December 2003 - cypherpunks-legacy

Re: Email firewall etc
by remailer＠jpunix.com 17 Dec '03

17 Dec '03

rishab(a)dxm.ernet.in once said: RI> Vincent.Cate(a)FURMINT.NECTAR.CS.CMU.EDU: RI> > Companies like the idea of firewall machines to protect the security of RI> > their internal nets. I bet they would also like something called an RI> > "email-firewall". Names are important. :-) I think of the RI> > email-firewall as a slightly modified anonymous-remailer. RI> RI> I haven't delved into the wide world of remailers out there, but I'd like a RI> remailer that encrypted, though did not necessarily anonymize, incoming mail. RI> RI> I'm not really bothered about the NSA reading my mail. In fact, I'm not usually RI> concerned whether someone in New York, for instance read my mail. But I might RI> not want people closer to home (local sysadmins, etc) to read it. I'm sure many RI> others share this position. RI> RI> The problem is that I can't ensure that people encrypt their mail to me. They RI> may not bother, or be unable. An alternative would be for them to send it to RI> a remailer, which, knowing my public key, would encrypt and forward it to me. Version 1.99 of my Remail for Waffle actually does this: it checks if the recipient of the remailed message has a PGP public key, and if so, it encrypts the outgoing message, if it is not encrypted already. The remailers remail(a)vox.hacktic.nl and remailer(a)jpunix.com use this program. For testing you can also use remail(a)desert.hacktic.nl, or remailer(a)desert.hacktic.nl PAtrick

1 0

Suggestions for InfoHighway Patrol dealing with abusive (cr)users
by NetSurfer 17 Dec '03

17 Dec '03

Alright, CP's, I've got a humorous one for you. The author is Gordon McLachlan (mclachlan(a)cardinal.com) and the article appeared in the "Crosswired" column of May 1994 Vol. 5 No. 5 Lan Computing. Hope it gives you a chuckle. (Unofficially included below) "Cane the Internet Loons" According to University of Michigan President James Duderstadt, it was a "monstrous act." An act that "made a mockery of the values of civility we hold dear." Was it a brutal campus murder? A rape? An assault? Did they lose a football game to Ohio State? Nope. It was email with the intent to inflict great psychological injury. In early April, someone apparently ripped off a Michigan student's password and made offencive racial and ethnic slurs to several Internet Usenet newsgroups. According to a written statement by university officials, this event "offended, hurt and frightened" many faculty, staff and students. Unfortunately the Internet has no official rules, and no way to effectively punish computerized criminals such as the person who sent these hurtful messages. Underlying Internet etiquette is the realization that the net hovers somewhere between anarchy and democracy. In effect this means you can say anything you want, but if you say the wrong thing, society's only recourse is to assemble an unruly mob at your electronic doorway to burn you out. If your transgression of netiquette is severe enough, you will be pilloried in public by your fellows and sent a barrage of hate mail. If you persist in being a pain in the ass, the system administrator at your home site will be flooded with mail telling him to cut you off. In the Michigan incident, this response was insufficient. All the well-meaning hate mail from the defenders of the net was sent to the wrong guy - the poor physics major who had his password stolen. Despite rapid action by the administration to deplore the act, write an apologetic missive to post on the net, and have "various units {sponsor} community forums where we can share our concerns," there isn't much anyone can do. Well, to hell with sharing our concerns. A monstrous act deserves a monstrous response. In Singapore, they'd hunt the perpetrator down and cane him. And if caning is good enough for a kid from Ohio who vandalizes cars, its good enough for a kid from Michigan who offends sensitive network types. Luckily our opportunity is at hand. At this very moment, congress is getting tough on crime, ready to fine, imprison and kill more young men for a variety of heinous offenses against society. I hope this shocking incident is enough to wake up our legislatures before there are more drive-by shootings on the information super-highway. First of all, we need a seven-day waiting period and a thorough background check before anyone can get issued a user-ID. This would give system administrators time to find out if a user is a loon, or has been bounced off of other systems for misbehaving. To support this effort, congress should establish a national database to keep track of network offenders. A quick scan of almost any mailing list or newsgroup will reveal sociopaths who should have their access priviledges revoked. And we should never forget that network access is a priviledge and not a right. Its ironic to me that we license people to drive cars, but all you need to get on the information superhighway is a MODEM. Of course, a waiting period won't stop network terrorists from stealing other peoples passwords and firing off their Scud missives, but there is much more we can do. By making MODEM manufacturers install something like the Clipper encryption chip in every MODEM they sell, we could trace offensive messages right back to their source so the Feds could confiscate the offending hardware. Maybe we could even use our national health plan ID cards to restrict access to the info highway by requiring every terminal or PC keyboard to incorporate a magnetic card reader. Furthermore, we should require speed licensing for the use of email distribution lists. Just as we have the right to bear arms but not fully automatic weapons, there are damn few good reasons why you need to have a mailing list. If its too much trouble to type out the names of all the people you are sending mail to, youre probably sending it to too many people. Curtailing the use of mailing lists would drastically limit the impact that any maladjusted weenie could have on our delicate sensibilities. That makes it worth any minor inconvenience it might cause. In the event that these steps are insufficient, we should impose stiffer penalties on network criminals. Theft of a password should be made a federal felony with manditory hard time. With "three strikes and youre out" a third breech of netiquette should result in revocation of all network priviledges and removal of your cable TV hookup. Some bleeding hearts may argue that these measures will stifle the free exchange of ideas, but if thats what it takes to stop people from being offended, hurt and frightened, its a small price to pay. -30- <hehehe> -NS

1 0

RE: Unicorn vs. tmp@netcom
by Mike Markley 17 Dec '03

17 Dec '03

| From: Cyber City <cyber1(a)io.org> | << partial quote removed >> | Likewise, when you were tested recently by net abuse, you went for | relief to your master, the government. This is what distinguishes you | from the rest of us. We might react against the abuse (or we might | not), but I think that none of us - or at least a very few - would have | gone to court for relief. I would have no problems at all going to court as a solution. Posting so called 'flamebait' does not make it right for someone to respond with attacks on the character of the original poster. If you must post responses to flamebait then attack the content of the article. As to the comments about contract murder, If you chose this route based on the economy of it, what are you going to do when you are arrested for the murder? I don't think the courts are going to buy a plea of "It was cheaper to deal with the problem this way." I don't think that this type of litigation is going to impact the free flow of information. Attacks on the character of the poster of the information are more likely to limit the flow than anything else. I'm not trying to sound PC here because I personally find the PC movement very offensive, but if you have a problem with someone deal with it privately and don't air your dirty laundry in public. Mike << rest of quote removed >> ===================================================== Mike Markley <mmarkley(a)microsoft.com> I'm not a Microsoft spokesperson. All opinions expressed here are mine. =====================================================

1 0

ecash Press Release
by DigiCash Information 17 Dec '03

17 Dec '03

DIGICASH PRESS RELEASE World's first electronic cash payment over computer networks. ============================================================= FOR IMMEDIATE RELEASE (Release Date: May 27, 1994) ---------------------------------------------------------------------- Payment from any personal computer to any other workstation, over email or Internet, has been demonstrated for the first time, using electronic cash technology. "You can pay for access to a database, buy software or a newsletter by email, play a computer game over the net, receive $5 owed you by a friend, or just order a pizza. The possibilities are truly unlimited" according to David Chaum, Managing Director of DigiCash TM, who announced and demonstrated the product during his keynote address at the first conference on the World Wide Web, in Geneva this week. Electronic cash has the privacy of paper cash, while achieving the high security required for electronic network environments exclusively through innovations in public key cryptography. "It's the first software only solution. In the past we've pioneered such cash for chip cards and electronic wallets, always with a tamper-resistant chip for storing the value--now all you have to do is download the software and you're up and running" continues Dr. Chaum. The product works with Microsoft(R) Windows TM, Macintosh TM, and most UNIX TM platforms. It was shown integrated with Mosaic, the most popular software for people accessing databases, email, or other services on the Internet and World Wide Web. The graphic user interface allows intuitive "dragging and dropping" of icons representing stacks of coins, receipts, record books, etc. The company will be supplying the technology through other firms who will release the products, under various cooperation and trial programs. The user software, which allows both paying and receiving payment, will be distributed free of charge. The product was developed by DigiCash TM Corporation's wholly owned Dutch subsidiary, DigiCash TM BV. It is related to the firm's earlier released product for road pricing, which has been licensed to Amtech TM Corporation, of Dallas, Texas, worldwide leader in automatic road toll collection. This system allows privacy protected payments for road use at full highway speed from a smart card reader affixed to the inside of a vehicle. Also related is the approach of the EU supported CAFE project, of which Dr. Chaum is Chairman, which uses tamper-resistant chips inserted into electronic wallets. The underlying 'blind signature' technology was described in the article "Achieving Electronic Privacy," by David Chaum, Scientific American, August 1992. ---------------------------------------------------------------------- For more information contact: DigiCash bv info(a)digicash.nl Kruislaan 419 tel +31 20 665 2611 1098 VA Amsterdam fax +31 20 668 5486 The Netherlands ----------------------------------------------------------------------

1 0

ecash Press Release
by DigiCash Information 17 Dec '03

17 Dec '03

DIGICASH PRESS RELEASE World's first electronic cash payment over computer networks. ============================================================= FOR IMMEDIATE RELEASE (Release Date: May 27, 1994) ---------------------------------------------------------------------- Payment from any personal computer to any other workstation, over email or Internet, has been demonstrated for the first time, using electronic cash technology. "You can pay for access to a database, buy software or a newsletter by email, play a computer game over the net, receive $5 owed you by a friend, or just order a pizza. The possibilities are truly unlimited" according to David Chaum, Managing Director of DigiCash TM, who announced and demonstrated the product during his keynote address at the first conference on the World Wide Web, in Geneva this week. Electronic cash has the privacy of paper cash, while achieving the high security required for electronic network environments exclusively through innovations in public key cryptography. "It's the first software only solution. In the past we've pioneered such cash for chip cards and electronic wallets, always with a tamper-resistant chip for storing the value--now all you have to do is download the software and you're up and running" continues Dr. Chaum. The product works with Microsoft(R) Windows TM, Macintosh TM, and most UNIX TM platforms. It was shown integrated with Mosaic, the most popular software for people accessing databases, email, or other services on the Internet and World Wide Web. The graphic user interface allows intuitive "dragging and dropping" of icons representing stacks of coins, receipts, record books, etc. The company will be supplying the technology through other firms who will release the products, under various cooperation and trial programs. The user software, which allows both paying and receiving payment, will be distributed free of charge. The product was developed by DigiCash TM Corporation's wholly owned Dutch subsidiary, DigiCash TM BV. It is related to the firm's earlier released product for road pricing, which has been licensed to Amtech TM Corporation, of Dallas, Texas, worldwide leader in automatic road toll collection. This system allows privacy protected payments for road use at full highway speed from a smart card reader affixed to the inside of a vehicle. Also related is the approach of the EU supported CAFE project, of which Dr. Chaum is Chairman, which uses tamper-resistant chips inserted into electronic wallets. The underlying 'blind signature' technology was described in the article "Achieving Electronic Privacy," by David Chaum, Scientific American, August 1992. ---------------------------------------------------------------------- For more information contact: DigiCash bv info(a)digicash.nl Kruislaan 419 tel +31 20 665 2611 1098 VA Amsterdam fax +31 20 668 5486 The Netherlands ----------------------------------------------------------------------

1 0

Learning to divide ( again )
by Jyri Poldre 17 Dec '03

17 Dec '03

RE every1. Recently i became involved in project of designing semi-custom VLSI device for endecryption. The device uses variable length RSA for key exchange and IDEA for data encryption. For pipelinig IDEA block we have to use 6 multipliers 16 bit ant that leaves us with 96 bit adder for RSA calculations. ( The chip should be reasonably cheap ). Otherwise the RSA speed would not be so cruicial but we have to generate both keys in chip ( involves physically random generator based on variable frequency being samled with constant clock, VF generator is inside chip ) to guarantee absolute secrecy - you cannot tell Secret component if you do not know it. To generate keys we have to use Fermat test for primality and that takes time. Although the RSA keys need not to be changed so very often it is still important to keep the process running in 'normal' time limits. So - I can use multiple operand adders ( meaning a+b+c+d with one carry-propagation time ) For RSA basic operation a*b mod Z i have decided to use radix4 modified Booth algoritm for multiply , but i am still not sure about divide. Has any1 encountered similar problems? I would greatly appreciate Feedback, cause i have to make up my mind in some weeks. If you are interested in more details about the design, let me know. I would like it to be good product for use in different applications. JP from PLDesign lab of Tallinn Technical University.

1 0

No Mail for last night...
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

I had disk problems last night, and lost all mail that was sent between 5 and 9 this morning. If anyone sent anything important, send it again. Sorry- -j

1 0

Re: Unicorn vs. tmp@netcom
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Of course, no-one has considered the possibility that the tmp@netcom persona was manufactured and played out over time solely in order to boost the credibility of the 'uni' persona :-) [does anyone have any proof that *either* of these people exist in real life or that all this flurry of pseudo-legal action ever took place???] G(in the spirit of Detweiler, since LD isn't around to suggest it himself :-) )

3 2

MIT Statement on PGP
by Hal Abelson 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE, May 26, 1994 Contact: Ken Campbell, Director, MIT News Office (617 253-2703 or 2700 NON-COMMERCIAL USE MIT Issues Software Codes To Promote Internet Privacy The Massachusetts Institute of Technology has issued--for non-commercial use--a free public software package that will allow people to send private coded messages on electronic networks in the United States. The release provides non-commercial U.S. users of the Internet with the ability to obtain secure communication and data protection. Commercial versions have been licensed to over four million users. The software, known as PGP Version 2.6 (for "pretty good privacy") uses the RSAREF(TM) Cryptographic Toolkit, supplied by RSA Data Security, Inc. of Redwood City, Calif. It is being released by MIT with the agreement of RSADSI. PGP 2.6 is fully licensed, for U.S. non-commercial users, to use public-key technology that has been licensed by MIT and Stanford University to RSA Data Security and Public Key Partners. Public-key technology gives users of electronic mail the ability to sign messages in an unforgeable way, as well as the ability to send confidential messages that can be read only by the intended recipients, without any prior need to exchange secret keys. "This agreement solves the problem of software being distributed on the Internet which potentially infringed the intellectual property of MIT and the licensee, RSA, " said Professor James D. Bruce, vice president for information systems. Although prior versions of PGP have been available on the Internet, the potential infringement of MIT and Stanford University patents has prevented it from coming into widespread adoption. END

2 1

No Mail for last night... (one more try)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

That last message must have been somewhat confusing. I meant mail sent between 5PM and 9AM. -j >I had disk problems last night, and lost all mail that was >sent between 5 and 9 this morning. If anyone sent anything >important, send it again. > >Sorry- >-j

1 0