December 2003 - cypherpunks-legacy

Re: Statistics of Low-Order Bits in Images
by kqb＠whscad1.att.com 17 Dec '03

17 Dec '03

Several people are attempting to create an algorithm to mask the presence of a steganized encrypted message in the least significant bits of an image. Don't forget that no matter how fancy your algorithm or how closely you mask your steganography with a model of what the statistics of an ordinary image look like, you have to assume that your opponent also knows your steganization algorithm, including your masking technique. (Otherwise you are just relying on security through obscurity.) This leaves you with three problems: (1) your opponent may have a much better model of an ordinary image than you do, and still be able to discern the existence of masked steganography, (2) since your opponent knows your steganization algorithm, he/she can look for any "signature" that your steganography masking model leaves, and (3) your opponent can "desteganize" all your images and check their statistics for deviations from the statistics for "desteganized" ordinary images. Resolving problems (1) and (2) requires a lot of work constructing good models. Resolving problem (3) requires, I think, a modeling function for steganography that is invertible only with a secret key. (Otherwise, your opponent could desteganize your image and find a uniform random distribution, which indicates an encrypted message.) Since this type of function is, to my knowledge, not well-developed, don't expect it to be secure. Thus, if breaking it could compromise your secret key for desteganization, then don't use the same public/private key pair for both encryption and steganography. Kevin Q. Brown INTERNET kqb(a)whscad1.att.com or kevin_q_brown(a)att.com

1 0

Factor Breakthru!
by Matthew J Miszewski 17 Dec '03

17 Dec '03

'Punks, Just curious as to what would (or will eventually) happen when a shortcut to factoring large numbers is discovered? Do we revert to older less secure conventions or am I missing something? --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

2 1

Re: Entropy, Randomness, etc.
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

Good questions. >My understanding of a random number is a number is generated from >two or more unrelated events. No. This may be one general category of ways to manufacture random numbers, but specifically a random number is just an arbitrary number typically drawn from a sequence of independent arbitrary numbers. The quality of 'randomness' is a measure of the independence of the elements in the stream. Therefor, there is no such thing as a random number except as an element of a sequence or other context from which to establish independence. >In order for this number to be most useful cryptographically, it needs >a even distribution. No. In order for this number to be cryptographically useful, it must cost more to guess the number (perhaps knowing the numbers that came before) than the reward for guessing it correctly. It happens that non-flat distribution of a sequence is a lever for cheaper guessing, thus flat distribution is natural characteristic of high-quality random sequences. >Does this make this distribution a gaussian distribution? No. Gaussian (a.k.a. 'normal') distribution is the bell curve (and clearly indicates a relation between samples). Math texts describing this distribution often use the phrase 'distribution of some random variable x', by which they in fact mean 'distribution of samples from a varying source'. >Also how are these statistical measurements done? See Knuth, "The Art of Computer Programming", Volume 2: Seminumerical Algorithms, Chapter 3: Random Numbers. >Is it as simple as a histogram? Yes. >Are we talking frequency analysis with FFTs and >more advanced things? Yes. >How do we measure the entropy of a random number, or a series of >random numbers? Ah. Now we're talking. Entropy is closely related but not equal to 'randomness'. Entropy is a measure of information often expressed as the fraction of information-size to data-size. Randomness is a measure of unpredictability. A sufficiently random sequence will be of very high entropy from the perspective of the 'guesser', though not necessarily from the that of the generator (e.g. a PRNG). The best way to measure entropy (if that is what you want to measure), is to build a sufficiently powerful Markov model, or the equivalent, to predict the sequence, and treat it like a compressor. The number of bits output is the entropy of the sequence with respect to that model. If you can't build a model as smart as your presumed attackers (as smart as them, not as smart as any model they might build), then you will have to use more tests to assure yourself of indepence of elements in the sequence (see Knuth, et al). In practice however, most of these methods represent very low bars over which any RNG _must_ jump, and which often poor ones can. Most RNGs are broken by understanding how they work, and exploiting weaknesses in their construction and context (e.g. poor 'seed' selection). >Have people on the list done this, or is this still in the range of >people that do math and number theory for a living? Yes, and Yes. >These topics are probably covered in some of the basic books in the field, >but all of the reference's I've been able to locate don't go into >specifics of how to measure the quality of random numbers. See Knuth. >Unless some measurements are made, you can't really be sure that those >/dev/mem MD5 hashes don't come up the same 10%, 30%, or more of the time. >It seems that a lot of assumptions are being made about what is good and >what isn't. You should be exactly as paranoid as it is cost effective to be. Hope this helps. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

What recipient-end mail filters are available?
by Anthony Garcia 17 Dec '03

17 Dec '03

I'm aware of two mail-filtering systems that operate at the recipient's end, procmail and Elm filter. Are there others? -Anthony Garcia agarcia(a)neosoft.com

3 2

Statistics of Low-Order Bits in Images
by jazz＠hal.com 17 Dec '03

17 Dec '03

>Sounds like the simple solution is for people everywhere to replace >the low order bits of all of their pictures with good random noise. You're kidding, right? Image processing software, and music processing equipment, are designed to get the maximum performance out of the storage medium. I find it pretty unlikely that any developer of image processing tools is going to deliberately drop one bit of precision off each n-bit unit; sheesh, image files are big enough without software deliberately wasting bits. As for introducing noise into the low-order bit of music CDs, definitely not; the trend is towards equipment that can extract the last dribble of information from well-recorded sources, and towards recording equipment that can meaningfully record every bit of every word. Why do you think there are 64x-oversampling players and the like? Eric's right; you'll have to build your own tools to make things noisy, as the trend elsewhere is to make things unnoisy. On the other hand, have you looked at the new mini-disc technology? That stuff already introduces audio compression, and the bits on a minidisc should be pretty high in entropy; of course, twiddling bits in a compressed audio recording may have dramatic effects on sound... Jason

2 1

Fedworld BBS Info
by jkyser＠netcom.com 17 Dec '03

17 Dec '03

Somewhat off topic, but for those of you interested in government information, there is a BBS called FEDWORLD which has gateways into 100+ federal BBS systems. It can be reached via telnet to fedworld.gov. Following is a list of the federal systems that can be reached through the gateway: 2:ALF (USDA) :National Agricultural Library BBS 3:ALIX (Lib of Congress) :Automated Library Information eXchange 4:BOM-BBN(Dept of Interior):Bureau of Mines-Bulletin Board Network 5:ISM-SIS (IRS) :ISM Support Info System 6:CIC-BBS (GSA) :Consumer Information Center 7:CLU-IN (EPA) :Superfund Data and Information 8:CPO-BBS (Census) :Lists open jobs at the Census Dept 9:CRS-BBS (Dept of Justice):Amer. With Disabilities Act Info 10:Computer Security (NIST) :Computer Sys Lab Computer Security BBS 11:DCBBS (DC Govt) :DC Government Information 12:DMIE (NIST/CSL) :NIST/CSL Data Management Information 13:EBB (Dept of Commerce) :Economic data and information 14:ELISA System (DoD) :DoD Export License Tracking System 15:GSA/IRM BBS (GSA) :Information Resources Management Issues 16:EPUB (Dept of Energy) :Energy information and data 17:FDA's BBS (FDA) :FDA info and policies 18:FDA/DMMS (FDA) :PMA, IDE, 510k & guidance documents 19:FERC-CIPS BBS(Dof Energy):Fed Energy Regulatory Commission 20:FEBBS (Fed Highway Admin):FHWA information and data 21:FRBBS (NIST) :FRBBS - Info on Fire Research 22:FEDERAL BBS (GPO) :GPO and Govt Data (Fee Based) 23:OSS-BBS (GSA) :GSA On-line Schedules System 24:Eximbank BBS :Export/Import Bank data and info. 25:JAG-NET (U.S. Navy) :Navy Judge Advocate General 26:Labor News(Dept of Labor):Dept of Labor information and files 27:Megawatt 1(DofEnergy) :Information on energy and DoE 28:NADAP (US Navy) :Navy Drug and Alcohol Abuse Prevention 29:NAVTASC (US Navy) :NAVCOMTELSTA Washington DC 30:EHSC-DDS :Army Engineering & Housing 31:NDB-BBS(Dept of Agricul) :Human Nutrition Information Service 32:NSSDC\NASA\Goddard :The NASA NODIS Locator System. 33:1040 BBS (IRS) :Electronic Tax Filing Information 34:SBB-BB (Treasury) :Surety Bond Branch, Circular 570 35:OIS (Bureau of Prisons) :US Bureau of Prison employees 36:SBIR-BBS (NASA) :NASA Small Business Innovation Research 37:WTIE-BBS (EPA) :Wastewater Treatment Info Exchange 38:QED-BBS (USGS) :Quick Epicenter Determ and EQ data 39:SALEMDUG-BBS (FEMA) :State and local FEMA user groups 40:SBA On Line (SBA) :SBA Information and data (9600 bps) 41:SBA On Line (SBA) :SBA Information & Data (2400 bps) 42:SBAI-BBS (SBA) :Small Bus. Admin internal BBS 43:Sample Weather Data (NWS):Sample data from Fee Based System 44:OPM Mainstreet :OPM - Job Info, Personnel Guidance 45:TELENEWS(Dept of Energy) :Data and info on Fossil fuels 46:USA-GPCS BBS (US Army) :Army Info System Software 47:USCS-BBS (Customs) :Customs and Exchange Rate Data & Info 48:USGS-BBS (USGS) :Geological Survey BBS/CD-ROM Info 49:NLPBB (Navy) :CNO's Navy Leadership Policy BB 50:FMS-BBS (U.S. Treas) :Inventory management data & programs 51:OASH-BBS (HHS) :Health & AIDS Information & Reports 52:FEDIX :Links Fed Data to Higher Education 53:DASC-ZE(Def Log Agency) :PC Info and files 54:GPSIC (Coast Guard) :GPS, Loran & Omega Info/status 55:NGCR-BBS (US Navy) :Next Generation Computer Resources Stan 56:PPIC-BBS (EPA) :Pollu. Preven, Clean Product, Ozone 57:Gulfline (EPA&NOAA) :Gulf Coast Pollution Information 58:FAA Safety Exchange (FAA):Small Plane Safety Reports & info 59:NTIS QuikSERVICE (NTIS) :Order NTIS Documents Online 60:LC News Service (LOC) :Library of Congress News Service 61:STIS (NSF) :Science & Technology Information System 62:MI-BBS (DoE) :DoE Minority Impact Bulletin Board 63:TECH SPECS (NRC) :Technical Specifications Improvement Pr 64:Census-BEA (Census) :Census BEA Electronic Forum 65:IHS-BBS (HHS) :Indian Health Service BBS 66:NOAA-ESDD (NOAA) :NOAA Environmental Services Data Direct 67:Offshore-BBS (Interior) :Off Shore Oil & Gas Data 68:TQM-BBS (T. Glenn) :Total Quality Management 69:NIDR Online (NIH) :Nat. Institute of Dental Research 70:NIHGL (NIH) :Nat. Inst. of Health Grant Line BBS 71:PayPerNet #1 (OPM) :Fed. Pay & Performance Management BBS 72:PayPerNet #2 (OPM) :Fed. Pay & Performance Management 73:CASUCOM (GSA) :Interagency Shared Services/Resources 74:ATTIC (EPA) :Alternative Treatment Tech Info Center 75:NCJRS-BBS (DofJustice) :National Criminal Justice Reference Sy 76:DRIPSS (EPA) :Drinking Water Info Processing Support 77:PIM BBS (EPA) :Pesticide Information Network 78:SWICH BBS (EPA&SWANA) :Solid Waste Management 79:NPS-BBS (EPA) :Nonpoint Source Program BBS 80:OEA BBS (DofInterior) :Interior's Off of Environment. Affairs 81:Metro-Net (US Army) :Army Morale, Welfare, and Recreation 82:CABB (Dof State) :Passport Info/ Travel Alerts 83:BUPERS Access (US Navy) :Navy Personnel Information 84:FCC-State Link (FCC) :FCC daily digest & carrier stats/report 85:HUD-N&E BB (HUD) :HUD News & Events BB. Press Releases 87:FREND #1 (Natl Archives) :Fed. Register Electronic News Delivery 88:FREND #2 (Natl Archives) :Fed. Register Electronic News Delivery 89:NHS-BBS (HHS) :National Head Start BBS 90:WSCA-BBS (Dof Labor) :Board of Wage & Service Contract Appeal 91:TEBBS (OGE) :Office of Government Ethics BBS 92:HSETC MD (U.S. Navy) :Naval Health Sci Edu & Training Command 93:PPCUG/RDAMIS (DoD) :Pentagon Users Group BBS 95:CBEE (Coast Guard) :Coast Guard On-Line Magazine & News 96:ATD BBS (FAA) :Air Transport Div. BBS 97:ATOS-BBS (FAA) :Air Traffic Operations Service BBS 98:AEE BBS (FAA) :FAA Office of Environment & Energy 99:OCA BBS (PRC) :Postal Rate Commission/Consumer Advocat 100:GEMI (GSA) :GSA Electronic Management Information 101:Airports BBS #1 (FAA) :Airport operators and designers 102:EnviroNET (NASA) :Space Environment Information Service 103:FAA HQ BBS (FAA) :FAA Headquarters BBS 104:IRS-SOI (IRS) :Public Taxpayer Statistical Information 105:ARA-BBS (FAA) :Aviation Rulemaking Advisory BBS 106:IIAC BBS (US Army) :Integration & Analysis Center BBS 108:ACF-BBS (HHS) :Admin. for Children and Families 109:NTIA-BBS (Dof Commerce) :Radio Freq. Management Issues 110:ED Board (Dept of Ed) :Dept of Ed Grant & Contract Info 111:BHPr-BBS (HHS) :Medical & Health Services Information 112:Marine Data BBS (NOAA) :Marine Databases & Files 113:Call-ERS BBS (USDA) :Agriculture Economic Research Info 114:Call ERS (USDA) :Economic Research Line Service Line 2 115:ABLE INFORM (Dof Ed) :Disability & Rehab Data & Info 116:PTO-BBS (PTO) :Patent and Trademark Office BBS 117:PerManNet (Dof State) :US Agency for International Development 118:Quick Facts! (NIAAA/HHS) :Alcohol Abuse & Alcoholism Information 123:IBNS/OMPAT BBS (DoD) :Military Performance Assessement 124:EDOS (DC Crt Appeals) :US Court of Appeals, District of Columb 125:RSA-BBS (RSA) :Rehabilitation Services Administration 126:FRESBB (GSA) :Federal Real Estate Sales Bulletin Boar 128:NCUA BBS (NCUA) :National Credit Union Administration 129:NBCI-BBS (USDA) :Natl Biological Control Institute 130:OECI-BBS (DOC&DoD) :Defense Conversion Information -- Jeff Kyser PGP 2.3 public key available via finger jkyser(a)netcom.com " "

1 0

WiReD has a gopher (and its name was...)
by Anonymous 17 Dec '03

17 Dec '03

Newsgroups: comp.org.eff.talk,alt.wired From: kadie(a)cs.uiuc.edu (Carl M Kadie) Subject: Wired Magazine's gopher Message-ID: <CHBE7B.Jt(a)cs.uiuc.edu> Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL Date: Tue, 30 Nov 1993 17:06:46 GMT Wired Magazine has a gopher. It includes many articles. Try gopher gopher.wired.edu I've also added it to the CAF whatsnew server. Try gopher gopher.eff.org 5070 - Carl ANNOTATED REFERENCES (All these documents are available on-line. Access information follows.) ================= admin/access ================= Information on how to access one computer medium via another: access anonymous ftp via email, access gopher via email, access gopher via telnet, read netnews via gopher, read netnews via telnet, write netnews via email, ftp via gopher. ================= admin/whatsnewd ================= * Code for and description of "whatsnewd" (v. 0.42) (Connect your Gopher to "gopher.eff.org", port "5070" to play with it.) It is a gopher-protocol server. What it does: When a user gives a date (e.g. "1 day ago") or enters a dated bookmark (generated by a previous query), he or she gets a gopher menu of the gopher items that are new or changed since that date. ================= ================= If you have gopher, you can browse the CAF archive with the command gopher gopher.eff.org These document(s) are also available by anonymous ftp (the preferred method) and by email. To get the file(s) via ftp, do an anonymous ftp to ftp.eff.org (192.77.172.4), and get file(s): pub/academic/admin/access pub/academic/admin/whatsnewd To get the file(s) by email, send email to archive-server(a)eff.org. Include the line(s) (be sure to include the space before the file name): send acad-freedom/admin access send acad-freedom/admin whatsnewd -- Carl Kadie -- I do not represent any organization; this is just me. = kadie(a)cs.uiuc.edu =

2 1

Signing Keys for Nyms and Digibank Users
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > If I remember right, none of these people puts a PGP Key ID or fingerprint > in their posting signatures, so I don't have that clue available - > that would increase my confidence a lot. But I still couldn't be sure. Suppose one were an anon(a)penet.fi subscriber, and that one were strict in digitally signing all messages, and that one's public key were available from the PGP public key servers, and that one conducted affairs in this way for a lengthy period. Would the confluence of the Email identification in the digitally signed message with the identity on the PGP public key along with the presumption of good identity management on the Finnish remailer be of sufficient weight to convince you to sign one's PGP public key? Would existing signatures on a PGP public key influence your decision? DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBFAgUBLPxHnvFZTpBW/B35AQF68AF+LqDXWrjntXqW0bqgdIETD+aOddCAvJIA J02n5sreNbTv/1beDYpL1vQiA/3vHZOl =MH5W -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

NSA Insecure Remailers?
by Duncan Frissell 17 Dec '03

17 Dec '03

A >probably only the NSA and some defense agency we haven't A >yet heard of are actually performing this analysis right now. But A >given the declining price of storage media, even saving everything on A >magnetic media and paying $1000/gig, it only costs about US$8.7 million A >to keep a year's worth of traffic headers around (media cost). A > A >So what? So what indeed. Why oh why do we waste so much time seeking systems that are mathematically unbreakable. You don't need mathematically unbreakable systems to have a free market on the nets. It costs a minimum of $50K to start a federal criminal prosecution (that is if the perp is inside the US). This means that the feds can only afford a few tens of thousands a year. When you add incarceration costs it quickly becomes very difficult. This being the case, they are dependent on your obedience for law enforcement success. Like any predator, the government must gain more energy from the kill than it expends on the hunt. Otherwise it weakens and dies. Did you know that fewer than 1000 people are convicted of federal tax evasion every year. Your obedience is in turn dependent on your view of whether or not obedience is right and on your fear of punishment. Quite apart from computer networks both the ideology of obedience and the fear of punishment have been declining. Net society further weakens both of these factors. The consensual hallucination that is rule by others seems more threadbare every year. The DDR border guards had the machine guns to fire on the crowds at the Berlin Wall on 10 Nov 1989. It was not mechanical failure or a magic shield that prevented them from firing. It was simply because a change had occurred in the minds of the citizenry (and in their own minds). Sure the feds can nuke your house. Would that gain them anything? It would cost more than it was worth. What they can't do is sit down next to every person on earth (or on the nets) and intimidate them. In the past it didn't matter because almost everyone was a peasant bound to the soil. As you keep piling technology and market opportunities (choices) on individuals, their power increases. Governance of others is hard enough when those governed are weak. It rapidly becomes impossible as they gain strength. Today and in the future, those who "move like Gods through cyberspace" will be much harder to control particularly since such controls will depend not on guns but on them convincing us that we are not free. DCF "They would not leave him alone." -- The first line of what relevant work of fiction? --- WinQwk 2.0b#1165

1 0

"CYPHERPUNK CRIMINAL" t-shirts
by Stanton McCandlish 17 Dec '03

17 Dec '03

The "CYPHERPUNK CRIMINAL" t-shirt project is now being handled by: Christian Void <cvoid(a)albemuth.tatertot.com> I've passed on all queries and "I want one!" messages to him, so no need to resend them. -- Stanton McCandlish mech(a)eff.org 1:109/1103 EFF Online Activist & SysOp O P E N P L A T F O R M C R Y P T O P O L I C Y O N L I N E R I G H T S N E T W O R K I N G V I R T U A L C U L T U R E I N F O : M E M B E R S H I P @ E F F . O R G

1 0