December 2003 - cypherpunks-legacy

Re: crypto anarchy
by an42035＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Count on it. Things are moving much too slowly on "our" side. Entities >like AT&T, Warner, etc. stand a good chance of controlling much of what >becomes "the net" in the future, if much of this technology is not: >1) in place and functional >2) easy to use by the clueless and lazy as well as techies >3) accepted for use within the network, indeed considered *part of* the > network both as "flavour" and technical specifications >4) impossible to remove - no govt/corporate turning back of the tide >VERY soon. In addition the populace has to become aware of: >4) HOW to do all of this - easy "newbie" software is needed - plug-n-play >5) that privacy is possible. Most have forgotten this. If we need this stuff out VERY soon, then there is a serious problem: Time-Warner, AT&T, etc. can afford to spend major $$$ on implementing technology, including having employees work on these projects full time, while the cypherpunks work that goes on is largely on a part time basis by otherwise employed professionals, or students. Not to insult anybody; each contribution in anonymous mail, digital cash, dc-nets, crypto software, etc. is GREATLY appreciated. However, the progress that has been made still has a fun oriented research and development slant. But all the same, if what you are saying is that these volunteer/hacker types have to battle for the future of the net, there's no way. I mean, look at all the stuff Phil Zimmerman went through to put out one crypto program. Can you expect anybody else to do the same? Many volunteers have spent countless man-hours working on PGP, and by no stretch of anybody's imagination is it "plug-n-play" ready. I can't tell you how many announcements of upcoming Windows PGP front-ends I've seen. I'm sure many hobbyists are working on it as much as they can, and I'm glad, but these people can't be expected to compete with real software development efforts. A software company that wants to make "plug-and-play" easy to use crypto software which meets #1 and #2 - including integration into popular mail software - will bury PGP or RIPEM by sheer numbers. Most people fall into the "clueless and/or lazy" category. >There's a lot of work to do. The Wired article may have called cypherpunks "millionaire hackers", but I don't think the majority of this list can afford to work on cypherpunks stuff full time like it probably needs to be worked on. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLMRcPcOOfkF1iwTdAQE7ygH+OixoYSJBqiH5HbLj4TSjnEaUJINZlndk /zBYfigU0hFYB12rEpI1MBsqep9DNSzR4aOqyQMz4WQ45ayBCp4ekw== =kQBw -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

5 4

Re: pseudospoofed out
by Doug Luce 17 Dec '03

17 Dec '03

to the individual with difficulties of a spoofing sort: the answer is procmail. my inbox script strips all recipiant header information. it also chops off signatures. it puts in a bogus From: line with a sequence number. it even parses the text for items like "My name is Joe Hoop," replacing them with "My name is XXXX." if i can't figure out who it is by the context, the sender loses. my outbox script matches the sequence number up with the proper recipient and ships my response out. rarely is the reply "I don't know who you are." dug

1 0

Re:backing
by doug＠netcom.com 17 Dec '03

17 Dec '03

F_GRIFFITH(a)CCSVAX.SFASU.EDU said: >Greshams law: "bad money drives out good" >i.e. where people have a choice (e.g. gold vs greenbacks post Civil >War), in making payments, they will use the lesser value money and >keep the higher value. Thus, the lesser value money will circulate, >the higher value money will not. So in essence you're saying that poorly-backed digital currency will win out over e.g. U.S. dollars? That's an interesting concept. (I mean the above literally, not sarcastically; I don't care to take either one side or the other of this question right this instant, although I will say that there must be some extra caveats to add.) Doug

6 5

PRIVACY: Shredded trash doesn't cut it
by System Operator 17 Dec '03

17 Dec '03

Fellow Cypherpunks, As if there was any doubt, the following will show that even shredded trash is not safe: >From _Search and Seizure Bulletin_, Vol 30, No. 9, September 1993 Shredded Documents - No Privacy Interest in Public Trash Massachusetts United States v. Scott, 975 F.2d 927 (1992) The Internal Revenue Service (IRS) suspected Scott of filing false income tax returns. IRS agent's searched Scott's garbage bags which were left in front of his house for collection and found shredded documents. The agents pieced the papers together and were able to establish probable cause to request search warrants based on the evidence revealed in the whole documents. The IRS presented a 47-count indictment against Scott. Scott moved to suppress the evidence, claiming the search of his garbage violated his privacy interests. His motion was granted and the United States appealed. DECISION: Reversed and sent back to the lower court. The Constitution does not prohibit the warrantless seizure of shredded documents found in public trash. Scott relinquished his reasonable expectation of privacy in the garbage once he abandoned it outside his house to be collected or destroyed by a third party. That he may have desired secrecy by shredding the documents does not change the fact he left the garbage in the public domain, and the police were free to use their resources to collect the evidence. A legitimate expectation of privacy is measured not by the individual's desire to maintain secrecy, but by whether the government's action violates constitutionally recognized privacy rights. Because Scott had no constitutionally protected privacy interest in this trash, the appeals court decided his motion to suppress should have been denied. California v. Greenwood, 486 U.S. 35, 108 S.Ct. 1625, 100 L.Ed.2d 30 (1988) United States v. Mustone, 469 F.2d 970 (1972) Dan uunet!anagld!decode!dan -- system(a)decode.UUCP (System Operator) Cryptography, Security, Privacy BBS +1 410 730 6734 Data/FAX

1 0

Re: pseudospoofed out
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Dug writes that he intentionally strips out all identifying information from his incoming mail that would show who it is from. Truly this is a radical solution to the problem of spoofing. A basic principle of discourse is that the validity of an idea is independent of its source (which is why ad hominem attacks are considered invalid). Yet this principle is not widely followed (which is why ad hominem attacks are considered effective). Dug's solution enforces the discipline of judging each piece of mail on its own merits. Maybe more people should consider this approach. Hal Finney hfinney(a)shell.portal.com

1 0

(fwd) Re: Error in RFC1 321 (MD5)?
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

I thought (perhaps) this may be of interest - Forwarded message: > Newsgroups: sci.crypt > Subject: Re: Error in RFC1 321 (MD5) ? > Date: 18 Oct 93 09:10:29 > Organization: RSA Data Security, Inc. > Lines: 27 > Distribution: world > Message-ID: <BURT.93Oct18091029(a)chirality.rsa.com> > References: <29u8jqINNn0s(a)umbc7.umbc.edu> > NNTP-Posting-Host: chirality.rsa.com > In-reply-to: olson(a)umbc.edu's message of 18 Oct 1993 10:18:34 -0400 > > In article <29u8jqINNn0s(a)umbc7.umbc.edu> olson(a)umbc.edu (Bryan G. Olson) writes: > > I just ftp'd RFC 1321 ( MD5 Message-Digest Algorithm ) from > rsa.com, and I believe there is a minor error in the > specification of the algorithm. > > On page 5, the four operations used in the four rounds are > defined, and the operations for round 3 and 4 seem to have > mis-matched parameter names. Specifically from page 5: > > [...] > >> /* Round 3. */ > >> /* Let [abcd k s t] denote the operation > >> a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s). */ > >> /* Do the following 16 operations. */ > [...] > >> /* Round 4. */ > >> /* Let [abcd k s t] denote the operation > >> a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s). */ > >> /* Do the following 16 operations. */ > [...] > > Yes, the 't' should be an 'i'. Not a major source of confusion, but > something that should be noted and corrected. > > -- Burt Kaliski > RSA Laboratories > _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

1 0

Re: PRIVACY: Shredded trash doesn't cut it
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

Ah, the infamous Shred Scott decision.

1 0

Re: pseudospoofed out
by nobody＠alumni.cco.caltech.edu 17 Dec '03

17 Dec '03

on Wed, 20 Oct 93 09:23:03 PDT, hfinney(a)shell.portal.com (Hal Finney) writes: < A basic principle of < discourse is that the validity of an idea is independent of its source < (which is why ad hominem attacks are considered invalid). Yet this < principle is not widely followed (which is why ad hominem attacks are < considered effective). i believe the reason this principle is not often followed is because so much context is gained from knowing who a person is. not just the message history, but knowing what a person's experience and profession are can be extremely helpful in understanding the intent of the communication. removing the sender's identity also removes a substantial amount of semantic information. computers might be able to send billions of bits per second over a network, but it's up to us humans to remove the degrees of freedom and figure out what is really meant. < Dug's solution enforces the discipline of judging < each piece of mail on its own merits. Maybe more people should consider < this approach. i don't think that's what he meant. Doug Luce <doug(a)lm.net> says: < if i can't figure out who it is by the context, the sender loses. which means to me, doug is still using contextual information gained by his knowledge of the sender. as an example, i often find mr. detweiler's posts to this list difficult to interpret, since i don't know him personally. is he playing devil's advocate? is he just trying to be entertaining? is he deliberately behaving in a schizophrenic manner, or is he just a victim of MPD? i can't tell from his posts alone. which is why i believe that honest humans for the most part will have no good reason to spoof. trusted communication just won't work without reputation. both the sender and receiver rely on context provided by reputation to send comprehensible messages. ---- i liked the point made recently that e-mailing lists are often like discussions at a coffee house, and are not formal environments for objective culling of opinion.

1 0

taggnets
by kone＠COURIER1.SHA.CORNELL.EDU 17 Dec '03

17 Dec '03

Taggnets are also found in the main components of "home-made" bombs. At least as early as '85. (call it a childhood indiscretion.) Components like high nitrogen fertilizer and heating oil #5. This alows the investigator to narrow down about when and where the components were bought. (I had bought a large quanty with my fathers card.) Most cases are solved because the "mad-bomber" is follish. i.e. keeps on buying more components or explosives, after the first bombing. Or, like me, bought in large quantys with no real reason too. Just something to think about. Kone. (yes it is a real name.)

1 0

Re: crypto technique
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >So, if I could prevent you from finding c, then you couldn't solve it. >How can I do this? By adding another constant. [...] >136.375x^4 + 139.25x^3 + 33.625x^2 + 110.75x + 179 >So what values for A,B,C,D,E,& F did I use? Have fun factoring! :) Sure, I'll give it a whirl as soon as my exams are over. Offhand, it looks like you get five equations in six unknowns, which is under-specified. So possibly one parameter can take on any value (or maybe any odd value), and the rest are then solved in terms of the fixed variable. The variable paramter can only take on values less than P (maybe only odd values under P), the number of unknows is then 2*(nestings) - 1; everything still looks linear. However, I haven't actually tried yet, so we'll see! This isn't meant as a flame (in fact, this method is very interesting), but you've posted two or three methods and declared them all impossible to break. Are you yourself trying to break these schemes? The very first method posted would have fallen under scrutiny. Also, mail any additional info to me directly; I'm behind on list mail. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLMV1CIOA7OpLWtYzAQGQRAP8CT79JpMKxVb/R//GVUfmCJ2ybtf8ASGY BZa8bsL1VG49sxpoe7LsnQH2mJVAv3GloJhnuVN0d/MbTmohN6mgtGXbrQxvTdyn r0eaTYcrXI0hiR5ahPp5SdfAHGuQ9LeQDermiiU+DK8I6lc+K6tzG0ZOUvs4r80n cF4K9aXSaLQ= =wMas -----END PGP SIGNATURE-----

1 0