen Boursy's comment should make Americans feel PROUD, and that his response to my rant made me think a LOT? Perhaps learning from the humility and wisdom of others has also been banned inside your... tiny-Tim brain cells. Happy Recovery Geirge

1 0

RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

I'm trying to think of a function to replace UNIX's crypt(3). My design criteria are as follows: 1) I want it to be secure. 2) I would like to use a cryptographic hash. 3) I would like to use well understood cryptographic primitives. 4) I would like to use a salt, and I would like the salt to be considerably larger than the current salt. 5) I would like the process to be able to be more computationally intensive than crypt(3). 6) The ability to use the algorithm in any setting domestic (US) and abroad is a concern, but not a primary one. #1 is important for the obvious reasons. #2 is important because a one way hash allows for a secure way of checking the original password against the entered password. No password should be able to be recovered by simply reading a file, or finding an internal key. #3 is basicly a result of #1 #4 and 5 makes the password system more resistant to a dictionary- type attack. Several of the more popular password guessers (ie: Crack) get a significant speed increase from the fact that they only have to hash each of the words once per salt. I would like it to be possible for each user to have an independent salt (for any reasonable system size). I would also like this function to be able to be scaled to that it can be slower than crypt(3). This will also hinder a dictionary attack. #6 is a byproduct of silly legal concerns. The algorithm that I developed was heavily influenced by RFCs 1852 [1] and 1828 [2] (IP Authentication using SHA and MD5, respectively), and "Keying Hash Functions for Message Authentication" by Mihir Bellare, Ran Canetti, and Hugo Krawczyk [3] This algorithm borrows several concepts from [3]: The idea of the keyed hash, where the key is used as the hash's IV, or Initial Value. Its security is completely based on the choice of the key, and the strength of the underlying hash function. The concept of the NMAC (Nested MAC), and security analysis of it. The Algorithm: Given that: . = the concatenation operator P = the user pass phrase H(m) = the hash of the message m l = length of the hash returned by H(m) H(k,m) = the keyed hash of message m, using key k (as the IV) N = salt, length l = (n1 . n2) where n1 and n2 are sub-salts i = the iteration number E = a temporary value = (e1 . e2) K = key = (k1,k2), where k1 and k2 are the sub-keys used in the NMAC NMAC(k, m) = H(k1, H(k2, m)) In several cases a value is said to be equal to the concatenation of two other values (we'll take N as an example); ie N = (n1 . n2) This means that N is divided into two equal sized chunks, n1 and n2. (n1 . n2) = N initially: (1) E = H (P) (2) k1 = (e1 . n1), k2 = (e2 . n2) (3) T0 = NMAC(K, n) And then: (4) T(i) = NMAC(K, T(i-1) . n . T(i-1)) (repeat (4) a number of times) In (1) the user pass phrase is hashed using the non keyed hash, and the resulting value is kept in E. In (2) k1 is formed by concatenating the first half of E and the first half of the salt. k2 is formed by concatenating the second half of the key with the second half of the salt. Now each sub-key is of length l. In (3) the NMAC of n is assigned to T0 and then in (4) T(i) is calculated by doing the NMAC of the value of the previous hash concatenated with n concatenated with the value the previous hash. Step (4) is repeated a known number of iterations. "Keying Hash Functions..." [3] seems to imply that the security of this hash would be based on the length of l and the underlying hash function, H. Because of the way that K is used, the security granted is a function of l/2, not l. (For further explanation see [3]) I was thinking of implementing this using SHA-1. This would lead to a 160 bit value for l, hence the security would be based on an 80 bit key. Some modifications that I have considered, and would like feedback on are: I was thinking of making the keys used for the hash come from the previous hashes, and then hash a constant string. ie: T(i) = NMAC(T(i-2) . T(i-1), P . n . P) instead of having a more-or-less constant key, and constantly changing what is being hashed. I also am not sure that the string that I'm hashing is ideal. Would (n . P . n ) be better? - ------------------------------------------------------------------------- [1] Metzger, P. and Simpson, W. "Request for Comments: 1852, IP Authentication using Keyed SHA" [2] Metzger, P. and Simpson, W. "Request for Comments: 1828, IP Authentication using Keyed MD5" [3] Bellare, Mihir and Canetti, Ran and Krawczyk, Hugo. "Keying Hash Functions for Message Authentication" I very much appreciate comments on any portion of this, or on my general approach. Thanks, Joshua -----------------------------Joshua E. Hill----------------------------- | If you not part of the solution, you're part of the precipitate | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

4 9

Re: More Euro Key Escrow
by Bryondp＠aol.com 17 Dec '03

17 Dec '03

take me off this list

1 0

Re: Giving Kill Files a Workout...
by cvhd＠indyweb.net 17 Dec '03

17 Dec '03

At 01:52 AM 11/16/96 -0800, you wrote: >What a week! What is this? "Net Loon pig-pile on Cypherpunks day?" >So far i have killfiled three people in the past two days. (That is the >total number I filtered to trash before that date.) >For those of you who are sick of wading through this mess, I am willing to >show you what it will take to filter those of your choice to /dev/null or >its local equivelent. (procmail can be your friend!) >Maybe after some creative filtering, the list will settle back to the usual >noise, instead of the net-loon noise. As the smoke from the first rounds of cyber-gunfire of the Gilmore vs Vulius shootout were wafting thru C-space several of us were bemoaning the fact that the entire issue hadn't been handled thru creative filtering on the part of list members as opposed to the heavy-handed "Big-Bro'ish" plug pulling by Mr. Gilmore. The "net-loon noise" level increase was predictable. Like you I will continue to perform creative filtering in order to extract the 4 out of 240 messages worth reading in any given 48 hour period. cvhd

1 0

Re: Mailing list liability (fwd)
by Greg Broiles 17 Dec '03

17 Dec '03

At 11:13 PM 11/9/96 -0600, Jim Choate wrote: >> From markm@gak Sat Nov 9 21:03:24 1996 >> Note that none of these say anything about any commercial service being held >> liable for defamatory statements because the service cancelled a user's >> account or prevented a user from posting in certain areas. I really don't >> see why you consider unsubscribing someone from a mailing list the equivalent >> of monitoring posts and exercising editorial control. > >It is exactly editorial control because it prevents, a priori, submissions by >Vulis under that account. He is FORCED to resort to other means. That is >what the courts will see, it is what the jury will see, and it is what will >eventualy sink the list, and place its operator under financial burden for >years. This is inaccurate. Vulis is still sending posts to the list and they are distributed to subscribers. You seem to have assumed that submissions are only accepted from subscribers. This assumption is wrong. >I joined this list under my own volition, I agreed to no review by the list >operator at any time. I did not agree to not hurt his feelings with my >comments or views. I did not agree to agree with the operator of the list. >I did not agree to make him feel warm and fuzzy inside. I agreed to NOTHING >other than my permission for him to put your submissions in my email box. I have a very hard time seeing a contract here - I don't think there was anything close to a "meeting of the minds" to the terms you seem to imagine, nor do I see any consideration. As you've indicated above, you took on no obligations - which suggests that your relationship to the list owner is not that of a party to a contract, but as a recipient of a gift. The donor of a gift (or series of gifts) is free to stop giving at their whim. > The >only way I can be removed from this list and not open the operator up to >legal consequences is by my own volition or the total cessation of this list. >This applies to every member subscribed so long as their is no proviso posted >at subscription time. I disagree strongly. I also strongly disagree that there was/is any contract between Gilmore and list subscribers or authors. And I strongly disagree with your ideas about posting notices and the "default" situation where notices aren't posted. I think that you're mixing up your analyses re defamation and contract (they are **not** the same thing). I also think you're using contract-style language to describe obligations apparently imposed by law, which is misleading. Further, I'm not aware of any law which would impose the obligations you imagine. If you've got better information, perhaps you'd be kind enough to post a citation so the rest of us can catch up with you. The case summaries you posted don't support your conclusion. The only one that's even in the neighborhood is Stratton-Oakmont; which, as I pointed out before, is appreciably different factually (the degree of control was much greater, the forum was advertised as a controlled one, and the defendant inspected the message before it was made public), did not receive further scrutiny at an appellate level, and has been criticized by commentators and scholars as being poorly reasoned. Stratton-Oakmont is a poor case to rely upon. As far as I can tell, you're basing your legal conclusion on the depth and quality of your feelings about this issue, which is always a mistake. Finally (and dispositively), the entire field of liability for "publishers" of online information was changed by the Communications Decency Act. See <http://www.gdf.com/lb4-1.htm#N3> for more. But this discussion reminds me of the unproductive discussions that various legal-minded folks (myself included) have had with Jim Bell from time to time. And I try not to spend time on unproductive pursuits. So I am not going to write more about this. I've offered my analysis, and readers can & will give it whatever weight they think it merits. If I don't respond to your messages, it's not because I don't think you're wrong, it's because I don't think saying it over & over helps anyone. Mike Godwin has written and thought a lot about liability for defamation in the online service provider context. I recommend his work to people who want to learn more. It's clear that you think John Gilmore did the wrong thing when he excluded Vulis. The notion that a relatively inflexible and harsh liability scheme awaits system operators who wander into some form of content control can be an attractive one. I don't blame you for liking that idea. But your conclusion is not supported by case law nor traditional theories of contract, tort, or property law. The result you want (any content control = duty to inspect every message = harsh result) might be a good one but it is not the state of the law today. If you're getting your legal information from computer media or mass media you're probably getting partially incorrect information or interpretation. -- Greg Broiles | "In this court, appellant and respondent are the gbroiles(a)netbox.com | same person. Each party has filed a brief." http://www.io.com/~gbroiles | Lodi v. Lodi, 173 Cal.App.3d 628, 219 Cal. | Rptr. 116 (3rd Dist, 1985)

2 1

Re: One Big Telecoms Company
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:23 PM 11/15/96 -0800, Dale Thorn wrote: >Progress? Most major cities (when I was a kid) had *several* competing >newspapers, Few realize that NYC today has circa 20 daily newspapers (circa 5 in English and circa 15 in other languages). In addition, I can read a hundred daily newspapers (or more) on the nets. DCF

2 1

Re: THAT is what makes ---Snipshit---------
by dshipman＠ewol.com 17 Dec '03

17 Dec '03

>>> time for ------Snipshit--------- >> An excellent --------Snipshit------------- > >In that case ---------------Snipshit------------ >Jai Maharaj >%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:% Om Shanti %:%:% Splash!! Another one falls from filter to Crap Bucket. Damn, a week ago I didn't even know how to *use* a filter! DLS --------------- A fanatic is one who can't change his mind and won't change the subject. -- Winston Churchill

1 0

Re: Does John Gilmore...
by George A. Stathis 17 Dec '03

17 Dec '03

At 06:00 ìì 16/11/1996 EST, Dr.Dimitri Vulis KOTM wrote: >Rich Burroughs <richieb(a)teleport.com> writes: >> >I have a suggestion for "Aga" and others who believe this sort of >> >nonsense. Please do us all a favor and try to sue John. I'm sure >> >that among all jack-leg and wannabe lawyers on this list that they >> >can come up with a viable cause of action. And John has deep >> >pockets; you could (literally) make out like bandits AND rescue >> >"freedom of speech" on privately maintained mailing lists. >> >> Such a case would obviously fail. John has the right to ban anyone he >> wants from a list that he is hosting. > >Sure he does - I've been saying all along that John Gilmore has the right to >act dishonorably, which he exercises. Yet the censorship supporters keep >attributing to me the diametrically opposite view - that the state can force >John to carry even the opinions he disagrees with. This is not what I've been >saying, of course. John Gilmore lied when he attributed this opinion to me (as >quoted by Declan McCulough). Only his honor could force him to do that, but he >has no honor and no credibility. John had the right to exercise censorship on >his private mailing list, which is precisely what he did. > >> I do question, though, whether or not it was the best way to handle the >> situation. As I have argued, the availability of end-user filtering made >> banning Dimitri from the list unnecessary, IMHO. And the list owner giving >> people the boot sure doesn't fit with the picture I have had of what >> cypherpunks was about. YMMV. > >Same here - I used to have respect for John Gilmore, but now I don't. Neither do I, or my friends who heard about it. What worries me is that people still subscribe to the cypherpunks list after this assault on free speech takes place. If pimps like Gilmore ever succeed in controlling people in the Net, it will be because of people accepting to become prostituted. I am not a petty nationalist, but where I come from, after such an expulsion a lot of people would unsubscribe, and the issue would appear in the daily newspapers (several pages of which every week are devoted to Internet news and activities). Pity I'm too busy nowadays (in dictionary software production). I would gladly write articles on Dimitri's expulsion and the facade of Free Speech in mailing lists etc., as I occasionally have written articles as a part-time journalist. Believe me, the nature of the (cypherpunks) list as well as the importance of the person expelled (at one time I wanted to interview Dimitri for other things he exposed), makes VERY HOT NEWS indeed. But since I have no time, it's likely someone else will report this. What we're REALLY interested in, is exposing fallacies about Freedom of Speech when "private mailing lists" are the biggest threat to it, nowadays, ever since the Net was invented. I will pass this on to relevant people and see what happens. Sincerily George A. Stathis P.S. already cross-posted this to "Eleftherotypia", perhaps the biggest and most democratic-minded newspaper in Athens, Greece. (if it bounces, I got the address wrong and will resend).

2 1

Re: Giving Kill Files a Workout...
by George A. Stathis 17 Dec '03

17 Dec '03

At 06:52 ìì 16/11/1996 EST, Dr.Dimitri Vulis KOTM wrote: >> Thank you in advance for your filtering instructions (yawn). >> >> BTW, why would anyone give a shit whether you killfiled anyone or not? > >But, Dale, that's the whole point of censorship: people like Alan Olsen >and John Gilmore and Jim Ray aren't satisfied when they've killfiles a >source of noise they consider annoying so it doesn't bother them anymore. >They feel compelled to silence it altogether. They claim altruistically >that they don't want the noise to bother anyone else, such as the clueless >newbies who keep subscribing to this mailing list and don't know how to >use mail filters. (Sandy Sanford's concern for them was soooo touching...) Rather infuriating, too, that newbies are PATRONISED. It's well known among my own circle that forcible expulsions from mailing lists serve the purpose of controlling the information-flow to _newbies_ mostly; since hard-liners and experts know how to killfile anyone anyway... But sometimes, in other mailing lists, "killfile-terrorism" appears, meaning an attempt to influence EVERY newbie into killfiling someone whose messages are no longer read, but the messages of his critics are read. It's a return to the MIDDLE AGES, because it means that the words of the prosecutor are heard, but the defense of the accused is deleted. Greek friends and I have been studying this Mechanism of Repression for rather a long time. It's probably encouraged by the EFF, too, in the sense that (the goal is): Turn the Internet into cows and sheep flocked together by pimp-cowboy list-owners. It nearly turned me into a Yankee-hater till I realized there are quite a few open-minded Americans similarly infuriated and concerned. One Net-friend of mine (an American lady) has a doctorate in History and Law and remarked that FEW PEOPLE IN THE STATES REALIZE WHAT THIS IS ALL ABOUT, and how EASY it is for the freedom-bashers to succeed. Lastly, I have now read nearly ALL of Dimitri Vulis' postings (in the F-K list), and consider it CRIMINAL censorship if anyone tries to stop him from speaking out. His talent at exposing fallacies is magnificient. This is the beginning of the END of pimping-on-the-net in the name of "privacy". George

1 0

Re: Censorship on cypherpunks?, from The Netly News
by Omegaman 17 Dec '03

17 Dec '03

On Wed, 13 Nov 1996, Declan McCullagh wrote: > Yes, I understand this. It's quite obvious; being removed from the > subscriber list hasn't slowed Vulis at all. When I was writing the piece > Vulis seemed to have slowed his ad hominem attacks and instead was talking > about censorship (something that is within the charter of the list), but ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Actually, Declan, it's not. "info cypherpunks" in the body of a message to majordomo(a)toad.com yields the welcome message to the list -- the closest thing to a charter available. The subjects of censorship and free speech are neither mentioned nor alluded to anywhere within that document. The subjects of censorship & free speech do bear some relationship to the list's expressed subject and are certainly near and dear to most cypherpunk hearts. The government cannot prevent us from discussing the implications of privacy enabled by strong crypto. Free speech & censorship may even be interesting, entertaining, & important topics -- hence their consistent recurrance in discussions. But the above assertion is factually wrong. _______________________________________________________________ Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send e-mail with "get key" in the "Subject:" field to get a copy of my public key _______________________________________________________________

3 2

Re: Final Solution to the Crypto Problem
by John Young 17 Dec '03

17 Dec '03

Tim May wrote: >Namely, once the infrastructure is deployed, once most electronic commerce >is handled via card tokens (and card readers are actually pretty cheap, and >volume will drive the price down further), the President can cite some kind >of national emergency, or widespread tax evasion, or whatnot, to announce >that beginning on suc-and-such a date all cards must be licensed, even to >domestic users. Not to diminish the validity of Tim's alarm, is there not reason to anticipate that these tokens will be crackable. And thus continue the race between crypto enforcers and crackers? In addition to the recent successes against smart cards, there seems to be trouble with the government's program for widespread use of Fortezza cards, according to complaints of various military and civilian sites. The Fortezza site at ljl.com seems to have been set up so that open, easily accessible information could be gotten by the harried military users (see, for example, the list of Fortezza complaints at http://infosec.nosc.mil ). Moreover, there is surely to be continued competition among the players who are trying to increase their market share -- both government and commercial, both domestic and international. Will they not continue to attack each other's crypto products? And will not each nation's government continue to subsidize their favored producers in international economic and military contentions? The point is made on cypherpunks that the odds are increasingly on the crackers even if there are periodic gains by behind-the-scenes plots among the enforcers and there temporary allies (as Tim notes, these are often short- term romances). And that hardware systems are the most vulnerable due to their illusory physical security -- the fatal conceit that brawn can beat brains in crypto, as it claims it used to do in iron- and fire-power (that was before iron became subservient to code). Finally, take a look at the history of these "emergency" Executive Orders outlined in No. 12924 posted by Peter Junger. Then look at the predecessors to those at www.house.gov. They go back through several administrations and confirm what Hal first raised: there is a concerted effort to get around accountability for the continuation of the so-called emergency, and successive Congresses have been complicit in the camouflage.

4 3

Re: Giving Kill Files a Workout...
by Dr. Jai Maharaj 17 Dec '03

17 Dec '03

On Sun, 17 Nov 1996 02:24:11 -0200 UTC, in message <199611170424.CAA09647(a)prometheus.hol.gr>, "George A. Stathis" <hyperlex(a)hol.gr> wrote: > [...] > Rather infuriating, too, that newbies are PATRONISED. [...] The practice is widespread in the newsgroups, of course. Years ago when I first started participating in the security and crypto groups I received many messages from vigilantes who instructed me to pay no attention to certain posters. It became quite obvious after only a few days that the persons to be avoided and censored were the creative ones with new ideas and the promise for a better Net. On the other hand, the self-appointed cops were the unimaginative pipsqueaks who were, quite frankly, involved in promoting only their mediocrity. They felt threatened by the wiser and brighter. > Lastly, I have now read nearly ALL of Dimitri Vulis' > postings (in the F-K list), and consider it CRIMINAL > censorship if anyone tries to stop him from speaking out. > His talent at exposing fallacies is magnificient. This is > the beginning of the END of pimping-on-the-net in the name > of "privacy". George His work in exposing the thugs of lava.net aka lava(tory).net is really appreciated here in Hawaii [*] by freedom-loving netters. Thanks to Dr. Vulis and others, the Cabal (spit) and the Lynch Mob (vomit) are nearly dead. Hawaii Footnote [*] A member of the international press who is traveling with President Clinton during his vacation here asked me earlier today, "How's the Internet doing, got a story for me?" I think I may suggest the issues being discussed here. Perhaps non- governmental-censorship matters have not received enough attention in the mass-media yet. Jai Maharaj Aloha! %:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:%:% Om Shanti %:%:%

1 0

Could Declan or some libertarian explain this?
by Rich Graves 17 Dec '03

17 Dec '03

>From the so-called fight-censorship list. I would ask there, but the list owner won't let me, and I won't stoop to Vulis's level. | PLEASE MARK MY WORDS: IF MY BOOK IS NOT RE-PUBLISHED AND AVAILABLE |IN BOOKSTORES, THE CAUSE OF ACADEMIC FREEDOM IN THE WEST WILL BE IN A SORRY |STATE. FEW ACADEMICS WOULD BE PREPARED TO SUFFER THE MANY BLOWS AND |THREATS THAT I HAVE NOW ENDURED FOR SIX MONTHS. IF 'The 'g' Factor' |DISAPPEARS, SO WILL OTHER SERIOUS PRODUCTS OF RESEARCH AND SCHOLARSHIP -- |ESPECIALLY IF THEY ARE DEEMED "CONTROVERSIAL" BY THE LIBERAL-LEFT. His complaint is that his publisher stopped distribution of his book arguing that blacks are mentally inferior to whites. Could someone please explain to me how Chris Brand is different from Vulis? I mean in form; in practice, Declan is bashing Vulis for not recognizing rights of private editorial control, but uncritically passing on Mr. Brand's message alleging that private editorial control is censorship. Far be it from me to criticize Declan's right to exercise editorial control over substantive dissent and factual correction, but I was just wondering. -rich

3 2

Re: NT insecurity
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 16 Nov 1996 17:00:56 -0500 (EST), Michael H. Warfield wrote: > Hooo Hummm... Another one... >> Given the recent comments about insecure machines, I thought it was >> interesting to note that you can clear *every* password on an NT box by using >> a diskeditor to corrupt the password file (Boot off of a floppy and use >> NTFSDOS if you have to). It'll reboot several times and then you'll be >> allowed to login. > Much as I absolutely detest NT, lets reitterate what everyone else >on this list has already heard too TOO many times... If you have physical >access to the machine, it ain't secure. It doesn't matter what operating True. However, as has been reiterated many times, NT is being marketed as a secure platform. Unix people tend to know that you need to work to secure it. MS hype might lead some of the non-cypherpunk admin types to believe it's secure. Trust me. I hear from these people all the time! # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

Re: Giving Kill Files a Workout...
by George A. Stathis 17 Dec '03

17 Dec '03

At 03:52 ìì 16/11/1996 -1000, Dr. Jai Maharaj wrote: >A member of the international press who is traveling with >President Clinton during his vacation here asked me earlier >today, "How's the Internet doing, got a story for me?" I think >I may suggest the issues being discussed here. Perhaps non- >governmental-censorship matters have not received enough >attention in the mass-media yet. Quite true, and the same thing I was told by the Chief-Editor of "Info" (the weekly Internet-supplement of a prominent Greek journal -Eleftherotypia). One last comment is important here: ****************************************************************** If the 'neo-liberal' ideology of EVERYTHING becoming 'privatised' succeeds, then non-governmental censorship is MUCH more important the governmental censorship. ****************************************************************** The Internet is a threat to the 'traditional' role of the media, and 'list-owners' try tp behave like patronising conventional newspaper-editors. All the filth that was hidden in the closet of the journalistic profession comes out, as a result, in the Net. These people want to _model_ mailing lists after journals -ironically at a time when many journalists are free to write what they like sometimes against the opinions of the journal-owners. Perhaps our only hope is that... Freedom sells. George

1 0

Exploring hooks in MSIE
by Dietrich J. Kappe 17 Dec '03

17 Dec '03

A little bird told me that MSIE has Javascript hooks that allow a site to check whether all Microsoft products on a client machine are properly licensed. Has anyone investigated the Javascript (err, Jscript) implementation in MSIE to see if this is true? The same little bird told me that MS is building some use of this "feature" into their Websites. Can any MS consultants corroborate on this issue? This is just a rumor. The names of the birds have been changed to protect the innocent. DJK

2 1

Re: National Emergency
by attila＠primenet.com 17 Dec '03

17 Dec '03

In <v03007800aeb2dc721dbf(a)[207.167.93.63]>, on 11/15/96 at 06:59 PM, "Timothy C. May" <tcmay(a)got.net> said: :[snip...] :One of the things that most people don't appreciate is that these emergency :orders are essentially never repealed. (Not too surprising--if I was in :government, I wouldn't voluntarily give back any additional powers, either. :And the only consituency for rolling them back is the membership of the :evil militias, so nothing happens.) : yes, you are absolutely right. absolute power corrupts absolutely and a government given (or taking) extra powers is not likely to surrender same --they hope everyone forgets? maybe there is an analogy: militias: the only way they'll take my weapon is from my cooling, smoking hand.... prez: the only way they'll take my executive privileges is to vote me out of office --IF I consent to leave. -- without arms they do not resist; without communication they know not what to resist. -attila [snip...] :Basically, this was one of the alphabet soup of Emergency Orders, National :Security Decision Directives, and Executive Decisions passed or enacted :(sometimes in secrecy) during the last 30 years of the Continuing Emergency. :(Nixon's wage-price freezes, the oil embargo actions, the strategic :reserves, the anti-inflation measures, various Carter emergencies, and :various Reagan emergency orders, including NSDD-145, which directly affects :control of communicaitons, cryptography, etc.) :FEMA, the Federal Emergency Preparedness Agency, took over several of these :emergency orders (the running of them) in the late 70s. :Standard stuff for we conspiracy buffs. One doesn't need to invoke :historical groups like the Illuminati to see that the levers of power are :pulled by strange folks.

1 0

Re: PGP3.0 & ElGamal
by Steve Reid 17 Dec '03

17 Dec '03

>> Yes, but I believe 3DES has an effective key length of only 112 bits. >> Of course, even this is more than sufficient for a long time to come. > 3DES can have an effective key length of 168 bits if 3 keys are used > instead of two. There are no security problems that I know of from > using 3 keys. The Meet In The Middle attack (MITM, not to be confused with Man In The Middle) is a time-memory tradeoff that works against any multiple encryption. Triple encryption: ciphertext = encrypt(k3, decrypt(k2, encrypt(k1, plaintext))) plaintext = decrypt(k3, encrypt(k2, decrypt(k1, ciphertext))) An MITM attack, as I understand it, works by decrypting from one end and encrypting from the other... Step 1- decrypt(x3, ciphertext) for every possible x3, and store all the results. This requires 2^56 operations and 2^56*8 bytes (550 petabytes?) of memory when done against 3DES. Quite a lot, but it might be doable. Step 2- decrypt(x2, encrypt(x1, plaintext)) for every possible x1,x2. This require 2^112 steps with 3DES. If the result you get can be found in the table built by step 1 then you've figured all three keys.

1 0