December 2003 - cypherpunks-legacy

Crypto-dongle redux
by ccat＠netcom.com 17 Dec '03

17 Dec '03

I think the idea of a standard user configurable crypto-engine is a good one..that way people could choose (and upgrade) algorythms.. sort of like modern DSP based highspeed modems..(It could also have a socket for ROM based firmware cartridges..(RSA,IDEA,etc..) and a magstripe reader and keyboard for key entry..(This would make trading keys easy..) I think this discussion was had before,about a year ago.. Would anyone care to elaborate on it? -Chris.

1 0

Re: Randomness of a bit string
by doug＠netcom.com 17 Dec '03

17 Dec '03

Tim May said: >I stand by my point that no number or sequence can be proved to be random. To expand a bit on Perry's arguments, the bottom line of all this research is that a claim regarding randomness can only be made *relative* to a particular system for specifying algorithms. In that sense, Tim's statement can be regarded to be correct, iff one assumes that a context (an algorithmic specification system) is not given. That is a huge qualifier, though, and not one to be taken for granted. A trivial example of this: pick some constant bitstring of length 32 or less. Call it K. Now look at the class of algorithms specifiable by the C code fragment printf("%x", K) --- i.e. print K as a hexadecimal number. Relative to that particular set of (one) algorithms, that value of K is trivially nonrandom, in the sense that the probability of of finding that bitstring produced by that class of algorithm is precisely 1. Next consider a program that computes an output by multiplying some input by two. The probability that the output will be K, given any possible (but unknown) input, is exactly zero if K happens to be odd. If K is not odd, then the probability depends on the distribution (randomness) of the inputs. Proceeding in this fashion, it becomes increasingly clear that the randomness of the output of an algorithm can only be measured relative to the properties of the class of algorithms being considered. Randomness in isolation is meaningless. The best sources of intuition regarding randomness usually derive from systems which shift the burden into an existing intuition on a slightly different subject. For instance, flipping a coin can be regarded as a random process in an intuitive sense, but only because it appeals to existing intuitions about equiprobablistic outcomes. Therefore one sees confused appeals to intuition about randomness, probability, entropy, or related ideas, in cryptography, quantum mechanics, information theory, statistical mechanics, philosophy (in regard to free will versus determinism versus randomness), etc, etc, but given Chaitin/Kolmogorov/et al, no intuition from any such subject should be taken at face value. There's more, but I'll pause to allow flames. :-) Doug

2 1

Comments on violence
by Carl Ellison 17 Dec '03

17 Dec '03

I don't know if legalization would prevent the violence at this point. It would probably reduce street crime but I'm concerned that our population is getting adicted to the thrill of violence (movies, TV news, video games, ...) and it might take a kind of drug treatment program for the whole nation to do anything about it. My second, bigger concern is that the government is using this violence as an excuse to attempt to remove our rights. The one I'm most concerned about is the right to privacy in communications through cryptography (since I'm a computer system architect and cryptologist). We have always had the right to invent and use our own strong cryptography (for the whole 4000 year history of cryptography) and yet the administration (no doubt prompted by the NSA) is now trying to claim a right to read all private messages [cf., the "Clipper" proposal], citing violence (drug dealers, snuff movies, etc.) as the need, without establishing a link -- just using the reference as a scare tactic to get voter adrenalin flowing so that they'll feel pro-law-enforcement. This is a major conflict between government and civil rights, coming to a head as we speak. A spotlight on this attempt by you would be appreciated. Thank you. Carl Ellison Sr. Technical Consultant Stratus Computer Corp. / ISIS Distributed Systems

1 0

Re: NSA museum now open, if you can find it
by Dave Hart 17 Dec '03

17 Dec '03

---------- | From: Hal <netmail!hfinney(a)shell.portal.com> | | That museum sounds fascinating. I got to visit the NSA's so-called | "Friendship Annex" once on business. This is not at Fort Meade itself, | but a few miles away, to keep the impure and unclean away from the holy | temple itself. | | Whoever named this place had quite a sense of irony; [...] As documented in _The Puzzle Palace_, the name derives from Friendship International Airport, now known as Baltimore-Washington International Airport. The Annex buildings are at the end of one of the runways. Dave Hart davehart(a)microsoft.com Not a Microsoft spokesperson

1 0

Re: Could I possibly be deleted, please...
by Al Billings 17 Dec '03

17 Dec '03

On Mon, 24 Jan 1994, Lance Ware {VOXEL Guru} wrote: > Please remove me as well . . . Try using the admin address. The list can't remove you. We only see your messages. -- (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*) | Al Billings aka Grendel Grettisson | "You are, each one, a priest, | | mimir(a)io.com | Just for yourself." | | Sysop of The Sacred Grove (206)322-5450 | | | Admin for Troth, The Asatru E-Mail List | -Noble Drew Ali- | (*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)(*)

1 0

quote of the day
by Carl_Ellison＠vos.stratus.com 17 Dec '03

17 Dec '03

Only those means of security are good, are certain, are lasting, that depend on yourself and your own vigor. - Machiavelli

1 0

Provability and Randomness
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

Entropy is relative. A string is `random' (with respect to an observer) when the probability of correctly predicting the next symbol of the string is arbitrarily low (e.g., size_of_the_alphabet^-1). Entropy, and therefore `randomness' can only be considered in the presence of symbol probabilities... and therefore prejudicial knowledge i.e., a context (algorithms, models, history, whatever). Different contexts --> different probabilities --> different quality of randomness. * Absent a context, there is no such thing as `randomness'. Posit two identical contexts, sender and receiver. Sender transmits a `random' string to receiver. (Beeeeeeeeeeep. Sorry, that was the warning that sounds whenever I fib). The sender can only send a random string if the reciever doesn't already `know' that string or doesn't know which string the sender will transmit. If the sender knows something that the reciever doesn't then the contexts are not identical. * Absent differing contexts, there is no such thing as randomness. A fair coin toss can be random because you_before_the_toss and you_after_the_toss are different contexts (reciever and sender, respectively; one of whom knows the outcome). Posit two disjoint contexts, A and B. A transmits a message to B, who has no information in common with A. B has no context with which to predict the first symbol that will appear and thus it is always random. As symbols appear, B builds a model of A... and thus acquires knowledge of A (i.e., a shared context). By the end of the message, B might be predicting quite well. If B can't build any model of A's behavior at all, then B will share no context with A; won't be able to predict characters; the string will remain random. * Absent shared knowledge (overlapping context), all information is random. Imagine that B's shared knowledge with A takes the form of a program to output a prediction of the next symbol A will transmit. This program---however large it is and however it might work inside---is nothing more than B's model of A. When B has no knowledge of A, this program is essentially `empty'. It contains no information, and can make no predictions better some arbitrary limit (e.g., size_of_the_alphabet^-1). The program learns from each symbol transmitted by A, thus a good (and portable) measure of the `size' of the program is how many symbols it has seen. Let us say that this program sees every symbol A ever transmits to B (numbered from 1..n), and thus during it's life it will actually be n+1 different programs (numbered B0..Bn of size 0..n, respectively). Imagine that you can ask any one of these programs to predict any symbol from A. Thus you could ask B3 to predict symbol 4 (exemplary of the normal case) or you could ask B5 to predict symbol 1 (which it could, of course, do perfectly, having already seen symbol 1). Now we have a new definition of randomness. A string is random with respect to B if no program of B shorter than the string can predict it with success greater than our arbitrary threshhold (which is typically defined by the performance of B0). If A is sending a passage from a well known book, and B `discovers' this after receiving symbol 20 and can access the text of that book, B20 suddenly becomes a very good predictor of many future symbols. The string is not random. But it _was_ random to B0, and B1 and perhaps less for each successive symbol. B20 is a different context than B0. It has different knowledge, different probabilities and therefore perceives a different quality of randomness in A's message. B20 is still only a program of `size' 20 (i.e., you don't count the size of the book in B). This is easily demonstrated if you imagine what happens when A sends a message that is a deterministic algorithm for producing a an infinite stream of symbols, followed by the stream it generates. If this algorithm requires i symbols to express, then Bi is a perfect predictor for all subsequent symbols. Bi is clearly of size i (there is no external book for us to add to the size of Bi). In fact, no matter what message A sends, B considers it an algorithm for generating predictions of future symbols. Thus A is actually sending B a sequence of programs (each a prefix of the next, and thus not re-transmitted) B1, B2, ... Bn (but remember, these programs execute in the context of B's knowledge... thus their predictions are not `universal'). This just brings our notion of programs, program length and prediction around to the other side and lets us summarize: * A string is random with respect to B if the string itself is the shortest program with which B can generate that string. ... or qualitatively * The randomness of a string Bn with respect to B is an inverse of the quality of the predictions B can make of Bn from the strings B0...Bn-1. We rely on the `relativity' of entropy. Codes and cyphers can't function without it. The difference between your context and that of an attacker (you know the key or codebook) is what makes the message meaningful only to you (hopefully it will still have _some_ information you couldn't guess before reading it). Randomness is relative, thus there is no universal randomness measure for a string, thus there can be no proof that a string is universally random. You can easily measure the exact entropy of a string with respect to a very formally defined context (one where you can produce exact predictions). This is useful, but reveals nothing about the quality of the predictions a different, even similar, context might make (Just one symbol is the difference between B19 and B20 above; the string was random to one but not the other), It reveals nothing about models we can't describe so perfectly (like human thought). * There is no algorithm for deciding if a string is universally random. In a less obvious leap, it is only by comparing the predictions of Bi with Bk that a string of length j (i < j <= k) can be shown to be random with respect to Bi. Thus: * There is no algorithm shorter than the string itself for determining if a string is random with respect to a given context. Not exactly Q.E.D. but close enough for rock `n roll. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Re: REMAIL: Cover traffic
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Arsen Ray Arachelian writes: > ...Even better, have each remailer send a specific > number of messages to each of the other remailers on the > network. These messages would be bogus messages, > however, there would be a fixed number of them. > > If a real nym message arrives, it is sent to the next mailer > up the chain, as part of the n (n-1 now) that are bogus. That > way a spook couldn't tell where a message was going since > he couldn't count the number of messages going out of the > mailer. > > Also if a target remailer has n real messages to be sent to, > any messages over that assigned packet size of messages > get spooled for the next round of bogus mail. This way each > remailer will send exactly n messages to every other > remailer on the net every specified period of time. > I like this idea. It seems to use fewer CPU resources than having a remailer route a bogus message through a random set of other remailers and back to itself. If I understand the encrypted remailer scheme correctly, the "route through random set" mechanism requires a remailer to enclose a bogus message in a set of nested digital envelopes (one for each remailer in the random remailer set). The "round-robin send to peers" mechanism only requires the remailer to create one envelope per bogus message. I also like the idea because it seems easier to analyse, and therefore easier to describe/formalize the properties of the system as a whole. Jim_Miller(a)suite.com

1 0

DEF CON ][ Initial Announcement
by Conal.Garrity＠f8004.n282.z1.fidonet.org 17 Dec '03

17 Dec '03

Updated Last : 1.16.1994 xxxxxxxxxxxxxxxxxxxxxxxx xx DEF CON ][ Convention Initial Announcement xxxxxxxXXXXxxxxxxxxxxxxxxx xx DEF CON ][ Convention Initial Announcement xxxxxxXXXXXXxxxxxx x x DEF CON ][ Convention Initial Announcement xxxxxXXXXXXXXxxxxxxx x DEF CON ][ Convention Initial Announcement xxxxXXXXXXXXXXxxxx xxxxxxxxx DEF CON ][ Convention Initial Announcement xxxXXXXXXXXXXXXxxxxxxxxxx x DEF CON ][ Convention Initial Announcement xxXXXXXXXXXXXXXXxxxxxx xx x DEF CON ][ Convention Initial Announcement xxxXXXXXXXXXXXXxxxxxxxx DEF CON ][ Convention Initial Announcement xxxxXXXXXXXXXXxxxxxxxx x xx DEF CON ][ Convention Initial Announcement xxxxxXXXXXXXXxxxxxxxxxx xx x DEF CON ][ Convention Initial Announcement xxxxxxXXXXXXxxxxxxxxx x DEF CON ][ Convention Initial Announcement xxxxxxxXXXXxxxxxxxxxxxxxxx DEF CON ][ Convention Initial Announcement xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx DEF CON ][ Convention Initial Announcement READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE ============================================================================= What's this? This is the initial announcement and invitation to DEF CON ][, a convention for the "underground" elements of the computer culture. We try to target the (Fill in your favorite word here): Hackers, Phreaks, Hammies, Virii coders, programmers, crackers, Cyberpunk Wannabees, Civil Liberties Groups, CypherPunks, Futurists, Artists, Etc.. WHO: You know who you are, you shady characters. WHAT: A convention for you to meet, party, and listen to some speeches that you would normally never hear. WHEN: July 22, 23, 24 - 1994 WHERE: Las Vegas, Nevada @ The Sahara Hotel So you heard about DEF CON I, and want to hit part ][? You heard about the parties, the info discussed, the bizarre atmosphere of Las Vegas and want to check it out in person? Load up your laptop muffy, we're heading to Vegas! Here is what Three out of Three people said about last years convention: "DEF CON I, last week in Las Vegas, was both the strangest and the best computer event I have attended in years." -- Robert X. Cringely, Info World "Toto, I don't think we're at COMDEX anymore." -- Coderipper, Gray Areas "Soon we were at the hotel going through the spoils: fax sheets, catalogs, bits of torn paper, a few McDonald's Dino-Meals and lots of coffee grounds. The documents disappeared in seconds." -- Gillian Newson, New Media Magazine DESCRIPTION: Last year we held DEF CON I, which went over great, and this year we are planning on being bigger and better. We have expanded the number of speakers to included midnight tech talks and additional speaking on Sunday. We attempt to bring the underground into contact with "legitimate" speakers. Sure it's great to meet and party with fellow hackers, but besides that we try to provide information and speakers in a forum that can't be found at other conferences. While there is an initial concern that this is just another excuse for the evil hackers to party and wreak havok, it's just not the case. People come to DEF CON for information and for making contacts. We strive to distinguish this convention from others in that respect. WHAT'S NEW THIS YEAR: This year will be much larger and more organized than last year. We have a much larger meeting area, and have better name recognition. Because of this we will have more speakers on broader topics. Expect speaking to run Saturday and Sunday, ending around 5 p.m. Some of the new things expected include: o An INet connection with sixteen ports will be there, _BUT_ will only provide serial connections because terminals are too hard to ship. So bring a laptop with communications software if you want to connect to the network. Thanks to cyberlink communications for the connection. o There will be door prizes, and someone has already donated a Cell Phone to give away. o Dr. Ludwig will present his virii creation awards on Sunday. o A bigger and better "Spot The Fed" contest, which means more shirts to give away. o More room, we should have tables set up for information distribution. If you have anything you want distributed, feel free to leave it on the designated tables. Yes, this year there will be a true 24 hour convention space. o A 24 hour movie / video suite where we will be playing all type of stuff. VHS Format. Mail me with suggested titals to show, or bring your own. o Midnight Tech Talks on Friday and Saturday night to cover the more technical topics and leave the days free for more general discussions. WHO IS SPEAKING: I was going to run a list of the current speakers we have lined up, but at this point things are still fluid. In a few months when the speakers list is more solidified I will release it. I'll name the poeple who have committed to attending in the next announcement. Trust me. WHERE THIS THING IS: It's in Las Vegas, the town that never sleeps. Really. There are no clocks anywhere in an attempt to lull you into believing the day never ends. Talk about virtual reality, this place fits the bill with no clunky hardware. If you have a buzz you may never know the difference. It will be at the Sahara Hotel. Intel as follows: The Sahara Hotel: 1.800.634.6078 Room Rates: Single/Double $55, Tripple $65, Suite $120 (Usually $200) + 8% tax Transportation: Shuttles from the airport for cheap NOTE: Please make it clear you are registering for the DEF CON ][ convention to get the room rates. Our convention space price is based on how many people register. Register under a false name if it makes you feel better, 'cuz the more that register the better for my pocket book. No one under 21 can rent a room by themselves, so get your buddy who is 21 to rent for you and crash out. Don't let the hotel people get their hands on your baggage, or there is a mandatory $3 group baggage fee. Vegas has killer unions. OTHER STUFF: If you check out Wired like 1.5 or 1.6 there was a blurb about the new Luxor hotel with it's total VR experience. It looks like the first true VR ride / experience for a group of people, it seats eight. Intense. A friend was just over there, and tested out the various rides. Not to be outdone the new MGM grand (Largest hotel in the world) has a ride called the R360 which is basically a gyroscope they trap you into with goggles. We should get a group together and make a mass trek over there and check it out. If enough people are interested I'll call and see if we can book a time to reserve space for a bunch of us. Both are within walking distance. I'll whip up a list of stuff that's cool to check out in town there so if for some reason you leave the awesome conference you can take in some unreal sites in the city of true capitalism. MEDIA: Some of the places you can look for information from last year include: New Media Magazine, September 1993 InfoWorld, 7-12-1993 and also 7-19-1993 by Robert X. Cringely Gray Areas Magazine, Vol 2, #3 (Fall 1993) Unix World, ??? Phrack #44 COST: Cost is whatever you pay for a hotel room split however many ways, plus $15 if you preregister, or $30 at the door. This gets you a nifty 24 bit color name tag (We're gonna make it niftier this year) and your foot in the door. There are fast food places all over, and there is alcohol all over the place but the trick is to get it during a happy hour for maximum cheapness. ============================================================================ UPDATE: I wanted to thank whoever sent in the anonymous fax to Wired that was printed in issue 1.5 Cool deal! Dan Farmer posted his paper on unix security on the net, and I've put a copy of it on the ftp site if you want to grab it and take a look. It's called "zen.txt" I've recieved more scanned images from last year, and they will be put on the ftp site. ============================================================================= FOR MORE INFORMATION: For InterNet users, there is a DEF CON anonymous ftp site at cyberspace.com in /pub/defcon. There are digitized pictures, digitized speeches and text files with the latest up to date info available. For email users, you can email dtangent(a)defcon.org for more information. For non-net people call: The Alliance BBS [612] 251.8596 16.8k speed Dual Standard Open Access. 24 Hours. Users get full access on 1st call. iirg disto site, Syncro Net, text files galore. Sysop: Metal Head (The huge guy from last year) A DEF CON directory is maintained here For Snail Mail send to: DEF CON, 2709 E. Madison Street Suite #102, Seattle, WA, 98112 For Voice Mail and maybe a human (me), 0-700-TANGENT on an AT&T phone. A DEF CON Mailing list is maintained, and the latest announcements are mailed automatically to you. If you wish to be added to the list just send email to dtangent(a)defcon.org. We also maintain a chat mailing list where people can talk to one another and plan rides, talk, whatever. If you request to be on this list your email address will be shown to everyone, just so you are aware. [Note: We need some good list-serv software for BSD, if anyone knows where to find some, please e-mail me.] STUFF TO SPEND YOUR MONEY ON: > Tapes of last years speakers (four 90 minute tapes) are available for $20 > DEF CON I tee-shirts (white, large only) with large color logo on the front, and on the back the Fourth Amendment, past and present. This is shirt v 1.1 with no type-o's. These are $20, and sweatshirts are $25. > Pre-Register for next year in advance for $15 and save half. > Make all checks/money orders/etc. out to DEF CON, and mail to the address above. If you have any confidential info to send, use this PGP key to encrypt: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCrAiyI6OcAAAEE8Mh1YApQOOfCZ8YGQ9BxrRNMbK8rP8xpFCm4W7S6Nqu4Uhpo dLfIfb/kEWDyLreM6ers4eEP6odZALTRvFdsoBGeAx0LUrbFhImxqtRsejMufWNf uZ9PtGD1yEtxwqh4CxxC8glNA9AFXBpjgAZ7eFvtOREYjYO6TH9sOdZSa8ahW7YQ hXatVxhlQqve99fY2J83D5z35rGddDV5azd9AAUTtCZUaGUgRGFyayBUYW5nZW50 IDxkdGFuZ2VudEBkZWZjb24ub3JnPg== =ko7s -----END PGP PUBLIC KEY BLOCK----- The next announcement will have more updated information. I'll hold off on naming the speakers unless they commit to attending. It looks to be a great line up. - The Dark Tangent

1 0

Re: IP rerouters (was Re: Remailers: The Next Generation)
by jerry＠terminus.dell.com 17 Dec '03

17 Dec '03

In article <2hunvn$71u(a)uudell.us.dell.com> you write: >From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> >Subject: IP rerouters (was Re: Remailers: The Next Generation) >In-Reply-To: <199401230709.XAA26564(a)servo.qualcomm.com> >References: <199401230709.XAA26564(a)servo.qualcomm.com> > >Phil Karn <karn(a)qualcomm.com> wrote: >> While you guys are thinking about where to take this stuff at the >> application level, how about giving some thought to how you >> might do it at the IP level? >> >Well, it would make tracing FTP difficult, altho, at least intially, >some FTP maintainers might try to block known IP rerouters. Of course, >if such rerouters became commonplace, it would eliminate that problem. ... >Does anyone how much it costs to get a continuous 56K internet >connection? What about a T1? How easy is it to get and set up? Yes anonymous IP would quickly get block by control freak sys admins. Costs for internet connections vary, but plan to spend about 20K/year. Plus about 10K in startup costs, plus equipment costs. Depending on a lot of factors prices can vary up to 50%. Unless you are on the internet it is very hard to get connected. Most of the companies that sell internet access do business through email. -- Jeremy Porter ----------------- Systems Enginneering ---- Dell Computer Corp. --- jerry(a)terminus.us.dell.com -------- ------------------------------------------------------------ Support your Second Amendment rights to encryption technology.

1 0