December 2003 - cypherpunks-legacy

Re: Need Suggestions for Random Numbers
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <9310060445.AA16280(a)toad.com> >From: peter honeyman <honey(a)citi.umich.edu> >Date: Wed, 06 Oct 1993 00:44:29 -0400 >Subject: Re: Need Suggestions for Random Numbers > >... recommended that i check >out marsaglia's paper in annals of applied probability v1n3 1991. I have this algorithm coded in C -- and will send it to anyone who wants it. It's not strong -- just long period. It's also part of the new "tran", as posted on sci.crypt and available for FTP on ripem.msu.edu - Carl

1 0

BBS seizures
by L. Detweiler 17 Dec '03

17 Dec '03

some annoying anonymous FIDONet apologist writes: >In any case, I am informed hobby sysops have been arrested and their >systems seized for allegedly illegal traffic on their systems of which >they claim to have had no knowledge. I believe this is the case in the >CT case pending. First of all, the Connecticut case you seem to be referring to is that of Michael Elansky (Hartford). See Computer Underground Digest for full details. This was *not* email. He had file downloads and kept around (uh) "fireworks recipes". We've got to track down these supposed cases where boards were seized for content. I consider them minor *anomalies*, and I think a rational analysis of statistics will bear that out. Turning a board into a systematic exercise in privacy violation is *not* the proper response to paranoia about law enforcement seizures. This punishes users for the misdeeds of overzealous officers. Sort of like ``because Steve Jackson was raided we have to monitor all traffic'' or ``because there are 50K missing children a year, you can't go outside to play''. Read the *scalding* decision handed down by the judge in the S.J. case on T. Foley and decide what the law *really* says about BBS seizures and operator responsibility. Don't these Fidonet operators *understand* that by perpetuating the myth that they are responsible for all traffic on their machines, that they are actually *playing into* the hands of authorities? they are *strengthening* the paranoid atmosphere. And in fact I am quite repulsed by their policies, posted here, that seem to cutely rationalize systematic invasion of privacy. IMHO FIDOnet operators are perpetuating that sort of media-hysteria-frenzy associated with illegal activities on boards by their warped policies. The outcome of Steve Jackson case should foster glasnost, ease, and freedom among the operators, but instead it appears to have had the opposite effect on FidoNet operators, who have done a fine job of erecting a vast, oppressive network of systematic surveillance more appropriate to the NSA. >Even if these cases are eventually dismissed, the >legal expense and personal disruption to a private party (usually a >young person of very limited means) is catastrophic and without >practical recourse. But this is absurd. There may be legal expenses associated with any illegal seizure. One may be subject to seizure and involved in a judicial process no matter *what* the policies. Would you rather approach that process saying that `I have no knowledge of illegal activity, I don't monitor any email traffic' or `uh, as far as I've seen nothing illegal is going on, and I know *everything* that's going on' or worse, `gee, somehow that one slipped by'? At the *very minimum* there should be no restrictions on cryptography use. And if they want to join cyberspatial society, they are going to have to drop their silly paranoias and bizarre policies and routine privacy invasion. Fidonet operators wallowing in delusion and hysteria appear to have missed an article by Joe Abernathy in the Houston Chronicle ~Feb 1, 1993: > AUSTIN -- An electronic civil rights case against the Secret > Service closed Thursday with a clear statement by federal > District Judge Sam Sparks that the Service failed to conduct a > proper investigation in a notorious computer crime crackdown, > and went too far in retaining custody of seized equipment. > > Secret Service Special Agent Timothy Foley of Chicago, who was in > charge of three Austin computer search-and-seizures on March 1, > 1990, that led to the lawsuit, stoically endured Spark's rebuke > over the Service's poor investigation and abusive computer > seizure policies. While the Service has seized dozens of > computers since the crackdown began in 1990, this is the first > case to challenge the practice. > > Sparks grew visibly angry when it was established that the Austin > science fiction magazine and game book publisher was never > suspected of a crime, and that agents did not do even marginal > research to establish a criminal connection between the firm and > the suspected illegal activities of an employee, or to determine > that the company was a publisher. Indeed, agents testified that > they were not even trained in the Privacy Protection Act at the > special Secret Service school on computer crime. > > "How long would it have taken you, Mr. Foley, to find out what > Steve Jackson Games did, what it was?" asked Sparks. "An hour? > > "Was there any reason why, on March 2, you could not return to > Steve Jackson Games a copy, in floppy disk form, of everything > taken? > > "Did you read the article in Business Week magazine where it had > a picture of Steve Jackson -- a law-abiding, tax-paying citizen > -- saying he was a computer crime suspect? > > "Did it ever occur to you, Mr. Foley, that seizing this material > could harm Steve Jackson economically?" > > Foley replied, "No, sir," but the judge offered his own answer. > > "You actually did, you just had no idea anybody would actually go > out and hire a lawyer and sue you." > > More than $200,000 has been spent by the Electronic Frontier > Foundation in bringing the case to trial. The EFF was founded by > Mitchell Kapor amid a civil liberties movement sparked in large > part by the Secret Service computer crime crackdown.

3 3

Re: POISON PILL
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Furthermore, pipe bombs throw shrapnel, and as such are anti-personnel > devices. The goal was to destroy data, not FBI agents. Booby traps that > take lives are considered in court as 1st degree murder. > There are more elegant approaches. Thermite, for instance :-) Actually, that could get you nicked for arson of Federal property, which carries substantial jail terms (a couple of anarchists who burned a government-owned flag a few years ago got 10+ years for it.) Releasing viruses can also get heavy penalties; keeping the malfunction (excuse me, "different data storage parameters") within your own machine is more likely to be safe, though destroying data on "Federal interest computers" (which manages to include banks and a few other things as well as government-owned systems) is also illegal, and your machine becomes a Federal interest machine if they steal it. You could do something really hostile, like have it boot OS/2 if someone gives the wrong password :-) Bill

1 0

Need Suggestions for Random Numbers
by jpinson＠fcdarwin.org.ec 17 Dec '03

17 Dec '03

Greetings from the Galapagos islands! I am working on a PC implementation of a one-time pad cipher, and am trying to develop a way to produce an "acceptable" random file to be xor'd with the plaintext. I have seen here and elsewhere descriptions of hardware random number generators (Geiger counters measuring random nuclear decay, microphones picking up background hiss etc.), but I need something that can be implemented entirely in software. I recognize that there is probably no "perfect" software solution, but some techniques are better that others. (i.e.: I want to avoid making a REALLY stupid mistake here!) Listed below are a few ideas I have come up with, but I need some feedback from more knowledgeable sources. Any suggestions or comments would be greatly appreciated. If you reply to me directly, I will summarize for the list. Please don't suggest book/journal references that are not accessible via the internet. It would take me about 6 months to order books from here. (Everything I know about the outside world arrives via my Pegasus/KA9Q mailer :-) Also, can anyone recommend a statistical test for randomness, or for detecting repeating patterns in a "random" file? (I remember some years back someone demonstrated the Apple II random number generator was flawed by converting the random numbers to screen coordinates and "painting" the screen. No matter how long you ran the program, certain areas of the screen were never filled in. In other words, certain numbers were never generated.) Thanks in advance for any assistance. Jim Pinson Galapagos Islands, Ecuador. jpinson(a)fcdarwin.org.ec PGP public key available by finger ----------Possible methods------------ (note: using the Borland C++ compiler) - Generate a random file using Borland's random number generator, then run the output through an encryptor (PGP, DES etc.). Possible variation: running through several different encryptors or multiple passes through a single encryptor. - Generate two random files using different random number generators, then xor'ing the two files together to produce the final file. - Generate a "bunch" of small random number files, reseeding the generator before each run. The resulting files would then be concatenated to produce the final file. (my thought here is to keep the random files small enough to avoid the eventual repeat of sequences that I understand occur in random number generators). - Combinations of the above? - Other: Suggestions welcome. -------------end------------- On the subject of using audio input for generating random numbers: has any one tried using an audio file created by the Windows sound recorder program? What would be a good source of random meaningless sound? (an quiet room, ocean surf, repeats of Gilligan's Island, old presidential speeches (pick your favorite president). :-)

4 5

EFF pornography file warning
by L. Detweiler 17 Dec '03

17 Dec '03

Boy, I sure have gotten flamed by the best on this one. And its rather deafeningly silent on the list. I'm bleeding from shrapnel wounds and hung out to die. Let me justify a few things. Enclosed: - why I posted the announcement - why I flamed EFF - things that have upset me about this affair - a classic cypherpunk rant on child pornography worthy of T.C. May * * * I posted the announcement to the cypherpunks because 1) there has been a long past history of interest in BBS type investigations 2) there was a huge flame war over CERT sending a notice to E.Hughes for his FTP site, saying `please look into this'-- this EFF announcement struck me as amazingly similar. (BTW, I had virtually nothing to do with that flame war, which was incredibly prolonged) 3) EFF of course is very close to the cypherpunk cause with S.Steele, M.Godwin, and J.Gilmore regular readers and contributors. 4) consider that comp.org.eff.talk would be another forum, but I rejected it, because this forum is more private and still watched by EFF. * * * Now, why did I flame EFF for this action? In one word: quagmire. I said it was `silly, useless, and damaging' 1) this opens them up to having to do this *regularly*. Is this what they want to be doing? 2) since when does EFF help federal BBS investigations? 3) M. Godwin just got done informing us the beauty of *non* liability with a hands-off BBS operator policy. 4) its silly to post a notice about given filenames. They simply are as amorphous as cyberspace itself. 5) a recall of any type is a notorious way to generate paranoia, perhaps a cure worse than the affliction. this kind of message spreads like wildfire. `What? EFF says file [x] is child pornography?' There are tens of thousands of BBS operators in the U.S. -- is this a service or a disservice to them? hence my urban myth ramblings. 6) Releasing this kind of notice only draws more attention to those files. Suddenly, they become collectors items. People start hunting them down. People create empty files with the same name as a joke. All because `EFF says file [x] is child pornography' 7) many other reasons that will become obvious and important in retrospect, but look like hypersensitivity at this point. * * * I'm very upset that 1) everybody on the list is hiding, and refuses to criticize EFF despite the strong parallels to CERT. at best this is cowardice and at worst hypocrisy. this tiptoeing and silence is very reprehensible, IMHO. 2) it does not appear to me that EFF has thought this through. this announcement reflects on EFF. why couldn't they have phrased it differently? e.g. Agents [x] of government agency [x] have requested that operators remove these files. As it stands, EFF associates its own reputation with this investigation and the file recall. 3) there have been requests from EFF representatives to `let it drop'. well, yes, that is one way of dealing with the issue, but IMHO more appropriate to a species of animal called `ostriches'. 4) in general, I object to this philosophy found elsewhere on the list of `if its in our backyard then don't criticize it'. the Fidonet operators are like this. EFF is like this. The former, in their cryptophobia and surveillance, are implicitly supportive of the philosophy of Clipper and the NSA. The latter, EFF, has a critical role in promoting coolness, not hysteria, among BBS operators. 5) In a rather low blow, S. Steele writes ``I figured those who sought to challenge the child pornography laws would poo poo the message. I guess I figured right.'' For the record, I do not seek to challenge child pornography laws or federal investigations. My message made rather clear that I was objecting to the role of *EFF* in the affair. * * * Lastly, I guess I'm a little confused. tcmay(a)netcom.com (Timothy C. May) >No, I won't say it was silly, useless, or damaging. >[...] >Do I hear any volunteers to become a test case? I tweaked T.C. May in the hope of seeing a message analyzing child pornography in digitized images over cyberspace, because I thought I recall him writing a rather amazing essay on the subject some months ago on the list. Apparently, based on my recent private email exchange, he wasn't associated with that. I guess I just misremembered because it seemed like such a classic cypherpunkesque rant in the spirit of his best. Anyway, as I recall, *someone* about 3 or 4 months ago posted to the list a remarkable analysis of a brouhaha surrounding the creation of the group `alt.pictures.erotica.children'. The person talked about posting a PGP file to the group, as I recall with an anonymous remailer, and then talked about the fierce reaction (melee?) involved. The person stated that the group appeared to have been created as a joke, and the file itself as PGP code was actually not legal syntax for `plausible deniability' of the author, but nevertheless raised important questions. The essay talked about the fruitlessness of trying to track down actual `child pornography' over cyberspace. One of the main points was that child pornography is not illegal everywhere, as I recall the person mentioned Denmark as a place where it particularly flourishes. Is a GIF illegal if it was taken in a country that prohibits it? that's easy. But what about if it was taken in a country where it was legal and imported? well, in the U.S. this is illegal too. But the poster raised a lot of other very fascinating questions that were highly relevant to pornography in cyberspace. Digital composition tools allow artist to cut and paste pictures with astonishing realism. What about a situation where adult models (as young as possible) are used and child's faces are plastered on top? Or how about the situation where *entirely imaginary pictures* are created? These are very real possibilities. Are they illegal too? How is it that just a particular configuration of pixels constitutes illegal pornography, and another does not? I think the poster made various humorous remarks about baby pictures too -- the type of children on bearskin rugs. Shall we imprison all parents that have taken these? (ug, I can't wait for all silly flames on the `I know it when I see it' definition of pornography.) This was my point with the EFF warning: the whole area is a quagmire, and the only consistent and enforceable philosophy seems to be a `hands off' approach. It is very likely to evolve in the long-term future because of all the quandaries. And in particular I was hoping the essay would pop up again on the list so they could see that perspective. Anyway, the poster then made some characteristic comments about the changes that cyberspace will introduce to these kind of pornography laws. The whole essay was such a brilliant exercise, IMHO, and involved actual `research' and `analysis', that I guess I just sort of misremembered T.C. May writing it, but apparently this is not the case. Anyway, I apologize for the misattribution. Just `attribute the misattribution' to my degenerating memory for specifics after 35 hundred cypherpunk postings <g> (But I would be fascinated to see that essay again, if anyone has a clue of what I'm talking about. Hopefully the writer is still on the list, has it in archives, and can post it. It's highly germane to the EFF warning, and was a really brilliant cypherpunk document, IMHO. If I'm just hallucinating over the whole thing, well, maybe its time for me to unsubscribe <g> )

3 2

Living in a state of sin
by Tom Libert 17 Dec '03

17 Dec '03

Don't use PRNGs for one time pads. To quote Don Knuth, anyone using software methods to generate random numbers "is living in a state of sin." Knuth quoted John von Neumann: "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." (1951)

1 0

Strong PRNGs
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

I can think of two: 1. a long-period PRNG (like subtract-with-carry) feeding a cryptographically strong hash function (perhaps triple-DES in ECB mode with both key nad input taken from the PRNG and output becoming the new PRNG output; 2. Russell Imagliazzo's (sp?) PRNG as strong as subset-sum. Reference: R. Imagliazzo, M. Naor, ``Efficient Cryptographic Schemes Provably as Secure as Subset Sum.'' FOCS89. For example: (if I remember correctly) Algorithm: Take an array of 512 numbers, each 521 bits long. Fill those with true random bits (coin flips, etc.). fill a 512 bit register with random bits. associate each bit of the register with one entry in the array. loop: for each bit in the 512-bit register, if the bit is a 1, add the corresponding array entry into a 521-bit accumulator (init'd to 0 at the start of this pass), modulo a 521-bit prime. at the end of the pass over all 512 bits, take the low order 8 bits of the accumulator as your output byte (a pseudo random value) and the next 512 bits as the new register for the next round. Toss the top bit. goto loop

2 1

Re: Standard Headers for Anonymous Remailers
by Stanton McCandlish 17 Dec '03

17 Dec '03

> It seems to me that his suggestion would work to make it easier for > readers to do that. There are people who don't want to read anonymous posts. It > seems only fair to give them a reasonable opportunity to kill them as a group > _from their own newsreaders_. This job is very difficult in the present, and it > requires that the person know the email addresses of every anonymous remailer > in the world, so he/she can killfile all of them. On the other hand, a single > word added to a special header would enable them to identify anonymous posts as > a group, saving everyone a lot of hassle. Which will result in newgroups banning anon mail wholesale. There are other filtration methods besides using the full address of the remailer. Simply filtering out all mail from userIDs "anonymous" and "nobody" will kill most anon mail as it is. > This isn't necessarily related to the banning of anonymous posts from a > whole newsgroup. This is about an individual choice by individual readers. But of course it is related to banning anon postings in whole groups. > What it suggests is a matter of opinion, and I'm sure that you will > give yours (as will I) to anyone who tries to ban anoymous posting in "normal" > groups. On the other hand, the academic and hard-science conferences you > addressed would be served by this feature. They can already filter out this stuff without that much of a hassle as can anyone. Really, the idea of standardizing the anon remailers is not that big a deal, I just see it as a step in the wrong direction, at least until anon mail is more accepted. It will just make it slightly more easy to filter out anon mail, and at a time when lots of admins and moderators are frowning up anon mail, is this such a good idea? > It is a bad idea to try to stop a technical development just because > some people might misuse it. Yes, the anon-marker heeader may be misused. PGP > has been and will continue to be misused, as will the remailers. That doesn't > mean we should get rid of them. It only means that we should behave > intelligently and make our own choices about who to believe and what to > support. Hahahah, I'm not trying to stop a [useful] technological development, just slowdown a potentially worse-than-useless one until anon mail is more accepted, at which point standardizing would be a good idea. Your last sentence above...when do I ever advocate otherwise? :) > Usenet is hardly an autocratic medium. If a normal Usenet group > suddenly banned anon traffic entirely, there would be ample opportunities for > you and I and all the other cypherpunks (both in membership and in spirit) to > raise objections. And it's not only cypherpunks who would object. The traffic > in the normally conservative news.admin.policy showed the disapproval of > oppressive top-down regulations during the ARMM/UDP incidents. > I just think that the creation of a special anon header is not a real > problem, since it would do no real damage, and might improve the image of > remailers considerably. This argument I really don't follow. I don't see how standardizing this mailing software to produce a specific header line will change anyone's opinion or remailers or anonymity on the net. Well over a year ago, some Fido-tech software authors came up with a similar idea for marking encrypted mail (specifically they created the ^enc PID kluge line, which is pretty much analogous to a type of mail header). The result was that no one's opinion of crypto in FidoNet appears to have changed, and the debate rages on just as before. > >Fido: <tba> IndraNet: 369:111/1 > Oh, a Fido member? What's your opinion on the recent squabble over > encryption/mail censorship there? Well I'm temp. out of Fido, for a week or so, due to the move, but if you mean the CP argument, I'm still sorting through it (again, due to moving, I have a major backlog, like 600+ emails). If you mean the general idea of le crypto en Phydeaux, well that's been raging for a year or 2 or 4. Quite a few of us decided 'heck with it', and started a secondary hub backbone system called the SecureMail system, which WILL carry encrypted mail. Just search the nodelist for the UNSMH and URSMH flags (that's Net SecureMail Hub, and Region SM Hub.) The EFF-BBS that's coming soon will likely been one such hub. -- DISCLAIMER: This message represents only my OWN opinion, not that of EFF. Stanton McCandlish Electronic Frontier Foundation Online Activist mech(a)eff.org NitV-DataCenter BBS SysOp Fido: <tba> IndraNet: 369:111/1

1 0

OTP random number sources
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <9310061539.AA09997(a)dink.foretune.co.jp> >Subject: Re: Enough already! >Date: Thu, 07 Oct 93 00:39:42 JST >From: "Robert J. Woodhead" <trebor(a)foretune.co.jp> >On a totally different topic, has anyone investigated using the >LSbit of CD sound tracks as the source of a 1-time pad? This was discussed, some, in the internet draft on random numbers. The one which just expired was draft-ietf-security-randomness-00.txt. A new one has been submitted to replace it. I'd recommend it to those interested in the topic.

1 0

Enough already!
by nobody＠pmantis.berkeley.edu 17 Dec '03

17 Dec '03

Has everyone on this list lost their minds? Can't someone give a well-intentioned piece of advice without getting bogged down in a ten-day flame war? I don't think anyone here questions the integrity of the EFF. They were trying to help by giving the names of those outlaw GIFs. What's the big deal? If there's someone smoking a cigarette on the subway platform and I see a cop coming, I'll tip the person off. Common courtesy. (I'm not saying this is the exact same thing that the EFF is doing, just making an analogy.) Why blow this all out of proportion? Please do your part to save bandwidth and keep S/N as high as possible. If you're going to harangue people, do it via private email. Probably 40% of cypherpunk posts in the last few weeks have been stupid bickering that never should have started and probably persuaded quite a few people to unsubscribe besides. There's no need to let everyone on the list know about every tiny disagreement you have with someone's opinion. Especially when that person clearly has the best of intentions. Maybe we SHOULD make people pay to post the list. -Mr. Funn

3 2