December 2003 - cypherpunks-legacy

Using "nobody" to camouflage encryption/remailers/commerce
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

If we use "nobody" as an email address we can hide remailers or make it seem like there were remailers where there are not, etc. The convention on the Internet is for mail to "nobody" to go to "/dev/null". This is used as a return address when you don't want bounced mail. Now remailer operators are clearly more interested in privacy than in following conventions. Imagine remailers also had addresses like "nobody(a)vox.hacktic.nl", and "nobody(a)jpunix.com". Now if someone doing an internet wire-tap sees mail to "nobody(a)furmint.nectar.cs.cmu.edu" it is hard for him to tell if this means: a) It will just end up in /dev/null like it does on 99% of the machines b) furmint is another remailer c) someone on furmint gets mail as "nobody" d) furmint acts as a remailer for those with money e) furmint is being used for some email based business f) etc So now assume that there was a lot of encrypted mail going to "nobody(a)alex.sp.cs.cmu.edu". That might be because I am also doing something funny there, or it might be because someone is just sending a lot of encrypted mail to /dev/null. By the way, anyone is welcome to send encrypted mail to this address (via a remailer or not). Even if there is no email going out of that machine, it could just be that with my remailer I collect the mail some period into a file, encrypt the file, move it off to some other machine (using FTP, NFS, uucp, rcp, http, telnet, etc.), and mail it from there. Could be hard to tell. Remailers named "nobody" will be harder to stop. So it would be nice if sites with remailers would set the "nobody" alias to point to their remailer to start this convention. Assuming that the remailer will drop non-encrypted mail (or at least mail that does not have a good format) this should not cause any problems. On "furmint" I did the following: Changed the "nobody:/dev/null" in /usr/misc/.mmdf/table/aliases to "nobody:vac+pgp@furmint.nectar.cs.cmu.edu". Ran "dbmbuild" to rebuild the "mmdf" database. I don't know how different this will be on other Unixes. It may only take editing "/usr/lib/aliases" on other systems. So I did give away the puzzle in the second paragraph, if you send mail to "nobody(a)furmint.nectar.cs.cmu.edu" it is the same as sending mail to "vac+pgp(a)cs.cmu.edu". So far. :-) I doubt that "nobody" was getting a lot of mail, but if so I will modify my "pgp-receive" script to drop any mail not encrypted for it. If they ever outlaw sending mail to "nobody" there will be millions of people who are breaking the law. If some country outlaws encryption, people (or programs) in other countries could send encrypted mail to "nobody" at random machines in that country to act as a cover for the legitimate encrypted mail. -- Vince

2 1

Hardware RNG's
by John A. Thomas 17 Dec '03

17 Dec '03

Perry Metzger asks if the hardware random-number generator I described in a post just before the list crashed could be modified to use serial output. Sure. It was just easier to use the parallel port. I know the original IBM PC stupidly omitted bidirectional ports, but they are available now. Roger Bryner asks if there is any ready-made hardware RNG device. Yes. A few years ago, at least, AT&T was selling such a chip. The data book says: "The T7001 Random Number Generator (RNG) integrated circuit produces random bits based on the phase jitter of a free- running oscillator. The output data stream is truly random, not pseudo random. The T7001 RNG is processed in CMOS technology, requires a single 5 V supply, and is supplied in a 32-pin plastic DIP." The output is 536-bit numbers, available in 8-bit bytes. There are probably others available; I haven't looked lately. John A. Thomas b858jt(a)utarlvm1.uta.edu 75236.3536(a)compuserve.com PGP public key available.

2 1

!A Question of Copyright
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

For the PC Expo disk distribution I would like to use some of the articles that have been "liberated" on here. These include NYT and LAT articles as well as several other magazines and papers. I have been told by a professor that as long as I label the diskettes as "For Educational Purposes" I can distribute these articles. Should I do so? I'd rather not get sued on this, so if there be a lawyer here, please advise... (For those just tuning in, I and several other cypherpunks will be giving out free disks at PC Expo with PGP, other crypto software, and crypto articles as a mini anti-clipper/digital telephony campaign...

2 1

Looking for Applied Cryptography Errata sheet
by bshantz＠spry.com 17 Dec '03

17 Dec '03

Hi, I grabbed a copy of the Errata sheet (1.5.9 I think) off of a newsgroup, or maybe it was posted to the list. Anyway, I lost the thing!!! If anyone (including the original poster...who I believe was Bruce Schneier himself) could send it to me, I would be extremely happy. Or if you feel so inclined, post it, so I don't get bombarded with several thousand copies of the errata sheet. Thanx, Brad :::::::::::::::::<<< NETWORKING THE DESKTOP >>>::::::::::::::::: Brad Shantz Internet : bshantz(a)spry.com SPRY Inc Ph# (206) 447-0300 316 Occidental Avenue S. 2nd Floor FAX (206) 447-9008 Seattle, WA 98104 ---------------------------------------------------------------- "In gopherspace no one can hear you scream." ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

1 0

Re: Thoughts on the NSA's correction to SHA
by Hal 17 Dec '03

17 Dec '03

Bruce Schneier may be correct about NSA's views, but I think the NSA gives itself too much credit. There was another very significant event in the 1970's which IMO played at least as much of a role in the increased interest in cryptography as the DES. This is, of course, the invention of public-key cryptography. I know that my own interest in crypto can largely be traced to the Scientific American column by Martin Gardner in which he introduced the RSA system (along with the famous RSA-129 number which was just factored). PK crypto combines simplicity with surprise to produce results which attracted a lot of attention and interest. In comparison, the development of DES was of relatively little interest outside of the few specialists in the field. I would suggest that PK crypto did more to attract attention to cryptography and to lure people to the field than did DES. If you look at the papers in the crypto conference proceedings you will see a number on cryptanalysis of DES and on DES-like systems, especially in the early days; but there are generally at least as many on PK and related ideas such as zero-knowledge. Much of what we think of as "modern cryptography" owes itself more to the kinds of information manipulation provided by PK than to the DES, which is often relegated to the role of a "black box" in a crypto protocol, interchangeable with IDEA or any other conventional cypher. It's more defensible to argue that strictly from the NSA's goal of reading other people's mail, DES was harmful by revealing a general approach for constructing strong conventional cyphers. But as far as stimulating the field of cryptography in general, I think PK has played a more important role. Hal Finney hfinney(a)shell.portal.com

2 1

looking for an ftp site
by nate＠VIS.ColoState.EDU 17 Dec '03

17 Dec '03

I am looking for an ftp site to hold 16K of gzipped tarred file. It's my WWW interface to teh remailer network, and I cannot put it up for ftp at my university (The Powers That Be and all that). Please send email. -nate -- +-----------------------------------------------------------------------+ | Nate Sammons <nate(a)VIS.ColoState.Edu> <nate(a)yuma.ANCS.ColoState.Edu> | | Colorado State University Computer Visualization Laboratory | | Data Visualization/Interrogation, Modeling, Animation, Rendering | +-----------------------------------------------------------------------+

1 0

test ignore
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

just a test for my .mailrc file please ignore.

1 0

FW: Crypto export legislation defeated in House Intelligence Cmte.
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

> So much for lobbying. > > Look, something is going on here that doesn't meet the eye. Nothing is > ever unanimous in Washington. These guys were told something by somebody > that caused them to vote like this. You can bet it had nothing to do with > terrorists, drug pushers, or pedophiles. Why don't you expend > some effort to find out what they were told and by whom so we could learn > what this issue is really about because it is NOT about "national security". > Think about it... If you've had the ability to listen to any voice or e-mail traffic you felt like with a simple telco set or inexpensive computer any time, anywhere you felt like, wouldn't you put up a fight? It's like trying to take a gun from a NRA member. Once you have a freedom to do something you aren't going to give up easy. It's only going to be more difficult since NSA, and other three letter orgs are part of the government. Our metro-police, FBI, CIA, XXX, have been able to tap phone and e-mail (illegally or with court permission, or in the name of "national security") as easy as plugging in a toaster. Once citizens start using crypto systems, these three letter orgs are going to have to work for a living. OK, so a crook is using crypto in his communications. Most are so stupid, getting the keys won't be that hard and even better... the crook will still think his comm link is secure. I'll stop here with my arguments for dropping the barriers to crypto. For NSA, finding the right string to pull is probably real easy. The only thing we can do is continue to apply pressure at all fronts. Educating the general public is on one front. EFF has other fronts. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

1 0

No Subject
by Sandy Sandfort 17 Dec '03

17 Dec '03

who cypherpunks

1 0

?
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From owner-cypherpunks(a)toad.com Thu Jun 23 13:26:22 1994 > Date: Thu, 23 Jun 1994 10:14:25 -0700 (PDT) > From: Sandy Sandfort <sandfort(a)crl.com> > To: Cypherpunks <cypherpunks(a)toad.com> > Mime-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Sender: owner-cypherpunks(a)toad.com > Content-Length: 18 > > who cypherpunks > Well, it's a long story...

1 0