December 2003 - cypherpunks-legacy

Crypto toolkit
by Hal 17 Dec '03

17 Dec '03

From: Peter Murphy <pkm(a)maths.uq.oz.au> > I was most > taken by the idea of a "Crypto Toolkit". I think it would be understand- > able to write the code in plain, vanilla C (as opposed to C++). One > good reason is the widespread availability of C compilers, especially > with UNIX. Additionally, C++ compilers do take up more space (although > this would be more of an issue with PCs. I think Tim had in mind something that was accessible more from a higher- level language than C or C++; ideally, something interpreted so you could sit down and type in a few commands to get something useful. Perl and TCL are two languages which Tim mentioned and which have been discussed here in the past. Smalltalk might do, although it is not as "freely" avail- able. If you want a C toolkit, a good example already exists: the PGPTOOLS package by Pr0duct Cypher. It is available by ftp from csn.org in /pub/mpj to US citizens, and probably from some European crypto sites as well. This has a bignum package as well as interfaces to IDEA and RSA encryption. It also supports processing of PGP message formats and key rings. The latest version has code for Diffie-Hellman key exchange. Hal

3 2

RE: Warrantless searches -- Sorry to start this again....
by GERSTEIN＠SCSUD.CTSTATEU.EDU 17 Dec '03

17 Dec '03

You guys just keep saying the right things... My comments are below... -------------- Jim Sewell (jims(a)Central.KeyWest.MPGN.COM) said : >Subject: Re: Warrantless searches -- A sign of things to come? >To: cypherpunks(a)toad.com >Date: Mon, 18 Apr 1994 10:30:25 -0400 (EDT) >From: "Jim Sewell - KD4CKQ" <jims(a)Central.KeyWest.MPGN.COM> > >Slightly reformatted, but the content is faithfully reproduced: > ><My computer told me that GERSTEIN(a)SCSUD.CTSTATEU.EDU said:> >> >> On Sun, 17 Apr 94 13:39:39 >> paul(a)hawksbill.sprintmrn.com (Paul Ferguson) wrote: >> >> >A Page 1 story in The Washington Post Sunday (94.04.17) reads, >... [warrantless searches of housing project] ... >> Anyway, the point is, these people aren't safe in their own homes. > > Then the cops need to sting/watch these guys until they catch them > committing these felonies and throw them in jail, not invade the > privacy of a citizen cuz they think it's right. If the cops were > watching that neighborhood then the child couldn't have been sniped > without the shooter getting bagged. It is a poorly chosen solution to > the police force's inability to do their job well due to fear and/or > underfunding. You see, Jim, the drug deals go on inside the apartment buildings. How easy is it to do surveilance (sp?) on an apartment that is run by gangs, surrounded by their other apartments, on floors that are run by the gangs? Sure, you can do a phone tap. But that doesn't work on cellular phones.... You could also take over an apartment in another building and bounce lasers off the windows, but their damn music is too loud, or they change the rooms they do business in daily (the gangs aren't stupid, you know). And if you did find some way to bust them, how are you going to do it? Fire-fight your way through 3-4 floors of crack-crazed junkies with Uzi's? I don't think so. As far as the sniper killing that little kid, think about what you said. You really think the sniper didn't hang around on the roof-top, waiting for that first cop car to roll up? He's not dumb. They have to get to the building, and he can "reach" them a hell of a lot better than they can fire at him. And once they get inside, it's the same thing. The cops have to fight their way to the roof, at which point the gun and sniper are both inside the building somewhere, safe and cozy. In many ways, the situation has gotten better since the searches started. I AM NOT SAYING I AM FOR THE SEARCHES, I am merely saying that they are being productive. I challenge you C'punks to come up with a better solution. Given the circumstances that those involved are dealing with, it's pretty good for now. Adam Gerstein Comments to: GERSTEIN(a)SCSU.CTSTATEU.EDU Flames to: /dev/null -=-=-=-=-=-=-=- -=-=-=-=-

2 1

Re: Crypto toolkit
by Hal 17 Dec '03

17 Dec '03

> I went to this site to pick up PGPTOOLS but apparently it's moved > or something, since the pub/mpj directory doesnt exist and when I scanned > some other directories I didnt find it. Does anyone know another pointer > to this package? Sorry, my mistake: the directory is /mpj, not /pub/mpj. Again, the site is csn.org. You will have to read the file README.MPJ which tells the name of a "secret" directory to cd to (which changes every time). Then look at pgp_tools/pgptl*. Hal

1 0

licence plates seen
by mdbomber＠w6yx.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I saw a couple interesting licence plates on cars at work. One was 2PGP386 Now, that's a valid ordinary sequentially issued plate. But I'd still say the owner of that one has the right idea. :-) Another one on a car I've seen many times is 68 ASCII I don't have an ASCII chart available. What does this one mean? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLbq3bTSSmvXojb+5AQHFngIAnS/cs41ZKXf0kdtPBDmtZ5dgLov5OZ5O VmGg8S65xjZh8xNAOgvbgMOVDhefT0Vig8KlLRlGJG0WRRGkpbPt7A== =WIur -----END PGP SIGNATURE----- Internet: mdbomber(a)w6yx.stanford.edu Matt Bartley GPS: 33 49' 117 48' PGP keys on finger and servers

4 3

Today's Dumb Question?
by David Merriman 17 Dec '03

17 Dec '03

I've got what may turn out to be Today's Dumb Question.... What Happens If, instead of using prime numbers or logarithms for the basis for a public-key crypto system, we instead generated out public key thus: 1> pick an arbitrary bit stream (large [pseudo?]random number, binary representation of selected chunk of text or data file, etc). 1024 bits or more (in 256 bit chunks?) 2> enter a passphrase 3> XOR the bit stream with the binary representation of the passphrase, cycling the passphrase as necessary. This makes the 'large' component of our public key. 4> hash the passphrase to 128 or more (in blocks of 64?) bits. This makes the 'small' component of the public key. 5> We then use these components as in normal public-key algorithms. Conceptually (to me), this would seem to work, and have the advantage of not being dependent on the factorability of any number; that is, the numbers could be extended as necessary fairly simply. It would also seem to depend on the entry of a passphrase that would be securely 'locked' inside someone's mind :-) Too, it wouldn't seem to be subject to any kind of patents. Finally, if the arbitrary bit stream were taken from something like a section of text in a file, a sequence of bytes in a data file, or even absolute track/sector reads from a floppy/hard disk, the entire thing could be rendered useless by the user by simply erasing/wiping a single file or track/sector. Would something like this work, or am I missing one of the trees because of the forest? Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 'That's odd.... the computer model didn't do that....'

1 0

"Information-Hiding" in Crypto Programs
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

The challenge I mentioned in my last message can be summarized as follows: - hide the complexity of implementation in the code, so that other programmers, and especially end-users, don't have to worry about it. - to pick a simplest example, a random number generator needs to generated a good random number without the user having to worry about a zillion related issues (this may get flames....I'm not saying users should be blissfully ignorant of some of the assumptions that went into the RNG, only that most users want an RNG that operates consistently, has been tested by others, etc. This is the Mathematica function method: have experts devise the best factoring or primality testing approach, implement it efficiently (usually in C or even machine language), and then give it to the user as "FactorInteger[3858783237285638838513] for him to incorporate as a canned functon.) - "information hiding," or modularization, means hiding the implementation details from the user and providing regularized calling conventions to make the code behave almost like a "thing" (internal consistency, reproducible behavior, etc.) - "crypto objects" (or instances of classes) would presumably know how to handle the usual crypto messages. - "digital cash objects" would help with the extraordinarily confusing protocols for multi-party transactions I'm not saying _how_ they would help, just that my intuition is that the crypto community could make new strides if the imperative style of programming ("do this," "now do this," etc.) were to be supplemented with the descriptive style ("this is a digital cash object and these are the messages it understands") and even the logical style (of Prolog, for example). Two years ago, Eric Hughes and I spent a few intense days debating these sorts of issues, including discussions of "program correctness" and protocol generation. For digital money to succeed, there had better not be flaws and loopholes that allow attackers to drain your money away or to cause confusion and doubt amongst your customers! Automatic theorem-proving methods, so often the topic of dusty old Ph.D theses, may come to the fore to handle these extremely complex (and attackable by spoofers, eavesdroppers, forgers, etc) protocols. This stuff goes beyond what I was talking about with objects, classes, and libraries, but may be needed sooner than we think. I promise to shut up for a while. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 3

your Clipper video testimony wanted
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message: From: blogan(a)crash.cts.com (Barry Logan) Subject: Re: vid testimony Date: Thu, 21 Apr 1994 11:51:17 -0800 ****** P A P E R T I G E R T V S O U T H W E S T ******* For Immediate Release 4.20.94 *Distrubute Widely* This is a request for submissions of video testimony regarding Clipper. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The public is increasingly becoming aware of the Clipper. Hearings are scheduled to held on April 27 and May 3, 1994 by Sen. Patrick Leahy's (D-VT), of the Senate Judiciary's Technology and the Law Subcommittee, the subject of which will be the Clipper initiative and the FBI's draft Digital Telephony surveillance bill. Momentum is building, get involved. Unless the conquest of cyberspace goes unchallenged by the public-at-large, First and Fourth Amendment rights will be abrogated in a "fait accompli" out-of-sight of democratic processes. This is a battle that cannot be won if fought solely in cyberspace. The implementation of draconian measures calls for innovative counter measures. We propose to take arguments against the Clipper proposal to the public with a video. Fighting with the traditional weapons of mass media will get the attention of the wider net-disinterested audience (most of whom will intersect with the net in the future), than relying on the net alone to conjure the necessary outcry to make Clipper an issue of public scrutiny. We need your collected clips to put together a composite argument. It will be distributed to public access television stations, key legislators, and also be made available to the general public. Submission guidelines: - DEADLINE MAY 8TH ~~~~~~~~~~~~~~~~~~~~~ -Send us a video of you containing your most cogent thoughts and passionate statement regarding Clipper. -Please limit your comments to privacy issues in general and Clipper in particular. -Send original tapes (we'll return them) in any format, 8mm, Hi8, VHS. ~~~~~~~~ Hi8 is the best. -Because of both the nature of video and the nature Clipper, guerrilla theater is encouraged. -Submissions of arguments in favor of Clipper will also be considered for inclusion. -Contributions from outside the U.S. are welcome. -Suggestions about content and/or format welcome. -Please send your video as soon as possible, but no later than May 8th for consideration. Information about Paper Tiger: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Paper Tiger TV is a non-profit volunteer collective based in Manhattan, with working groups in San Diego (PTTV Tiger South West) and San Francisco (PTTV West). Paper Tiger TV produces 30 minute programs shown weekly on public access cable TV and distributed to cable stations, colleges and libraries across the country. The collective has been working for nine years with critical readings on many areas of cultural production including advertisement, TV, films, mainstream publications and cultural events. Although there is no confirmation, it is likely that the finished tape will be uplinked by Deep Dish TV: an association of community and independent producers, public access and cable programmers; a national, alternative satellite network with multi-racial, multi-regional representation producing and distributing television that has a point of view. FEARLESS TV!! We hope that our shows will inspire, educate and empower the political movements that we are a part of. Mail your tapes to: VIEWING HABITS 3270 MT.AACHEN AVE. SAN DIEGO, CA 92111 We are including Herb Sciller's "Plunge into cyberspace". Well known lefty media critic and guru of our collective. This is a historic moment, don't blow it. Make history, make video.

1 0

Re: The un-BBS
by sdw＠meaddata.com 17 Dec '03

17 Dec '03

> > Mike Ingle writes: > > > There are occasional waves of actions against BBSes. The most recent ones > > are for porn. Before that it was pirate software and phone codes. The next > ... > > > What we need is a totally decentralized BBS. It would be something like > > running Usenet over UUCP. There would be newsgroups or SIGs or whatever > > you want to call them. Anyone could leave their computer and modem on, > > and anyone else could call them and get an update. There would be no BBS > > to call and log into. You'd just call your friend's computer and update > > your newsgroups, and someone would call yours and update his. The network > > would grow outward, with no organization or structure. Anyone could create > > a new newsgroup, and if his friends chose to take it, it would spread. > ... I'm pretty perplexed: What's wrong with the current Netnews (Usenet...), Email, etc. setup? It's very flexible and you can get access for very reasonable amounts of money (even for a server). The software's free, the net is huge, etc... I dislike BBS's alot compared to standard Internet services. It's only expensive if you want online, realtime access, gigabytes/mo. of traffic, etc. > This is FIDONet (or FidoNet). In most essential features, this is what > FidoNet has been doing for the past half dozen years. Distributed, > decentralized, dial-up lines, banyan-type architecture (sort of), etc. > > Tom Jennings, one of the main architects of FidoNet, was once on our > list, as were a couple of others, but they don't seem to be any > longer. > > There are some interesting issues here, which I'll just list: > > * since the FidoNet is not subsidized by others the way the Internet > is, operators of FidoNet nodes (I don't know the exact term) often end > up subsidizing the costs themselves. Most systems/people on the Internet are not subsidized. This is well known. The critical mass of users has obviated the need for it. I've been grappling with what features I'd like in the perfect communications / BBS / Internet / online system. Does anyone have strong opinions about which features are important? For instance: I find that my Unix Internet mail/news tools are an order of magnitude more efficient than any BBS message base reader I've ever encountered. sdw -- Stephen D. Williams Local Internet Gateway Co.; SDW Systems 513 496-5223APager LIG dev./sales Internet: sdw(a)lig.net OO R&D Source Dist. By Horse: 2464 Rosina Dr., Miamisburg, OH 45342-6430 Comm. Consulting ICBM: 39 34N 85 15W I love it when a plan comes together Newbie Notice: (Surfer's know the score...) I speak for LIGCo., CCI, myself, and no one else, regardless of where it is convenient to post from or thru.

3 5

Re: Today's Dumb Question
by Matt Thomlinson 17 Dec '03

17 Dec '03

David Merriman <merriman(a)metronet.com> writes: What Happens If, instead of using prime numbers or logarithms for the basis for a public-key crypto system, we instead generated out public key thus: 1> pick an arbitrary bit stream (large [pseudo?]random number, binary representation of selected chunk of text or data file, etc). 1024 bits or more (in 256 bit chunks?) 2> enter a passphrase 3> XOR the bit stream with the binary representation of the passphrase, cycling the passphrase as necessary. This makes the 'large' component of our public key. 4> hash the passphrase to 128 or more (in blocks of 64?) bits. This makes the 'small' component of the public key. 5> We then use these components as in normal public-key algorithms. ---------- (matt says:) Okay, you're forgetting one thing. In public key systems, the two numbers you have are related -- the algorithm you use needs a pair of numbers that create a function and inverse function pair. The pair you suggest above [((random #) xor (passphrase)), hash(passphrase)] have nothing in common. Good, as you point out, since you can't create one from the other, but also bad for a public key system, since you can't use one to decrypt what the other encrypted (they're not inverses)! mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

1 0

Warrentlesss SEarches (fwd)
by Llywelyn 17 Dec '03

17 Dec '03

Sorry about resubmitting it y'all but I discovered the line feeds were wierd so I just re-formatted it. Ben. > Think about it. The cops are out-gunned and out-manned. What would you > do? And don't tell me that you would just go in there. I consider myself pretty > brave, but I don't think even for a second that I would be able to even > consider going in there, not without a nice, warm, cozy M1 Abrams Tank > surrounding me. And even then I wouldn't be truly safe. > These cops are doing the best that they can, and everyone in the U.S. > are worrying more about the "rights" of these gang-bangers and drug-dealers > than they are about the rights of the innocent people that are trapped in these > buildings. > And don't even start to tell me that the "innocents" can just leave, > cos these CHA buildings are the only place they can afford to live. > You folks are to busy yelling about the illegal searches to even think > of coming up with an alternative. > > Maybe if you spent a little time thinking about what it's like to live > in a place like this, you might shut up about the cops not doing their jobs. Ok, Let me respond 1)I live in this kind of neighborhood at home when I'm not at school. That's right, I live in West Oakland, California. I was born and raised in the inner city. Don't tell me how these places are, don't tell me how they're run, don't tell me how dangerous they are. I've lived it. Have you? All you know is what you see on the news, on the television shows, and what is portrayed in mass media. 2)I know the value of a gun in this environment. I know how many times our home has been kept safe because my father has been willing to wield a gun against either intruders or against 'undersireable' characters coming around(read drug dealers, crack heads, you name it). Our part of the block has a reputation for not being somewhere for these pepole to hang out because my father and our neighbors have taken a stand against such scum. 3)Not everyone who lives in these neighborhoods is bad simply as a result of their economic conditions. We don't want these people around any more than you people do in your neighborhoods. It just happens, and I know this for a fact, that it takes Oakland Police(OPD) a lot longer to respond when we call them, than when people in Skyline(a rich white neighborhood) call them. 4)My family has not broken any law simply by trying to protect ourselves. There is no way in hell that the police can be everywhere at once, even if they are as efficient as you in the 'burbs seem to think they are, keeping out and harassing all the minorties that come your way. Until they get there, the only way we can protect ourselves is with our guns. We havne't broken any laws, we're not the ones who have severed our contract with society by choosing to live outside of it, its not us, its the people who prey upon us in our homes and in our schools, and it is not us who should lose our rights, but them. By simply lumping us in with them by sheer virtue of where we live and how much we earn is not only sheer folly but is also classist. 5)Yes we worry about the rights of the accused. I do. I've been arrested and harassed when the only crime that I committed was being in the wrong place at the wrong time, and not having the right skin color. Yes, I worry about those rights, because for me, it might be that one day, that it is I who is on trial, it is I whose rights are being questioned, and it is I who wants my day in court, and unless we protect the rights of the accused, even if they don't look like us, it reaps a beneficial result to society as a whole. Thomas More in the movie _Man for All Seasons_ makes an excellent point when he asks young Will, if he would cut down all the laws in England to catch the devil. When Will responds in the affirmative, More asks him, "And what would you do when the winds rage about you?" You see, if you don't protect the rights of the accused today, there might come a day when you're in their shoes and you'll wish that you still had those rights--remember the 5th amendment? The 4th's prohibitions against unreasonable seach and siezures? What about the 14th's due process clause? It is the rule of law, not of decree that makes this nation great, and there's no way in hell, I'm going to sit idly by and watch this nation become an autocracy simply because some people in suburbia decided that it would be easier to do away with the rights of the accused in their racist, xenophobic fears. Any comments? Ben.

1 0