December 2003 - cypherpunks-legacy

Re: Running regularly
by mbriceno＠netcom.com 17 Dec '03

17 Dec '03

I wrote: >> The next problem that must be addressed is the auto-logout upon >14min of >> inactivity on the modem level that Netcom imposes on you. There is a simple >> 2 line command that you can add to your .login file to disable the >> auto-logout. I saw it once posted in one of the Netcom newsgroups, but I >> lost it. Perhaps you might post the question there. I would not advise to Ed Carp wrote: >Did you ever get an answer to this one??? I know that TMOUT in bash controls >the shell timeout - does this have an effect?? I don't know if TMOUT has anything to do with it. I posted the queston in the appropriate Netcom newsgroups and hope that the original poster will see it and send me his script. Once he does I will post it to the list. After all,there is no reason why one shouldn't be able to use one's computer for other purposes while Netcom's machine is factoring that 50 digit number ;-) -- Marc Briceno <mbriceno(a)netcom.com> PGP public key by finger

1 0

Stego for Video ?
by Matthew Bernardini 17 Dec '03

17 Dec '03

Have any programs been written that would allow for three dimensional stego in moving pictures ? I think this would make it a little more difficult to detect. How about more advanced graphical techniques like using a stego file as a map in a renderer ? The person who received the picture would know for instance that all the vertical walls, or all the brick surfaces, etc were stego encrypted messages. It would take some sophistication to reverse engineer the rendered picture, but necessity is the mother of invention. The actual image would not contain any specific information, but would be a disguised "envelope" for other pictures within the picture. Matt ----------------------------------------------------------------------------- | Rutgers University Computing Services Matthew Bernardini | Hill Micro/Graphics Center 7804 McCormick | Site-Manager (908) 878-0946 | 017 Hill Center | (908) 932-3129 (908) 932-4921 -----------------------------------------------------------------------------

1 0

ViaCrypt Encryption Hardware
by Mike Ingle 17 Dec '03

17 Dec '03

Some interesting flyers for ViaCrypt hardware encryption devices: There are three of them. The DigiSig+ D350 is an external device which hooks up to a parallel port. The D355 is similar but hooks up to a serial port. Both of these are flat boxes that look like external modems. The D360 is an internal board, and the D150 is a software emulator. All of them do the same things: RSA, DES, and DSS. The hardware devices have tamper-resistant memory to store secret keys, which can be generated internally. ViaCrypt says the hardware boxes will support PGP soon. All of the devices are controlled by a script language. The hardware units take ISO Memory Cards. ViaCrypt PGP is also selling for $99. ViaCrypt's number is 1-800-536-2664 or 602-944-0773 --- Mike For the person who requested my PGP key: Type bits/keyID Date User ID pub 1024/569A09 1993/07/31 Mike Ingle <mikeingle(a)delphi.com> sig 87C0C7 Edgar W. Swank <edgar(a)spectrx.saigon.com> sig 9C0865 W.Meredith <Genie w.meredith(a)genic.geis.com> Key fingerprint = AB B7 D7 70 4D 32 72 64 79 63 7F 05 07 1D 62 5D -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAixa6xEAAAEEAN0a4+5zXcAbvGCkhWMowzko1fjc+9Q/kWsPXPABJ1H12wmZ fvsTOlIZKsYVG9oulz6N928btkP+CBWAKEyykDSaD3/HQBpg5T3/T6CVQCCkfGJx qvdJa6OdY0f7d83o2MX2P58veYqgXuiDSL0BUtqXcF1GNeV+ra2f+EADVpoJAAUR tCFNaWtlIEluZ2xlIDxtaWtlaW5nbGVAZGVscGhpLmNvbT6JAJUCBRAtTrsZ3ic1 /dqHwMcBAYXmBACRfSLCOBa3VfIMf4IhwqqxBToNqzJuD1g9N97A6SJ7/7E4/ux+ gulv3EsQJl2SXA6tnKPaZVPdDEOwW0+I+/YyT4YkeXiu7y7bgQSjeGdiElJaMboO vNcdNUaDWBn0t3+h1B9UGE29/CyHXPGVzkh8W+mK1J+3GrrCxoIZch9RTIkAlQIF EC0hm4Q+dhgw+ZwIZQEBXxcEAKw8CGgLbYjmPPeFSvc9KGnPn10ky8ltuFwRg5zu tLN70WpkQtivHA74d4CTYroklOj//HiBlVAb04Pl31Ypug6F3PUiEZC4thlJ4BeF 3q4LJSHvD70gYZ3uzwEn/ZOqfAn79ehsVpsiCfh6haZN0oJfJpz7Tr5c1eVAyl99 ZAdb =/VCZ -----END PGP PUBLIC KEY BLOCK-----

1 0

Looking for lost mail
by Mike Ingle 17 Dec '03

17 Dec '03

I lost some list mail today. Could someone please forward me the missing messages? These are the last ones I got. Everything between this and the "KERT Advisory" joke is what I lost. Thanks, Mike Some people have been asking how to run background tasks on Netcom. How about this: have your task run, then send a ping to a remailer. When the ping comes back, your .forward file will start the task back up and it can run, then ping the remailer again. From: IN%"mech(a)eff.org" "Stanton McCandlish" 4-FEB-1994 20:44:29.91 To: IN%"eff-board(a)eff.org" CC: IN%"eff-staff(a)eff.org", IN%"comp-org-eff-talk(a)cs.utexas.edu", [ everywhere ] Subj: White House crypto briefings: Clipper, FIPS, escrow agents, export From: IN%"smb(a)research.att.com" 4-FEB-1994 21:03:12.11 To: IN%"hughes(a)ah.com" CC: IN%"cypherpunks(a)toad.com" Subj: RE: CERT advisory From: IN%"fb(a)cyberg.win.net" 4-FEB-1994 21:08:15.44 To: IN%"cypherpunks(a)toad.com" Subj: RE: Magic Money Digicash System

1 0

Re: Magic Money Digicash System
by Hal 17 Dec '03

17 Dec '03

From: fb(a)cyberg.win.net (Francis Barrett) > > Magic Money is a digital cash system designed for use over > > electronic mail. > This is the neatest thing I have read in a long time. Where can I get > one? FTP to csn.org, cd to /mpj, read the file README.MPJ which will tell you a directory to switch to, do that, cd to pgp-tools (or pgp_tools, or pgptools, I forget which), and get magicmny.zip. Then unzip and build it. > A few questions. Since the client which generates the proto-coins is > under the control of the consumer, the bank has no way of making sure > that he is not running his own code, or that the RNG he is using is > cryptographically strong, or even that he is not distributing modified > client programs to other users. None of these things should cause major problems. At worst useless coins would be generated. Initially, users might send their coins in right away to confirm that they are OK until they get some confidence in the program. > How does the bank deal with collisions in the 16 byte values of coins? This will practially never happen if they are chosen randomly. Bad randomness could produce coins which match ones which have already been spent (if somehow your RNG got into exactly the same state as someone else's), so they would be valueless. I think the program makes you initialize a random file before using it, so just make sure you put something random there! > What if the user picks the numeric values for the server to sign in a > way which leaks information about the banks private key? RSA is much > more secure when signing random-esque data, like a message digest, > than it is when signing numbers provided to it by some outside party. I don't think there are any values you can sign which would give away a private key. Even signing "1" or "2" should be safe, I think, since the secret key is the size of the modulus. I ftp'd a paper recently mentioned on imp-interest (on "anonymous credit cards") which claimed that new cash could be generated from sets of old cash in Chaum's scheme. I don't believe this, and the ref was to a paper "in preparation" by the authors. I'll try sending them email to ask about this. > Similarly, how can the consumer trust the bank's representation that > money has already been spent? Surely the bank should be required to > publish a list of cancelled coins and timestamps with a running MD5 > hash periodically for inspection by the unwashed masses. Here is how this problem would arise. Alice has some cash, which she sends to Bob to buy something. Bob sends it to the bank to be verified and turned into fresh cash before he will send the goods to Alice. But the bank says the cash has been spent before, and Bob reports this to Alice. Alice insists that she has never spent this cash before. Now, this is like a mystery story. Who is telling the truth? Maybe Alice is lying. Maybe the bank is lying. Maybe they are both telling the truth and someone broke in and stole Alice's cash while she was sleeping, copying it from her computer and spending it before she could. Ignoring that last possibility for a minute, it is basically Alice's word against the bank's. In general, in situations like this, we often go by the reputation of the parties involved. If the bank really is cheating, there will be lots of other people like Alice, people with good reputations, who are making similar charges. This will make people stop trusting the bank. On the other hand, if Alice is cheating, this is probably not the first time. In time she will get a reputation for being untrustworthy. The idea of publishing lists of used coins is interesting but I'm not sure it helps. Double-spending could easily occur close together in time, between publication of lists. A cheating bank could claim a coin had been spent just before the actual coin came in. > What do you do about lost messages from the server to the client. > Once coins have been recorded as spent, they cannot be redeemed again. > Yet the mail message containing the new coins may have been lost in > transit. The server should re-transmit the message if it does not arive. We discussed this a while back and it appears safe for everyone in these protocols to re-transmit messages freely if the other person claims never to have gotten them. Even if they are lying, what is the harm - you are just sending them information they already have. Good questions. Hal

1 0

SQUISH II, the SEQUEL
by L. Detweiler 17 Dec '03

17 Dec '03

Hello, my mailbox has been awfully quiet lately from cypherpunk rants, and I need a bit of a massage at the moment, so I wanted to ask you a question. Have you considered what I was saying about preventing `abuse' of remailers? I have given you some time to formulate a plan. so-- could someone email me your new official Cypherpunk ethical guidelines for anonymous posting, involving your opinions and procedures on libel, harassment, and `violent death threats'? what's that? you don't have an official policy or any safeguards? I guess that means that `anything goes' (quite literally!) kind of a disturbing policy, because someone simultaneously very ingenious and malicious could create some major annoyances. I guess you already know that. but even the past `operations' could pale in comparison to future ones. the possibilities are really limitless. imagine what can be accomplished when no one is held accountable for what they post! why, it is a recipe for Utopia. cypherpunks, I so admire your vision of the future. BTW, I want to commend you anonymous site operators for your resilience. it does appear that the remailers are fairly secure, at least, that is the picture portrayed to `outsiders'. of course, with insiders, it is a different story. but in a certain interesting application of anonymous remailers, e.g. an enemy attacking the remailers themselves, the confidentiality of identity among `insiders' is not critical. in fact, it can be very satisfying for an enemy to strike his foe, even while the foe sees his face, but can do nothing about it because of his own predicament. even more delightful (for the attacker, that is!) is the situation where the `predicament' is not even due to the attacker, but entirely the enemy himself. in other words, the most effective and devastating tactic of guerilla warfare is to twist technology to get your enemy to shoot *himself*.

1 0

He's baaaaack!
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

Just when you thought it was safe to go back on the internet... He's baaaaack! Remailer operators, please lock him out now, before he does whatever he is getting ready to do. Better yet, set it up so when he sends to a remailer, he gets back a hundred copies, and one gets forwarded to his sysadmin with his name on it.

1 0

Encrypted Snail Remailer.
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Disclaimer: Please take this as a work of science fiction, a short monologue by the character in a novel. It is meant to stimulate discussion and to express concerns that have recently turned from vague to clear, in my mind. I have great respect for the people out here, but I can not help myself. I very much want a secure network of remailers, but I fear the problem is the design, inflexible and non-private, of the internet itself. This is dedicated to those such as Phil Zimmerman and Pr0duct Cypher, individuals who seem to see the larger picture, that which involves humanity, not just internet culture 1994. -=New Secure Remailer Service Announcement=- For discussion purposes only until I post my mailbox address and buy that 128/256MB drive ;-) ! Ultimate in remailer technology. Only slightly slower than many Cypher remailers, but much less traceable. Up to 250MB at once. Encrypt your message with the (possibly anonymous) public key of a friend or contact, signing it with your anonymous secret key. Encrypt that, along with the friend's postal address, with my public key. Put it on a new DOS or Mac floppy, or 128/256MB Optical Disk, avoiding finger prints and DNA on the postage stamp. Send it with a fake return address from a pubic mailbox to my yet to be announced post office box. I will decrypt the forwarding address on my PowerBook, not at home, and mail it from various Manhattan street mailboxes, with no return address (or one you send me). I will then securely overwrite the file from my hard disk. Of course, you can include an anonymous encrypted return address as part of your message to the recipient. The cost is $5 cash, plus $1/MB of encrypted message to cover the CPU time. Express mail would in fact be AS fast as the serious Cypher remailers, but would cost you $20 since I have to pay in cash at a post office, or get a money order to use FedEx, and then make up a fake return address if you leave one out. Until a new generation of internet remailers are produced, I make claim to my remailer service being much more secure. There is also no need keeping logs to protect my liability, since no one knows that my remailer was where it came from. One of the most serious weakness of any internet remailer is that you tell someone spying on the recipient exactly which remailer site a piece of mail came from, as well as when. I asked about faking internet mail but was told that this was "frowned upon" for internet mail. Too bad. REALLY too bad. With mine, it could be any individual in NYC, and the time of day doesn't mean much. It thus involves a lot more than a few keystrokes on the assumed NSA internet logging database to trace it back to the sender. Fairly obvious and fairly illegal spying on me and the other manual remailers out there would be required, as well as opening mailboxes before the mailman arrived. A TEMPEST attack on a PowerBook in public in different locations just isn't going to happen very often. Bugging my PowerBook isn't possible since I always carry it with me (and know what it's insides look like in detail). Secure encryption being available to the common man is what will change the world. I'm not yet convinced that internet remailers will have a similar influence unless they are able to resist the presence of full site-to-site monitoring by the government and hackers, a thing which should thus be assumed by their designers. Cryptoanarchy doesn't mean the internet. It means encryption. Given that snail mail encrypted remailing is already possible, the reason for a new, secure remailer generation isn't really security but is speed, convenience, flexibility, and cost. The same reasons for ANY use of the internet. But current serious remailers are neither fast nor convenient, and they don't have a BILLION messages going through them a day to mix your secret messages into, like postal mail DOES. They tag mail as having BEEN remailed as well. Even when ALL e-mail is encrypted you haven't done anything for anonymity until all e-mail is also REMAILED, with no logs or remailer sites appearing in the headers. E-mail is free now. Remailing needs to be free too, or what advantage has it over snail mail, given that it does the same thing? The only way I can see all mail being remailed, assuming it is already all encrypted, is if every personal e-mail account was itself a remailer. I don't see this happening unless the Cypherpunks themselves write the software for the "data highway". Otherwise I will never trust remailers since as I've said to others, I can't SEE the wires. PGP is what's happening. Digital money too. But the INTERNET, even with (centralized) remailers is just a Big Brother nationwide wiretap. So don't use wires. What is my liability, if I am a remailer and the authorities intercept a message to a gangster? None, since they don't know I remailed it. Can any internet remailer be so lucky? I could say I don't KNOW if I remailed it (no logs), even if they find a return address as encrypted in my public key; "Any one of dozens of Manhattan snail remailers could have sent it." However, if your return address IS encrypted with my public key, law enforcement can, most likely LEGALLY, demand my pass phrase. Of course they'll only know the return address using the pass phrase and secret key of the receiver. Again though, this situation is BETTER security than internet remailers, since the pass phrase for the remailer is in my head, not plain text in a perl code. They can't secretly download my memory, or at least not YET ;-). Breaking into your remailer site without a trace is conceivable though. I'd find it similarly attractive but more rewarding than dumpster diving. Commercial sites are easiest, especially small high tech companies. Are these sites TEMPEST secure? Tempest based on simple radio receivers is primitive compared to what modern spectroscopy could conceivably do, even at a distance. I'd imagine ACTIVE spectrosopies could do much more or you could actively induce a current in a given direction at a given frequency. How about having your CPU mail me its secret key and pass phrase? Things like this are only getting easier, fast. VERY fast. Another reason to not trust fixed-location centralized remailers. I don't even like the idea of personal accounts on a Unix machine. Every laptop should be an internet node, and an encrypted remailer. Only when central remailers are no longer there to attack will we have safe anonymity without using snail remailing. Hell I can't even get more than three fucking e-mails in response when I ask for INFORMATION about the existing remailers. I thank Eli and Hal, but I guess the NSA doesn't hand out info on the dozen Cypherpunk remailers IT is running. Zero knowledge (yup), reputations (lowsy or non existent except for anon.penet.fi), information markets (selling remailer pass phrases and sendmail logs), anonymous networks (snail mail only), collapse of governments (yes, but not using the existing nationwide wiretap, er... internet). Fuck, I'm sounding like Detweiler. But I'm ranting for MORE cryptoanarchy. Another internet-like standardization such as that of e-mail headers, has very sadly crept into PGP itself, weakening it as the secure encryptor. PGP 2.3a still has no "random data block" output format, in which the ONLY way to even KNOW it's a PGP message is to successfully decrypt it. I asked about this on alt.security.pgp, generated little interest, but was told a future version may have this option (just gossip). I say it should be the STANDARD. Internet-like standards should NOT be the guiding force behind CRYPTOGRAPHIC standards. Get the fuck off the internet, and write me a real encryptor. How can steganography work if it's so easy to figure out if what is extracted is an encrypted message? Given the upcoming non-voluntary second generation Clipper, steg will have to become the norm. And don't port PGP to the Mac and Windows, port it FROM them; over 100 million strong and growing. "Five to one baby." News of the revolution will not be posted. Thanks for PGP. Thanks for the CPU. Like those Cypherpunk T-shirts though! Boot up and slam dance. Kewl! Nice sig! If my remailer, the ONLY acceptably secure encrypted remailer that exists, catches on, I may add a modem feature, involving pay phones. I've already written the needed secure code (none). And remember, security begins with people, not technology, always has, always will. -=Xenon=- P.S. gosub disclaimer. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVM1wwSzG6zrQn1RAQF8kwP/YetocN9urSgB4X9u70ZABFeLawEkwu56 jFDWZgDG+Z/81vFkVWTC7gvfDDB4Rjy0qeEhuq187zeRJ3fKCRPkkHz7swDV3V+o RA9waKWz7tdxglkW98bJIKpC9rYp4lvtxPWgtAsLTs6b9tJqvXmp2S+OcjcyV6sE gKI25vPg5Ww= =zjED -----END PGP SIGNATURE-----

1 0

Alert--Admin. names escrow agents, no compromise on Clipper - 7 files (fwd)
by Mike Godwin 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Crypto Regulation Reform
by rcain＠netcom.com 17 Dec '03

17 Dec '03

Mr. President, I am watching with great interest the activity with regard to cyrpto regulation and have an observation I would like to share. The following was excerpted from the Harris statement: > > The President has determined that vital U.S. national security and > law enforcement interests compel maintaining appropriate control > of encryption. Still, there is much that can be done to reform > existing controls to ensure that they are efficiently implemented > and to maintain U.S. leadership in the world market for encryption > technology. Accordingly, the President has asked the Secretary of > State to take immediate action to implement a number of procedural > reforms. The reforms are: > While I totally understand the concern here and am in sympathy with the reasoning, assuming benign adherence to the procedures, I think you are in effect jousting windmills with this attempt to control or regulate crypto. It is simply too easy to build and distribute inexpensive devices that are *truly secure*, without back doors to make it other than delusional to think that the people that we would not want to have this technology won't. A device can be made right now at lower cost than a computer modem, much lower, that could be inserted between any phone and the wall that would make it impossible, no matter what laws are in place, to tap either passively or acitively, communication that passes between two of these devices. I know how to do it, could do it and probably will just for the fun of it at least. If I can there are many others that can also. In fact I personally know several. These devices can be credit card size and even fit in a wallet. They can easily be smuggled in and will be. A black market will flourish and nothing will have been accomplished except the expenditure of a lot of futile money and creation of more crime in an inflated, lucrative market. We simply must accept that point-to-point secure communication is a part of our electronic environment and swallow the bitter pill that no matter what the valid arguments are for regulation, it is effectively not possible, so that national security and law enforcement are going to be denied, in the near future, a tool in their arsenel and will have to come up with new ways of gathering this intelligence. Please abandon this effort before we throw good money after bad and create a worse situation than we will have without it. I would like whoever processes this email to forward a copy to the following contact. > The contact point for further information on these reforms is Rose > Biancaniello, Office of Defense Trade Controls, Bureau of > Political-Military Affairs, Department of State, (703) 875-6644. Sincerely, Bob Cain -- Bob Cain rcain(a)netcom.com 408-354-8021

5 13