December 2003 - cypherpunks-legacy

Warning: Don't run MacPGP 2.6 on a 68000 based Macintosh
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Warning. MacPGP 2.6 (1.1.1) will *not* work on a 68000 based Macintosh. It will bomb. I was unaware of the nasty hack you have to do when compiling MacPGP in order to get it to be 68000 aware. People who have the source distribution can compile it for either machine. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAgUBLfupN1UFZvpNDE7hAQHY7QH5AWxYbjgSGhV45R6MTWQ43HytC7ZdlPdQ E9dCNnmKK2NvPdJOOq/ZLEbSE0jjmcMzKDT3crL5yulYTAAcgfojFQ== =IVv2 -----END PGP SIGNATURE-----

1 0

URGENT Action required (NJ folks only)
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

Estimated time for this good deed: Two minutes Do you live in one of the following zip codes in New Jersey? 07010 07014(part) 07020 07022 07024 07026 07029(part) 07031 07032(part) 07047(part) 07057 07070 07071 07072 07073 07074 07075 07087(part) 07094 07096 07306(part) 07307 07308 07310(part) 07407 07410(part) 07452(part) 07601 07602 07603 07604 07605 07606 07607 07608 07631 07632 07643 07644 07646 07649(part) 07650 07657 07660 07661 07662(part) 07666 07670(part) If your zip code is listed above then you are one of Rep. Torricelli's constitutents. "part" means your zip code is split between two districts, one of them Rep. Torricelli's. Rep. Torricelli is on the House Intelligence Committee and needs to hear from you about HR 3627, which would permit cryptography exports. The attached file explains all about the bill and why you should support it. Call Rep. Torricelli today and ask him to send Rep. Maria Cantwell's bill, HR 3627, to the House Floor! Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 9 NJ Torricelli, Robert (D) 1-202-224-5061 1-202-225-0843 2159 RHOB Here is a sample communique you might use: Dear Representative Torricelli, Please report Maria Cantwell's Cryptography export bill (HR 3627) out of committee. Its passage will both assist American industries competing globally, as well as allow American consumers to purchase products to enhance their privacy. Sincerely, ______________ Table of contents: Introduction & Alert Status of the bill What you can do right now List of legislators supporting HR 3627 List of legislators wavering on HR 3627 List of legislators opposing HR 3627 What is the Cantwell bill? ------------------------------------------------------------------------------- INTRODUCTION & ALERT The Cantwell cryptography export bill has entered a critical stage in its travels through Congress. The bill, which would loosen controls on the export of encryption software, has been referred to the House Select Committee on Intelligence, and must be be reported back from committee by June 16th or it will die. This alert details the provisions of the bill, its history, and what you can do to show your support. Voters Telecomm Watch keeps scorecards on legislators' positions on legislation that affects telecommunications and civil liberties. If you have updates to a legislator's positions, from either: -public testimony, -reply letters from the legislator, -stated positions from their office, please send them to vtw(a)panix.com so they can be added to this list. General questions: vtw(a)panix.com Mailing List Requests: vtw-list-request(a)panix.com Press Contact: stc(a)panix.com Gopher URL: gopher://gopher.panix.com:70/1/1/vtw WWW URL: Be patient; we're working on it. :-) ------------------------------------------------------------------------------- STATUS OF THE BILL (updated 6/3/94) The office of the House Select Committee on Intelligence reports that HR 3627 has been referred to the the committee and must be reported out by June 16th or it will die in committee for the year. May 20, 94 Referred to the House Select Committee on Intelligence May 18, 94 Passed out of the House Foreign Affairs Committee on May 18 Dec 6, 93 Referred to the Subcommittee on Economic Policy, Trade and Nov 22, 93 Referred to the House Committee on Foreign Affairs. ------------------------------------------------------------------------------- WHAT YOU CAN DO RIGHT NOW Estimated time to do this good deed: Two minutes Show your support for HR 3627 by contacting a member of the House Select Committee on Intelligence, especially if your one of your state's representatives is on the committee. The end of this alert contains a sample message on which you can base your contact. The following list, sorted by state, shows the full membership of the committee and how to reach them. Remember, the deadline for the bill to pass out of committee is June 16th, so it is important to act quickly! If you live in one of the states listed below call your legislator. Otherwise, call Rep. Glickman. Here's a sample communication: Dear Representative ___________, Please report Maria Cantwell's Cryptography export bill (HR 3627) out of committee. Its passage will both assist American industries competing globally, as well as allow American consumers to purchase products to enhance their privacy. Sincerely, ______________ All addresses are Washington, D.C. 20515 Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 5 AL Cramer Jr, Robert E. (D) 1-202-225-4801 1-202-225-4392 1318 LHOB 8 CA Pelosi, Nancy (D) 1-202-225-4965 1-202-225-8259 240 Cannon 32 CA Dixon, Julian C. (D) 1-202-225-7084 1-202-225-4091 2400 RHOB 40 CA Lewis, Jerry (R) 1-202-225-5861 1-202-225-6498 2312 RHOB 46 CA Dornan, Robert K. (R) 1-202-225-2965 1-202-225-3694 2402 RHOB 2 CO Skaggs, David E. (D) 1-202-225-2161 1-202-225-9127 1124 LHOB 10 FL Young, C. W. (R) 1-202-225-5961 1-202-225-9764 2407 RHOB 4 KS Glickman, Daniel (D) 1-202-225-6216 1-202-225-5398 2371 RHOB 1 NE Bereuter, Douglas (R) 1-202-225-4806 1-202-226-1148 2348 RHOB 9 NJ Torricelli, Robert (D) 1-202-224-5061 1-202-225-0843 2159 RHOB 3 NM Richardson, William (D) 1-202-225-6190 1-202-225-1950 2349 RHOB 1 NV Bilbray, James H. (D) 1-202-225-5965 1-202-225-8808 2431 RHOB 17 PA Gekas, George W. (R) 1-202-225-4315 1-202-225-8440 2410 RHOB 2 RI Reed, John F. (D) 1-202-225-2735 1-202-225-9580 1510 LHOB 14 TX Laughlin, Gregory H. (D) 1-202-225-2831 1-202-225-1108 236 Cannon 16 TX Coleman, Ronald D. (D) 1-202-225-4831 None 440 Cannon 19 TX Combest, Larry (R) 1-202-225-4005 1-202-225-9615 1511 LHOB 1 UT Hansen, James V. (R) 1-202-225-0453 1-202-225-5857 2466 RHOB 6 WA Dicks, Norman D. (D) 1-202-225-5916 1-202-226-1176 2467 RHOB ------------------------------------------------------------------------- LIST OF LEGISLATORS SUPPORTING HR 3627 The following legislators have formally registered support for the Cantwell cryptography export bill, HR 3627. Call them with your cheers. All addresses are Washington, D.C. 20515 Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 1 WA Cantwell, Maria (D) 1-202-225-6311 1-202-225-2286 1520 LHOB HR 3627's sponsor; thank her for her work! 16 IL Manzullo, Donald (R) 1-202-225-5676 1-202-225-5284 506 Cannon Cosponsored on 11/22/93 3 UT Orton, William H. (D) 1-202-225-7751 1-202-226-1223 1122 LHOB Cosponsored on 03/22/94 3 OR Wyden, Ronald (D) 1-202-225-4811 1-202-225-8941 1111 LHOB Cosponsored on 03/22/94 16 CA Edwards, Donald (D) 1-202-225-3072 1-202-225-9460 2307 RHOB Cosponsored on 03/22/94 19 OH Fingerhut, Eric D. (D) 1-202-225-5731 1-202-225-9114 431 Cannon Cosponsored on 03/22/94 4 MA Frank, Barney (D) 1-202-225-5931 1-202-225-0182 2404 RHOB Cosponsored on 03/22/94 2 UT Shepherd, Karen (D) 1-202-225-3011 1-202-226-0354 414 Cannon Cosponsored on 03/22/94 3 WA Unsoeld, Jolene (D) 1-202-225-3536 1-202-225-9095 1527 LHOB Cosponsored on 03/22/94 19 FL Johnston II, Harry (D) 1-202-225-3001 1-202-225-8791 204 Cannon Cosponsored on 03/22/94 9 WA Kreidler, Mike (D) 1-202-225-8901 1-202-226-2361 1535 LHOB Cosponsored on 03/22/94 4 WA Inslee, Jay (D) 1-202-225-5816 1-202-226-1137 1431 LHOB Cosponsored on 03/22/94 7 WA McDermott, James A. (D) 1-202-225-3106 1-202-225-9212 1707 LHOB Cosponsored on 03/22/94 8 IN McCloskey, Frank (D) 1-202-225-4636 1-202-225-4688 306 Cannon Cosponsored on 03/22/94 14 CA Eshoo, Anna G. (D) 1-202-225-8104 1-202-225-8890 1505 LHOB Cosponsored on 03/22/94 10 NC Ballenger, Thomas C. (R) 1-202-225-2576 1-202-225-0316 2238 RHOB Cosponsored on 05/04/94 2 WA Swift, Al (D) 1-202-225-2605 1-202-225-2608 1502 LHOB Cosponsored on 05/04/94 ------------------------------------------------------------------------------- LIST OF LEGISLATORS WAVERING ON HR 3627 [Feel free to use the sample communique at the end of the FAQ when calling or writing a legislator.] 26 NY Hinchey, Maurice D. (D) 1-202-225-6335 1-202-226-0774 1313 LHOB Recently told a constituent that he is taking the Cantwell bill under consideration, but has "national security concerns" about allowing encryption to be exported outside the United States. 1 IA Leach, James (R) 1-202-225-6576 1-202-226-1278 2186 RHOB Has yet to answer a constituent letter with a stated position. 13 NY Molinari, Susan (D) 1-202-225-3371 1-202-226-1272 123 Cannon Has yet to answer a constituent letter with a stated position. (has taken inordinately long) 8 NY Nadler, Jerrold (D) 1-202-225-5635 1-202-225-6923 424 Cannon Met with lobbying constituent in April '94; no position taken yet 25 CA McKeon, Howard P. (R) 1-202-225-1956 1-202-226-0683 307 Cannon Responded to a constituent with a "non-position", May '94 ------------------------------------------------------------------------------- LIST OF LEGISLATORS OPPOSING HR 3627 [Feel free to use the sample communique at the end of the FAQ when calling or writing a legislator.] None on file yet. ------------------------------------------------------------------------------- What is the Cantwell bill? The Cantwell bill would permit companies to export products with encryption technology in them. US companies are currently not permitted to export products (hardware or software) with this technology in them. What is encryption technology? Encryption technology, or cryptography, is the art of scrambling a conversation so that only the people communicating can decode it. Other people (such as eavesdroppers) cannot learn about the conversation. Where is cryptography being used? Cryptography is used to encrypt electronic mail to protect its confidentiality in transit. It's used by bank automatic teller machines to protect sensitive data (such as your account number, your Personal Identification Number, and your bank balance). It can be implemented into software (such as electronic mail programs and word processors) as well as hardware (such as telephones and "walkie-talkies") to ensure your privacy. Why is there a restriction on exporting products with technology in them? For many years the United States was a leading researcher in cryptography. High quality cryptographic technology was available only within the United States. The US government thought that if they did not let this technology be exported, foreign individuals would not be able to obtain it and use it against us (by keeping US intelligence agencies from eavesdropping on their communications) Since then, cryptography research has been published in international journals. Companies have been created throughout the world who export cryptographic technology from countries that do not have these restrictions. You can now buy the same, high-quality cryptographic technology from many international firms. Although the marketplace has changed, the regulations have not. Why should the regulations be changed? US companies compete in a global marketplace. Because of the export regulations, they often compete alongside products with superior cryptographic capabilities built into them. The result is that US companies build their products with an inferior encryption technology. The result of this is that you, as an American consumer, have great difficulty obtaining products with strong encryption in them. Because US products cannot compete against products with better privacy features, and because the laws are outdated, the regulations should be changed. The Cantwell bill fixes these regulations to more accurately resemble the current situation of the world marketplace. How can I help encourage more privacy-enhanced products and pass the Cantwell bill? Call or write your representative and ask them to support or cosponsor the Cantwell bill, HR 3627. You can base your letter on the sample communication below. SAMPLE LETTER OR PHONE CALL The Honorable ____________ address Washington DC, 20515 Dear Congressman or Congresswoman, As a citizen concerned for my privacy, as well as a supporter of American business, I urge you to cosponsor the Cantwell cryptographic export bill, HR 3627. The bill would allow US companies to produce and export products with cryptographic privacy-enhancing technology in them. These products are already available from firms throughout the world. US companies lose nearly $100 million per year in exports to them. By encouraging this industry, ordinary citizens like you and me would be able to purchase products with better privacy features. Please support or co-sponsor HR 3627. Sincerely, ___________________________________ [updated May 28, 1994, shabbir(a)panix.com] -------------------------------------------------------------------------------

1 0

CERT warning about majordomo
by adwestro＠ouray.Denver.Colorado.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Regarding the list going down again: I was just informed that CERT has issued a warning about a security hole in majordomo. Anyone have any info on this? Alan Westrope <awestrop(a)nyx.cs.du.edu> __________/|-, <adwestro(a)ouray.denver.colorado.edu> (_) \|-' finger for pgp 2.6 public key "Silent, We the Empire Await, Trystero!" -- Pynchon (sorta...) S,W.E.A,T! -- graffito at Moe's Pretty Good Gym -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLfu61lRRFMq4NZY5AQESBQP/fn0lhPeUgVk+abGqQzNSOG+7895AvWFQ oWguun145cEB93NxL4vZyHOg5OgtEod7M33uvOGCVssEj3ux8iv8aW96LJOmc6ph kWIlXieNnvsR9WUXk2mapoYsakwz0VkwL4rsCLQhHcbQbFhlnJbKXOtw9n1h7Q8V Fas0G695ZyE= =C8+V -----END PGP SIGNATURE-----

1 0

Online/offline transactions
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Don't worry about online vs offline transactions. The credit card companies are moving toward all online transactions. A company down in NJ called RAM Mobile Data is helping them on this. They have base stations in 90% of urban business areas. The radios are fairly cheap (even though they need an appropriate thing to plug them into) and the per-transaction charges are about a dime. So I would say that the important problem to solve is "how do we make accounts anonymous?" rather than "how do we avoid double-spending?" -russ <nelson(a)crynwr.com> ftp.msen.com:pub/vendor/crynwr/crynwr.wav Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key 11 Grant St. | +1 315 268 1925 (9201 FAX) | Quakers do it in the light Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.

1 0

list of spiffy places to put your money
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

Dan Harmon: >Robert Hettinga wrote: >> [...] But we knew this already, from a list of spiffy places >> to put your money published here a few weeks ago. > >Maybe we could get the list republished? The list is in: ftp://furmint.nectar.cs.cmu.edu/security/banks And for easy access to all sorts of fun stuff, try mosaic on: ftp://alex.sp.cs.cmu.edu/links/security/vac-security.html -- Vince

1 0

Re: list of spiffy places to put your money
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

I wrote: >And for easy access to all sorts of fun stuff, try mosaic on: > > ftp://alex.sp.cs.cmu.edu/links/security/vac-security.html But I really meant to give the following URL (more fun): ftp://furmint.nectar.cs.cmu.edu/security/README.html -- Vince

1 0

Re: back to programming projects...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > On a related note, should encrypting remailers have the keys changed > > regularly? The RSA-IDEA combination isn't very suspectible to known > > plaintext attacks, right? Right. There are two sets of encryption used in the RSA-IDEA combo: 1) RSA, encrypting a random session key with a public-key algorithm. By definition, RSA-like public key algorithms can easily have known or chosen plaintext generated, since you can encrypt anything you like. RSA isn't susceptible to known-plaintext (except for verifying that a (presumably stolen) private key is correct, or by factoring very large numbers of very large prime numbers and checking them, which is computationally infeasible), and any other public key system that *were* susceptible to known-plaintext attacks wouldn't be very useful. Major breakthroughs in factoring theory could always change this, earning mathematical fame and fortune for the discoverer. Short RSA keys can be factored; you're better off with 1024-bit keys or longer for anything you're real serious about. 2) IDEA, encrypting the message itself using the session key. IDEA is not known to be susceptible to anything better than brute force, so known-plaintext attacks require trying 2**128 keys, which is computationally infeasible. Perhaps someone can find a hole in IDEA, but there's nothing major at present. 3) There's a third component that might use encryption - generating the "random" session key. Obviously, if you use the same session key to send different messages to different people, they might notice. If you use different session keys to send messages to people, but the session keys are easily derived from each other, and one recipient notices the pattern from several messages sent to him, he might try guessing the key for the next messages you send to other people. So use a genuine high-quality random number generator. There is one more special case, which is sending the same message to multiple recipients, with the message encrypted once with the session key, and multiple versions of the session key encrypted with each different recipient's public key. I've forgotten the details, but if there are more than e recipients, it's possible to crack this. (e is the encryption exponent, typically 3 or 17.) That's why PGP and other well-designed systems will pad the session key with random stuff before encrypting with RSA (which is an essentially free operation, since the RSA blocksize is much larger than the session key for IDEA.) Bill

1 0

Re: Protocol Wanted!
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> How does Bob make Alice aware that he can factor RSA keys > and make sure that he and Alice can do business without > either one of them getting ripped off or the NSA catching him. Sounds like a job for Blacknet, or similar anonymous-broadcast systems. He can't easily hide the fact that *somebody* is in the business from the NSA, since he can't easily tell that Alice doesn't work for the NSA and isn't planning to publish his business's existence to the net. But if he and Alice are both remailer-users able to post to the Blacknet broadcast (using whatever mechanism, like alt.waste), Bob can post a note to Alice saying he is able to crack RSA keys for money, and Alice can post replies saying she doesn't believe him and here's a message to crack. There are cut-and-choose protocols described in Schneier that can handle (awkwardly) the mechanics of getting Bob to recode and return the message, and Alice to hand over the digicash, without either of them feeling too ripped off, assuming there's a digicash system in place that gives sufficient anonymity. Bob has a bit of an advantage in convincing Alice, since he can probably read her encrypted posts to the net - he can start teh conversation by posting to her on Blacknet with some keywords from messages she's posted to other people. That doesn't directly tell her that he's cracking RSA rather than IDEA/3DES, but he could also include a note that the first n bits of her private key are ....... Alternatively, he can go on a political rant about Too Many Secrets, but having seen that movie he can announce the details of his decryptor on sci.crypt *before* announcing that he's giving a lecture at Stanford... :-) Somebody, in the discussion about pricing, said that some of the proposed protocols would take too much CPU time, cracking lots of keys just to demonstrate that he can do it, and that he should always charge money to avoid overloading his 486 box. If he's going to go into the business of factoring RSA keys for money, he'll probably make enough to afford a few *new* computers once he hits up a couple of wealthy customers, if he's not spending it all on air travel and bodyguards. "Bob"

1 0

RE: cypherpunks list wiped out again... (duplicate)
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

================ > From: IN%"rslau(a)usc.edu" 12-JUN-1994 17:57:04.72 > To: IN%"cypherpunks(a)usc.edu" > Subj: cypherpunks list wiped out again... (duplicate) > It looks like the cypherpunks list was wiped out again this afternoon... > I think I may have found the bug in majordomo that caused this or maybe > it's just coincidence since the last time this happened was also on a > sunday afternoon, i believe. there must be a timebomb in majordomo ala > pgp 2.6 :) > > Resubscribe by sending the following in the body of the message to > majordomo(a)toad.com: > > subscribe cypherpunks > > Robert Lau - Systems Programmer, Unix Systems 213-740-2866 > -- University Computing Services Internet: rslau(a)usc.edu > -- University of Southern California Bitnet: rslau@uscvm > -- 1020 W Jefferson, LA, CA USA, 90089-0251 UUCP: > ...!uunet!usc!rsla> This may sound like a "dumb" question, but if the list was "wiped out", why did I receive this? ====================

1 0

List Maintenance
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

Today the disk that the cypherpunks list lives on filled up, and then someone try to join the list and the list got zeroed again. I am currently installing a new version of MajorDomo and making changes to prevent this happening (at least we caught it in the act this time). The list will likely be up and down a little bit for the next few hours or day (hey, I have to sleep sometime! :r) but should be fully stable again by Tuesday in any case. This time I do plan to install a recent backup of the list. If you have any questions please email mail, this list it's self does not need any more crud on it. ||ugh Daniel Sometimes Postmaster hugh(a)toad.com

1 0