December 2003 - cypherpunks-legacy

Re: Digitally Signing Physical Objects
by Hal 17 Dec '03

17 Dec '03

Tim has an interesting point on the use of digital signatures. A variation is to use an "undeniable" signature. This is a signature which can only be checked with the cooperation of the signer. However, the protocol is such that the signer cannot cheat and try to deny a valid signature (hence the name). This could be used by manufacturers to authenticate their products only to certain customers; for example, to customers who have paid for them. This might be especially useful for software, although Tim's idea would extend it to any object for which the authentication is especially valuable. PGP is distributed signed by Phil Zimmermann using an ordinary digital signature. This allows anyone to verify that it is a good package, free of viruses or trap doors. If it instead had an undeniable signature, this verification would require interacting with Phil (or his agent) via a protocol; but at the end the same assurance would result. This kind of signature would be more appropriate with a payware product. Undeniable signatures cannot be passed on from one person to another. If Alice verifies Bob's undeniable signature, she can't prove to Charlie that the signature is good. She can claim it is good, and assure Charlie that it is good based on her own reputation, but Charlie can in general not be convinced unless he verifies it himself directly with Bob. Hal

2 1

Re: STEALTH OCEANS
by Sergey Goldgaber 17 Dec '03

17 Dec '03

This is my first post to this list, so please don't flame me if I make some trivial mistake. %-> IDEA Re: making random noise files "undetectable"... ~~~~~~~ On many machines the file system allows users to "delete" files without actually deleting them. This is usually accomplished by simply marking the disk blocks that make up the file as free. Thus it should be possible to write an encrypted (noise) file on to disk, pad the rest of the disk with more noise and "delete" the whole thing, making the disk look blank to all casual observers. PROBLEM: If the above idea is implemented, one could not write on to the ~~~~~~~ the disk for fear of accidentaly overwriting the "free" disk blocks. SOLUTION: Knowing the _exact_ location and size of the file, one could write ~~~~~~~~ directly to those block which are _really_ free. 2nd PROBLEM: In order to decrypt the file, one needs to know it's ~~~~~~~~~~~ _exact_ location and size (or use some undelete util)... Which brings me to the... 3rd PROBLEM: An undelete utility could make recovering the encrypted ~~~~~~~~~~~ file trivial for _anyone_. SOLUTION: Make the file undetectable to udelete utilitys by modifying ~~~~~~~~ the FAT table, or equivalent. One would, of course, have to keep track of the file in some other, non-standard, way. FINAL(?) PROBLEM: Implementing the above idea is trivial for the average ~~~~~~~~~~~~~~~~ user. Making and recovering truely undetectable files may not be. All feedback welcome, Sergey ------------------------------------------------------------------ * * * This is a repost of a message I posted on this list on Feb. 18 * * I am reposting in hope of further feedback fromm other readers * * * ------------------------------------------------------------------

1 0

Re: quetion about Multi-user systems
by Eric Johnson 17 Dec '03

17 Dec '03

: From owner-cypherpunks(a)toad.com Wed Feb 23 15:13:16 1994 : Subject: quetion about Multi-user systems : To: cypherpunks(a)toad.com : Mime-Version: 1.0 : Content-Type: TEXT/PLAIN; charset=US-ASCII : Sender: owner-cypherpunks(a)toad.com : : : : I myself have a Linux system at home, all set up with PGP and : rather secure from outside thrats since it is unconnected from the net : except for when I dial-up. I was wondering what strategies some people : use in order to make it easier to write and respond to mail. I dont feel : like writing a message at home, encrypting it and then U/Ling it to my : acount and mailing it. Is there another wya to use PGP on my mail account : wihtout severely reducng mysecurity? I know the Sysop can read my secring : etc.. at any time and can also intercept my passkey for my secring, BUT I : would still like to perhaps use a low security key from my Unix account : and then have a high security key on my home system that is very safe. : The problem is, figuring out which message goes to where and all. Could : someone with extnsive knowledge of PGP use on a Unix system help me out : here>? : : : You're eqipped with a hundred billion nueron brain, that's : wired and fired, and it's a reality generating device, but : you've got too do it. Free youself ----Tim Leary---- Why not use UUCP? --Eric

3 3

Re: quetion about Multi-user systems
by mch＠sqwest.wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: quetion about Multi-user systems > sOn Wed, 23 Feb 1994, Eric Johnson wrote: > > > : would still like to perhaps use a low security key from my Unix account > > : here>? > > > > Why not use UUCP? > > > > --Eric > > > I was just advised to do that. the problem is I would > need to write something to allow me to do it without the > sysadmins knowledge here. He doesnt take kindly to The simplest solution is to get UUCP service from a commercial provider. (The cost should be somewhere around $20/month) Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLWvwreULSAGiySfVAQGa3wP5AVIiNtKJx95YHzXm54xVRlEMEUhJ8CCV gkVXF/GoqZolBA0kZJ7nLIXnocV9n676LFqyN8/wRHqLGJKr8hIM2o/ipEg4dOgr qWpkWm+uLQlZOLxclvFSptOygwMS2AMz4OVID2kAVCPJGmCrO8rxnUXT8j4dY4gK ME7l/naYYPY= =Oul+ -----END PGP SIGNATURE-----

1 0

pgp tools
by mpjohnso＠nyx10.cs.du.edu 17 Dec '03

17 Dec '03

So, is soda still the archive (have I missed a major announcement?)? Is there a later version of pgptools? Try csn.org:/mpj/I_will_not_export/crypto_???????/pgp_tools See csn.org:/mpj/README.MPJ for the ??????? Is there an approved of pool or newsgroup to send messages to Pr0duct Cypher? I hate to add to the cypherpunks traffic with comments directly to him/her. (We NEED to get the return addresses working, or Pr0duct Try posting to alt.test, with the subject "ignore Pr0duct Cipher"

2 1

Re: STEALTH OCEANS
by Sergey Goldgaber 17 Dec '03

17 Dec '03

This is my first post to this list, so please don't flame me if I make some trivial mistake. %-> IDEA Re: making random noise files "undetectable"... ~~~~~~~ On many machines the file system allows users to "delete" files without actually deleting them. This is usually accomplished by simply marking the disk blocks that make up the file as free. Thus it should be possible to write an encrypted (noise) file on to disk, pad the rest of the disk with more noise and "delete" the whole thing, making the disk look blank to all casual observers. PROBLEM: If the above idea is implemented, one could not write on to the ~~~~~~~ the disk for fear of accidentaly overwriting the "free" disk blocks. SOLUTION: Knowing the _exact_ location and size of the file, one could write ~~~~~~~~ directly to those block which are _really_ free. 2nd PROBLEM: In order to decrypt the file, one needs to know it's ~~~~~~~~~~~ _exact_ location and size (or use some undelete util)... Which brings me to the... 3rd PROBLEM: An undelete utility could make recovering the encrypted ~~~~~~~~~~~ file trivial for _anyone_. SOLUTION: Make the file undetectable to udelete utilitys by modifying ~~~~~~~~ the FAT table, or equivalent. One would, of course, have to keep track of the file in some other, non-standard, way. FINAL(?) PROBLEM: Implementing the above idea is trivial for the average ~~~~~~~~~~~~~~~~ user. Making and recovering truely undetectable files may not be. All feedback welcome, Sergey PS: I originally posted this message on Feb. 18, '94 I am now reposting in hope of recieving more feedback from other readers. PPS: Please forgive me for my previous repost. I just realized it is illegible to anyone without MIME.

1 0

Re: Digitally Signing Physical Objects
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> 3. The shop or customer wishing to authenticate the part takes the > number stamped on the part, runs it through the *public* key of the > manufacturer (widely available, not kept secret, of course) and gets > back the feature vector, which he can then compare to what he actually > sees on the object. > > (This clearly requires similar hardware to what was originally used by > the manufacturer. And some tolerance for variations in intensity > caused by equipment variations, wear, new scratches, etc., is needed. ... > 4. A would-be forger cannot generate a "digital object signature" that > correctly decrypts through the published public key. > --Tim May This seems to have a tricky dependence on the tolerance. The forger can get a valid plaintext and signed feature vector. So, if the tolerance for error is too low, you get false positives, but if it's too high, a forger could create something starting from the feature vector. An interesting CAD/CAM problem. -fnerd quote me - - - - - - - - - - - - - - - We shall have to evolve Problem solvers galore As each problem they solve Creates ten problems more. --Piet Hein -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Re: Prof. Denning's Newsday Editorial
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> ====================================================================== > | Newsday, Tuesday, February 22, 1994, Viewpoints | > ====================================================================== > The Clipper Chip Will Block Crime > By Dorothy E. Denning > ..... > ====================================================================== > | Copyright Newsday. All rights reserved. This article can be freely | > | distributed on the net provided this note is kept intact, but it may | > | not be sold or used for profit without permission of Newsday. | > ====================================================================== Dorothy Denning's article had a few interesting comments. > But would terrorists use Clipper? The Justice Department has > ordered $8 million worth of Clipper scramblers in the hope that they Are you saying the Justice Department are terrorists? :-) Or merely that this will subsidize the Clipperphone industry enough that honest cryptosystems will have a harder time competing? > will become so widespread and convenient that everyone will use them. > Opponents say that terrorists will not be so foolish as to use > encryption to which the government holds the key but will scramble > their calls with their own code systems. But then who would have > thought that the World Trade Center bombers would have been stupid > enough to return a truck that they had rented? Someone from NIST was also quoted in the newspapers agreeing that only the stupider criminals would use Clipper. On the other hand, the government is trying *very* hard to get the cellular phone industry to adopt Clipper, and I would think this deserves a mention, since the government's limitation on the number oflayers in the cellphone market means that citizens don't really have a choice. > Moreover, the Clipper coding offers safeguards against casual > government intrusion. It requires that one of the two components of > a key embedded in the chip be kept with the Treasury Department and the > other component with the Commerce Department's National Institute of > Standards and Technology. Any law enforcement official wanting to > wiretap would need to obtain not only a warrant but the separate > components from the two agencies. This, plus the superstrong code and > key system would make it virtually impossible for anyone, even corrupt > government officials, to spy illegally. I've found this claim to be one of the most annoying of the Clipper proponent's claims. The chip does *not* support two-agency escrow; it only has one key, necessitating some insecure keyloading procedure like the NSA-two-agents-and-a-laptop-in-a-vault charade. But the rules for handling the keys are only set by the attorney general, not by law or technology, and they are carefully written NOT to mention or forbid any other access by anyone else - especially the not-mentioned NSA. > The FBI alone has had many spectacular successes that > depended on wiretaps. In a Chicago case code-named RUKBOM, they > prevented the El Rukn street gang, which was acting on behalf of the > Libyan government, from shooting down a commercial airliner using a > stolen military weapons system. Please correct me if I'm wrong, but isn't El Rukn the street gang that the government got in a lot of political hot water about for bribing informants with drugs, sex, and reduced prison sentences? Thanks; Bill Stewart # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: Digitally Signing Physical Objects
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Could someone repost the "Digitally Signing Physical Objects" article (or mail it to me). It never arrived at my site. Thanks, Jim_Miller(a)suite.com

1 0

Digital Telephony Bill 1994 (Draft)
by Mike Godwin 17 Dec '03

17 Dec '03

Forwarded message:

1 0