December 2003 - cypherpunks-legacy

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by Hallam-Baker 17 Dec '03

17 Dec '03

Kent Crispin wrote: > Thus, in PGPs case at least, if you want escrowed encryption, then > you must escrow the signature key. Hence the DSA which is a signature algorithm that does not do encryption. I think the use of the same key for both is a bad idea BUT note that if you have a secure signature scheme you don't need an encryption key at all. Simply generate yourself a fresh set of public key parameters for each communication in the manner of IPSEC. The hard problem of setting up security is knowing the identity of the other party. All else pales into insignificance in comparison. Consider the following scenario. SMTP is adjusted so that it has a DH key exchange crypto option. A typical conversation becomes:- EHELO You-got-crypto-mate? 269 Yeah I have crypto XCHAL RSA 248af23876acdef 270 [key-id] [DHparameters e, n, e^x mod n] [sig-of-challenge+DH-params] XENCRYPT [IV] [e^y mod n] [Conversation continues encrypted under key e^y^x mod n AND keybits padding out messages as appropriate.] Now this type of scheme could be implemented without a certificate infrastructure and severly increase the difficulty of snooping. In that case the message would be sent even though [sig-of-challenge+DH-params] was absent. But with a CA infrastructure you could make sure that you hads contacted the correct machine, one authorised to accept mail for fred(a)ibm.com] all you need is a means of hacking the following assertion into X509v3: "Is authorized user of DNS namespace identifier matching" Add in a date and the protocol could be made very reilient and entirely transparent. Now that mail is moving away from godamn awfull crap like sendmail towards engineered systems like notes or exchange adding in protocol extensions becomes easier. If the mail sending agent knows that mail to a particular host should be sent encrypted the system can be made much more transparent than PGP or S/MIME. Like the punters might be able to use it without getting screwed too often. I think email security has often been the perfect being the enemy of the good. One huge problem has been braindamaged ideas about routing email through store and forward mailers rather than connecting to the real destination to start with. Phill

1 0

Re: OECD: No GAK
by John Young 17 Dec '03

17 Dec '03

>Is this in reference to the various GAK initiatives by the administration >or are they finally pushing for forced restrictions on domestic crypto? Has >anyone seen these drafts? I assume that the draft KRAP legislation at CDT Peter Junger cited here is what Markoff refers to: http://www.cdt.org/crypto/970312_admin.html Anyone know of other KR/TTF drafts in the US, UK, FR, JP, AU or elsewhere among the 29 signators of Wassenaar? The Wassenaariors have a wider ambition than the OECDistes.

1 0

Bay Area Anarchist Book Fair, Saturday 3/29
by Bill Stewart 17 Dec '03

17 Dec '03

10am-6pm, S.F. County Fair Building, Golden Gate Park, 9th Ave at Lincoln Way. Free. +1-415-431-8355 Bound Together Books is organizing it, as usual. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

The Upside of Higher Source's Actions
by Toto 17 Dec '03

17 Dec '03

There's 39 new job openings in San Diego. (Astral travellers only, need apply.) -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Timothy C[reep] May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. /\ o-/\ Timothy C[reep] May ///\|/\\\ / /|\ \

2 1

Re: The Blessing of Keys
by Toto 17 Dec '03

17 Dec '03

Hal Finney wrote: > I don't know about Tim's idea of claiming that a key signature is a > religious act. That sounds pretty bizarre to me. I wouldn't be so certain about that. Give the CypherPunks history of treating PGP as a Holy Icon, I think a good case could be made for building a religion around key signatures. Apparently, however, not all CypherPunks can be considered 'True Believers'. I, among others, checked out the information in the anonymous post which indicated press reports of the RSA algorithm being broken. I suppose that now I will be denied the opportunity to partake of the PGP Sacrament at the next CypherMass. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Mutual Link Proposal
by mail＠mkljk.com 17 Dec '03

17 Dec '03

Hello, my name is Guy W. Rochefort, President of Dino Jump International. I found your address through YAHOO. Dino Jump International are specialists in manufacturing and distribution of Interactive Inflatables worldwide. My lines have been featured in Walt Disney productions, NFL shows, and NBA events. Our product lines include moonwalkers, bouncehouses, and castles. I am interested in mutual links on our respective webpages beneficial to both our businesses. Additionally, I am interested in opening dialog on mutual beneficial business dealings as far as wholesale/retail efforts for manufactured products from my factory and/or resale distribution at competitive pricing. Please come visit my site at http://www.dinojump.com or email sales1(a)dinojump.com or call me at 1-800-570-3466 or 619-754-5186. If this email is intrusive I apologize and you will not hear further from me. Thank you again and I am looking forward to doing business with you. Guy

1 0

Resurrect yourself
by shiftcontrol＠nml.guardian.co.uk 17 Dec '03

17 Dec '03

In this week's Easter Fools' Issue of Shift Control: "Not only did Christ not die on the cross, but his body was never placed in the tomb at Golgotha. Indeed, by the infamous "third day" Christ had most likely already rounded the Italian coast and was, for all we know, exchanging anecdotes with Sardinian crab merchants." - Paul Robinson on the imminent resurrection of Jesus's freshly discovered remains. "The post-war baby-boomer generation keeps getting ever more wistful for its lost youth. Bowie begat Suede; the Beatles and the Small Faces begat Brit pop; Rod Stewart begat everything in a skirt in the Seventies and these days his torch is carried by Mark Morrison." - Robin Hunt on the resurrection of nostalgia. "Identical lambs are gambolling in the fields. Six-legged featherless chickens are hatching from their eggs. Piglets ready to offer their organs for every transplant need are snuffling in the new grass. A herd of calves trot happily to the slaughterhouse. It's Easter, time of regeneration and renewal, and all is well with the world." - Bronwen Davies on genetic manipulation and cloning: resurrection for the Nineties. "The gods we buried previously now arise as green shoots and come into their own at the harvest. We drink their blood and eat their flesh when we pass around the wine, beer, bread and cakes in the glorious evenings of autumn. For pagans the deities symbolise the fruits of the year - Christianity, for some reason, chose to reverse this." - Druid Steve Wilson on resurrection, pagan-style "There are a number of things I would require of anyone who would be able to clone me. I would first require that he make two clones instead of one. Next, I would demand that neither of these cloned boys be circumcised. I was and although I do not remember the experience I do well remember when I had my tonsils taken out." - Robert Nicolai on how he should be resurrected through cloning. Also this week: Your chance to win 200 quid in our fiction competition; more memoirs from Freebee the rock 'n' roll bee; and our latest quiz: how wild are you about Jesus? All this and more, waiting and willing at: http://www.shiftcontrol.com ------------------------------------------------------------------ Shift Control is produced by the Guardian's New Media Lab with help from Boddingtons and Stella Artois Dry To unsubscribe from this mailing list send e-mail to shiftcontrol-request(a)nml.guardian.co.uk with the following text in the body of the mail message: unsubscribe

1 0

CypherPunks Hash Distribution Network / Combined thread
by Truth Mongrel 17 Dec '03

17 Dec '03

Igor Chudov @ home wrote: > As far as I understand, the process of building a distributed network of > cypherpunks mailing lists is logically complete. It means that the following > list servers are now connected: > ssz.com <---> algebra <----> cyberpass > Again, you are free to do so and your Cc-copies will NOT cause any > duplication of traffic because each mailing list server employs an > anti-duplicate filter. It is just a waste of your keyboard typing. > Dale Thorn @ bat: >> That's funny - I unsuscrived to toad, and 'scribed to cyberpass and >> algebra. I have been getting an average of 2-1/2 of each message >> that comes through. Mostly three's, a few two's, and an occasional >> five or six copies. It sounds to me as if we might already have a naturally recurring parallax to a hash-collusion system here. In other misued words, perchance the ASCII art spams and multiple copies of various posts, which became common fare for anyone who followed the moderation/censorship experiment/dictatorship of Gilmore/Sandfort and Toad/C2Net in Jan/Feb, are nature's way of exacting a cost for subscription to the CypherPunks list(s). Perhaps the good Dr.Vulis DV K, rather than being called a flamer, should be referred to as our good friend, Mr. Fire, who helps to clear the deadwood out of the forest. Apparently, over a thousand pieces of deadwood were cleared in the last cycle of flamewars. ("Run, Bambi. Run!") Below, agreeing with me (in my dreams): Hal Finney wrote: > Adam Back writes: > > [ Re idea to for a nym to "post a bond" to enhance reputation] > > Your suggestion is another neat way of passing expense and tying an > > investment to a nyms reputation. > > X-reputation: 64 bit SHA1 collision > > or > > X-reputation: $100 digicash > > > Don't forget though, it's not really a payment system. The hash > collisions can't be exchanged for anything in the real world. > They represent a certain threshold of effort which someone has to have ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (emphasis mine) > expended to create them, but they can't replace cash. At best they > could be sort of a "play money" which some people choose to accept. > > I do like your idea of using it as an incoming spam filter, though. > (By spam I mean mass mailings.) Which begs the question, is the current system capable of acting as an outgoing filter? Can it glean out the losers who are cruising for an easy view of cryptography issues, and help maintain a higher level of membership, limiting it to losers who have a more dedicated interest/psychosis in privacy/paranoia cryptography/disinformation issues. > > - and anyway I've nearly finished implementing it (I'll post the hash > > cash postage money mint (collision generator) and remailer plug-in > > for postage later on today) where as not many people have digicash > > accounts. Perhaps if Dale developed an 'outgoing filter' system to go with Adam's 'incoming filter' system, we could have the best of both worlds, being saved from "Make $$$ Fast" spams, but having to use our delete keys to ante-up in regard to our own list loons. We could also institute a 'bad hash' system, where bad-hashes like Tim C. May could use their guns to balance the threat of legal actions from bad-hashes like Greg Broiles. With new developments such as these, to thwart the efforts of anti-thwarters to bring balance and sanity to the list, perhaps the CypherPunks can bypass the inevitable evolutionary extinction of the 'bug-fixed' victims of insect vasectomies, and bring in the new millenium as the longest running wash-out-your-mouth-with Soap Opera on the InterNet, staying one step ahead of the guys with the ButterflyNet. The Truth of the Mongrel is, that we obviously need to develop a system that makes certain the spam we receive is CypherSpam. The loons on the list should be CypherLoons. Our membership should consist of CypherIdiots, CypherNewbies, CypherElitists, CypherLosers, CypherCynics, CypherSpooks and CypherGenius'. Where else can movers and shakers like Robert Hettinga join in an list-takeover attempt, call for the killing of the list, and then, like a whirling dervish acting as his own spin doctor, re-appear, riding on the back of the CypherXenix rising from the ashes, and genuinely declare, "I *love* this list."? Where else can CypherWoofers like Toto roundly condemn Sandfart <spit>* and Gilmore <swallow>* as fascist censors, then praise his own bum-buddy, Igor Chewed-Off <commie>*, for his site blocking efforts, and then cynically whine when his own "Make Big $$$ Licking Your Own Nuts At Home" bulk-emails are intercepted and deleted? (* - ASCII Graphicology allegedly (c) DV K Bot-ling Plant, No-Inc.) Where else can Afro-American cryptographers have their native tongue, Ebonics, recognized as a valid encryption system? Where else can you be guaranteed that your typoos will be forwarded to Ft. Meade, to be pored over by military analysts for hidden meaning, quite possibly launching world infowars as a result of drunken, sticky fingers. The CypherPunks list, love it or leave it, is still, far and away, the best show in town. ("If I can make it theeerrre...I can make it anywheeerrre..") And the way this relates to cryptography is...my brain is scrambled/encrypted. Anarchist (Don't) Rule! Truth Mongrel ~~~~~~~~~~~~~ Just say "No" to "Bad Dog Inside" We got nuts, we're peeing on telephone poles, I know that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Truth Mongrel | Doggie Anarchy: cats chased, bones buried, tm(a)woof.nut | anonymous droppings, analog come-calling Woof! Woof! | legs lifted, territories marked "Yard fences aren't even speed bumps on the garbage sniffing alleyway."

4 3

Re: remailer spam throttle
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:40 PM 3/30/97 -0800, Lucky Green <shamrock(a)netcom.com> wrote: >Reply blocks are unreliable anyway. Yeah, but they're a moderately useful kluge in that they let you separate the information about how to find an anonymous recipient into at least two places, which is far more secure than just one. They're relatively annoying to use, but the nymserver approach makes it possible to use them without the average user messing with the details. >The current piggy backing of recipient anonymity >on systems designed to provide sender anonymity can not work reliably and >must therefore be replaced by a separate design. Is this a distributed-commercial-remailer-boxes approach, or something different? It's a hard problem to do right. In a large-scale system, one good design is to have a Pipenet or equivalent that's used to pick up POP-mail. It needs enough traffic/users/bandwidth to achieve Obscurity, but if you could convince people to carry their Usenet feeds as cover traffic, that'd be more than enough :-) Store-and-forward variants are less reliable, but may do a good enough job, or I suppose you could cook up some sort of distributed message pools. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0