December 2003 - cypherpunks-legacy

Remailer REORDER not DELAY
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Jim choate <ravage(a)bga.com> writes: > 2. messages will be cached and re-transmitted after a random delay. I intend > to generate a random number between 0 and 24. When the appropriate hour > arrives all messages with that time stamp will be sent encrypted. > I would suggest getting a random number between 0 and 1440. This will I waited for a good reply to this and didn't see one. Smart people have commented on this before and no one in this round seems to be remembering. Delay--time--isn't what matters. It's confusion about which message is which that matters. So if I get 10 messages in one minute, I can scramble the order and send them out the next minute, and I've done my job--at least the order-scrambling part. (You also need to pad or packetize messages.) So use serial numbers, not times! Send a message for every one you get, keep a fixed number of messages queued, and add dummies if necessary to keep things moving. > On the issue of traffic analysis: > > It occurs to me that simply monitoring a remailers feeds and their traffic > analysis will provide enough information to determine the difference between > bogus (ie random generated) and real traffic... Why not have the dummy message forwarded in a long enough chain and back to you? Then you could swallow it or turn it into another dummy, depending on whether you need to hurry your queue right now. I don't think the amount of dummy traffic is a big problem. You only need enough to keep your queue flowing. Plus, if the remailers only generate dummies when necessary, the total dummy traffic is self-regulating, since multi-hop dummies are x-lax for every remailer they pass through. I like thinking about the traffic pattern with get-one-send-one remailers: A user sends a message, and it seems to bounce from remailer to remailer to remailer...to a final recipient--but no, it was all a shell game! -fnerd - - - - - - - - - - - - - - - the snack that eats like a food -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

4 5

Tracking cellular phones (OJ reference)
by Michael Wilson 17 Dec '03

17 Dec '03

About the earlier note on tracking cell phones. It isn't hard. In fact, the network HAS TO do it, essentially. A cell phone has a pager in it that signals when it is getting a call, what cell to go for, and frequencies (check out the old Bell System Technical Journals from when cell technology was a research project at what is now Ameritech). Cell receiver stations are arranged in a hex about 8 miles on a face. When a signal gets weak (it can tell signal strengths), the phone is handed off to a better cell; it can go a good round of local cells until it actually hits a stronger receiver site. Using this, you can bounce the phone around to different cell receivers, test signal strength (none of this actually activates the phone, it is part of the standard polling), and get a fairly good fix on location. After that it is simply a matter of flooding the area with enough black and whites to find the phone (in this case, the car that OJ was driving around in, which they did pick up from a helo). No real need for special gear, other than what it might take to track a signal through triangulation on a local basis; standard FCC gear for hunting pirate radio and video bands, and easily available for law enforcement. So think of your cell phone as a leash, 'cause that's what it is. Anyone else notice a serious *lack* of usage of cyberpunk style journalism in this one? Scanners to track police, listening in on 911 reports, hunting down the local cell phones to listen to them, a directional mic to hear negotiations. The local LAPD didn't even know how to pull the number of their own cell phone. Back to lurking... ;) [A special note to our friends in the intelligence community out there... Tag, you're it! With love, The Nemesis Group]

1 0

ADMIN: List Software Upgrade Warning
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

This is a "two birds with one stone" message, testing the new version of MajorDomo that I just installed and telling you folks that if you have any strange problems with the list to please contact me about them. ||ugh Daniel Sometimes Postmaster hugh(a)toad.com

1 0

Re: Prime magnitude and keys...a ?
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

Jim choate <ravage(a)bga.com> wrote: | No, again it will allow you to find the secret key, it will not | provide any information about the factors of that number. It might | be used for that but as you have pointed out, it takes a long time. Okay, obviously neither you or Perry know what you're talking about, or you are too busy flaming each other to express your thoughts coherently. Finding the secret key WILL allow you to factor the modulus (assuming you know the public key). Therefore, solving for the secret exponent is equivilent to factoring. This has been discussed before. I thought you have been on the list long enuff to remember it, but it is obviously necessary to restate the explanation for those who haven't seen it before. Assume we have: Two (unknown) prime numbers p and q, a known modulus n, where n is the product of p and q, and known public key exponent e. Now, suppose someone discovers the corresponding secret key d. Now assuming the case where de=(p-1)(q-1)+1, we have two equations with two unknowns: pq = n de = (p-1)(q-1) + 1 Solving for p and q is simply a matter of solving simeltaneous equations. First, we rewrite the second equation: de = pq - p - q + 2 Now we substitute the known values for de and pq and do some simple algebra: p = n - de + 2 - q Substitute p in the original equation: q(n-de+2-q) = n q(n-de+2) - qq = n -qq + q(n-de+2) - n = 0 qq - q(n-de+2) + n = 0 Now solve for q using the quadratic formula. q=((n-de+2)+((n-de+2)^2-4)^(.5))/2 P can then be found (of course) by dividing n by the now-known value for q. Now, there is the possibility that (p-1)(q-1)+1 will not equal d*e. However, d*e will always be equal to k(p-1)(q-1)+1 where k is an interger. Given PGP's fondness for using 17 for d, and since e < (p-1)(q-1) then de < 17(p-1)(q-1), therefore k<17. It would therefore be fairly easy to find k, since it could only be one of sixteen possible values. Furthermore, (and more importantly), it is not necessary to know the prime factorization to generate key pairs. It is only necessary to know a valid number of the form k(p-1)(q-1). You can find an inverse key for any public key just by finding its multiplicative inverse modulo k(p-1)(q-1) (k, p, & q do not need to be known.) Therefore, if you find one keypair, you can find them all.

1 0

"Thomas A Douglas", do you mind?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Whoever it is on illuminati.io.com forging mail to cslaw with a return address of cypherpunks, kindly fuck off, and remember you're not the only person from io.com who reads this group. This sort of trivial forgery is easy to track down if anyone could be bothered. G > The original message was received at Fri, 17 Jun 1994 13:45:53 -0500 > from illuminati.io.com [198.4.60.10] > ----- The following addresses had delivery problems ----- > <cslaw(a)pericles.com> (transient failure) > Return-Path: cypherpunks(a)toad.com > Received: from (illuminati.io.com [198.4.60.10]) by wuarchive.wustl.edu (8.6.8.1/8.6.4) with SMTP id NAA20107 for <cslaw(a)pericles.com>; Fri, 17 Jun 1994 13:45:53 -0500 > Date: Fri, 17 Jun 1994 13:45:53 -0500 > From: cypherpunks(a)toad.com ^ Not funny. > Message-Id: <199406171845.NAA20107(a)wuarchive.wustl.edu> > Subject: Green card information, please. > Apparently-To: <cslaw(a)pericles.com> > I am interested in your services. Please send me more information. Thank you. > ----- > Thomas A. Douglas > "Just another bump on the Information Superhighway." Perhaps he forgot to remove his sig file, on the other hand there is no-one obviously called Douglas on illuminati.

2 1

totally secure email?
by khijol!erc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Howdy! I'm trying to totally secure email as soon as it comes into a site, before it hits me mailbox. I don't have root access, though. :( What I've tried is to do a "|pgp -feat ecarp|rmail erc%khijol(a)apple.com", but pgp just produces empty files! If I execute it by hand, it works. Anyone know either (1) why it isn't working wnd how to fix it, or (2) suggect a better alternative? For political reasons, my email must be encrypted as soon as it hits the site before it gets dropped in my mailbox, or the sysadmin will read it (snoopy bugger) and find out I'm looking for a job elsewhere. Thanks for all your help!! - -- Ed Carp, N7EKG/VE3 ecarp(a)netcom.com, Ed.Carp(a)linux.org "What's the sense of trying hard to find your dreams without someone to share it with, tell me, what does it mean?" -- Whitney Houston, "Run To You" -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLgMnySS9AwzY9LDxAQF81AP9FIZnm0r0BoIl85dQgbedwpoSIEjlhoUJ jTM/bXiNW07udBzmsS6Egb2HeuNOy4Hai+sw52rk4IhuBYVhi+z6OooQVLnsu5Qo arxcfaqGEfW7peg45FcyAO2MEuJURIsjk26bKsUR+RRHm7y2BqnKKq7NnqZjDWAe YNk8YOUQK/Y= =IyWZ -----END PGP SIGNATURE-----

1 0

Re: Another Cellular Victim
by Tommy the Tourist 17 Dec '03

17 Dec '03

> >They report that he was tracked via his cellphone use. What this country > >needs is a good anonymous cellphone net. > Really. And what's more: when the Colombian drug lord was located > via his cellular use, the story was that the NSA had to bring special > equipment into the country to do the tracking. That doesn't wash here. > It looks like at least some switches in Amerika are already equipped > to read out locations for individual phones. They probably don't even > have to wait for you to make a call - they can call you, or even use > the phone's automatic pings. No NSA equipment needed. A simple scanner and some software can be used to track which cell you are in. They didn't have to triangulate OJ's position or anything, they only needed to know which cell he was in, and the direction he was traveling. The rest is simple. (you can find such software on hack/phreak BBSes already. The only personal information needed is the telephone # of the cell phone) ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 7 lines: :: Response-Key: ideaclipper ====Encrypted-Sender-Begin==== MI@```$YS^P;+]AB?X9TW6\8WR:.P&2'N\0Q?\$?[X!7/,SN6`JBJ$D//!Z"Z FS)`S)G0<=-J!/44-Q$^WK"37[MUZNKYYE)[BS7ZNSJSP<LH*RSD` ====Encrypted-Sender-End====

1 0

Re: DSS
by nobody＠rebma.rebma.mn.org 17 Dec '03

17 Dec '03

Dan Harmon wrote: >What do they know that we do not? Makes you wonder about all of PKP's >claims. Has PKP ever sued anyone over their patents or have they just >threatened? Very curious. They have just threatened.

1 0

Re: O(f(x))
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> The way *I* learned it was like this: g(x) = o(f(x)) means that > g(x)/f(x) -> 0 (as x goes to some specified limit) g(x) = O(f(x)) > means that |g(x)/f(x)| is bounded (as x goes to some limit) > > In other words: a function that is o(f(x)) is of lower order than > f(x), while a function that is O(f(x)) is of no higher order than > f(x). Well, close anyway. Okay, here's straight out of my Discrete math textbook: "A useful way to check whether f [is a member of] O(g), is to look at the limit: Lim(as n->infinity) (f(n)/g(n)) In other words, we look at the _asymptotic_ behavior of f and g. If this limit exists (in practice it usually does) and is a finite number (possibly 0), we can conclude taht f [is a member of] O(g). If this limit is infinity, then f [is not a member of] O9g). For example, 7n**3 + 100n -3 [is a member of] O(n**3), because the limit of the ratio of these functions, as n->infinity, is the finite number 7. In fact, if the limit is a _nonzero_ number, as in this case, then O(f)=O(g). Okay, end of the quote. What all this stuff is used for is just comparing the running time of different algorithms. If you've got an algorithm whose running time varies with size of input n, according to the function 7n**3 + 100n -3, then this is _basically_ the same as if it varied according to n**3. Now, according to the definition of "big -oh notation ", which is what this is called, we could also say that function was an element of O(n**4), or O(n**20), or even O(3**n). So what big-oh notation really means is that function f is basically the same as, or better then, function g. But in practice we pick the "quickest" simple function g. So we call the functions (5n**4 + 4) (32n**4 +43n) and (n**4 +n**3 +n**2) elements of O(n**4). Which means that algorithms whose running times were described by those functions are all about the same speed, and are all about the same speed as n**4 too. Furthermore, any function which is O(n**k) for any k, is called _polynomial_. A polynomial algorithm is slow. Better is one which is an element of O(n log(n)), or even O(n), which is called _linear_. There ends the lesson. :)

1 0

(NONE)
by bmorris＠netcom.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com CC> Alas, the full quote runs "Under the rule of men entirely great, the CC> pen is mightier than the sword". Pen wielders tend to omit that awkwa CC> preface. Perhaps a better ( and more optimistic ) way to put it would be "All the armies on earth can not stop an idea whose time has come". * RM 1.4 B0037 *

1 0