December 2003 - cypherpunks-legacy

Glitches in PGP Messages
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

And now for something completely different, a question. Lately I have been the recipient of PGP encoded messages which look like this: ------Begin PGP Message------- ssdfkighjsdw'kjojnhsfkassofka[ofk[oaekfowwjkg[owlketglks[orkg[wpokloekfgtfoweo sadifhjwpiejfowjieffgoweito[ikweo[gikw[oekjg[owkjgokjweljkgw[jfowjhygwrkoettf[ sadfflo sadkpjfpajf[oqwkfo[qkfo[qekf[oekqffoekfg[wekfgoejfgoiwqekjkff;lqfpkqwep sd;kljfgfgv'pkisjdfgf'pskjmdgvmeduwelgl;wleiogl;ed;h,./rthledky,elky;elrth;rel ------End PGP Message-------- PGP gives me an error message if I try to decrypt this ciphertext. However, if I edit the ciphertext beforehand (connecting the two truncated lines) , the ciphertext can be decrypted. Is this just a glitch in the transmission? What would cause a text line to be disrupted onto two lines? I suppose it could occur during downloading or when it is sent thru the NET. My friend uses MacPGP 2.3. This has happened the last two times I have gotten my buddies messages. Any ideas as to what the possible causes of this simple glitch could be? Thanks. Scott G. Morham ! The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second ! and Third ! Levels of ! Information Storage and Retrieval ! DNA, ! Biological Neural Nets, ! Cyberspace

2 1

DES
by Jamie Jamison 17 Dec '03

17 Dec '03

Two questions about DES. 1) If the current, 56 bit, DES system is so easy to break why don't people switch over to a DES system that uses a larger key space, say 128 bits? People obviously aren't, so what's the barrier to this? 2) How much longer would it take to break triple DES versus standard DES using one of the key-breaking machines described? As an aside I'll point out that I go by the Yakima Research Station once a month when I'm out with my National Guard unit, this is the radio dish that's on the cover of _The Puzzle Palace_. It's not a very large installation. Jamie Jamison niteowl(a)u.washington.edu

3 2

Re: DES
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

I don't think it takes the cube of it. There are 56 bits in one key, and 112 bits in two keys, so there could not be an entropy of more than 112 bits to triple DES. It is no more cryptographically secure than double DES because it uses 2 keys. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Re: pornography & the ``cypherpunk cause''
by doug＠netcom.com 17 Dec '03

17 Dec '03

Edward Elhauge <ee(a)lever.com> said: >A counter-example might be: > 1) Someone breaks down my door while I am eating. As per California law >there is a REBUTABLE PRESUMPTION (embedded in statutory law) that my life is >in danger and that deadly force is justified. Consequently, my response to the >situation is ruled justifiable homicide. Doesn't this need to be phrased more cautiously? As I understand it, you need to demonstrate to the jury that you feared for your life, and someone breaking down your door is not enough for that. Unlike in some other states, in California it is essential that there be a clear threat to your life. > 2) Someone breaks down my door while I am eating. A feeble minded guest >of mine shouts out "I don't think he's armed." Consequently, the police find >that the man is either not armed or had a water pistol. I might do 5-10 for >manslaughter or 2nd degree murder. The phrasing of this makes me think that you and I have the same impression of the law, but that you just were a bit terse in phrasing #1. >Your example doesn't involve a law that requires knowledge or a state of mind >to be guilty. Laws about the transport of illegal information do! I tend to be concerned about arguments that don't take the infamous "ignorance of the law is no excuse" into account. That is, one needs to make a clear distinction between ignorance of the law and ignorance of the action itself. There have been times in this particular thread when I wasn't clear whether people were making that distinction. Doug

2 1

Re: Cypherwaffle on spoofing
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

Arthur Chandler writes: > What I find odd is the number and vehemence of posts ON A LIST DEVOTED >TO ENCRYPTION saying "Hey, it's a fact of life, accept it" -- even >dragging out Machiavelli's profoundly mistaken "if you can't enforce >it, don't prohibit it." "It's a fact of life" is a fact central to the, ahem, cypherpunk cause. Virtual personas are here. The only question is how this will change the way people deal with each other over the net. >Of all the groups on the Internet, I would >think that this one would be in a special position to say "put your >digital John Hancock on your post if you want to to taken seriously." That is one possibility: people start signing posts with IDs that verifiably mean something over a wider range of net and RL spaces than just a single small world like cypherpunks(a)com.toad. Personas which consist only of postings here might come to be taken less seriously, even if their content appears useful and constructive. I do not see what authoritarian action is needed, desirable, or practical. I would rather see a consensus emerge over how to behave in this new environment. I notice you didn't sign your post. Can I conclude that you do not want it to be taken seriously? -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

German "NSA" has a Clipper plan too? + News of German conf.
by Stanton McCandlish 17 Dec '03

17 Dec '03

More int'l. news of some interest. **** Begin Forwarded message **** From: Reiner Perivolaris <tutlaibe(a)w250zrz.zrz.TU-Berlin.DE> Message-Id: <9310082023.AA03362(a)w250zrz.zrz.TU-Berlin.DE> Subject: CCC'93 and You ... To: fig(a)well.sf.ca.us Date: Fri, 8 Oct 1993 13:23:34 -0700 Re-To: reiner(a)physik.tu-berlin.de X-Mailer: ELM [version 2.4 PL5] Content-Type: text Content-Length: 1827 The plan of the Clinton administration for the ISDN-Net (?!) will be a part of a workshop or a own theme and the fight for private cryptos (eg. PGP), include the trouble of P. Zimmerman. The 'Clipper/Skipjack'-Chip can/will be a theme, because storys are "on their way", that german BSI (*my* translation:Federal Office for Security of Informationsystems) and the TELEKOM (Telephoncompany) have a plan like the NSA. Where all this and more? At the CCC'93 (10. Chaos Communication Congress 1993). 27. -29. Dec. 1993 Eidelstedter Buergerhaus Alte Elbgaustr. 12 Hamburg-Eidelstedt Germany Organization: Choas Computer Club e.V. Address: CCC e.V. (Orga-CCC'93) Schwenckestr. 85 20255 Hamburg Germany I am one of the guys who organize this workshop and the congress. We are reading 'comp.org.eff.news', 'comp.org.eff.talk' and other information we can get. But only to talk about the EFF *we thing* is not enough. It would be nice, if members of Your organization will be there and have the chance to explain what EFF is doing. And when You get new members *we hope so* it will be good for Your movement and the 'global village'. **** End Forwarded Message **** -- -=> mech(a)eff.org <=- Stanton McCandlish Electronic Frontier Foundation Online Activist & SysOp "A nation that is afraid to let its people judge the truth and falsehood of ideas in an open market is a nation that is afraid of its people." -JFK NitV-DC BBS 202-232-2715, Fido 1:109/? IndraNet 369:111/1, 14.4V32b 16.8ZyX

1 0

Re: Uniqueness and "is-a-person" credentials
by hal＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

I remembered about is-a-person credentials after I posted. I had thought this idea came from Chaum but I didn't see it in his 1985 paper. I don't recall the details of this credentialling mechanism, so take what I say here with a grain of salt. I hope someone can post a cite. One point is, there is no need to associate these with states. Private corporations could easily issue is-a-person credentials. You show up and let them take your thumbprint (retina print, DNA scan, ...), and they give you the credential. They don't need to know your name, just that you don't already have a credential. (The different agencies would have to share a database as is done in many industries today.) Then, if L. Detweiler wants to accuse Eric and Jamie of being the same person, they can disprove it by exhibiting their different is-a-person credentials. (They might not "exhibit" them, they might use some kind of zero-knowledge proof to show they are different.) If anonymity and spoofing get to be too bad a problem, most people may refuse to have net.dealings with anyone who is not willing to show an is-a-person credential. Among your pseudonyms, only one can show it, otherwise they will be linked. This would force all but one of your pseudonyms into second-class citizenhood on the net. This may seem unfortunate, but as those who just got through flaming Detweiler remind us, if something like this is possible then just because you don't like it, that won't stop it from happening. It may be that in the future the net is not a very anonymous environment, just because the technology exists to catch spoofers. L. Detweiler may get his wish after all. Hal Finney hfinney(a)shell.portal.com

1 0

Re: on anonymity, identity, reputation, and spoofing
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

I believe it is very valuable to have an anonymous identity that nobody can associate with your actual one. Besides asking embarsassing newbie questions (which I will become more and more famous for), I am learning a lot about what it means to build up an anonymous reputation. I have posted to a few other newsgroups as well, and I am having dialogues with people through e-mail. I feel as though I have a real identity. My actual identity also has reasons for not wanting to appear on this mailing list. I wonder if I am catching some strain of multiple personality disorder... Wonderer ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

jrk@sys.uea.ac.uk (Richard Kennaway)
by smb＠research.att.com 17 Dec '03

17 Dec '03

I have a fairly strong bias these days towards staying out of meta- discussions on mailing lists and newsgroups, and primarily contributing when I have some particular expertise I can bring to bear. I'll break that rule now... There's a persistent tendency on this list to confuse technical feasibility, political feasibility, and ultimate desirability. The whole business about pseudonyms is a good example. Guess what -- the ability to use pseudonyms is not new. Yes, the Net makes it easier, but they're far from rare in the ``real world''. The potential for abuse is obvious -- and that's why the government has tried to make it harder and harder to create truly-functional aliases, to the point of criminalizing many aspects of it. Nor is the concept of an anoymous spending mechanism new. We speak of ``digital cash'' for a reason -- its essential properties are modeled on those of real cash. Of course, when real cash became problematic for the government, they did the obvious -- they promulgated laws and regulations regarding what you can do with it (i.e., the rules on forms to be filled out when leaving the country, the bank rules on large cash transactions, etc.). Are any of these laws 100% effective? Or even substantially effective? Of course not -- but they've accomplished two things. One, they've raised the ante for playing certain games that the government doesn't want played. Two -- and probably more important -- they've provided the government with a new weapon to use against you. Can't convict Al Capone of racketeering? No problem; just charge him with tax evasion. So it is with the net. When email and digital cash become social forces in the larger community, as opposed to our electronic subcommunity, you'll start to see more regulation. It might not even be purely governmental; the large companies that want to run ``the'' net have their own agendas, which concern things like large profits and keeping the government away, and have little to do with privacy. Remember Prodigy? I haven't noticed that it's lacking for customers because of their policies. Or -- envision, if you will, an ukase that the FCC will regulate the Internet, and that anyone who wants to connect will have to agree to an acceptable use policy that includes the requirement that all mail be digitally signed, both by the individual and by the site, and that mailers enforce this requirement. Can't happen? Nor do I think that ``offshore data havens'' will help. Apart from the fact that most major governments are basically in accord on the question of who makes the rules (them, not the people -- or did you see any governments denouncing Clipper? I saw lots of endorsements), there is a potent weapon that can be used: mandatory disconnection from the net for any country that doesn't co-operate enough. (Even the famed Swiss banking system is under a lot of pressure these days on such issues, and they and the Swiss government are co-operating a lot more with other countries. Wanna place any bets on creating a whole new anonymity structure?) For that matter, international bandwidth is a matter for diplomats as well as technicians; permission to create new circuits will simply be withheld. If you doubt me, try placing a call to Cuba, or to the former USSR. After your Nth ``circuits busy'' message, don't bother asking why the long distance carriers haven't installed more trunks, when there's obviously a demand for them. Certainly, there are ways around some restrictions. The inability to call directly between Israel and the Arab countries has bred call- forwarders. But to the extent that these have come to official notice of governments that care to suppress the traffic, they've been shut down. This is force majeure, friends, not bits on a wire. Cryptographic technology is an enabling mechanism for various social changes. It by no means makes them inevitable. Don't delude yourself on that; the political will to do something is more important when various alternatives exist. To allude to fiction again, I've heard people cite Margaret Atwater's ``The Handmaid's Tale'' as an argument against electronic banking and the like. In the book, at the stroke of a pen all women's bank accounts were cancelled. But that's the wrong lesson; the real issue was the governmental decision to take the action. And throughout the centuries, governments have had no trouble stripping hated minority groups of their assets, without any need for computers. If you want a Brave New Digital World, it isn't sufficient to build the tools. You also have to convince people that it's a good idea. Oh, the online world is coming; no doubt about that. But people have to be convinced that privacy and the like is in their interests, that it will solve problems that *they* will have. Equally important, they have to be convinced that it will not create new problems, to their perception (and the perception may have little to do with reality. 500 -- nay, 500,000 -- channels of digital information to the home will do nothing to educate those who prefer to learn about the world from McData Services, or from CBS/NBC/ABC/Fox/AP/UPI. There are myriad sources of information right now that most folks never see, because they don't know of them, don't trust them, or just don't want to bother. Face it, it's easier to let someone else do the editing -- but then you have to trust them. Do you want an example? Here's how to shut down an anonymous remailer. First, find a name for a host that no longer exists. Send a note through the remailer to someone putatively on that host, making it appear like a stolen account (bin(a)foo.bar.edu, or some such). The mail should appear to discuss criminal activity, and be signed with a name from the proper ethnic group. The message will be queued forever, of course, and will likely be stored on the backup tapes for the mail spool directory. Next, send a message through the remailer to president(a)whitehouse.gov, threatening the president. Poof -- the Secret Service *will* come investigating (those guys have no sense of humor). They may or may not believe that the planted note is genuine. But they will approach the appropriate dean to demand that this tool of criminal activity be shut down. Quick -- how many remailers have the support of the university? How many boards of trustees -- at state universities, often linked to the government -- will back them, if the Secret Service ``requests'' that they be shut down. The answer, of course, is to have a defense ready in terms that such people can accept. Show the good remailers can do (i.e., alt.abuse.recovery, though I know of the controversy surrounding it). Show them as a paradigm for privacy. And show that abuses are not tolerated by the community. The recent ``traitor mail'' here is actually a good example. While there have been refreshingly few calls for limiting anonymity, there's also been no tolerance for the ideas expressed. I've gone on too long, and this message has started to ramble. Enough for now. --Steve Bellovin

1 0

DETWEILER
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, Lance Detweiler finished his most recent rant thusly: . . . is *this* what the Cypherpunks really stand for? UNFAIR INFLUENCE. ABUSE OF POWER. MANIPULATION. DECEIT. TREACHERY. EXPLOITATION. SECRET CONSPIRACIES. Lance, stop frothing at the mouth and get a life. S a n d y (aka Tim May, Eric Hughes, Nick Szabo, Perry Metzger, Duncan Frissell, Mao Tse-tung, George Herbert Walker Bush and a cast of thousands) >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0