December 2003 - cypherpunks-legacy

Re: standard for steganography?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Doing a pnmstego isn't quite the right approach, since it's a special-purpose tool that advertises its presence. A more appropriate general-use tool would be something like pnmbitplane, which would let you do something like extract a specific bitplane from a ppm or pgm as a pbm, and a reverse tool which would let you substitute or xor a pbm into a pgm or ppm, with appropriate options for the ppm versions that let you do one color, all three, etc., and for both ppm and pgm to let you pick which bitplane. You'd also have to add something appropriate for padding, like a random-fill vs. 0- or 1-fill option, or else provide a tool that makes a string of bytes into a bitmap shaped like a given pnm. Some advantages - it's more general, there are other uses for it (such as adding titles to ppm pictures), it's not much more work to write, and only the NSA agents reading cypherpunks will know that's why it's there :-). A disadvantage, of course, is that potential users may not guess, unless people tell them things like "Oh, yeah, you could use ppmbitplane to do that, of course". This also lets you reserve the name ppmstego for translating between ppm and Stego Mac format. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

MEET: NE Ohio
by Derek Atkins 17 Dec '03

17 Dec '03

I'm going to be in Cleveland, March 3-7 this weekend (all day Friday-Sunday inclusive), so if anyone would like to meet, possibly echange signatures, or just chat, please send me personal email before 4pm Thursday! Hope to hear from some of you... -derek

1 0

Anybody heard of "The SLED"? (long)
by mcb＠net.bio.net 17 Dec '03

17 Dec '03

On ba.internet I got a pointer to something called "the SLED", a database of e-mail addresses, and requested the info file, which is appended. While the people offering the system seem to be interested in privacy, encryption, and PGP key service, there are some strange thing about it, especially where they require *you* to identify yourself to *them* when registering your address. My comments to the newsgroup appear at the end. -- Michael C. Berch mcb(a)net.bio.net / mcb(a)postmodern.com -------------------------------------------------------------- Date: Sun, 27 Feb 1994 18:56:21 -0800 From: Stable Large Email Database <sled(a)drebes.com> Message-Id: <199402280256.SAA10575(a)drebes.com> To: mcb(a)net.bio.net References: <199402280247.SAA16850(a)net.bio.net> In-Reply-To: <199402280247.SAA16850(a)net.bio.net> Subject: Sled Info ----------------------------------- SLED : Stable Large Email Database ----------------------------------- SLED is an attempt to provide a reasonable mechanism to maintain and search email addresses for individuals and companies that make up the on-line community. SLED is intended for those who have one or more mailboxes that are generally checked on a daily basis, and are addressable from the internet. --- What does it provide? --- I. Timely maintenance of current email address: Over a period of time a person may have many different email addresses, which come and go with the changing of jobs, internet providers, schools, and so on. Maintenance also means pruning the list for those who no longer interact on-line (and are perhaps dead). II. Realistic search parameters: Current email databases such as whois & netfind provide a search granularity that is useful only if you already know the person's email address. The data set is crafted by each individual user. It can contain entries for schools, occupations, research areas, nick names, and so on. See note below on how this data is kept private. III. Protection against the enemy: SLED is intended to provide a high quality data set which provides flexibility in searching, but yields protection against the enemies of large address books. The enemy can be one of the following. - Head Hunters/Body shops - Anonymous and Fake user accounts - Commercial Junk mailers IV. A repository for PGP public keys: SLED provides an alternative to the huge, very public "public key" rings on some of the foreign key servers. (If you don't know what PGP is, don't worry.) --- How? --- It costs a few $$, and it requires the use of snail mail ( USPS ) at least once. There are several reasons for charging a small (very small in this case) fee for this service. 1. Authoritative ID. For your data to be included in the database we require that you write a personal check. For the initial sign-up, we verify that the name on the check matches the name in the database. A signed check which clears the banking system provides very good authentication. A semantic note: we don't actually wait for the check to clear. We get the check, eyeball the data, update the computer and then send the check to the bank. If the check turns out to be bogus we go back and zap you. (So you see, there is a way to get a couple days of free time.) 2. By charging a small fee, we can help offset the cost of the resources used to maintain & back up the database. With the fee structure, no one will get rich or poor, but there is an increased likelihood that this database will be around for years. 3. By tacking on a few dollars to the initial fee, we hope to discourage people who would fail to maintain their data, and then drop out of the database, then re-join, then drop out, then re-join. 4. Every 5 months (or so), we email an invoice (typically for $5.00 US) for the next 5 months of service. This invoice must be printed and sent to us, with a check, via US mail. This procedure keeps all data reasonably current ( +/- 5 months), which is about as good as it's going to get for such a remote service. The point being, you can not just write a check for $50.00 and be covered for the next 4 years. --- Well, how much does it cost? --- Fee to add your data to the database: $4.00 US Fee to maintain your data: $1.00 US / per month --- Trivia --- - The database is meant to be hold REAL names, no aliases, anonymous, or otherwise bogus id's. - In order to search the database, users must themselves exist in the database. - The dataset you enter for yourself can never viewed as a whole. You are encouraged to enter data for previous & current schools, occupations & other organizations/institutions, but a match on a single item will not reveal the others. For example, you used to work at AT&T, and now you work for IBM. If an old friend was trying to track you down, they might search on parts of your First and Last Name and AT&T. If you were found, it would only show your one line entry corresponding to AT&T. The point being that although your data might be read as a personal resume, it won't be shown that way. Of course that won't stop your nosy friend from sending you email asking where you are working now. - People keep asking why the database doesn't have fields for phone & address. No! That kind of data is too personal for a large database like this. If you want someone's address, send them email and ask for it. - The searching criteria make it really hard to use this database for something like head hunting or generating a junk mail list (this is by design). --- Interface --- The interface is via email. This allows the database to span all services (cis, prodigy, aol,...) which have gateways to the internet. Also, it allows each user to craft their data with their own editor, in a flexible time frame. Searching the database via email, while very functional, is a bit more kludgy than is desirable. A searcher accessible via telnet will be put online once we get an idea of the bandwidth & cpu needs. It would certainly be cool to have interfaces to gopher and www also. Additionally, the future will make further use of PGP (ViaCrypt PGP in our case). --- How To Start --- Send Mail to: - sled(a)drebes.com subject 'info' for a (this) text - sled(a)drebes.com subject 'add' to add yourself to SLED - sled(a)drebes.com subject 'change' to alter your data - sled(a)drebes.com subject 'search' to search the SLED - bugs(a)drebes.com To report a bug. - comments(a)drebes.com To send a comment that isn't quite a bug. --- The End --- ------------------------------------------- From: mcb(a)umberto-eco.postmodern.com (Michael C. Berch) Newsgroups: ba.internet Subject: Re: NetPages Coming Date: 28 Feb 1994 03:07:20 GMT Organization: Postmodern Consulting, San Francisco, California USA Lines: 37 Sender: mcb(a)umberto-eco.postmodern.com Message-ID: <940227.185716.mcb(a)umberto-eco.postmodern.com> References: <mcculleyCLI2AI.DI9(a)netcom.com> <2k7a3b$lhp(a)usenet.ins.cwru.edu> NNTP-Posting-Host: remarque.berkeley.edu Summary: The SLED In the referenced article, cx132(a)cleveland.Freenet.Edu (Cliff Gillespie) writes: > [Response to Aldea NetPages] > Oatmeal! Not a flame, but this a pales in comparison to what the > folks running the SLED are doing. They have a setup where you > can store & search all sorts of stuff (where you sent to school, > where you used to live, jobs, books you've written, multiple > email addresses...), but only matched items are displayed. > You can send mail to sled(a)drebes.com with info in the subject > for a summary. I requested (and read) the SLED info file and was not that impressed. First of all, you have to PAY to be included in the SLED database. It is only $5 plus $1/month, which is not a whole lot, but the problem is that will so sharply limit the number of people who list there, so the value of the database is limited as well. And there is the pain-in-the-ass factor of having to pay them every few months or so. Plus, the SLED people seem to claim to be interested in subscriber privacy (by offering PGP [future?] and making the DB hard to make into a marketing list), yet seem to be totally anal-retentive about the DB being only "REAL NAMES", to the point of REQUIRING a real live personal check from you (not cash). There is also no provision for entering street addresses or voice telephone numbers, even if you WANT to, since they claim that is much too personal. Shouldn't users make that choice for themselves? This also makes the DB that much less useful, plus you have to search it BY EMAIL only, which is slow and clunky. Thanks, but NetPages sounds more useful to me. Or even "whois", for that matter. (The SLED people also claim that to use whois you have to know someone's email address, which is completely bogus.) -- Michael C. Berch mcb(a)postmodern.com / mcb(a)net.bio.net / mcb(a)remarque.berkeley.edu --- END ---

1 0

Re: I have FOIA'd the Clipper Key Escrow databases
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Steve Bellovin writes: > Good strategy. I still wonder if the decrypted keys are (all) classified, > while the encrypted ones aren't. After all, the local cops' magic decoder > boxes can strip off that layer of encryption (as, of course, anyone > who steals one of those boxes or bribes a local cop). I'm puzzled by the applicability of "classification" here. The NSA can classify stuff, since they're part of the military, and a few other government agencies can (State Dept., I think?), but are NIST and Treasury able to do so? (Assuming, of course, that we maintain the charade that the NIST and NSA are separate for crypto purposes.) I don't think they can, and if they could, they wouldn't be able to give any of the classified stuff to regular local cops. If things become classified by the NSA handling them at key-setting time, then they can't give them to the so-called escrow agencies, or if they do, those agencies can't give them to uncleared people. Perhaps the NSA's secret backdoor mechanisms in the key-setting process are classified, since the nation would feel very insecure if they knew about them, but that's a separate issue. Keys for batches of chips the NSA burns for use by Defense Department users are a different story, and probably have a different Family Key than civilian-wiretapping keys, but they're probably handled under entirely different rules anyway. > Anyway, I hope the idea works, or at least drives them a bit crazy... Bill

2 1

RE: Clipper Death Threat
by LYLE, DAVID R. 17 Dec '03

17 Dec '03

--> -->On Fri, 25 Feb 1994, LYLE, DAVID R. COMPEX wrote: --> -->>. . . -->> -->> -->3. Why we have a right to strong encryption. -->> -->> Actually, our constitution does not say we have the right to private -->> communication. It would be nice, but it's not a right. -->> --> -->Try the 9th Amendment on for size: --> -->"The enumeration in the Costitution, of certain rights, shall not be -->construed to deny or disparage others retained by the people." --> -->Privacy was a long recognized right in Anglo-American juris prudence. It -->goes all the way back to the very English idea that "a man's home is his -->castle." --> Sandy, please re-read what I said... "private communication". If this were a right, then wiretapping AT ALL would be illegal, and it is not. Don't get me wrong. I am all for private communications. I'm very much against restricting the public's access to encryption technology. What gets me is when everyone runs around saying "this is a right". lyled(a)pentagon-emh9.army.mil --> --> S a n d y --> --> --> -->

4 4

RE: Civil Rights
by Blanc Weber 17 Dec '03

17 Dec '03

As I read the contribution from Jim Choate on the subject of "rights", I had some further thoughts & comments on the subject. Please delete if you don't care; it doesn't address cryptology directly, but some of you *are* interested, and if you have further comments please just send to me and copy only those others who also have expressed interest. ~ Blanc ---------- >From Jim choate: Seems to me that a 'right' as is being discussed should be 'Civil Right'. When used in this context I believe a suitable definition would be the following: Civil Right A characteristic granted to a citizen of a country which is beyond the normal law making ability of that countries governing body. In effect it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government. It in effect says that there are certain facets of an individual which are outside the normal operations of a government and can not be regulated or otherwise controlled through legistlative means. ........................................................................ It is true that the term a "right" can mean different things, depending on how one is considering the word & its meaning; in terms of a governed society, the meaning should be considered within the context of action as limited by agreement/consent, as something that involves the group's assessment of what is to be allowed (or not) within the organization; what permission will be granted and by whom, for what purpose, considering the consequences to all involved. The ability to determine what shall be considered a "right" depends upon the knowledge and intelligence of those who can make such decisions, who can achieve a comprehensive view of the situation and put individual action into perspective within this sweeping view. Given such a requirement, I would question the order of things, in concluding what the proper source is for the establishment of what these right should be, and give serious examination to the interpretation of what the actual nature of our circumstance is, (within the context of a society "under" government, but with liberty & justice for all, etc.). It is a bit difficult to make a succinct sentence which comprises all of my thoughts into a few sentences, I hope the above is not too difficult to understand. Not to make an example of Jim's contribution, but it just so happened that going through the sentences in the paragraph offered by him, I found concepts which I see as sources ripe for confusion & contention: A characteristic granted....... . So, the origin of this 'right' is from the decision-making of those elected to make considerations of this kind, which no one else is permitted to make. And I wonder: what qualifies them for this, the exclusive right to determine what it is all right to do within the context of a governed body of people, to be the ones who "grant" permissions to move, to do, to act. i.e., the source of an allowance to movement comes not from the ability to think correctly about it, to make valid judgements, but only from a permission *granted* to one by another. This immediately puts an individual's own thinking in danger; there is created the possibility of having one's own decisions categorized as without merit because they do not serve the purposes of the government, or because they do not serve the purpose of the governed society (the significance of which is seen as more important than that of being an individual of a singular character - compared to, say, an amoeba which absorbs all, as societies often begin to imagine themselves to be and presume themselves to have the right to demand utter mindless conformity on account of their numerous fears of what wanton individuals might do). It is unreal, that the determination for what is a 'right' is thought to come not from the ability to think successfully about life, liberty & the pursuit of happiness, but from the position one has been awarded over other citizens. This is like the right to a position over their minds, as well. And the ability to think and to serve the purposes of one's own interest are seen, then, as a crime, unless first submitted to the State for review and authorization as politically acceptable and therefore allowable. ...it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government...... . who are all honorable men..... :>) who recognize the merit of being an individual, not simply a "member" or society; i.e., not a lesser being, a minor "element" of the greater good, the Great Society, but, au contraire, who is expected to engage (to the max) in the pursuits explicity named in the Constitution (or was it the Declaration of Intent, Know What I Mean, George). ...there are certain facets of an individual which are outside the normal operations of a government . . . . . . As an exception to the rule? where most of the facets of being an individual are *within* the "normal" operations of a government? This concept does not represent they way that I think of the activities or the boundaries of my life, nor what I would wish to impose on others (or no one that I could admire). I'm sure government employees would agree with this, where I would not. It really is necessary to consider what is "normal" for a human being first, rather than what is normal for a government. First there must be someone to be governed......and a satisfactory reason why they should be governed. ...certain facets of an individual... cannot be regulated or otherwise controlled through legistlative means . . . . So there are a "few" things to be acknowledged, after all, as existing outside the atmosphere of governmental control. You know, "legislative means" are only the precursors to action; legislation only arranges verbally the threat of what will later be done physically to someone if they do not comply. This statement implies that one is only free secondarily, but primarily exists within an environment of control (external to one's own). I don't think it was intended that citizens of the US think of themselves as regulated first and freemen second. I don't think this is the correct way to think about life per se, or about "rights" within the context of an organization. Furthermore, the truth of the matter is that legislation alone does not control my (or anyone's) actions from some power of its own, and it alone does not automatically convince me of what I ought or ought not do, simply because it has been written, and voted agreeably upon, by members of an electorate. They could all be wrong. The control which exists as brought about by legislative means is only the effect upon the mind of those who will fear the consequences, delivered by "enforcement personnel" armed with weapons of subjugation. And as we all know, legislators themselves have ways of getting around this fear and its expected consequences. But this does not necessarily do any justice to reality, the cause/effect that we live with in the 'real world', which it is our responsibility to come to terms with if we want to live and have a quality existence. And this is what is left out of legislation: that we have to come to terms with it (reality) independently, not only in association with each other, and that we have to do this first in regard to our own lives, before we worry about those of others. The direction of the concept of a 'right' is set towards group thinking (the collective), whereas the Constitution would set it in the other direction. Gosh, I'm so glad everyone on this list is crypto-anarchist and can appreciate the fine details of anti-government analyses. ~ finis ~

2 1

standard for stegonography?
by marc＠tanda.isis.org 17 Dec '03

17 Dec '03

Jef Poskanzer <jef(a)ee.lbl.gov> writes: > Is there a standard for stego yet? I just added stego and de-stego Given that the whole object of steganography is to hide the very existence of a message, wouldn't a standard be counter-productive? Cheers, Marc --- Marc Thibault | Any warming, global Automation Architect | or otherwise, is Oxford Mills, Ontario, Canada | welcome. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQA9AiyT2YcAAAEBgKVboQejsR2t2U70HoWOXTIqlWUCRGkTht8Yn/4kuzWby/e3 Z9tT8RHJbAx9us7QZwAFEbQdVGFuZGEgTWFpbCA8bWFyY0B0YW5kYS5vbi5jYT4= =aFhG -----END PGP PUBLIC KEY BLOCK-----

1 0

standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

Is there a standard for stego yet? I just added stego and de-stego filters to my pbmplus image toolkit, using a simple protocol I made up on the spot. Now I'm wondering if I should make them compatible with existing stego tools. --- Jef

6 18

How to clear sign messages with PGP (FAQ)
by exabyte!smtplink!mikej＠uunet.UU.NET 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > How do you get those great signatures on your posts? > > I've been trying to do this with PGP, but I only get a signature file. This > file seems to be a binary file or just a signature. I'll use a command > like: pgp -s filename. > > Perhaps your using a shell? No, I just use this MS-DOS batch file called sign.bat: pgp -sta +clearsig=on %1 The %1 expands to the first argument on the command line. To sign a text file called toscott.txt, I just give the command sign toscott.txt When you get a message signed like that, you should be able to verify the signature by simply executing pgp on the file you get (provided you have my key -- it is on the key servers, available by finger mpj(a)csn.org or mpjohnso(a)nyx.cs.du.edu, ftp://csn.org/mpj/mpj4.asc, or on my BBS (303-938-9654): pgp frommpj.txt For more pgp tricks, see the FAQ ftp://netcom.com/gbe/ (echoed on ftp://csn.org/mpj/public/pgp/) or on the Colorado Catacombs BBS. ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-938-9654 | | | | / _ | mpj(a)csn.org ftp csn.org \mpj\README.MPJ for access info.| | |||/ /_\ | aka mpjohnso(a)nyx.cs.du.edu mikej(a)exabyte.com | | |||\ ( | m.p.johnson(a)ieee.org CIS 71331,2332 VPGP key by finger | | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLXdfdj9nBjyFM+vFAQEkDAQA0sp3qwbXBcp9F4LhtHaLCtag0LKXR1XQ 6hlNsE+M5KIZzLBYcQirlMY0qQKeKwXg9SE3kPs/m/hBySsGbFMqVh0OBSVNjT8a 9QizZB2MZQg+oh91eyNq+Ys5SG04TeOCQtW5UtKdqD4Pe+Teb7UIJxbCq+gGaQ0O Ba1dF1DC8/4= =6W/G -----END PGP SIGNATURE-----

1 0

Re: How to do encrypted telnet without being root (tutorial, includes src)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

That's quite interesting, but it sure looks like it's unable to encrypt the only part of the session that I really want to encrypt: the password. --- Jef True - that's why I suggested using one-time passwords before you get to that stage. I'm using s/key myself. If you can't install s/key checking in login, you can use an s/key shell as a user process (assuming you can change your shell that is). By the way, S/Key *doesn't* need an intelligent card - you can do what I do and print off 100 passwords small on a credit-card slip. I fetched it as soon as I discovered this. It's not a perfect system but it helps. G

1 0