December 2003 - cypherpunks-legacy

CHAOS gopher maintenance
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

Who's in charge of the chaos.bsu.edu gopher? I was just browsing the contents and it is not very up-to-date with cypherpunk information... - Paul

2 1

"Reason" mag. article on public key crypto
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

About a month ago, I posted a small extract from an article entitled "Hide and Peek" by Lee Dembart. I came across the complete text of the article while looking for something else at gopher.internet.com. If you're interested in this piece, e-mail me and I'll send you a copy. (a note for Extropian list members - I nosent the piece to the list, and have provided a pointer to the message number so you can retrieve it.) Jeff trestrab(a)gvsu.edu trestrail(a)delphi.com

1 0

Public-key secret sharing
by Mike Ingle 17 Dec '03

17 Dec '03

Has anyone combined polynomial secret sharing with public-key cryptography to create a public-key secret sharing system? For example, encrypt a file with a session key, SK. Use secret sharing to split SK into n parts, with m required for decryption. Encrypt each of the n parts with a different person's public key. Publish the encrypted file and public-key encrypted pieces of the key. To decrypt, m of the trustees use their secret keys to recover their shares of SK, combine them, and retrieve SK to decrypt the file. This has the advantage of requiring only one copy of the file, and requiring no pre-arrangement with the trustees. Is there a better way to do this (especially so the size of the file does not grow linearly with the number of trustees)? When is PGP 3.0 with the toolkit coming out? This should make it easy to implement these things, along with digicash and other projects. The MPI library and conventional crypto is fairly accessible, but the code which creates PGP-format packets is not easy to call from another program. --- MikeIngle(a)delphi.com

1 0

Re: Traffic analysis and file size
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Scott Morham asks about how well file sizes are preserved by encrypted remailers. Generally speaking, in creating a nested encrypted remailing request, at each stage PGP will attempt to compress the input, then encrypt it, which preserves its size but adds a block to the beginning of about the size of the public key (typically 100-150 bytes), then makes it ASCII, which increases the size by 1/3, then adds a small header block of 50 to 150 bytes or so. Since the compression is ASCII-encoded encrypted text, the best it can do is to "undo" the ASCII encoding or compress by about 1/4, but I don't know if it actually does that well. Probably it compresses by somewhat less. So generally each chain will add a few hundred bytes and scale the size of the message up by probably 10 or 20 percent. I think that this will probably allow pretty reliable matching of incoming and outgoing messages on the basis of size alone, at least, more reliable than I would be willing to count on to prevent attacks by this means. Scott also suggests using .zip compression at some point, but this isn't likely to help much since encrypted files look random and are basically not compressible. What we have talked about here is adding random padding to change the file size. Because encrypted files do look random, you can generally pad them with random bytes pretty easily and undetectably. This depends somewhat on the file format but it is basically easy. I wrote some perl scripts to pad .pgp public-key-encrypted files undetectably. The extra bytes are ignored when the file is decrypted. The scripts aren't really production- quality since they just use perl's built-in random numbers. Good random numbers should be used. Hal hfinney(a)shell.portal.com

1 0

Re: Remailers: Turnaround Times?
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Coerr asks about turnaround times for the remailers. Karl Barrus posts a list of remailers approximately every month. On that list he shows which remailers have high-speed, continuous connections to the internet and which have intermittent connections which introduce larger than normal delays. In my experience, the direct-connected remailers generally respond within a minute or two. The other ones introduce delays ranging from an hour or so up to overnight. A good test is to send a "ping" (remail to self) message to each remailer and see how quickly responses arrive. In my experience, the extropia remailer tends to take a few hours, while the rebma remailer is usually a day or sometimes longer. I don't have recent values for the others. Hal Finney hfinney(a)shell.portal.com

1 0

Secure Clear
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

wisej <wisej(a)acf4.NYU.EDU> asked: > (M) MOTOROLA > Motorola and Secure Clear are trademarks of Motorola, Inc. (c) 1993 > Motorola, Inc. >Comments? Don't have one, but know two who do. Scramble, as I understand the meaning of the word, they don't. Last I knew, "Secure Clear" is simple frequency inversion, and can be defeated by: a $15 kit added to a scanner, or; tuning the freq on a single sideband receiver. I've even heard of individuals who had trained themselves, or been trained, to understand the freq inverted signal. Check out Cincinnati Microwave's spread spectrum frequency phones. I don't know if they use frequency hopping or direct sequence, but they may be secure against all but military and LEA types... and the really determined and accomplished hardware hacker.

1 0

Re: newsgroup v news-list
by Jim choate 17 Dec '03

17 Dec '03

> > You're a little new to the list for all the text you're generating. If you'd > wait about a month, you'd see all of your questions answered, examples of > situations that would match or disprove most of your assumptions, and many > many examples of the sort of thing that Detweiler is lobbing into the list. > > Everyone has different ideas of what the list is about and for. When the fol ks > who've been on it for more than a year can't agree on what it's about, it's > irritating to have a new person spout off their opinion on the matter. > > I imagine some folks have given you some indication of Detweiler's history, b ut > in case they haven't given you the complete flavor, let me add my two cents: > imagine a true paranoic with the DTs from alcohol withdrawal locked into a > room with a terminal... Every stray impulse that crosses his mind causes a > flurry of keystrokes to make the pink spiders go away... > > The guy is far enough gone that we're not really talking about censorship -- > any more than dealing with a crank phone caller is censorship. He's > dripping vitriol, not opinion. > > -Bill > Why should how long I have been on the list have anything to do with what I can contribute? Why should I wait a month to figure it out experimentaly when I can ask a couple of questions now, race up the learning curve, and move on to othe more important agendas. We are talking about limiting access to the list (for whatever reason), THAT is cencorship. I personaly find the idea that a person has to 'earn' the right to make a statement on a mail-list or newsgroup as counter-free speech. I oppose your view. How long have you been playing w/ computers? Maby you haven't been doing it long enough to make posts either....

2 1

Dead mans stick
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -> From: "Alan (Miburi-san) Wexelblat" <wex(a)media.mit.edu> To: cypherpunks(a)toad.com Subject: Give me your password- OR ELSE! It seems like it would be relatively simple to program in a sort of dead-man switch at the time of creation of the secret key. [...] As you can imagine, there are increasing levels of personal security you might employ. For example, using the duress phrase might be set up to change the pass-phrase to something *you* don't know but which is known by a trusted other party (wife, mother, agent/lawyer, etc.). Knowing this phrase doesn't help them since that phrase can't access your secret until *after* you've given the duress phrase and the software has disabled your normal access phrase. <- The problem with the duress phrase seems to be this: One would use such a phrase when physical site security had been compromised no? Let's assume government types (which seems to be the hint I get when you suggest the alternate pass phrase being held by your lawyer. It's fairly easy to duplicate the key and stick it somewhere on a floppy and try the passwords extracted from you via rubber hose method on the copy rather than the original. In fact, if people being to use duress codes, it seems that this would become standard practice, if it's not already. In as far as the idea behind a duress code is to keep you from being beaten repeatedly by making it impossible for you to decode the information alone, copying the encrypted key defeats this method. :( - -> - --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168, Pager: 617-945-1842 PUBLIC KEY available by request "To pleasure!" "To passion!" "To paradise!" "To pain!" "Tonight!" <- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLPmWBhibHbaiMfO5AQEQuQQApDtaIxVjjZvdUYD9Jl6FZGdq62SpPM+y KMqsIvSOhPOK2kOsoAyLuIN4+bXVUyTHiAkYX/ye2q2gqj9yrOLvkGyH6yak5YFi xoOCYx6qGScHeoqwpJKoRTTwUjAo79ZmXupA+ylX527eQDILwZJa+W+wSln/rXhG zajsBTeG/mw= =B4y+ -----END PGP SIGNATURE-----

1 0

Motorola Ad
by jbhicks＠aol.com 17 Dec '03

17 Dec '03

In the November 29, 1993 issue of Time Magazine, opposite p. 67, there is an interesting ad: > Give the Gift of Privacy > > All it takes to eavesdrop on most cordless calls is another > cordless phone, scanner or even a baby monitor. That's why > every Motorola Cordless Phone features Secure Clear (TM) > technology. Secure Clear (TM) scrambles voices, so all an > eavesdropper hears is garbled noise. > > Motorola > > Motorola and Secure Clear are trademarks of Motorola, Inc. > (C) 1993 Motorola, Inc. - James -

1 0

taxes (net)
by Black Unicorn 17 Dec '03

17 Dec '03

-> --------------------- Tax Havens on the Net --------------------- compiled by James R. Hart Leichtenstein net access: ---f- languages: German, Alemanni currency controls: none bank secrecy: excellent preferred legal entities: allows any type found anywhere in the world (!) establishment (limited liability, unlimited duration) company limited by shares foundations and trusts taxes: none for income outside Leichtenstein. Net worth tax of 0.01% on capital and reserves (min. 1,000 Swiss francs), local resident taxes tax treaties: not party directly or indirectly to any exchange-of-information agreements double-tax treaty exists only with Austria n.b.: bankers won't assist law enforcement officials with drug, fraud, theft, or tax investigations. They might assist in money laundering and insider trading investigations, informing the customer first. Yes but, Liechtenstein, Not LEIchtenstein. :) You'll find it difficult to invest less than 1.5 million in Liechtenstein secretly. -uni- (Dark)

1 0