December 2003 - cypherpunks-legacy

PGP 2.6(1)
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

... is obviously not available yet. I just took a look on net-dist.mit.edu and only vanilla 2.6 is still available. Any clues on when 2.6(1) will be available? - paul

2 1

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

hello folks i have been trying to ge the non-net folk to fight against clipper and all other such methods of the gov't to surpress the freedom to talk to anyone at anytime without other listening in on things so my finacee wi going ot give a short series of speachs to her speech class. anyone can do this, talk out loud to the public tell your non net friends, tell everyone. also ..... help anyone who has a list of article or topics that can be looked up in serial lititure to use for this purpose, please e.mail me the info or post it so others can gain the infomation to use to fight those who would take our rights from us. charles the monster maker

1 0

Re: Ames/clipper compromised?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> sommerfeld(a)orchard.medford.ma.us (Bill Sommerfeld) : > > >BTW, my guess at the most likely back door is that the unit keys will > >be generated as a cryptographic function of the serial number and a > >*small* random number generated for each chip and unknown to the > >agency. They would have to search a mere 2**16..2**32 keys once they > >get the serial number out of the LEEF. The existance of such a > >backdoor would be difficult to prove, since there would be no visible > >evidence for it in the individual chips. It is also difficult to > >disprove such a theory because the clipper key generation algorithms > >are classified. Key generation is one of the obvious backdoors; the wrinkle of making the random number space from the keymasters small enough to search is interesting, especially because they only need one key per batch to validate whether they've got the right guess. My original reaction to the version described by Dorothy Denning was that it wouldn't be very hard to *steal* the key-generating keys the keymasters bring to the key-generation charade in the vault, either physically or by leaking them out in generated keys or something. Now that they've announced they're changing the script for the charade, who knows how easy it will be? They've certainly announced no plans for validation of the key-generation software design or implementation. Matt Thomlinson writes: > I just read a paper that might apply to this type of backdoor; it was by > someone at RSA, with the title "..RSA's trapdoor can be broken". I'll No, that's a different argument; it's (name forgotten) vs Kaliski, where the proposed method turns out to take as much work as factoring and therefore doesn't rate as a backdoor. Bill Stewart

1 0

Re: Ames/clipper compromised?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

1 0

Very funny, Polyanna :-( [namespace pollution]
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Grrr. I use a mailer here (that I'm developing) that automatically encrypts outgoing mail for user X if "<X>" can be found in my pgp keyring. Unfortunately some comedian has published the key below... Type bits/keyID Date User ID pub 384/99CBA7 1992/11/15 Polyanna, c/o <cypherpunks(a)toad.com> 1 key(s) examined. so if I use this mailer when posting to cypherpunks, it gets encrypted for this idiot. I guess this is something we mailer writers will just have to allow for. Looks like I'm about to add a stop-list... (removing it from the keyring won't be good enough, because next feature planned for my mailer is to look up the fingerable key-server if it isn't found locally...) G

3 2

Re: Ames/clipper compromised?
by Peter Wayner 17 Dec '03

17 Dec '03

I spoke with D. Denning last week and she told me that she was not going to CFP because they had a Clipper Review Panel meeting. She said she wanted to get a chance to go out to Mykotronix and check out the vault. -Peter Wayner

1 0

Ames/clipper compromised?
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I remember awhile back someone posted some clipper documents that were released under FOIA as I recall. The thing that struck me was that the NSA was refering internally to clipper as "The Trapdoor chip." Why refer to it as such if there is no back door? If anyone has the documents I'm refering to handy, please repost, (or I'll have to dig them out!) Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T"--James Speth -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLZdBc9CcBnAsu2t1AQHJZwP/f49BBtg/Gts4C4X0MdhzJ0UUUoSVDY4B wO0Ib44dTx/i00M3P/v1Q1xTcfyEXIRQaJmvp7xXPmjHAd6GPZaeW0Ag8hmvDAel DMmVLAAnaGP7Jmj2gSE7N2do/p80aY6IMzBwD3rI4glbns2kq0/kLjrLosXLK/c4 S3zjwR2wYVA= =mfh0 -----END PGP SIGNATURE-----

2 1

Bruce Sterling's Speech
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

I greatly enjoyed Bruce Sterling's speec/rant/assessment of the entire CFP conference on Saturday afternoon. Does anybody know if he will be posting the text of that speech on-line (as he has of other presentations he has made) or if somebody w/ access to one of the tapes of the speech will post a transcription? If someone can get me a bootleg, I would be willing to do the typing. -john. -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 PGP public key available upon request. KILL YOUR Privacy in the information age is a right, not a privilage. TELEVISION Information = Power = Control. Fight the centralization of information.

1 0

Magic Money simplification
by Hal 17 Dec '03

17 Dec '03

In my posting about remailer abuse, I mentioned a point in passing re Magic Money that perhaps deserves a more explicit mention. Presently, Magic Money has each user create a special public key just for use by that program. When MM sends a message to the bank, it includes a copy of the user's public key. Then, when the bank sends the return message, it encrypts it with that key. (Messages to the bank are also encrypted with the bank's public key.) Last night it occured to me that this encryption may not be necessary. Messages to the bank are of the form f(x)*r^e, where f is a one-way function, x is the coin's serial number, r is a random blinding factor, and e is the bank's public exponent for this denomination. The bank signs this by taking it to the d power, were d is the RSA-inverse of e, and sends back f(x)^d * r. It looks to me like these two messages are secure even without being encrypted with the user's or bank's public key. r, and r^e, both act as one-time-pads, blinding the underlying f(x) or f(x)^d value perfectly. This blinding, of course, is what prevents the bank from linking up withdrawn cash from spent cash. But it should serve just as well to prevent an eavesdropper from stealing the cash. If someone manages to get f(x)^d * r, this is of no value to them if they don't know r. Since only the original sender knows r, this message can be sent in the clear. Similar logic applies to the message from the user to the bank. If this argument holds up, the usage of Magic Money can be simplified considerably. The user should no longer have to create a special public key. Nor should he need to know the bank's public key. All he needs to get started is the email address of the bank, to which he can send the standard initialization query message which causes the bank to send back information about the exponents and denominations used, as well as the name of the money. Of course, when users send actual un-blinded coins amongst themselves as payment, those transmissions need to be encrypted or done via some secure channel. But MM never concerned itself with those. It was only involved with messages to and from the bank, and for these it seems to me that encryption is not necessary. Hal

1 0

INTERNET CONNECTIONS IN JAPAN
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, A quick question to help an international friend: Does anyone on the list know anything about getting a (cheap, if possible) Interenet connection in Japan? Please let me know by private e-mail if you have any information. Thanks, S a n d y

1 0