December 2003 - cypherpunks-legacy

MAIL: Using "nobody"
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

> I don't understand: why can't the somebody do a telnet to port 25 and > "vrfy nobody" to see if it points to /dev/null? Or find out if mail > is piped to a script? Try that on andrew.cmu.edu

1 0

Re: Archives?
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

Roger Bryner <bryner(a)atlas.chem.utah.edu> wrote: > Hello, > Are there archives for this mailing list? ftp cs.cmu.edu /afs/andrew.cmu.edu/usr12/mg5n/public/cypherpunks It's a symlink to CMU's internal news directory. You will need to get the file cypherpunks.index to figure out the filenames. The file also contains some binary data for the local news software here, you will have to just ignore that. Not exactly the easiest way to look things up, but it works. Messages are kept one month.

2 1

Re: Unofficial Release
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Perry says; >Yup, you have it on me. I guess it is important to lower the >possibility of someone cracking your key by brute force from lower >than the odds that all the oxygen atoms in the room you are in will >spontaneously end up on the wrong side of the room to lower than the >odds that all the oxygen atoms in the world will end up on the wrong >side of the planet. After all, we are fooling with lives. Perry, I don't know the probability of oxygen atoms moving to Japan or anywhere else. (who said Japan was the wrong side of the planet) And, I don't think that anyone will attack my keys by brute force. I do think that someone will be trying to crack messages on a random basis. That is by trying IDEA keys with otherwise idle cpu time on a large base of message trafic. (not my one little pathetic message). Given estimates that the IDEA algorithem is equivlent to a 3000-bit rsa key. I am bringing the rsa part of PGP up to par with the IDEA part of PGP. (just hitting on the weakest link first) So, call me paranoid or joe, I will strive to reach MY crypto comfort level. And that seems to be a higher level of crypto than you have. Who cares ! Use whatever crypto you want. tom

2 1

PGS v0.99b is out there...
by ER CRAMER 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have just uploaded PGS v0.99b to the following ftp-sites: - wuarchive.wustl.edu:/pub/msdos_uploads/pgs/pgs099b.zip - oak.oakland.edu:/SimTel/msdos/security/pgs099b.zip (just uploaded it... So it must be there in a few days...) - rzsun2.informatik.uni-hamburg.de:/pub/virus/crypt/pgp/... (just uploaded it... So it must be there in a few days...) If you want it fast look on wuarchive... For the ones who don't know what PGS is... PGS is a very good ms-dos shell for PGP. It reads directly from the keyrings and has a very good keymanagement system... ... If you outlaw Privacy, only Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ - -------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLglnQ4DAdPKe9hHLAQHHvAP/eP5M6hh5k1jXya19p+tj7ol8a6h+A2fg XKwj3ZPT+pPmEdFe1TQpKTPDQJwATmPMHg8930fp0sET4Gfmtx8yggDXAUJabEGN Tvx9Su7QwIuKg4Ga2JSW1onyplJdxqI5KmBAhGrDpEj1TDDIO55r8hnBrQsxIsld lJa+XC+SFEA= =qDDg -----END PGP SIGNATURE-----

1 0

Re: Cellular Telephone Experimenter's Kit (2600 article)
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

This CTEK sounds like a fun toy and I guess I'm glad that it can't be used for cellular phone fraud. That would be an illegitimate use. But, monitoring cell phone traffic is a crime now, right? Is there a legitimate use for the device? Can anyone think of one? -Peter Wayner

2 1

Re: Unofficial Release
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Perry(a)imsi.com says: >Tom Rollins says: >> Ahhhh, It is nice to know that people won't even TRY to crack >> big keys. Cracking, you know, is a lot like the lotto. You >> MIGHT guess the correct key on the first TRY. But, if you >> don't TRY, then you won't crack the key. >> >> "Gotta play to win" > >It is all a question of economics. Its one thing if your idle try has >one in 10^6 chance of working, but if its one in 10^70 or something >like that the attempt is pretty much pointless -- you are more likely >to have a giant sack of gold hit you on the head. Even spending a >penny on cracking something that way is uneconomical. Our govenment has NEVER been very economical! >They could spend a lot less effort simply >getting your key via "practical cryptanalysis". True, a good hose or pretty woman in the sack would loosen me up. Except for my old key that hangs out on the pgp-key-servers. Too bad, Lost that secret key... >There is therefore no point in using a cryptosystem which would cost >the enemy hundreds of billions of dollars to try to attack and then >type in your key on a machine who's keystrokes can be monitored using >$3000 in equipment. Which way would YOU try to get the keys, eh? Say, that sounds like a good deal ! Where could I buy that. Wow, hang out at Charles Schwab, or Meryll Lynch and get account info... >Unless you are already doing all your encryption in a Faraday cage, >I'd say that there is no conceivable point in using anything over a >2000 bit key -- indeed, there is probably no point in using such a key >even if you are doing all your encryption in a Faraday cage. Well, I work for C3-Telos and we make several lines of ruggedized portable tempest capable equipment (like the one I am typing on). >The benefit is minimal, and the cost, in terms of dramatically slowed >performance, is very high. Using an 8000 bit key is like claiming you >are stronger than the enemy because whereas he only has enough nuclear >weapons to vaporize your city 15 times over you have enough to >vaporize his 90 times over. I don't need an 8000 bit key, but, I don't want the pgp-key-server barfing on a 4096 bit key that I feel I need. How can you put a price on someones life. You don't know there situation. (think about OJ and fooling around with his wife) Tim May says: >If this was tongue in cheek, I missed it. Nobody in their right mind >will try a brute force attack on a 1024-bit key, let alone a 1200- or >2000-bit key. Unless there are flaws in PGP and/or RSA we haven't >heard about. So you or I won't try the crack. But then there are all those people who are being paid from tax dollars to do nothing else but crack. And all those high priced computers paid for with tax dollars to do the cracking with. Do you think they will just close up shop and sell off the equipment? Yes, there are flaws. (some call them design compromises) Why known text in the Idea data area? Why CFB mode vs CBC mode? Peter Gutman's SFS documentation makes reference to a class of weak IDEA keys. What are they? And what do they do? >As for lotto, simple calculations tell anyone that the best way to win >is not to play. The return _at best_ is 30 or 40 cents on the >dollar, with the rest going to all the various programs the lotto is >supposed to support. The more you play, the more you lose. I don't advocate that you play the lotto. I am pointing out a fact that the lotto people use/say/claim to get people to play their game and thus give them money. >(I think gambling is a perfectly fine "tax on stupidity," collecting >money from the gullible. However, banning gambling by private citizens >while having the government run their own casinos and lotteries is >crummy. It's government at its worst.) I agree almost 100%

4 6

Re: Unofficial Release
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 3:27 PM 06/22/94 -0400, Perry E. Metzger wrote: >Fine. However, you are, you realize, a fool. There is no point in I was wondering if you had recently lost an appendage, or maybe had bad hemorrhoids or something.

1 0

EXPAT WORLD ARTICLE
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I've been asked to post the /Expat World/ crypto article to the Cypherpunks Channel. Here 'tis: S a n d y * * * EXPAT WORLD June 15, 1994 "How Big Brother Wants to Listen, Too" (copied without permission) Recently, the White House sent Stewart A. Baker, general counsel for the National Security Agency (NSA), to the annual Computer, Freedom and Privacy Conference in New York City to speak about the Clinton Administration's desire to safeguard the government's ability to eavesdrop on every American. At that conference, Mr. Baker posed the question: "Do you want to live in a world where law enforcement cannot do its job because of the need for privacy?" Everyone who cherishes his constitutional rights should answer, "Absolutely." The Orwellian, or Al Gorewellian, technology that would foster the government's ability to eavesdrop on its cit- izens is essentially a microcircuit that the Administration want all American telephone and computer companies to install in their products. The microcircuit, dubbed the "Clipper" chip, scrambles all electronic communications between individuals, resulting in gibberish to outsiders--all outsiders, that is, but the federal government. The plan to implement the Clipper chip is an insult to the American people and its realization would erode the Fourth Amendment rights of all citizens. As usual, presuming Americans have no more sense than Yahoos, the administration has presented the Clipper chip in the guise of a plan to protect individuals from invasions of their privacy. According to the NSA, because telephone conversations and compu- ter transmissions are becoming so easy to tap, the White House would like to offer the Clipper chip to shield everyone from such unwanted interferences. In reality, the Feds want to see a uniform standard in the type of computer software that secures electronic communications. The reason for this is that people are already protecting their con- versations with a variety of privately-supplied devices, and the FBI, CIA and NSA cannot and will not be able to penetrate such security. With the Clipper chip, everyone has the same lock on his communi- cations. Unfortunately, the government has the keys. The Amer- ican people can do without the overwhelming generosity of this administration. When Charles Freeh, FBI director, testified before the House Judiciary Subcommittee on Technology and the Law, he said that the chip is necessary because the police and national security agents are falling behind advances in criminal technology. How- ever, no one has offered evidence that a trend of criminals or terrorist using scrambled communications to pass unlawful plots exists, or reasons why a criminal sophisticated enough to use cryptography would be dumb enough to use an American made tele- phone or computer containing the Clipper chip. Worse, the implementation of the Clipper chip would erode the right to be free from illegal searches and seizures under the Fourth Amendment. According to the President's plan, both the Commerce and Treasury Department would hold keys to unscramble electronic communications, operating as a "key escrow" system. The government would no longer be aiming wiretap technology at specific individuals or specific locations. The presumption would be that everyone is a criminal. Because only two keys partition people's privacy from governmental seizing electronic documents without prior notification is great. If the White House truly desires to use technology for the bene- fit of all, it should mandate the use of a different computer chip. How about one called the Clinterceptor that would act as a sort of modern-day Paul Revere. Through the information super- highway, the Clinterceptor would forewarn the public that the government is about to invade their privacy. Thus, the next time President Clinton and his college roomies are burning the midnight oil and come up with a hair-brained idea like the Clipper chip, an alarm will sound and alert the American people to the government shaking the shackles of the Constitution. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Unofficial Resease
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Perry says: >Fine. However, you are, you realize, a fool. There is no point in >building a house with 3 foot thick steel doors and walls made from >paper. After 2^10 or 2^11 bits or so the key is no longer the weak >link, and is not what people will attack since it no longer has a >reasonable possibility of success. You are entitled to your opinions, >of course. Excuse me, What is your point. My 4096-bit rsa key is (last I looked 4096 == 2^12) over your 2^10 or 2^11 estimate and thus NOT the weak link. Why would you want the rsa key to BE the weak link? After all the rsa key will decrypt all your messages and the IDEA key is for (1) message only. -tom

2 1

Re: e$: Geodesic Securities Markets
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

> Changes in ownership are reflected by offseting book entries. Ah, the > wonders of double-entry bookeeping. BTW, 1994 is the 500th anniversary of the invention of double entry bookkeeping (by a monk). Made capitalism possible. Ah yes, "Swedish Accounting Techniques" as my Economics lecturer used to call it :) G

1 0