December 2003 - cypherpunks-legacy

Re: Fortune, 3 Feb
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Mike McNally wrote: > > Big article in Fortune about e-mail privace. One little paragraph > about encryption ("scrambling"). Fairly clue-free overall, but > entertaining. > I found the article to be extremely silly, although it was probably useful for "management". Anyway, computer security is an oxymoron. - Igor.

1 0

Re: Voice Encrytion/Scrambling
by Lucky Green 17 Dec '03

17 Dec '03

At 05:09 PM 2/2/97 -0800, Huge Cajones Remailer wrote: >Can anyone comment on and give pointers to devices designed to >encrypt voice transmission over POTS lines? I am interested in >the respective sound qualities (if you've tried it) and >relative strengths of encryption algorithms. http://www.comsec.com/ Uses 2048 bit DH and 3DES. The voice quality is excellent. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

My Departure, Moderation, and "Ownership of the List" -Reply
by Eldon Jenkins 17 Dec '03

17 Dec '03

Sandy, I've been a member of this list off and on for the past few years. In reading this list daily for quite some time I feel that the filtering you are doing has made quite a substantial and positive change. Normally I would spend an hour or so at work filtering through the list deleting endless threads of nonsense just so I could glean the valuable information that is hidden in midst of the mindless chatter. Now the time I spend searching for information has been drastically reduced and I would like to thank you for this. While I am against censorship and moderation whole-heartedly I see this as a different case. You are not preventing anyone from posting, you just sort the posts and place them in their appropriate list. I see your efforts as more of an organizing project rather then censorship. I would love to see the list continue to be moderated. Just my two cents though. Eldon Jenkins USRobotics Programmer

1 0

Re: PCS Encryption?
by Greg Rose 17 Dec '03

17 Dec '03

David Lesher writes: >Greg Rose sez: >> >> The three different digital standards in North >> America are TDMA, CDMA, and GSM (in NY and DC >> only AFAIK). Newer analog phones use at least >> some of this, but I don't know much about them. > >? I always thought GSM was a specific application >of TDMA... Technologically, GSM *is* a kind of time division multiple access, but the term "TDMA" as I used it is meant to apply to North American IS-128(?) compliant things. They are definitely not interoperable. Greg. Greg Rose INTERNET: ggr(a)Qualcomm.com Qualcomm Australia VOICE: +61-2-9743 4646 FAX: +61-2-9736 3262 6 Kingston Avenue homepage. Mortlake NSW 2137 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45

1 0

Moderation [Tim,Sandy]
by Lucky Green 17 Dec '03

17 Dec '03

Since it seems to be the topic of the day, here are some of my thoughts on moderating CP. o Moderation achieved what it could achieve. Spam is no longer clogging up the list. Insults, i.e., "Tim Mayo fucks children", are no longer polluting the list. o Moderation did not achieve what it couldn't achieve. The level of noise has been reduced, but signal has not been increased. This is sad, but true. The attempt was probably bound to fail, since many of the "top signal generators" have long left the list and are not about to come back. All that is remaining are a few diehards, such as myself, some TLA goons (knowingly or unknowingly) working against the cause, and many newbies and observers. I believe that Cypherpunks is beyond hope of recovery. In fact, each day Cypherpunk (as in cypherpunks(a)toad.com) lives on, it does damage to the cause. Let's kill the list. Once and for all. Let the hard core crypto go to Coderpunks, the politics to Cryptography, and the garbage into the void. I am well aware of the name recognition and reputation capital associated with CP, still I believe it best to *kill the list*. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

4 3

Re: PCS Encryption?
by Andrew Meredith 17 Dec '03

17 Dec '03

Greg Rose wrote: > > The three different digital standards in North America are TDMA, > CDMA, and GSM (in NY and DC only AFAIK). GSM is also a Time Division Multiple Access (TDMA) system. In it's original form it uses specrum around 900 MHz, which I believe not to be available in the US. Shame really, I can roam with my GSM phone over pretty much the rest of the planet ... except the US. Anyway, there are two higher frequency derivatives, PCS1800 & PCS1900, which have been deployed in the US. I'm not involved directly in the US market so I'm not sure where. I assume however that these are the systems to which Greg refers. > Newer analog phones use at least some of this, but I don't know much > about them. I'll ignore GSM. ^^^^^^^^^^^^^^^ Aww shame ;) > The conclusion is that neither way of doing it is truly > cryptographically strong, but both are a lot better than > listening to Princess Di call Newt "Squidgy" on a Radio Shack > scanner. GSM uses the A5 algorithm which *is* cryptographically strong, but is unfortunately considered to be top secret stuff. If, however, you were to pick up a copy of "Applied Cryptography, 2nd Edition" by Bruce Schneier you may find something of interest. I hope that you'll work out from my .sig why I can't say much more. Hope this helps Andy M -- ___________________________________________________________________ Andrew Meredith Senior Systems Engineer Tel: +44(0) 1793 565377 Network Engineering Tools Grp Fax: +44(0) 1793 565161 GSM Products Division Page: +44(0) 839 421153 Motorola SMTP: meredith(a)ecid.cig.mot.com 16, Euroway, Blagrove X400: QSWI016(a)email.mot.com Swindon, SN5 8YQ, UK SMS: 44860608008(a)sms.telco.mot.com ___________________________________________________________________

1 0

Dissolving Choke Points
by Peter Hendrickson 17 Dec '03

17 Dec '03

I was amused by the similarities of USG crypto policy and the moderation of the cypherpunks list. Recently a number of new regulations were announced to go into effect by a certain date. Requests for comments were made after the policy was announced. Many of us thought that was pretty sneaky. I feel the same way about the moderation plan. Moderation has been a failure. I'm pretty good at filtering and I can sadly report that there is very little signal out there. There are lessons to be learned here. One is that censorship does not promote a stimulating and creative dialogue. The cypherpunks list right now is about as interesting as hanging out by the 7-11. Another lesson is the danger of choke points. We can see how tempting it is for people to exercise their control. Even John Gilmore was unable to restrain himself from involuntary social engineering experiments. Who would we have considered to be more trustworthy? Toad.com is a choke point, not just in terms of moderation but in terms of the rate at which it can distribute messages. Let's replace it. What we want are many machines carrying the cypherpunks list. A message posted to any machine goes to all of the others. Each machine sends messages to its subscribers only once. Some of these machines should be across borders. The mail loop and multiple posting problems are solved by observing the message IDs. Fast implementation: use moderated mailing list software. Put a filter in the .forward file of the "moderator" account which looks at the message ID and forwards the message if it hasn't been seen already. The mailing list machines all subscribe each other. I've been looking for a stable machine with a good net connection to do this. I haven't found one. However, if we have many machines sharing the load, the stability of any one unit is not as important because the list will survive multiple "hits". Only the subscribers on one machine will be affected by having their messages delayed. This greatly reduces the work and responsibility for any one list operator. (As John will attest, keeping a machine running 24 hours a day, 7 days a week, rain or shine, is a lot of work.) Also, with multiple machines, each unit handles a small amount of the load. This makes more machines available and has less impact on people's net connections. Last I checked, there were about 1200 addresses on the mailing list at toad.com. All we need are about 10 machines to take 120 subscribers each. (This is a completely manageable load.) Do you have a Unix machine on the Net? Does it have sendmail and Perl? Then you have all that it takes to participate. Send me mail and I'll help you set it up. Peter Hendrickson ph(a)netcom.com P.S. I like and respect John and Sandy and I've learned a lot from both of them. While basically well-intentioned, they just made a mistake in this instance.

2 1

Re: Dissolving Choke Points
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

i do have unix (linux) and stuff, but i can't take a lot of subscribers -- maybe 200-300 or so. i actually wrote a proposal for a mailing list without a central control point, with several advantages being impossibility of control, absense of a single point of failure, and cryptographic verification of honesty of moderators. if there is any interest, i will post it here. igor Peter Hendrickson wrote: > > I was amused by the similarities of USG crypto policy and the > moderation of the cypherpunks list. Recently a number of new > regulations were announced to go into effect by a certain date. > Requests for comments were made after the policy was announced. Many > of us thought that was pretty sneaky. I feel the same way about the > moderation plan. > > Moderation has been a failure. I'm pretty good at filtering and I > can sadly report that there is very little signal out there. > > There are lessons to be learned here. One is that censorship does > not promote a stimulating and creative dialogue. The cypherpunks list > right now is about as interesting as hanging out by the 7-11. > > Another lesson is the danger of choke points. We can see how > tempting it is for people to exercise their control. Even John Gilmore > was unable to restrain himself from involuntary social engineering > experiments. Who would we have considered to be more trustworthy? > > Toad.com is a choke point, not just in terms of moderation but in > terms of the rate at which it can distribute messages. Let's > replace it. > > What we want are many machines carrying the cypherpunks list. A > message posted to any machine goes to all of the others. Each > machine sends messages to its subscribers only once. Some of > these machines should be across borders. > > The mail loop and multiple posting problems are solved by observing > the message IDs. > > Fast implementation: use moderated mailing list software. Put a > filter in the .forward file of the "moderator" account which looks > at the message ID and forwards the message if it hasn't been seen > already. The mailing list machines all subscribe each other. > > I've been looking for a stable machine with a good net connection to > do this. I haven't found one. However, if we have many machines > sharing the load, the stability of any one unit is not as important > because the list will survive multiple "hits". Only the subscribers > on one machine will be affected by having their messages delayed. > This greatly reduces the work and responsibility for any one list > operator. (As John will attest, keeping a machine running 24 hours a > day, 7 days a week, rain or shine, is a lot of work.) > > Also, with multiple machines, each unit handles a small amount of the > load. This makes more machines available and has less impact on > people's net connections. > > Last I checked, there were about 1200 addresses on the mailing list at > toad.com. All we need are about 10 machines to take 120 subscribers > each. (This is a completely manageable load.) > > Do you have a Unix machine on the Net? Does it have sendmail and > Perl? Then you have all that it takes to participate. Send me > mail and I'll help you set it up. > > Peter Hendrickson > ph(a)netcom.com > > P.S. I like and respect John and Sandy and I've learned a lot from > both of them. While basically well-intentioned, they just made a > mistake in this instance. > > - Igor.

1 0

Filling Power Vacuums
by Timothy C. May 17 Dec '03

17 Dec '03

At 6:57 AM -0800 2/3/97, Sandy Sandfort wrote: >After reading through Tim's post, I don't think much would be >served by doing another point by point response. From Tim's >tone, it appears he is still seething about how this all came >about, so I'll just leave our two expressions of opinions where >they were. I have no wish to exacerbate any hard feelings Tim >may be having. Indeed, I have been seething for the past several weeks (off and on, as I am fortunately able to usually put it out of my mind and do other things with my mental energies....). I think I have figured out why I'm seething. It's about "power grabs." You see, in any anarchic situation, where reliance on self-control and self-filtering is emphasized, there is always a _temptation_ for some to "fill the power vacuum" and grab power. I learned in my years at Intel how easy it was to start bossing people around, and as I hired engineers and scientists, I built up quite a little empire. But I didn't like what it was doing to me, as it distanced me from the technology and also brought out "control freak" tendencies....I started worrying about how my people were using their time ("my" time), and I increasingly applied my own notions of what they should talk about and what were suitable topics for laboratory chatter. In other words, I became a censor. (Not a government censor, but a censor in the broader definition I've already cited.) So I gave it up. Even before eventually retiring from Intel, I elected to leave the management track and rejoin the "technical ladder," becoming one of Intel's so-called Principal Engineers. No longer could I control others, except through the example I set and the information I provided. And I was happy I had moved away from "the dark side of the force." (I accept the role hierarchies play in corporations. They can't be built with just people like me. They need leaders, controllers, power freaks, etc. But a virtual community like the Cypherpunks group is not such a heirarchical organization, and it needs few rules, leaders, etc. "We don't need no steenking leaders.") As this relates to Cypherpunks, I have steadfastly refused to consider any "management role," so to speak, in how the list is run, the formal policies, etc. I'm not saying there has been a call for management (though Detweiler used to rail against us for not having a management heirarchy, for not having rules and democratic procedures for "making decisions"), just that the power vacuum in anarchies such as ours is often an open invitation for someone to step in and "provide structure and guidance." I resisted any thoughts of doing this, and argued against this sort of thing whenever the topic came up in conversation. I chose to lead only by the posts I wrote and the ideas I worked on. There have been frequent calls over the years for the Cypherpunks to have a more permanent presence, perhaps even an office in Washington, D.C., such as the EFF had, the CPSR still has, and so on. And to have an Official Spokesman, a contact person for the media droids to contact. The calls for this have declined in the last couple of years, as people figured out that the Cypherpunks are not about having spokespunks for us, and that the media will just have to deal with the "anarchy" of having to herd cats to get information out of us. Now, of course, the message is being sent that Sandy Sandfort is in some sense the de facto leader, being that he determines what traffic goes out to the main list and what traffic gets bounced into the flames list. In fact, I'll make a prediction: The media will see that he is the chief censor and arbiter of worthiness and will increasingly contact him for the Official Point of View on various items they are interested in. It distresses me greatly that Sandy Sandfort has elected to move into this "power vacuum" to nominate himself as our Leader and Chief Censor. Foo on that. (I used to hear this at Intel, where the argument for a hierarchical structure was much stronger, to wit: "Tim, if you won't agree to manage others, you'll have to accept that people less technically competent than yourself are going to elect to become managers and they'll probably become _your_ manager in the not too distant future.") So, I sort of thank Sandy for helping me to realize certain things that I may not have explicitly realized before. Namely, I realize that I don't want the karmic burdens of power myself, preferring to lead only by the example I set and the ideas I generate. This is why "market anarchies" (books, music, ideas, all things where "no ruler" exists) appeal to me so much. And since I don't wish to assume the mantle of leadership, and don't see much need for leadership or global censorship (as opposed to locally contracted for filtering, a la Eric Blossom's list, or Siskel and Ebert giving recommendations, or ratings of restaurants, etc.), I am resentful and suspicious of people who _do_ step into the "power vacuum" to lead and control. Now I grant you that Sandy's form of leadership and control is relatively mild, but the very notion that Sandy can reject a long essay because of a couple of phrasings he dislikes (this was his "judgment call" point about why he (reluctantly?) allowed my post to go out) is a step in the wrong direction. And given our strong ideological bias toward market anarchies, this move toward censorship stands out like a sore thumb. At least the issue would be clearer if Sandy passed all posts through but deleted sections that offended him and marked deleted sections as "**CENSORED**." Yes, I'm seething. Sandy is right about that. I saw a group I helped create and spent thousands of hours on, writing articles and developing ideas choose--by fiat from the owner of the machine the list was being sent out from--to embrace the dark side, the control freak side. In the name of "comity," Sandy's term for the bonhomie he thinks he can cultivate, we lose our ideological purity. "Hey, even the Cypherpunks have embraced censorship." Instead of letting the power vacuum remain unfilled, and suggesting to people that they solve the problems it creates as best they can, Sandy jumped in to fill the vacuum. This is what I'm seething about. And even dropping the power grab at the end of the "experiment" will not stop this seething. Fuck it. --Tim May " Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: GAK cracking?
by C. Kuethe 17 Dec '03

17 Dec '03

On Mon, 3 Feb 1997, tmcghan(a)gill-simpson.com wrote: > Just days after a U.S. graduate student cracked the most powerful > computer encryption system allowed out of the country, the Commerce > Department announced it would allow three companies to export an > even stronger system. [snip] > Companies said products with just 40-bit long keys, the old limit, > were too easy to crack. The approvals came just days after Ian Goldberg, a > graduate student at the University of California, cracked a message > encoded with a software key 40-bits long. > > The government did not name the companies given permission to export > stronger, 56-bit programs, but Glenwood, Md.,-based Trusted > Information Systems acknowledged that it was one of the three. Why does it not surprise me that TIS gets permission to export 56-bit (DES?) ? They do key recovery (is it GAK?) They brag about government consulting. The clients they will admit to having are listed on: http://www.tis.com/docs/products/consulting/govt/govcon.html and, purely unsubstantiated rumors here, but I've heard (seen) TIS, NSA, FBI and other "friends" of ours all together in the same paragraph. Conspiracy? Maybe... This is both good and bad.... yes, longer codes are now exportable, but only to / by certain people? I notice that the new cipher length is 56 bit...same size as DES? hopefully that's just a coincidence (yeah, right) or maybe somebody's starting to see the real world where people download pirate cryptosystems and says "so let's export bigger ones and make a buck off it, too..." (yeah, right) PLUR chris -- Chris Kuethe <ckuethe(a)gpu.srv.ualberta.ca> LPGV Electronics and Controls <c100305(a)wolfcreek.cs.ualberta.ca> http://www.ualberta.ca/~ckuethe/ RSA in 2 lines of PERL lives at http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0