December 2003 - cypherpunks-legacy

Re: public accounts / PGP / passphrases
by Rich Salz 17 Dec '03

17 Dec '03

> >Could someone please elaborate on the foolishness of using PGP with a > >passphrase on a public machine (as I do) ? Am I wrong in thinking that my > >secret key is useless to an intruder until she guesses my passphrase ? The sys admin can change the kernel running on your machine. A special kernel can be built so that when a particular user is typing on a tty and the executing process is named "pgp" then all keystrokes they type are recorded into a file for the administrator to read later on. The local machine must be part of the trusted computing base. /r$

1 0

PGP Sig Proposal
by VAMAGUS＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have never posted to this list before because I am rather new to it. What bothers me is that as a Hardware Technician it is the Cypherpunks that inspired me to flagellate myself at my keyboard while invoking the deity of Borland in ANSI 'C' to compile my source code. Ok, so it never works but the idea of the Cypherpunks has made me a (limited) programmer none the less. *Not* signing messages because you are asked to flies in the face of the purpose it serves. To spread the word about PGP and, as it has done, uncover any difficulties that may still exist in the propagation and utilitization of PGP. In actuality the amount of mail that suggests the difficulty in performing PGP signing should be a call to all Cypherpunks to start coding. Instead, like a child that has been asked to play with a favorite toy, there is refusal based soley on....I won't do it because you asked me to do it. Forging signatures is a waste of resources that could be better spent finding ways to smooth the path for PGP and similar encrypting/signing implementations. If I want to be anonymous I will use CHAIN and go thru a remailer. My .sig and PGP sig say the rest. ***************************Frenchie Sends*************************** * Key ID: BEB3ED71 J.Francois PGP Key on Request* * As soon as any man says of the affairs of the state * * "What does it matter to me?" the state may be given up for lost. * * J.J.Rousseau - The Social Contract * ****************Want to know more about PGP? Ask me!**************** -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt6IjrbmxeO+s+1xAQEo8AP/e1L7c/GGHqoRMQ0OyoA0nVyMvbVo3CdP UmAqFhR4V0D4nXnK0PFZqKrkBzJDxpvCb5mJSS4F6KAnMl6Oa5aq055g/9GHEPZb RvDEiraxcJ8y6vwOfrhxyOrDxX/2/g3sHds9lekBDc71Z72FS6Ix3A1KJjI+o2hP HSx6rt+qHc8= =UOH6 -----END PGP SIGNATURE-----

1 0

RE: Re: ERIK HUGHES: EGOTISTICAL PRICK
by shawn leas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- shawn leas writes: > > In article <199412020536.VAA08584(a)jobe.shell.portal.com>, > > <anonymous-remailer(a)shell.portal.com> wrote: > > >this is BS!!!! let's find a NEW LIST. a list is a COMMUNITY > > >PROPERTY. anyone who pulls this kind of prickery, insinuating > > >they are in the "bully pulpit", deserves > > >CYPERSPATIAL EXCOMMUNICATION for HIGH TREASON TO THE CYPHERPUNK > > >CAUSE of TOTAL AUTONOMY FOR THE INDIVIDUAL. > > I list is not 'community' property. Just like if you tryed to say that > my money was your community's property (Clinton supporters) I'd probably > cut your head off. Eric has full rights to go so far as to kick you off > if he feels fit. Or me, for that matter. Whatever, it's HIS LIST. I clipped the wrong line and made it look like I was replying to a guy who was replying to the original guy. A public apology is in order, because noone deserves to be associated with the dick who flamed Eric. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt+V1aZRyOzqm29xAQECMgP/d0BDw40DVx9LJ4+BBGAHXiIb0D1mGnK3 3HVU01f3tE0AZ6iZnsTK+jg3K22szCXo1e6QoMjyqWIWsF7H1Bj+H/iEHF5rjp9l krbBExPG88Q4qnAm5kgEVpWK0z0L7uBe8EU1ni+UaD1VXSUM8EM1hjehFzEfwRJM /ZXSDNCV8Wc= =P72R -----END PGP SIGNATURE-----

1 0

Re: making public keys public
by lmccarth＠ducie.cs.umass.edu 17 Dec '03

17 Dec '03

[This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.] -----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Eric writes: > someone (Alex Strasheim ?) writes: > Perhaps we would have > a default web, which would have everyone's key in it. > > This is a really bad idea. Some "public" keys should not be made > public, but rather revealed only to the correspondent. Forward > secrecy is the reason. If the public key has never been in the > possession of an opponent, and assuming the results of the public key > operation yield little or no information about the modulus, then when > the keys are changed and destroyed, no amount of factoring can find > the private key because the public key isn't around to factor. If you're not going to make the public key public, why use public key cryptography at all ? Save time and effort and use a symmetric cipher. - - -L. Futplex McCarthy; PGP key by finger or server "Don't say my head was empty, when I had things to hide...." --Men at Work - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLt6Eq2f7YYibNzjpAQGIJQQAvKd0jyHXkaNfXp787EXQl/dXMYUXz8dB dF9NF9tiYp761ZwtkeKOoASZGYWvygO+8nseE/1pFz9Gns1XkUM0uyHvg4nvgIWj CJHtVsbV2rtRFZfIjDwD3wqsfRTRms5JvFcRpUsOSKol93hcabnIf3Vx9EAdIUSv hEtvQUBhzKY= =3yjE - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt6F9SoZzwIn1bdtAQFUvwGAhbycPCwIjZGjGeNMWkgnxQUJw6v2RpU3 Z2hvAV6sSiz3+wyLlkR+Nz9nTgRHqjWT =RaG/ -----END PGP SIGNATURE-----

2 1

Diffie, Blaze, Berman, Rivest, Bizdos
by cjl 17 Dec '03

17 Dec '03

C-punks, To those of you who are not members of the American Association for the Advancement of Science (i.e. subscribers to SCIENCE Magazine) I thought I would forward some information on their upcoming meeting in Atlanta. Enclosed is a response I received in response to a query to the address amsie95(a)aaas.org. The response was from rsmariga(a)aaas.org and I quote: You asked specifically about the "Privacy and Encryption in an Electronic Environment" session. Organized by Alex Fowler of AAAS and Caroline Whitbeck of MIT, this session is scheduled for Tuesday, February 21. There will be speakers in both the morning and the afternoon. >> Blurb in printed version I have includes the following: >> Learn about the rapid deployment of encryption technologies, their use >> in ensuring communications security, the legal and ethical >> interpretations of privacy, and the ongoing debate between government >> and non-government professionals Morning speakers Matt Blaze, AT&T Bell Labs Topic: Deciphering the Mechanics of Encryption George Trubow, John Marshall Law School Topic: Privacy Issues in an Electronic Environment Joan Winston*, U.S. Congress Office of Technology Assessment Topic: Privacy, Encryption, and Public Policy Jerry Berman*, Electronic Frontier Foundation Topic: Clinton's Clipper Chip Proposal Afternoon speakers Marc Rotenberg, Electronic Privacy Info Ctr Topic: The Responsibility of Computer Professionals Ronald Rivest, MIT Topic: Encryption and Scientific Freedom Peter Szolovits*, MIT Topic: Privacy, Encryption, and the Proposed Health Care Identifier James Bidzos, RSA Data Security Topic: Encryption and the Protection of Corporate Privacy Jeffrey Ritter: Ohio Supercomputer Ctr Topic: International Aspects of Privacy and Encryption * Invited speaker, not yet confirmed If you have any further questions, please feel free to contact us. We hope to see you in Atlanta. Robert Smariga Registrar AAAS Meetings 1333 H St, NW Washington, DC 20005 phone: (202) 326-6410 fax: (202) 289-4021 end quote. I note that I also asked for info regarding the Information Security session which I guess I have to key in :-) Information Security: Principles and Public Policy Monday pm, Feb. 20th, 1995 Organized by Joan Feigenbaum, AT&T Bell Labs To address concerns about the authenticity, integrity, and privacy of electronic information: An overview of the mathematical theory of information security, the social and legal structure in which the digital society is emerging, anad the new service and products available. Speakers: Joan Feigenbaum, AT&T Bell Labs The Mathematical Theory of Information Security Stuart Haber, Surety Technologies, Inc. Ensuring the Integrity of Digital Documents Daniel Schutzer, Citicorp Tech. Office Secure Consumer Banking over the Internet Whitfield Diffey, Sun Microsystems Rights and Responsibilities in a Digital World ObCurrentThread: I'd sign this if it were a lot easier too. But then, some Cypherpunks write genetic code. C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

1 0

No Subject
by Anonymous User 17 Dec '03

17 Dec '03

I don't know what is going on here. This list seems to have bogged down in meta-issues. I am very disappointed with Eric Hughes' recent display of feather-fluffing. He seems to fail to understand that the list has absolutely NOTHING to do with him personally. The full subscriber base could MOVE IMMEDIATELY if so inclined, and indeed the atmosphere seems to be getting a bit oppressive here. I hate to say this but it reminds me of when all the Detweiler flames were erupting a long time ago. Detweiler seemed to be especially enraged with the way that E.Hughes ran the list in a dictatorial, "iron fist" way. He failed to understand that his own role was merely that of a janitor, not a celebrity with a personality cult. Is that all the cypherpunks list is about? I tell you that this idea that "cypherpunks code" does not mean anything. "cypherpunks talk about code endlessly" but when it comes down to it, this whole list is nothing but a lot of people STROKING EACH OTHER'S EGOS while the outsiders (Phil Zimmermann, Ralph Levien) are the only ones getting anything done!!

1 0

Re: Scalability of Ecash System / Article on Internet Cash available.
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One thing that could be done with the on-line ecash system would be to decentralize the task of detecting double-spending. DigiCash could set up a large number of coin validation centers on the net, dispersed geographically to equalize the load. Then the merchants would do a simple hash algorithm on the electronic coin to determine which validation center to use. That center only records spent coins which have the specified hash. Since any attempt to double-spend would mean re-use of a particular coin, both instances would hash to the same validation center and so the re-use would be detected. This way if a validation center went down it would hamper but not stop electronic commerce. Other coins could perhaps be offered in payment in place of those which cannot be validated (although this would require a certain amount of trust of the shop, but perhaps not much more than is necessary already). This might address some of the scalability concerns raised with the on-line cash system. Another idea comes from the NetCash people. Here you have the customer get a payment token from the bank which is made out to the specific merchant desired and given a time-stamp, perhaps good for one day. Now the merchant can accept these, check the signature, and check its own database of tokens which it has received earlier that day. As long as the incoming token is not in the database, the merchant can accept the payment with confidence and turn the tokens in to the bank for credit later as in an off-line system. Effectively these tokens would be digital cashier's checks. The big problem with this is the difficulty of the customer getting his payment token anonymously. If the bank knows the customer who is asking for a particular "cashier's check" to be cut then it learns the customer's spending patterns, defeating his privacy. So there would have to be some communication infrastructure to allow for anonymous connections in order for this system to work. Chaum, as it happens, has written on this topic as well, with his "Mix" and "DC-Net" systems for anonymous communications. Unfortunately, these systems have scaling problems of their own and don't appear to be entirely satisfactory for this purpose. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLt651RnMLJtOy9MBAQEzfwIApLw5dPjil4unqa0yToT1Wm5/kczvnE/E IdXrWqhbVz32VqKw1d6QrG/I20t8RiZSG+yuBCPSOcoMi9XMRs2nnw== =EJTS -----END PGP SIGNATURE-----

1 0

2nd release of signing software
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've made a couple of changes to the format of outgoing messages that should hopefully make life easier for readers. The most noticable will be the movement of the blurb, but also very significant is the removal of the "Reply-To: " (feh on the proliferation of MUA behaviors) header, and way down on the "noticable" list is an "Errors-To: " and a "Sender: " header. Thanks for y'all's comments: keep 'em coming. - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt69EyoZzwIn1bdtAQGLEwF8DAyzBUf0Z86xPHPKWsSaGM6cqSWJOrV8 kGDmEaQooJ9WhSYA5aOo1NtVZjgwOUgP =KRYJ -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Paper available on new cipher
by Matt Blaze 17 Dec '03

17 Dec '03

Bruce Schneier and I have been designing a block cipher, called "MacGuffin", based on a new variant of the standard Feistel (S-P) network structure. We are presenting a paper describing the cipher, entitled "The MacGuffin Block Cipher Algorithm", at the Leuven crypto algorithms workshop later this month. Here's the abstract: \begin{abstract} This paper introduces MacGuffin, a 64 bit ``codebook'' block cipher. Many of its characteristics (block size, application domain, performance and implementation structure) are similar to those of the U.S. Data Encryption Standard (DES). It is based on a Feistel network, in which the cleartext is split into two sides with one side repeatedly modified according to a keyed function of the other. Previous block ciphers of this design, such as DES, operate on equal length sides. MacGuffin is unusual in that it is based on a {\em generalized unbalanced Feistel network (GUFN)} in which each round of the cipher modifies only 16 bits according to a function of the other 48. We describe the general characteristics of MacGuffin architecture and implementation and give a complete specification for the 32-round, 128-bit key version of the cipher. \end{abstract} A PostScript preprint of the paper is available via anonymous FTP from: ftp://research.att.com/dist/mab/mcg.ps A forthcoming paper will discuss the characteristics GUFN structure in more detail. Comments and analysis greatly appreciated. -matt

1 0

public accounts / PGP / passphrases
by lmccarth＠ducie.cs.umass.edu 17 Dec '03

17 Dec '03

[This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.] -----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Hal writes: > Just create a special key for your netcom account. Use no pass phrase; > using one would give a misleading sense of security IMO. Just pass your > mail through "pgp -saft" or equivalent and you've got it. It is easy to > do this from most editors. Could someone please elaborate on the foolishness of using PGP with a passphrase on a public machine (as I do) ? Am I wrong in thinking that my secret key is useless to an intruder until she guesses my passphrase ? I have no net access except via an account on a public machine, so I'm not about to start storing my secret key elsewhere, but I'll change my passphrase to <null> if it's irrelevant anyway. I just reviewed the PGP docs a bit and Phil says "Nobody can use your secret key file without this pass phrase.", which seems to contradict what many people on the list have said. - - -L. Futplex McCarthy; PGP key by finger or server "Don't say my head was empty, when I had things to hide...." --Men at Work - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLt6Cq2f7YYibNzjpAQF3KwP/ZgxKliBQe+BQ+Q0FfiN9ycxTRWRHlPWY qF4iqmxT70uWLm6hsSX6A88EKv1E+k4mfYhVAnT8XQCTp2wEYMVOHvlFJQiKHOCj 55Cot8bL7JCrJ+lUIDdCPOnNra61F2cc+S26EyB5jIKvudzkPLsWI49galG201M7 ILld5lrJhAw= =vc9N - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt6D+ioZzwIn1bdtAQGz5gF+Kokq6ZW/HpgRWowG2/+3QB913tJD2opJ +gKNrxqTK40qzj/8pdNNpreKYrf4rWIi =9YBk -----END PGP SIGNATURE-----

4 3