December 2003 - cypherpunks-legacy

Xerox glyphs
by John Young 17 Dec '03

17 Dec '03

Pointer: Xerox glyphs encoding process. Publication: The New York Times, July 10, 1994; Section 3; Business; p. 9. Title: Smart Paper Documents for the Electronic Age. Subhead: A new coding method hides computer data in plain view, By: John Holusha. A quote from an illustration: A Xerox technology, known as glyphs, would enable paper business documents to carry thousands of characters of information hidden in unobtrusive gray patterns that can appear as backgrounds or shading patterns. Glyphs could be used for encoding machine-readable data onto paper documents.

2 1

RE: Mass forwards vs. pointers
by Blanc Weber 17 Dec '03

17 Dec '03

From: Philippe Nave Does anyone have a FAQ (or a brainstorm) on how to route Microsoft Mail messages to appropriate folders based on message content? ............................................... 1. You can use the Message Finder feature in MS Mail to collect all of the messages, say To: "cypherpunks" and then move all of these to a folder. You can also select all the email sent directly to your name or to a specific alias, read these, and continue searching the inbox this way for messages groups. 2. There's a software program from Beyond Incorported called WinRules 1.0, which will filter incoming messages according to who the message is From, To, CC, words in content, attachments, etc. and route them to folders, optionally popping up a message or a sound as a folder receives email throughout the day. It also has some other neat features which you can set to deal with email traffic. Blanc

1 0

Re: Request: tamper-proofing executables
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Tamperproofing things that aren't hardware is difficult. If your code is sufficiently non-obfuscated to be worth tampering with, Bad Guys can tamper with the tamper-checking code just as easily as they can with the useful-stuff code. One way around this is to leave digital-signature-checking to exterior programs, e.g. include a PGP signature (probably in a separate file to avoid mushing it into your binaries) and let them check the signature from their own copy of PGP. (Or for cheapness without patent problems, distribute a RIPEM-sig instead.) Some people have suggested code that does things like encrypt some critical parts of the code and decode them on the fly at runtime, using a key that's generated by checksumming the file and XORing with the last 8 bytes or some variant. Sufficiently persistent Bad Guys can respond to this by grabbing the code from memory as they run it, and you can play games with them about decoding stuff a piece at a time, etc. (All of this is of coure easier in LISP or interpreted languages.....) How much work you want to put into this depends on how much effort you think the Bad Guys are willing to spend cracking your code. I've heard people talk about doing totally encrypted computation, but I'm not sure whether anything practical hs been implemented. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

4 3

Re: Request: tamper-proofing executables
by Ian Farquhar 17 Dec '03

17 Dec '03

>This is as useful as writing your own PCode interpreter and encrypting the >PCode as it runs. Whoop de doo. :-) Somewhat easier, though. And utilizing single-step defeats a lot of debuggers too, who don't expect programs to use it. The tool of choice for killing such systems is an ICE, although most hackers do not have access to these. >Capture it in memory, save the memory >image to the disk, write some code to reload it, and restart it again. Exactly the point I made in the original article: the code to do the decryption is vulnerable. >There's no way to do this securely without hardware. Ditto in my original article. >The best thing to do is to build a custom CPU with custom RAM and seal it in >some epoxy with self destructive materials in it. This is excruciatingly >cumbersome, and you have to deal with the problem of heat dissipation. (Since >the CPU is a custom made one, you can't simulate it or break it. Since you >have no access to RAM, you can get RAM images, etc.) And it's not particularly secure, either. There are well-known techniques for defeating such approaches. These are discussed in the CMU paper I referred to. Ian.

1 0

Framed by another state for a non-crime
by hkhenson＠cup.portal.com 17 Dec '03

17 Dec '03

If anyone has a good contact with the ACLU, this is a time to use it! Date: Sun, 10 Jul 94 16:49:03 PD Lines: 83 DRAFT MOTION (Note this is not a motion, but an early draft by a non-lawyer -- -me- about one aspect of the AA BBS case. I have been very concerned with what I have found about the performance of the courts. It has turned out to be a lot worse than I thought. Keith Henson) On July 8, 1994 Judge Julia Smith-Gibbons, United States District Court for the Western District of Tennessee in Memphis TN, verbally ruled that defendant's motion to dismiss (improper venue based on the North American Free Trade Agreement and others) was denied. Her words were that her order denying the motion was "in the typewriter." Defendants and defendant's attorney expect (on the basis of her previous judicial conduct) to be handed the written order at the time of trial, precluding any interlocutory appellate remedies. Defendants Robert and Carleen Thomas are therefore forced to appeal Judge Gibbon's ruling without an order reduced to writing and signed by the court. However, her verbal ruling is "final" with respect to this issue. If this interlocutory appeal were delayed until after trial the Thomases' would be irreparably harmed, even if acquitted. Not only would they lose the cost of trial, which could not be recovered civilly, but they would have to shutdown their business as it requires part time physical presence. (Trial in this area would not be as onerous in that the business could continue to be operated with a few hours attention each night.) These motions are being filed in both the Sixth and Ninth Cir- cuits because the underlying case involves an *assault* on the authority of the Circuit Courts, and therefore upon the entire court system. When the Courts lose their capacity to function normally it is termed insurrection. The case at hand may be close to this state. As is made clear by attached documents, a *district* court in the Sixth Circuit is attempting to enforce authority over persons and property in the Ninth Circuit on the basis of a manufactured "crime". The gross inequity performed by law enforcement agents in manufacturing the child pornography charge could be proved at trial, but the *law* on which the "crime" is based (Title 18, Section 2252 of the Federal Code) has been ruled "unconstitutio- nal on its face" in the Ninth Circuit (US vs X-citement Video, Inc., 982 Federal Reporter Second Edition, page 1285, Dec. 16, 1992). At the time of the search of the Thomas's home and business, (January 10, 1994) this statute *could not* be used to prosecute *any* person in the Ninth Circuit because it is an unconstitutional law, and unenforceable. (Judge Gibbons was notified on June 22, 1994 of these facts.) On January 26, 1994 a Federal Grand Jury in Memphis Tennessee returned an indictment against Robert Thomas citing section 2252, a section which *could not be applied* by any Ninth Circuit District Court to a citizen in that circuit or any other Circuit. (There were other sections cited including section 2256 calling for forfeiture of tens of thousands of dollars of computer hardware to the Tennessee authorities, and possibly the sysops home, car, etc.) The effect--if a district court in one section of the country is allowed to charge citizens on laws ruled unconstitutional in the Circuit where they live--is to completely undermine the authority of all the Circuit courts in the country. This case is about liberty and property, but taken to the extreme, a person could be removed from his home by a District Court operating in another part of the country and executed. This appeal is about nothing less than the authority of *any* Federal court to protect the life, liberty and property of any citizen of the United States. If this appeal is not granted, it will show that the District courts can ignore another Circuit's laws and do anything they want with a citizen's life, liberty and property. It will show that the Circuit courts do not have the authority to protect life, liberty, or property for the people within their circuit, and ultimately will undermine the courts ability to protect any inhabitant of the United States. (Net.folks--please comment!)

1 0

Bug in PGP2.6 when editing your key
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- We have found an important bug in PGP 2.6 (and 2.5). Problem: If you store your pass phrase in the PGPPASS environment variable or supply it via the PGPPASSFD hack and you edit your key (pgp -ke) you may lose. Specifically if you edit your key and do *not* change your pass phrase, then it gets clobbered and you lose access to your private key. What to do if this happens to you: You will know that this has happened because you will edit your key and then not be able to use your private key. *IMMEDIATELY* restore your secring.pgp and pubring.pgp from the ".bak" versions that PGP automatically creates. This will put things back the way they were. Work Around: You can avoid this problem when editing your key by doing one of the two things below. 1) Remove the PGPPASS environment variable (or don't use PGPPASSFD) when editing your key. You will then have to manually type in your pass phrase when editing your key, but the pass phrase will not get clobbered this way. 2) If you still use the PGPPASS environment variable, then when the key editing process asks you if you wish to change your pass phrase answer "y" (i.e., tell it that you wish to change your pass phrase) it will then prompt you twice for your new pass phrase. Note: You can set it to what it was, effectively not really changing it. PGP will not know the difference and your pass phrase will not get clobbered. Status: This problem has a known fix and it will be included in the next release. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAgUBLiCWkVUFZvpNDE7hAQF/GQIAoWi86mx1TylR5CUWInJrYy/L5kNB0qqB Uo/gA+u4M7YYeFEVF+voeBBRW686j2ksWaMA3ERTN8o6HWc5hrcf+A== =fXWk -----END PGP SIGNATURE-----

1 0

using RSA-the-cryptosystem to secure RSA-the-company's patent?
by Jef Poskanzer 17 Dec '03

17 Dec '03

Apropos the recent thread on tamper-proof programs... Can anyone think of a way that RSA-the-company could include some sort of RSA-cryptosystem-secured check in a release of PGP so that it would only interoperate with other versions that have the same check? I don't see how it could be done, but it's sure an intriguing idea. --- Jef

2 1

Re: using RSA-the-cryptosystem to secure RSA-the-company's patent?
by Jef Poskanzer 17 Dec '03

17 Dec '03

>The point of this is, why would *you* care? I can understand why RSA >_might_ care, but I don't see Phil Zimmermann agreeing to it, and I >don't see how anyone could force it into PGP at this point. They got the stupid version number thing in; if they had thought of a better trap, they could probably have gotten that in instead. The point is, the secret key would not be in the source code. I can't think of a way to use that; you can't; RSA couldn't; but I'm not convinced it's impossible. --- Jef

2 1

LD's Cypherwonks list
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Peterwheat(a)aol.com: > found this by doing a keyword search (cryptography) in America Online's > database of mailing lists. I thought it might be of interest to the > cypherpunks mailing list: > > CYPHERWONKS: The Development of Cyberspace I subscribed to this when LD first announced it early last December. I never received any mail. At that time I do believe Julf had said something supporting this list. Incidentally the address for LD in your database on AOL is ancient. And the description message seems watered down. The original post was full of LD's paranoid gems -- here's an excerpt for your entertainment: > anonymity. However, we do not necessarily believe that others are > required to read anonymous postings. To the contrary, we believe that > the individual should have the tools and freedom to filter his or her > own mail based on real identities. In particular, we condemn the > practice of `pseudospoofing,' the dangerous deception where a person > builds up a pseudonym and misrepresents it as being that of a real > person's identity. We police each other on the list to prevent it, and > require a promise that our members refrain from it. While our trust can > be betrayed, only those that are honest are true cypherwonks, and > anyone who betrays our trust we consider a dishonist hypocrite, or worse, > a *traitor* Note the Detweilerese: pseudospoofing, honest and true, hypocrite, *traitor*. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

PGP for Russia...
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

"Robert M. Humphrey" <Robert(a)rmh.khabarovsk.su>: > Anyone with any ideas how I can get going on PGP or something else under > the circumstances would be more than welcome. Do you have telnet/ftp access? I believe the .su domain does have full Internet connectivity... If you do, you should pick up PGP version 2.6ui from ftp.dsi.unimi.it /pub/security/crypt/PGP/pgp26uix.zip Even if you're a US citizen you can't export PGP from the US under US law, so don't try it from CompuServe. If you don't have net access, the only way is to have someone split PGP into dozens of UUENCODED parts and mail it to you. If no one else volunteers to do this from outside the US, ask me. (Yes, I am lazy, and maybe someone's already got a split UUENCODED PGP ;-) Rishab ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0