December 2003 - cypherpunks-legacy

Re: Nom de guerre public key
by bogus＠no.return.address 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Louis Cypher >> A signature on your PGP public key is a personal guarantee from the >> person who signed it that she has first-hand knowledge that the key's >> userid accurately names the person who physically possesses the key >> (i.e., the signature validates the binding between userid and person). >> But you do not have a binding between your userid and your person, >> because your userid is a pseudonym, and a pseudonym is a name not >> bound to a person. > >Actually, this is not true. A signature on a key is a personal >guarantee from the signer that binds the user-id to the _KEY_, not >necessarily a person. The problem is validating that key<->userID >binding in a pseuodnymous case. For example, in the case of a real >person, you can send me a message to "warlord(a)MIT.EDU" and later meet >me in person, and I can verify that I received the message by >responding in some appropriate manner. > >But you cannot perform this check for a pseudonymous identity, because >there is no secure way to prove that that key really belongs to some >identity. > >Just for an example, I am fairly certian that there is a single >identity behind Pr0duct Cypher (speaking of PC -- I heard from you in >a while), but it is difficult to securely obtain assurance of the >binding behind the key and the keyid. > With a pseudonym, all a signature really says is that this is the key that always goes with the posts signed by this nym. Assuming there has not been more than one key claiming to be the "real" nym, then after a while there can be no doubt that the key and nym go together (which is all that was to be proved). Personally, I sign nyms that have existed consistently for some time. I have never distributed any of these signed keys, but see no harm in doing so as long as the key's user-id field clearly indicates that the key is a nym and not a person. A sig on a key by a notable like Tim May would help keep new users from getting taken in my some interloper claiming to be Pr0duct Cypher. >> Unless you reveal your pseudonym to someone and identify yourself >> according to the rules of the PGP Web of Trust, you should not be able >> to get signatures on your PGP public key. > >Well, this isn't the case. It is possible to set up a server that >compares userID to mailID in some secure manner. For example, there >were some way to get a secure mail from a user to a server, and the >server could verify the mail address, and then validate the mail >address to pgp keyID. > >-derek If I am trying to maintain a truly anonymous pseudonym, I am hardly likely to allow to connect my key with an email address. All a sig on a pseudonym's key means, is that is the key which signs posts from that nym, not such a hard thing to demonstrate with enough empirical evidence. -Louis Cypher P.S. I can be reached privately by leaving a message in alt.anonymous.messages with my name in the subject line. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLo9uWKyHUAO76TvRAQFVpwP+PJ9Ratos4OirW5VvO+r8ZdYig4e4JsR1 T2UGzFsyCLJnG+IyPc3d2xh3ipyM4Ifaw9pcp4xNJuimzaWyU+MfAzCr4IF6CLB2 R8+s/HW8kH5uiXdV+NCv95OL7zBI4p9GiWBiphsfcEkKkhI1CiHXhcoDR6CIIfdO MVe2HEASEng= =Dfb5 -----END PGP SIGNATURE-----

1 0

Manufacturing quantum computers
by Sherry Mayo 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi all, Regarding the quantum cryptography thread: Some people expressed the view that although the idea may be workable, the manufacturing technology was a long way of being able to produce quantum computers. The quantum dot design proposed by Eckert et al for a quantum "factorisation engine" requires 100000 quantum dots (to factorise RSA-129 or similar) which are each about 10nm across to be fairly densly packed onto a chip. I'm not so sure about this being 'a long way off' in terms of materials technology, and I found the following article on WWW which describes some relevant research into this kind of manufacturing at a US army research centre. I found this on the FedWorld (US Govt, http://www.fedworld.gov/ ) pages.... ============================================================ Part of the "unique ARL (Army Research Lab) facilities" page http://info.arl.army.mil/UAFD/uafd.html ============================================================ Ultralithography Center. This facility provides the Army and DoD with a capability that significantly impacts the development of novel ultra-submicron electronic device technology required by next-generation and future military systems. A multi-million-dollar Leica (Philips) EBPG-5HR electron-beam lithography system, which represents the state of the art in ultra-high-resolution device patterning, is housed in a newly constructed clean room. The Leica EBPG-5HR accomplishes lithography by scanning a finely focused beam of high-energy electrons over an electron-sensitive polymer coating applied to the substrate surface. With an electron beam spot size approaching 10 nm, the Leica EBPG-5HR provides an effective solution to the most demanding lithographic applications, including ultra-small (250 angstrom [= 25nm]) electronic and photonic devices. These devices will provide an enabling foundation for next-generation Army electronic and optoelectronic systems. Devices such as sub-100-nm gate length millimeter-wave high-electron- mobility transistors (HEMTs), novel quantum-effect and mesoscopic (phase-preserving) devices, and quantum-well infrared photo-detectors are patterned with this system. The instrument's high acceleration voltage (100kV) provides a unique capability to pattern closely spaced nanometer-scale device features without feature or sample- related distortion. Automated calibration permits the writing of undistorted patterns over the large sample areas required to fabricate many photonic devices and optoelectronic circuits. ======================================================= Well there you go. Perhaps the technology is nearer than we think. Of course this still doesn't answer the noise problem that critics of the proposed technique think will render it all but useless. However I wanted to make the point that we shouldn't be complacent about the materials technology side of things. Tim May makes the point that he is not selling his shares in intel, and that conventional chip technology is not about to be supplanted. The problem with this IMHO is that these are not two completely different technologies we are talking about. The constantly improving techniques being used to cram more and more onto conventional chips are directly applicable to the manufacture of these proposed quantum dot devices. Just my 2 cents Sherry Sheridan C. Mayo | WWW pages include caving, sci fi and RSC, ANU, Australia | crypto pages. NEW: X-files has its own scmayo(a)rschp2.anu.edu.au | page with gifs/sounds/fanfic etc. Finger for PGP key | http://rschp2.anu.edu.au:8080/local.html -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLo+G9uFu4n6w1qeBAQGVMgP+Kechf44WUe11qnQG5cD3Ybf+NuNc9jjr ajI7ZXYmZgQb1xdhS7ruy+UOo39zBCPxgKOaCahAniKV9vlNOmHB2pqAr8aYoMWt olhDdZdEWSGrLPAvfh4gVa/T8GI9C2NPc7kusIZujlVHnemBbSSz6FW+dJedR/FE oRKvzzW0IHs= =Ub7K -----END PGP SIGNATURE-----

2 1

The Decline of Liberty
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

My favorite old curmudgeon, Jeff Cooper, has some interesting things to say in the 27 Sep issue of "Cooper's Commentaries," (cf. rec.guns). "The subjection to which the American citizen is now exposed every day of his life is so great that the whole idea of liberty ("That which does not injure one's neighbor") is almost totally lost. The greatest of despots, Louis XIV, never told his subjects what they could or could not eat and drink, and he never told them how to conduct their private lives." I won't even try to add more to what he has said. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay

1 0

Export controls apply to physical objects, too
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Yesterday's _Huntsville Times_ had an interesting story about a local company's problems with the ITARs. The company, Signature Technologies, makes an EM-absorbent paint called Signaflux, the main application for which is decreasing the radar cross-section of various flying objects. Although so far the primary customers for Signaflux have been from the US DoD, there have been sales to "friendly" foreign governments, notably the Israelis. ST has been trying to diversify; in that vein, they've been selling Signaflux for industrial and commercial applications, like EM shielding in test cells and reducing airport buildings' radar signatures. The dispute in this case comes from a contract to sell Deutsche Aerospace SA about $500,000 worth of Signaflux for the Cyclops cruise missile. ST applied to Commerce for an export license under the dual-use provision. After a CJ determination, State yanked their export license. The story didn't say who requested the CJ determination. I can't imagine that ST would have asked for one, since they had a license already. In closing, the CEO was quoted as saying (paraphrased) "These rules are stupid; I could sell the Germans a fleet of F-16s with dashboards full of avionics, but I can't sell them paint." - -Paul - -- Paul Robichaux, KD4JZG | Demand that your elected reps support the perobich(a)ingr.com | Constitution, the whole Constitution, and Not speaking for Intergraph. | nothing but the Constitution. ### http://www.intergraph.com ### -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLpAGjafb4pLe9tolAQF8eAP+K2I9qwXHfZQg8jTVXl3XE5Ymi1ukBhUB t+6DNG9N/Z6VVXdz60WYNW5rpYfHIsb/DjwVYhi8dgScKoesdHpzAgysKQ403ENG IIZH3egeuDBQy0kwl0oL7bLsJTzPnh+jKBH3PEHspmbsjZ4rREfW1KN1EoVN5++5 ofWCod/NQeo= =CnMq -----END PGP SIGNATURE-----

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I have written and installed a remailer pinging script which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html Please let me know about any other remailers which I missed. I've only included remailers which can mail to arbitrary addresses, so I already know chop and twwells are missing. This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: fftp://soda.berkeley.edu/pub/cypherpunks/premail/premail-0.22.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"chaos"} = "<remailer(a)chaos.bsu.edu> cpunk hash ksub"; $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk oldpgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk oldpgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post"; $remailer{"wien"} = "<remailer(a)ds1.wu-wien.ac.at> cpunk pgp hash nsub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric pgp. post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"leri"} = "<remail(a)leri.edu> cpunk pgp hash"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"underdog"} = "<lmccarth(a)ducie.cs.umass.edu> cpunk pgp hash latent cut post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"efrias"} = "<efrias(a)csugrad.cs.vt.edu> cpunk pgp hash"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 3 Oct 94 6:00:02 PDT remailer email address history latency uptime ----------------------------------------------------------------------- c2 remail(a)c2.org *+-********* 13:09 99.99% wien remailer(a)ds1.wu-wien.ac.at ***#+**--#** 19:02 99.99% chaos remailer(a)chaos.bsu.edu **####**+##* 2:56 99.99% leri remail(a)leri.edu ***#**#***** 6:38 99.99% portal hfinney(a)shell.portal.com *##*#+***#** 4:01 99.99% ideath remailer(a)ideath.goldenbear.com *****-*+- ** 1:40:23 99.99% underdog lmccarth(a)ducie.cs.umass.edu ***+******** 4:41 99.98% penet anon(a)anon.penet.fi *****+-+**** 47:05 99.96% jpunix remailer(a)jpunix.com *-*#**-**-** 11:04 99.96% vox remail(a)vox.xs4all.nl .-......-- 12:10:26 99.94% bsu-cs nowhere(a)bsu-cs.bsu.edu **# #****#-* 13:42 99.76% efrias efrias(a)csugrad.cs.vt.edu *#***** 4:30 99.79% rebma remailer(a)rebma.mn.org -+---*--.-*- 10:13:40 99.58% extropia remail(a)extropia.wimsey.com ++ +-++++*+ 40:30 99.40% soda remailer(a)csua.berkeley.edu -......_.. 9:25:30 99.31% nately remailer(a)nately.ucsd.edu -++++- ++++* 33:37 99.15% usura usura(a)xs4all.nl +***..-** ** 1:16:06 98.42% desert remail(a)desert.xs4all.nl .---...---- 24:19:31 84.16% alumni hal(a)alumni.caltech.edu *****+** 6:06 79.87% Suggested path: chaos;wien;c2 For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). If you've got a Web page, please feel free to include a link to this page. If you think your Web page is relevant to the subject of remailers, let me know and I'll link it in. Comments and suggestions welcome! Note to remailer operators: this script generates hourly ping messages. If you don't want that, let me know and I will take your mailer off the list, or increase the interval between pings. Raph Levien

3 2

New Remailer feature
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Raph, I just saw your bi-monthly posting about the remailers. I'd like to point out that jpunix supports a feature not mentioned in your message/finger mechanism. Jpunix.com also supports the ability to have messages encrypted to the recipient by the remailer itself. This will protect cleartext messages sent back to the sender via reply blocks. By adding Encrypt-Key: yourkey to the header list for jpunix.com, jpunix will encrypt anything following a ** on a line by itself with that key. John Perry - perry(a)jpunix.com - -- PGP 2.61 key for perry(a)jpunix.com is on the keyservers. PGP-encrypted e-mail welcome! -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLpATZlOTpEThrthvAQHMmQP/SLFOCbArzMbJ26lSJZz0mUXQfABstXf2 Um5TqDgiOuDnAWE3DvZkDIQcMtALJ9wI/Lj+ji4gCF0Ytk7hShizyl+zcj0huKQT npvbFC//9Yv0RJZsm1f47R4ttksqBmO+kEep4LUsWoRlqBBMwFyVkAPaFX/nclPw zdcGEpIv7JU= =+o2l -----END PGP SIGNATURE-----

1 0

Anarchy-X Notification
by John Young 17 Dec '03

17 Dec '03

Got about a dozen of these in the last couple of days. Should I fear or embrace Organization: Anarchy-X? Sounds good but TLA maybe? John Forwarding mail by: "ROOT"@ax.com () on Mon, 03 Oct 1:1 AM ------------------- >From ROOT(a)ax.com Mon Oct 3 04:45 EDT 1994 Received: from netcomsv.netcom.com (uucp4.netcom.com [163.179.3.4]) by pipeline.com (8.6.9/8.6.9) with ESMTP id EAA02169 for <jya(a)PIPELINE.COM>; Mon, 3 Oct 1994 04:45:26 -0400 Received: from ax.com by netcomsv.netcom.com with UUCP (8.6.4/SMI-4.1) id BAA22993; Mon, 3 Oct 1994 01:37:39 -0700 Received: by ax.com (UUPU-1.42) id D1115pj Mon Oct 03, 1994 01:01:37 EDT From: "ROOT"@ax.com Message-Id: <9410030101.D1115pj(a)ax.com> X-Mailer: UUPlus Mail 1.42 To: jya(a)pipeline.com Subject: Non-Delivery Notification Organization: Anarchy-X Date: Mon, 03 Oct 94 01:01:36 EST Content-Type: text Content-Length: 377 NON-DELIVERY NOTICE ------------------- The message you sent on: Unknown to "ROOT" was undeliverable. ========================= !!! Automated Notice !!! ======================= E-mail replies to this user should have the following on the first line of message text: TO: "ROOT" ================================================================= =========

1 0

SHA patch
by Michael Shiplett 17 Dec '03

17 Dec '03

Hello there, After some work with the SHS (or is the implementation actually the SHA?) code listed in _Applied Cryptography_, I have patched it to allow updates of buffer sizes that are not a multiple of SHS_BLOCKSIZE. The patched version works for the different groupings of the test data "abc", e.g., update(abc) update(a) + update(bc) update(ab) + update(c) Since the "abc" case tests only the logic of shsUpdate() [all the transformation invocations are actually performed by shsFinal()], I ran the original code and the modified code on several files and (fortunately) received the same hash values for the two implementations. shsUpdate() follows. You may need to define a bcopy->memcpy macro. michael =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= void shsUpdate(SHS_INFO *shsInfo, BYTE *buffer, int count) { int offset, need; /* determine if there are left over bytes in the shs data. they are handled specially below */ offset = (int) ((shsInfo->countLo >> 3) & 0x3f); need = SHS_BLOCKSIZE - offset; /* update bitcount */ if ((shsInfo->countLo + ((LONG) count << 3)) < shsInfo->countLo) shsInfo->countHi++; /* carry from low to high bitCount */ shsInfo->countLo += ((LONG) count << 3); shsInfo->countHi += ((LONG) count >> 29); /* if there were indeed left over data bytes, see if the incoming data is sufficient to fill to SHS_BLOCKSIZE. if not, copy the incoming data and return; otherwise fill the block, perform a transformation, and continue as usual */ if (offset) { if (count < need) { bcopy(buffer, (BYTE *) shsInfo->data + offset, count); return; } else { bcopy(buffer, (BYTE *) shsInfo->data + offset, need); #ifdef LITTLE_ENDIAN byteReverse(shsInfo->data, SHS_BLOCKSIZE); #endif shsTransform(shsInfo); buffer += need; count -= need; } } /* process data in SHS_BLOCKSIZE chunks */ while (count >= SHS_BLOCKSIZE) { bcopy(buffer, shsInfo->data, SHS_BLOCKSIZE); #ifdef LITTLE_ENDIAN byteReverse(shsInfo->data, SHS_BLOCKSIZE); #endif shsTransform(shsInfo); buffer += SHS_BLOCKSIZE; count -= SHS_BLOCKSIZE; } /* store the left over data */ bcopy(buffer, shsInfo->data, count); }

1 0

Filing FOIA Requests
by ozymandias G desiderata 17 Dec '03

17 Dec '03

A large group of my friends and I are interested in finding out exactly what the cheeseballs over in Intelligence, Inc. have on file about us. Does anyone have handy the details necessary to file a Freedom of Information Act request for your own file? Do y'all have some hints so that we can expect the best possible yield? On the same note, do any of you have any humorous / chilling stories about what you found out when you got your file? Thanks in advance for the info, ozymandias G desiderata

2 1

DTI Pointers?
by ozymandias G desiderata 17 Dec '03

17 Dec '03

I'm taking public speaking so that I can finally get out of college and into the big wide world, and have decided to educate my class on the controversy surrounding the Digital Telephony Initiative. I need hardcopy to make my TA happy, and after an (admittedly quick) browsing of the archives, I wasn't able to find much in the way of hard information. Are there any good pointers, especially to the recent Lehman version of the bill and the controversy that now surrounds the EFF? Thanks in advance for your help, ozymandias G desiderata

1 0