December 2003 - cypherpunks-legacy

Clipper Qs
by Colin Orion Chandler 17 Dec '03

17 Dec '03

Hurm...I have had a couple of thoughts, no dowbt simple ones, but maybe you can help: If I bought a a ClipperFone and switched chips with my neighbors chips (Clipper Chip, that is), could the .gov tell what was going on? Also, can these chips be re programmed? ;) I'd like a cracker... ___________________________________________________________________________ |---===================================--| /\ | | \ |_ _\ \ / | |---Colin Titus Orion Xavier Chandler----| \\ \ | | . | | > < | |---===================================--| \ \\ / \__/ _|\_|___|_/\_\ | | _____ | / \/ / / | |/\ __ \ __ "What year is it?" | / / \//\ "If it's not a | |\ \ \/\ \ _ __ /\_\ ___ ___ | \//\ / / Sun, it's not a | | \ \ \ \ \/\`'__\/\ \ / __`\ /' _ `\ | / / /\ / computer." | | \ \ \_\ \ \ \/ \ \ \/\ \L\ \/\ \/\ \ | / \\ \ .__ __ | | \ \_____\ \_\ \ \_\ \____/\ \_\ \_\ | \ \\ |_. | | |\ | -| | | \/_____/\/_/ \/_/\/___/ \/_/\/_/ | \/ __| I_| | \| __|/160| +________________________________________+_______________________________+ | Colin Chandler |"It can only be accountable to *human* error."-HAL9000| | (415) 388-8055 | orion(a)crl.com, wizard @ BayMOO (mud.crl.com 8888) | |________________________________________________________________________|

1 0

What's a "real encryptor"?
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I (Nik) got a letter from a mathamatician asking me to clarify what I meant by a "real encryptor". Here is the answer I gave. It is for the newbies out there, not the serious cryptographer types who know this already. Warning: one of my Xenon character's last rants will be arriving shortly. Take it with a grain of salt; it's pretty nasty, and not meant for those who already understand its message. I'm trying to drum up some public demand for a "real encryptor", for one thing. Think of it as propoganda, for it appeals to emotion not logic, and it is not very fair. Steganography involves hiding a message in a file. I can use the Mac program Stego to place say a PGP message into a Mac PICT (just a picture) file as the least significant bit of each pixel. If it is a 24 bit per pixel color picture, then you can't even see a difference. If it is 8 bit color, then you CAN. It looks like digital noise. On off, on off. No matter. The problem IS, anyone with Stego can extract the file and immediately see that it is an encrypted PGP message. When PGP encrypts a file, after compressing it, it includes in the final output all sorts of extra things like a checksum at the end, and full information given out to anyone about the name of the key that it was encrypted with. It will proudly announce, for instance, "This message can only be read by Pr0duct Cypher. You do not have the secret key required to read it." I don't know the full details. The PGP documentation mentions some of them, for the binary format PGP output files. I could send you this if you want. What I mean by a "real encryptor" is something just like PGP, but minus the convenience features that get tagged onto the PGP messages. It might be as simple as stripping them away the PGP convenience procedures. If the output was simply an encrypted message, and it seems to me PGP could do this, it should be hard to distinguish it from a random series of bits. Hopefully nearly impossible! Then you can use steganography for your messages but no one can tell if what they extracted is a message or not! The least significant bit of most messages such as sound files is noise anyway. On off, on off. They can't even tell how big it might be. That is a potential mega problem with PGP itself not being able to know how big it is though. You would have to know before hand, or make the picture or sound file BE the right size, EXACTLY. That's certainly easy for sound files! Just send voice mail! You could pad the content of the PGP message if you wanted to hide the actual size of the decrypted message. If you get voice mail from a stranger saying something vaque, you can check if it contains a PGP message encypted with your public key. If PGP outputted such a hard-to-distinguish-from-random data format, it opens up many different possibilities for sending your messages. Ideally, no one would be able to tell if it was an encrypted message except by successfully decrypting it. As it is now, such schemes have to rely on "encrypting" an already encrypted PGP message to hide the fact that it IS a PGP message! Many of us just want to be left alone and are tired of having our files tagged as BEING encrypted. Personally, I suggest using PGP as a Clipboard utility so I can cut a message out, encrypt it, paste it back in and save it as a word processor file which I then Macintosh BinHex encode as text, and e-mail off. Now I'm just sending a BinHexed word processor file, just like thousands of other Macintosh e-mailers out there every day! This isn't good enough since it is so easy reverse, by anyof them ;-), and they are still struggling with just e-mail. PGP is still a program only used by those why really need it. It may remain that way, so for those people, having a random data block output would mean they wont set off alarms and catch the attention of the government, just for sending a love letter to their mistress ;-). -Nik (-=Xenon=-) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVb/QgSzG6zrQn1RAQHPRgQAttdvv7y01xE0+8xKOnoODYJ3Xmlw0Wrs hIlMIGglirxY8Q244EEfjA538QES19jS95+8G5q9p5eEjM6w0apkRKQbyQOxme8j tfBU+yhhtqTGPUidLdiOWNszn2DvD0hrTVFH15b3yFoB2F1mA1kkjbfmXAm1r7gS MmJaO0c6ZNE= =SIQx -----END PGP SIGNATURE----- P.S. Were PGP like many programs, able to accept modular "Plug ins" like say Adobe Photoshop, this "bare" data block output could be an add-on featue ("feature stripper?") that those who want it would use. Or at least a separate utility that would strip and restore PGP messages.

1 0

nate@vis.colostate.edu remailer *GONE*
by nate＠VIS.ColoState.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Everyone out there, plese listen up! The remailer at nate(a)vis.colostate.edu has been taken down as a result of the posting by some anonymous person to a local list of administrators. I will also be taking down my GUI in Mosaic for the remailer, but the software is still available at: ftp://vangogh.vis.colostate.edu/pub/nate/remailer-GUI/cpremailer.tar.Z thanks for the support, and could someone send me info about netcom accounts? Thanks, - -nate - -- +-----------------------------------------------------------------------+ | Nate Sammons <nate(a)VIS.ColoState.Edu> <nate(a)yuma.ANCS.ColoState.Edu> | | Colorado State University Computer Visualization Laboratory | | Data Visualization/Interrogation, Modeling, Animation, Rendering | +-----------------------------------------------------------------------+

2 1

Campaign Against Clipper
by Dave Banisar 17 Dec '03

17 Dec '03

Campaign Against Clipper CPSR ANNOUNCES CAMPAIGN TO OPPOSE CLIPPER PROPOSAL Embargoed until 2 pm, Monday, February 7, 1994 contact: rotenberg(a)washofc.cpsr.org (202 544 9240) Washington, DC -- Following the White House decision on Friday to endorse a secret surveillance standard for the information highway, Computer Professionals for Social Responsibility (CPSR) today announced a national campaign to oppose the government plan. The Clipper proposal, developed in secret by the National Security Agency, is a technical standard that will make it easier for government agents to wiretap the emerging data highway. Industry groups, professional associations and civil liberties organizations have expressed almost unanimous opposition to the plan since it was first proposed in April 1993. According to Marc Rotenberg, CPSR Washington director, the Administration made a major blunder with Clipper. "The public does not like Clipper and will not accept it. This proposal is fatally flawed." CPSR cited several problems with the Clipper plan: o The technical standard is subject to misuse and compromise. It would provide government agents with copies of the keys that protect electronic communications. "It is a nightmare for computer security," said CPSR Policy Analyst Dave Banisar. o The underlying technology was developed in secret by the NSA, an intelligence agency responsible for electronic eavesdropping, not privacy protection. Congressional investigations in the 1970s disclosed widespread NSA abuses, including the illegal interception of millions of cables sent by American citizens. o Computer security experts question the integrity of the technology. Clipper was developed in secret and its specifications are classified. CPSR has sued the government seeking public disclosure of the Clipper scheme. o NSA overstepped its legal authority in developing the standard. A 1987 law explicitly limits the intelligence agency's power to set standards for the nation's communications network. o There is no evidence to support law enforcement's claims that new technologies are hampering criminal investigations. CPSR recently forced the release of FBI documents that show no such problems. o The Administration ignored the overwhelming opposition of the general public. When the Commerce Department solicited public comments on the proposal last fall, hundreds of people opposed the plan while only a few expressed support. CPSR today announced four goals for its campaign to oppose the Clipper initiative: o First, to educate the public about the implications of the Clipper proposal. o Second, to encourage people to express their views on the Clipper proposal, particularly through the computer network. Toward that goal, CPSR has already begun an electronic petition on the Internet computer network urging the President to withdraw the Clipper proposal. In less than one week, the CPSR campaign has drawn thousands of electronic mail messages expressing concern about Clipper. To sign on, email clipper.petition(a)cpsr.org with the message "I oppose clipper" in the body of the text. o Third, to pursue litigation to force the public disclosure of documents concerning the Clipper proposal and to test the legality of the Department of Commerce's decision to endorse the plan. o Fourth, to examine alternative approaches to Clipper. Mr. Rotenberg said "We want the public to understand the full implications of this plan. Today it is only a few experts and industry groups that understand the proposal. But the consequences of Clipper will touch everyone. It will affect medical payments, cable television service, and everything in between. CPSR is a membership-based public interest organization. For more information about CPSR, send email to cpsr(a)cpsr.org or call 415 322 3778. For more information about Clipper, check the CPSR Internet library CPSR.ORG. FTP/WAIS/Gopher and listserv access are available.

1 0

Re: Atlantis Project/Oceania
by Blanc Weber 17 Dec '03

17 Dec '03

"I'm not sure their economics can float that well either - if it costs $500M to build, and holds 1000 people, that means $500K/person.... Maybe they're looking at more people or less money. Nice T-Shirts and promo material, though." ...................... Does it not seem that they are putting more effort into the publicity, marketing, & attraction of money for support of this virtual country, than into the establishment of other fundamentals? Like: setting up an alternative currency & banking system, the manner of conducting business with the rest of the conventional world, and resolving the many little problems that would be of concern when living under such conditions? Blanc

3 2

Re: Nate's Remailer Shutdown.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous said, "The reasons the Post Office gets more slack are that 1) They're the government, or at least used to be 2) They can randomly open mail when they feel like it, see 1)" So what's your point? Talk is cheap. The situation remains the same. The message in my post remains valid. The reason why it is so doesn't matter to someone desiring privacy. The internet still sucks and always will, due to the From and Received by e-mail headers as well as many other Unix system problems like sendmail logs, and the fact that you can't trust a wire 'cause you can't see it. -=Xenon=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVbo8wSzG6zrQn1RAQEZqgP+LOHqzsOR+mbHjagehpv12qvihvJl9SSm f1Rz/iVtyKhPVpvsmwhIm3S/F6AmAikQwuO7Kt90BFpS8Q2tfV+iL4mRr1009xKi LovMs+oeydinlH6uOvKGvS4vtaju3dd7+SXQIa0sR46cN8r7O0BiVA6K+9AZ91Cx 6oONCh2Wpfo= =7yq9 -----END PGP SIGNATURE-----

1 0

Magic Money -> Chaum Cash
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ok, let's try this one more time... Based on Eric's long and mathematical explanation, which I did not fully understand and was therefore convinced by, I have changed the program to use full Chaum cash. It takes the 16-byte random number, takes its MD5, and stores the MD5 in the coin. The coin is now a triple (id,e,mpi) and the bank never sees id when blind-signing the coin, thus preserving anonymity. I sent this new version to csn.org as mgmny10c.zip. I haven't had a chance to update the manual or the comments in the code, but it does seem to work. At least, I was able to mint coins and cycle them through the server a few times, so the basic coin cycle seems to work. Please check it out, on machines of both endians, and let me know what happens. Pr0duct Cypher -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVdfXcGoFIWXVYodAQExBQQAlAOtfHApmQlmj1bk2kdBEg+Rst0I4CcB vIoxQ/iXiAS5c9fGdl5WNWpBk5TYCQSHm3jyzAoYaeLwJ4XsgnH5WbvB+UeRzwJX VatnTUK7x7wZMtIBAAaaPGX2woosns83bnXMa5voKkiYeESFFLgU5Dw5zw24xFas 1fkwlBSnyRA= =L9Ei -----END PGP SIGNATURE-----

2 1

Re: Clipper Qs
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Doesn't matter if you switch CLipper Chips - the chip squawks its serial number when it starts a session, and they simply get the keys for *all* clipperphones that they overhear while wiretapping. That way they don't need to keep track of who's got what chip (which is impossible, since you could switch with your neighbor), though that may be some help if they happen to know some eavesdropping victim's serial number and are tapping all the pay phones in an area. As far as reprogramming goes, no. They're a fancy tamperproof design, which they hope will make it difficult or impossible for people to get the algorithm or the key out of.

1 0

Re: Atlantis Project/Oceania
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > The Atlantis Project is a group in Las Vegas which is trying to build a > > floating city in the Caribbean sea. Their new city would be an > .... > Of course, the U.S. will immediately declare they a national threat and > bomb them back to the stone age. :-) Which is kind of a problem for a floating city, since stones don't float very well, concrete canoes excepted :-) I'm not sure their economics can float that well either - if it costs $500M to build, and holds 1000 people, that means $500K/person.... Maybe they're looking at more people or less money. Nice T-Shirts and promo material, though.

7 6

Magic Money ftp
by norm＠netcom.com 17 Dec '03

17 Dec '03

Is there somewhere that I can ftp the Magic Money protocol from?

1 0