December 2003 - cypherpunks-legacy

Re: Another Cellular Victim
by Phil G. Fraering 17 Dec '03

17 Dec '03

I was on a trip out of town a while back... as soon as I crossed into another cellular network boundary, I got a call from the provider's sales droid, telling me how to use their service. They _are_ tracking individual phone movement, IMHO. pgf

3 2

Re: totally secure email?
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> For political reasons, my email must be encrypted as soon as it hits > the site before it gets dropped in my mailbox, or the sysadmi n will > read it (snoopy bugger) and find out I'm looking for a job elsewhere. Get teh unix program "procmail", source available on any comp.sources.misc archive, or, probably, at ftp.informatik.rwth-aachen.de /pub/unix/procmail.tar.Z. This program lets you do things like sort your mail into different mailboxes as soon as it comes in. It's also really easy to use it as a hook for other programs or shell scripts to operate on mail as soon as it comes in. It shouldn't be very hard to do what you want, but there are a couple of things to be aware of here: 1) Your sysadmin can assuredly get around this too if he wants, and get at your mail even before procmail does. As a general rule of thumb, the sysadmin can do anything. But getting aroudn this would definitely be more dificult then simply reading your /spool/mail file. 2) You obviously don't want to leave your private key in your unix account, as the sysadmin could just use it to decrypt all your mail and read it. Obvious of course, but sometimes it's easy to overlook the obvious. Of course the best solution would be to have your correspondents send you PGP encrypted mail, but I guess the best solution isn't always available.

6 9

DECLINE AND FALL
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com SS> The important issue for Cypherpunks is how we should respond to this SS> seemingly inevitable increased mobility of capital. Does it pose a SS> threat to privacy? I'd say that those moving the money around the world would be deeply interested in privacy - their own. Not necessarily for nefarious reasons, but to protect the competition from knowing what they are doing. A 800-pound gorilla like the Fidelity Magellan Fund takes elaborate precautions to not alert the market as to what they are buying and selling. Thus, I assume, they deeply value their own privacy. Will the capital moving about the world be hostile to cypherpunks et al? I doubt it. Instead, they'll probably cherry-pick the best of crypto technology and use it for themselves. Besides, big money generally isn't thrilled by governments and usually views national boundaries as an annoyance, a view shared by many on the Net. * RM 1.4 B0037 *

1 0

Andy Grove on Clipper
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

In between the helocopter coverage of OJ, which looked like outtakes from "Speed" in slo-mo, I happened to catch a repeat showing of the "Larry King Live" discussion with Al Gore, Andy Grove, the head of the FCC, and a journalist. The transcript was posted here, so I won't try to check on the details. Just my impressions, having worked with Grove. I say impressions because its important we understand how views come to be held, how strongly they are held, whether they can be changed, etc. In the case of Grove's comment that Clipper is just an extension into the digital real of existing wiretap "rights," I think I can see why he has this view--I don't agree with it, of course, but his view is probably the dominant view. Something we need to understand. To wit, * If asked whether digital transmission should "exempt" someone from wiretaps, most people would say "No, of course not." (There are subtle issues here, of course. More on this later.) * If asked a different question, about whether users should be compelled to use a government encryption and key escrow system, the answer for most Americans is different: "No, of course not." (Actually, same answer, different question.) If I were trying to convince Grove of the "Cypherpunks position," I would of course make these arguments about mandatory escrow, about the parallels to "diary escrow" (after all, cops can search papers with search warrants, so doesn't this mean that the digital age needs "diary and papers escrow"?) and other such travesties. I think it might take an hour of discussion, but eventually a light bulb would go off in his head and he'd see that the price paid with these "escrow" systems--especially if _mandatory_, as most of think is the real agenda--is simply too high for a nominally free society to put up with. (I had these hour-long debates with Grove, Moore, and Barrett when I was at Intel, and sometimes I won. Often I lost. I won't be having any opportunities to argue the Clipper issue with them, of course.) I'm citing this because it helps to explain the dichotomous reaction to Clipper. If the question about Clipper is phrased as an issue of privacy, do Americans have the right to keep conversations private, etc., then the answer is overwhelmingly (80%, as in Time-CNN poll) pro-privacy. If, however, the question is phrased in terms of "legitimate law enforcement needs" and whether suspected terrorists and pedophiles have a sacred right to use "fortress-like crypto," then I suspect the answer will shift in the other direction rather dramatically. With egg all over their face on Clipper, I see the Administration now launching a new campaign, a campaign being led by Donn Parker, Dorothy Denning, Andy Grove, and others. In this campaign, the second approach mentioned above will be dominant: a focus on pedophiles who "encrypt their list of victims," a focus on "terrorists who form virtual networks around the world," and a focus on "money launderers who use crypto anarchy to spread their poison." Their is little chance that we Cypherpunks will get the opportunity to make our case in the public...the hour it might take me to convince Grove, as an example, is about 59 minutes more than the "sound bite" any of us will be given. Is it hopeless? For public relations, probably yes. Fortunately, the power of strong crypto lies in its use. The leverage effect. As Phil Karn put it: "Don't get mad, get even. Write code." --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 4

Re: OJ`S CELL PHONE
by peter honeyman 17 Dec '03

17 Dec '03

a cellular phone that is turned on is in periodic contact with the local antenna. certainly the cellular provider knows what cell a mobile phone is in; that's how calls are directed. in fact, anyone can monitor the paging channel to make a primitive tracking device. (some folks on this list know much more about this ... perhaps they'll speak up.) peter

1 0

Re: MAIL: anon mailing list
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Say somebody wants to run a mailing list as you propose. I think they > should just run the list at the same address unless the remailers can > suitably pad, delay, and randomize incoming messages and redirect them > to the true list site (but then delay and randomization may lead to > loss of coherency on the list ;). If not, surely external observation >of the contact point will show where all the messages are headed. Hmm. I'd think that if the list address were an encrypted remailer path with several hops, it would be non-trivial to find the contact point by external observation. Would it even be possible? Regretably, probably so. An additional layer of security could be having the list address underneath all of the encrypted remailer stuff be an anon address at the server in Finland. Although it's probably quite easy to to determine your true address by external observation of anon.penet.fi, unfortunately. Still, the combination of chained encrypted remailer paths, and the finnish anon server would definitely make it dificult to determine the contact point. But I guess not as dificult as I had hoped. > The resources needed would be higher than a normal list since each > incoming message would need to be checked for a digital signature (or > the list could become victim to an anonymous mail bomber, and you Yeah, quite true. It would be impractical for a very large list. At least, if you wanted a list with more then maybe 70 members, you'd need to dedicate some machine to it, probably. Although maybe not; I don't want to concede that until it's actually tried to see how much proccesing power is required in practice. :) And yeah, it would take users who were actually committed to doing it, as most users of _this_ list (including me), don't even sign their messages, as you point out. If we won't even sign our messages, then I don't know who is going to be willing to sign, encrypt, append remailer path, to it. Although I guess if the list required it, as it would, then people might join the list and do the stuff, just for the principle of it. And automated shell scripts certainly help. You could have an automated shell script particularly for the mailing list that took cleartext, encrypted it to the list, signed it, appended the remailer stuff to the front, and sent it off to the proper remailer.

1 0

PC RND generator based on physical random
by jp＠jep.pld.ttu.ee 17 Dec '03

17 Dec '03

What you need is natural source of random. I have used clocking higher speed quarz generator with lower speed (10 x is ok ) unstable frequency oscillator and then taken parity of the result (4-5 bits is enough for most situations, depends of cource on distribution of LF generator values) . Variable Freq. oscillator is RC and higher quarz. Now as we are not willing to give up card slot (and PCB board area ands so on ) for just RND generator maybe it is good to find existing source of random in PC itself. So - do we have RC generator in PC? YES. We have 4 of them, to be exact. Most of us do not make much use of these ports, because most games do not support them correctly. But anyhow, joystick ports are there. IO card costs 10$ if you have not already got one. So I propose scheme for PC RND generator: 1. Make LF generator using Joystick ports 2. Use HF oscilltor of PC clock ( Program Execution, if any interrupts occur, it is no problem). 3. Find out the distribution of LF oscillator and calculate the needed Parity filter size. ( By parity filter I concider parity values of N last bits) 4. Use it

1 0

Hardware RNGs
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

pfarrell(a)cs.gmu.edu: > up IRQs, port addresses, etc. Does this suggest that a > Plug-n-play board would be more attractive? Just build it, on any platform. The key is the RNG, not the interface, which can be easily adapted to market demands. I take it that you don't plan to invest millions of dollars to start up, so _which_ interface you use first is not crucial ;-) There have been too many "let's do this" suggestions that degenerate into a discussion of the smallest details and disappear all together... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Neural nets crack RSA? AAARRGHH!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Jim choate <ravage(a)bga.com>: > As far as I am concerned if it could be done w/ a neural network, or Ouch. Neural networks are _deterministic_ (except, possibly, analog VLSI ones such as Mead's). Digital neural networks can't do _anything_ that cannot be done by algorithms; they run on Turing machines too. Why neural networks are 'magical' as Perry says, in certain classes of problems, is that they provide a way to perform complex algorithmic funtions through a relatively simple interface to humans. In any case, how "fuzzy" do you allow your relative magnitude function to be? Even if a function exists that compares keys with a magnitude difference of the order of 100 bits, it's useless. For your binary search method to work, this comparator function would have to be accurate when the difference is on the order of just 1 bit. Yeah, quantum computers ;-) ----------------From owner-cypherpunks Mon Jun 20 10:33:41 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA20571; Mon, 20 Jun 94 10:33:41 PDT Received: from src.honeywell.com (moon.src.honeywell.com) by toad.com id AA20548; Mon, 20 Jun 94 10:33:24 PDT Received: from tbird.src.honeywell.com by src.honeywell.com (4.1/smail2.6.3/SRCv0.25); Mon, 20 Jun 94 12:33:26 CDT id AA02136 for cypherpunks(a)toad.com at toad.com Posted-Date: Mon, 20 Jun 94 12:33:15 CDT Received: by tbird.src.honeywell.com (4.1/SMI-3.2) id AA29883; Mon, 20 Jun 94 12:33:15 CDT Date: Mon, 20 Jun 94 12:33:15 CDT From: bergstro(a)src.honeywell.com (Pete Bergstrom) Message-Id: <9406201733.AA29883(a)tbird.src.honeywell.com> To: cypherpunks(a)toad.com Subject: re: MAIL: secure mail Sender: owner-cypherpunks(a)toad.com Precedence: bulk >>>>> On Sat, 18 Jun 1994 21:05:04 -0500 (CDT), Karl Lui Barrus <klbarrus(a)owlnet.rice.edu> said: > What I've tried is to do a "|pgp -feat ecarp|rmail erc%khijol(a)apple.com", > but pgp just produces empty files! If I execute it by hand, it works. > Anyone know either (1) why it isn't working wnd how to fix it, or (2) > suggect a better alternative? > The problem may be this: pgp needs a path. > Try "| PGPPATH=/whatever pgp -feat ecarp | rmail erc%khijol(a)apple.com" > This is what I needed to do when I tried something similar with mh > and slocal. Keep in mind that if you have a site that follows CERT advisories, there are usually restrictions on which programs may be used to filter mail. My site requires a sysadmin to put an entry in a config file to allow any filter programs to work at all. One standard filtering program that works well is procmail. This will typically be "approved" by default and should keep your (Ed's) admin from having to be involved in your incoming mail. Pete

1 0

Stealth Crypto (Was: Re: Andy Grove on Clipper)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 2:28 AM 06/20/94 -0400, Ed Carp [Sysadmin] wrote: >I've read about (with interest) the so-called "stealth viruses", and how they >adapt to their environment - might crypto do the same thing? There is no way to to translate the idea that I can see. Stealth viruses work by patching the interrupts that AV programs watch- (on a PC- Macs and other platforms are conceptually different) INT 21h, etc. and the file attributes repoting mechanisms in DOS, and lie. It is hardware specific, and I don't see anyway to translate the concept to a networked environment in order to fool 'traffic cops.' I wonder about the mutation engine concept, though... -j

1 0