December 2003 - cypherpunks-legacy

Re: Rejection policy of the Cypherpunks maiing list
by Cynthia H. Brown 17 Dec '03

17 Dec '03

On Fri, 24 Jan 1997, Toto wrote: > Igor Chudov @ home wrote: <snip> > > The explanation that Sandy Sandfort gave me mentioned that he rejected > > my message because it continued a thread where Sandy noticed instances > > of "flaming". Note that my message was free of any flames, including > > its quoted part. > > The standard of what constitutes a 'flame' seems to rest very much > upon whom a comment is directed at, or merely 'vaguely toward'. Beauty, flames and censorship are all in the eyes of the beholder. However, by providing both "raw" and "cooked" versions of the list, Sandy is allowing readers to choose for themselves whether or not they want someone else's filters applied to their mailbox. Personally, I choose to press the "Delete" key myself. <snip> > > Sandy also states rather plainly that crypto-relevance is not the > > criterion by which he moderates this list. > > This was more than obvious to anyone who cared to cast an objective > eye on the process, but their input was pooh-paah'd by the 'washed > masses'. Note that Sandy also stated that the post in question would not be sent to the 'washed masses'. > > I would like to hear your opinions as to whether such policies satisfy > > the current readership. > > Like all of the 'opinions' that were expressed prior to the censorship > of the list? I haven't seen any indication that these opinions were > given the slightest consideration. This is not the readership's list. > It is a private individual's list. Agreed, and said private individual can do as s/he sees fit. My only objection is that the moderated version has the same name as the original list (sounds like Rogers Cable's recent attempt at "Costs More Unless You Speak Up Now" channels). <snip> > In short, I don't see the moderation as being 'fair', and I don't > think it was ever meant to be. Again, fairness is in the eyes of the beholder. I don't object to the list being filtered, as long as everyone understands that this is happening. What will happen, I wonder, if at the end of the trial period the number of subscribers to the "raw" list outnumbers those who get the "cooked" list, or vice versa? Is that one of the criteria for determining the "success" of the experiment? Cynthia =============================================================== Cynthia H. Brown, P.Eng. Ottawa, Ontario, Canada E-mail: cynthb(a)sonetis.com Home Page: http://www.sonetis.com/~cynthb/ PGP Key: See Home Page Junk mail will be ignored in the order in which it is received. Klein bottle for rent; enquire within.

1 0

(fwd) Re: PGP implementation source code
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

[The discussion started with Pretty Safe Mail, the recent "PGP-compatible" Mac program, and whether or not it was safe. Source code is not available. Some authors noted that PSM was much slower than PGP, but so far lives up to its promise of user-friendliness. A Win95 version is in the works.] >From: Ian_Miller(a)bifroest.demon.co.uk (Ian Miller) Newsgroups: comp.security.pgp.discuss,comp.security.pgp.resources Subject: Re: PGP implementation source code (was "Imminent Death of PGP?" revisited) Date: Fri, 24 Jan 1997 19:55:46 +0000 Lines: 66 Message-ID: <AF0EC44296683DACD(a)bifroest.demon.co.uk> In article <5c2kap$1tu(a)topcat.uk.gdscorp.com>, Steve Gilham <steveg(a)uk.gdscorp.com> wrote: >PGP defines, but, IIRC does not inspect, a comment packet type. This >packet type could be added to a .pgp file and contain anything the >implementor wished (your plaintext secret key if it has been used in >this instance of the program, any IDEA key used, your passphrase, if >given) without any standard PGP implementation being aware of it The IDEA initialisation vector could also be used as a subliminal channel, it is only 8 bytes but it could (for example) leak a random 60 bits of one prime in your secret key with the remain 4 bits saying which set of 60 bits. Worse is the possibility that the program could put a back door into RSA key generation to make the modulus trivially factorisable by someone in the know. There are a number of mechanisms for this of varying detectability up to detectable only by reverse-engineering. Here are some of the (endless) possibilities in order of increasing sophistication:- 1) Make one of the primes a constant. Factorise by dividing by this number. Detectable by inspection of public keys alone. (For more details, see my article "There are no common factors in the Public keyring", 13th Jan in comp.security.pgp.announce.) 2) Select the first prime P at random but make second prime Q the smallest prime larger than PK where K is a constant. Factorise by searching from root(N/K). Probably detectable by suitable inspection of several secret keys generated by the product, but (I think) undetectable from public keys alone. 3) Select a random seed and using a good PRNG, make the rest of generation process deterministic based on the seed. Use the "deadbeef" technique to select a modulus that has this seed as its least significant bytes. Factorise by extracting the seed from the modulus and repeating the deterministic key generation. This is detectable only by reverse engineering. 4) Select a random seed and use a short key PKE key exchange system (e.g. Elliptic curve) to generate a session key and a key exchange cyphertext. Use a key generation similar to (3) except that you seed the PRNG with the session key and deadbeef to make a key ending in the key exchange cyphertext. Factorise by extracting and decrypting the session key (requires a secret key), and repeating the key generation. Again this is only detectable by reverse engineering, but even after executing the reverse engineering you still cannot factor the keys generated because the program only contains the public key not the secret key. Method (4) is an interesting example of a "locked back-door". There is often an unstated assumption that back-doors have to be open. i.e. If you can find them you can get in. It isn't always true. Whereas it seems intuitively unlikely, it is not inconceivable that there is a way of putting a locked back-door into some forms of Feistel ciphers. The NSA would have been reluctant to put an open back-door into DES, but they would not have hesitated to put in a locked back-door. In my opinion the only safe assumption is that they could and they did. In cryptography you shouldn't trust your intuition, code with source or unexplained algorithm components. Ian Ian_Miller(a)bifroest.demon.co.uk FAI-D10204 PGP key 1024/FCE97719 FP: 2A 20 46 10 E5 96 27 40 91 B1 95 BA CA D3 BC 14 Antworten auf Deutsch waeren mir angenehm. -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information Tell your friends 'n neighbors you read this on the evil pornographic Internet "Where one burns books, one will also burn people eventually." -Heinrich Heine People and books aren't for burning. No more Alexandrias, Auschwitzs or Wacos.

1 0

Extra Income
by pal＠king.cts.com 17 Dec '03

17 Dec '03

*********************************************************************** Our Research Has Indicated That The Following Message Will Be Of Interest To You. *********************************************************************** Imagine what you can do with... UP TO $800.00 A WEEK EXTRA INCOME! Here's How To Get Started Let me tell you which companies to contact so you can start to receive your checks. They can be $200.00, $400.00, even $800.00 per week, depending on what you do. You can earn this excellent income right at home. And you work only when you want to. My name is Henry Summers. I investigate income opportunities that are advertised in magazines or by mail or are listed in home work directories and other sources. Then I talk to people who are actually using these opportunities. I ask how much money they make... and whether they enjoy the work. This helps me direct you to the best opportunities that are available today. Ones that people are using right now to earn all the money they want. Get Paid For Stuffing Envelopes. No Fees. Nothing To Buy. This easy work is very appealing, but most people do not know how to get it. That's because so many of the envelope stuffing programs being advertised are not what you expect. And you don't find that out until after you send in your money. Let me tell you the real facts. With true envelope stuffing... * You do not need to pay any fee or buy any materials to get started. * You do not do any advertising or handle any orders. * All printing, postage, and mailing lists are supplied free by the companies that pay you. * Your pay is based entirely on how many envelopes you complete. Rosie Martinez is an example of someone who earns money stuffing envelopes. The company delivers all the materials right to her door. She stuffs the envelopes, seals them, and applies the mailing labels and postage stamps that are supplied. Then she gets paid for every envelope completed. Rosie says, "I'm retired, and I enjoy having something to do. I usually watch television while I work. The home shopping shows are much more fun now that I have money to spend." If you'd like to do this kind of work, just follow the directions in Chapter 3 of my book "Real Home Income". Or try any of the other opportunities covered. Hundreds of companies are ready to help you make money. I'll tell you what each one has available now. Choose the kind of work you like and write to the companies who offer it. Pick any you want. You can work as an independent contractor for as many companies as you have time for. There are no qualifications to meet, so you will not be turned down. I guarantee it. If you don't like one company or you want to make more money, there are plenty of others you can try. Get Paid For Assembling Miniatures Gina Walker of Texas likes to assemble miniature furniture for doll houses. All the necessary materials are supplied by the company that pays her. She puts them together and sends them back to the company. Everything is conveniently handled by mail and UPS. The company sends her a nice pay check for each batch she completes. Gina says: "I really like the work, and the extra money helps pay my bills. I'm glad I found out about these companies." You can get paid the same way. And you don't have to make miniatures. You can choose from many other types of work. You can sew baby bonnets, assemble beaded jewelry, crochet doll clothes, make wooden items, assemble stuffed animals, paint figurines, weave rattan reed, and many more. You get the names and addresses of over 50 companies that will pay for things you make or assemble at home. No experience is required, and it makes no difference where you live. Almost all the companies supply the needed materials. Just do the work and get paid for each batch you send back. Wouldn't you like to get those pay checks? I'll show you how to get started fast. How I Made $800.00 Per Week After Losing My Job I became interested in home income opportunities several years ago when I lost my job. I sent for dozens of money making offers. Most were totally worthless. Others did not appeal to me. But circular mailing caught my interest... and it actually worked. In just six weeks, I was making over $800.00 a week working part time at home. It was better than my previous job. I soon paid off my bills and bought a new car. Yet that was only the beginning. As I learned more about it and tried different things, the money poured in even faster. It made a huge difference when I applied certain secrets that are used by the experts. I was amazed at how profitable it could be. In "Real Home Income" you'll learn how to use those secrets yourself. I'll tell you which companies to contact to get started. I'll show you some simple steps you can take to double your income without doing any more work. If you want, you can do all of this without handling any orders. Your name and address does not have to appear on anything you mail. You just mail circulars for companies and receive nice fat checks from them. With my proven methods, you can soon be earning more money than you ever imagined. Just follow my directions, and you can start receiving checks from the same companies I do. Receive One Dollar For Each Envelope You Stuff. Envelopes Come To You Already Stamped And Addressed. This easy work is advertised by over thirty- five companies. But they require that you pay $25.00 to $45.00 to register in their program. And then the program seldom turns out to be what you'd expect. That's where my book can help out. I describe the three kinds of mail programs that pay one dollar per envelope. But there is only ONE that I recommend. Not only is it more profitable overall, but you don't have to pay any fee to do it. Not even a dollar. Read about "The World's Best Dollar- Per- Envelope Program" in Chapter 4. How To Avoid Disappointment So many worthless offers are commonly advertised that many people give up before they come across a good one. That won't happen to you when you have my book. It tells you exactly how to recognize and avoid worthless offers. The most common ripoffs are covered in detail. This knowledge can save you a great deal of time and money. You can then take advantage of the many practical, down- to- earth opportunities that are described. Ones that enable you to start making money fast. Even just one extra source of income can make a big difference in your standard of living. Start To Earn Money In 48 Hours When you get the book, look over the many excellent opportunities. Each listing includes a brief description of what is offered. Write to the companies you like and request an application form. They have openings right now, and they'll be happy to get you started. You can begin to make money even faster if you choose one of the programs or plans that the book describes in detail. I'll tell you everything you need to know to get started. By taking a few simple steps, you can already be making money just 48 hours after you receive the book. Unlimited No Nonsense Guarantee "Real Home Income" costs just $29.95 plus $3.00 for postage and handling. I'm so confident you can make the money I've talked about that I back it with a lifetime, money- back guarantee. If at any time you feel the book has not helped you make all the money you want, just send it back. I'll promptly send you a full refund of everything you paid, including postage and tax. Start to enjoy more income and a better life as soon as possible. Please complete the order form and mail it today. Everything will be rushed to you by first class mail. Sincerely, Henry Summers P.S. I've recently discovered an amazingly profitable opportunity. One person I talked to made $20,000 in his first six weeks... working right at home in his spare time. It is not multi- level marketing. I've never seen anything like it before. I'l give you a toll free number to call so you can get started. Please Print and Mail This Order Form ----------------------------------------------------------------------------------------------- SUMMERS PUBLICATIONS # 30516 1010 Calle Cordillera, P.O. Box 3127 San Clemente, CA 92672 ( ) Yes, I would like to get started. Please rush me "Real Home Income" under your lifetime money- back guarantee. Enclosed is $29.95 plus $3.00 for postage and handling. $32.95 total. (If you live in California, please send $34.95) Name____________________________________________ Address___________________________________________ City, State, Zip_____________________________________ -------------------------------------------------------------------------------------------------

1 0

(fwd) New keyserver available
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

>From: tage(a)cc.uit.no (Tage Stabell-Kulo) Newsgroups: comp.security.pgp.tech Subject: New keyserver available Date: 24 Jan 1997 16:11:26 GMT Lines: 12 Message-ID: <5camve$3d4(a)news.uit.no> A new PGP keyserver, still _very_ experimental, is available at host dslab1.cs.uit.no at port 24162, use telnet(1). In general it will find a key in a few seconds. Your comments and suggestions are solicited. -- //// Tage Stabell-Kuloe | e-mail: Tage(a)ACM.org //// /// Department of Computer Science/IMR | Phone : +47-776-44032 /// // 9037 University of Tromsoe, Norway | Fax : +47-776-44580 // / "'oe' is '\o' in TeX" | URL:http://www.cs.uit.no/~tage/ -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information "We think people like seeing somebody in a uniform on the porch." -US Postal spokeswoman, quoted in AP, 1/27/96. I don't know about you, but most people I know who saw someone in uniform on their porch would pull out the shotgun...

1 0

(fwd) Re: PGP implementation source code
by Damaged Justice 17 Dec '03

17 Dec '03

[The discussion started with Pretty Safe Mail, the recent "PGP-compatible" Mac program, and whether or not it was safe. Source code is not available. Some authors noted that PSM was much slower than PGP, but so far lives up to its promise of user-friendliness. A Win95 version is in the works.] >From: Ian_Miller(a)bifroest.demon.co.uk (Ian Miller) Newsgroups: comp.security.pgp.discuss,comp.security.pgp.resources Subject: Re: PGP implementation source code (was "Imminent Death of PGP?" revisited) Date: Fri, 24 Jan 1997 19:55:46 +0000 Lines: 66 Message-ID: <AF0EC44296683DACD(a)bifroest.demon.co.uk> In article <5c2kap$1tu(a)topcat.uk.gdscorp.com>, Steve Gilham <steveg(a)uk.gdscorp.com> wrote: >PGP defines, but, IIRC does not inspect, a comment packet type. This >packet type could be added to a .pgp file and contain anything the >implementor wished (your plaintext secret key if it has been used in >this instance of the program, any IDEA key used, your passphrase, if >given) without any standard PGP implementation being aware of it The IDEA initialisation vector could also be used as a subliminal channel, it is only 8 bytes but it could (for example) leak a random 60 bits of one prime in your secret key with the remain 4 bits saying which set of 60 bits. Worse is the possibility that the program could put a back door into RSA key generation to make the modulus trivially factorisable by someone in the know. There are a number of mechanisms for this of varying detectability up to detectable only by reverse-engineering. Here are some of the (endless) possibilities in order of increasing sophistication:- 1) Make one of the primes a constant. Factorise by dividing by this number. Detectable by inspection of public keys alone. (For more details, see my article "There are no common factors in the Public keyring", 13th Jan in comp.security.pgp.announce.) 2) Select the first prime P at random but make second prime Q the smallest prime larger than PK where K is a constant. Factorise by searching from root(N/K). Probably detectable by suitable inspection of several secret keys generated by the product, but (I think) undetectable from public keys alone. 3) Select a random seed and using a good PRNG, make the rest of generation process deterministic based on the seed. Use the "deadbeef" technique to select a modulus that has this seed as its least significant bytes. Factorise by extracting the seed from the modulus and repeating the deterministic key generation. This is detectable only by reverse engineering. 4) Select a random seed and use a short key PKE key exchange system (e.g. Elliptic curve) to generate a session key and a key exchange cyphertext. Use a key generation similar to (3) except that you seed the PRNG with the session key and deadbeef to make a key ending in the key exchange cyphertext. Factorise by extracting and decrypting the session key (requires a secret key), and repeating the key generation. Again this is only detectable by reverse engineering, but even after executing the reverse engineering you still cannot factor the keys generated because the program only contains the public key not the secret key. Method (4) is an interesting example of a "locked back-door". There is often an unstated assumption that back-doors have to be open. i.e. If you can find them you can get in. It isn't always true. Whereas it seems intuitively unlikely, it is not inconceivable that there is a way of putting a locked back-door into some forms of Feistel ciphers. The NSA would have been reluctant to put an open back-door into DES, but they would not have hesitated to put in a locked back-door. In my opinion the only safe assumption is that they could and they did. In cryptography you shouldn't trust your intuition, code with source or unexplained algorithm components. Ian Ian_Miller(a)bifroest.demon.co.uk FAI-D10204 PGP key 1024/FCE97719 FP: 2A 20 46 10 E5 96 27 40 91 B1 95 BA CA D3 BC 14 Antworten auf Deutsch waeren mir angenehm. -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information Tell your friends 'n neighbors you read this on the evil pornographic Internet "Where one burns books, one will also burn people eventually." -Heinrich Heine People and books aren't for burning. No more Alexandrias, Auschwitzs or Wacos.

1 0

Re: Homo/bi/sexuals Most Destructive (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 24 Jan 97 21:33:41 +0000 > From: "Attila T. Hun" <attila(a)primenet.com> > Subject: Re: Homo/bi/sexuals Most Destructive Much drivel about AIDS deleted. > One of the saddest commentaries on the entire problem is the > man, a Pan-American flight steward, who was identified as carrier > #1 by the Communicable Disease Center (CDC) in Atlanta; he died The correct term is 'Patient 0'. Jim Choate CyberTects ravage(a)ssz.com

1 0

(fwd) New keyserver available
by Damaged Justice 17 Dec '03

17 Dec '03

>From: tage(a)cc.uit.no (Tage Stabell-Kulo) Newsgroups: comp.security.pgp.tech Subject: New keyserver available Date: 24 Jan 1997 16:11:26 GMT Lines: 12 Message-ID: <5camve$3d4(a)news.uit.no> A new PGP keyserver, still _very_ experimental, is available at host dslab1.cs.uit.no at port 24162, use telnet(1). In general it will find a key in a few seconds. Your comments and suggestions are solicited. -- //// Tage Stabell-Kuloe | e-mail: Tage(a)ACM.org //// /// Department of Computer Science/IMR | Phone : +47-776-44032 /// // 9037 University of Tromsoe, Norway | Fax : +47-776-44580 // / "'oe' is '\o' in TeX" | URL:http://www.cs.uit.no/~tage/ -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information "We think people like seeing somebody in a uniform on the porch." -US Postal spokeswoman, quoted in AP, 1/27/96. I don't know about you, but most people I know who saw someone in uniform on their porch would pull out the shotgun...

1 0

Re: Homo/bi/sexuals Most Destructive (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 24 Jan 97 21:33:41 +0000 > From: "Attila T. Hun" <attila(a)primenet.com> > Subject: Re: Homo/bi/sexuals Most Destructive Much drivel about AIDS deleted. > One of the saddest commentaries on the entire problem is the > man, a Pan-American flight steward, who was identified as carrier > #1 by the Communicable Disease Center (CDC) in Atlanta; he died The correct term is 'Patient 0'. Jim Choate CyberTects ravage(a)ssz.com

2 1

Re: Airport security [no such thing]
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Thu, 23 Jan 1997 ichudov(a)algebra.com wrote: > Is it really true that my response was tossed out as flames? a) NO posts have been "tossed out." Your response was sorted into the "flames" list--not because it flamed directly, but because it was part of the threat started by Dimitri in which he engaged in flaming. b) While I realize this is a judgment call that others might dispute, I don't think it makes much sense to post to the moderated list only the parts of threads that are not flamish. I would rather keep thread intact on one list or the other. There are exceptions. I put one of Dimitri's post on this thread into the moderated list because the point he made did not require particular knowledge of the entire thread and had non-inflamatory relevance. > It was crypto-relevant. Perhaps, but crypto-relevance is NOT the criterion by which I am moderating the list. I am sort on the basis of (a) emotional, non-relevant personal attacks on list members, and (b) spam. I believe (and so far the postings have borne me out) that in an atmosphere of civil, reasoned discourse, the relevance issue will largely take care of itself. By the way, contrary to what Dimitri has alleged, I have posted every message from him in which he was able to restrain himself with regard to gratuitous insults and/or spam. In other words, the set of Dimitri posts that have appeared on the moderated list is not the null set. By the way number two, this response will be posted to the flames list and NOT the moderated list. Even though I have not flamed anyone, two things keep it off the moderated list: (1) my policy about keeping thread on the same list where possible (see above), and (2) basic precepts of fairness. Though Dimitri has stated-- without a scintilla of evidence--that my moderation policy would be used to attack him and not give him the opportunity or forum to defend himself, I am keeping ALL personal attacks off the moderated list. Those who are subscribed to the "flam" postings can see numerous unkind posts about Dimitri that I have not allowed on the moderated list. That policy applies to me just as much as to anyone else. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Comments
by satan_is_a_hacker＠juno.com 17 Dec '03

17 Dec '03

All comments on my article will be welcome and replied to.

1 0