December 2003 - cypherpunks-legacy

NII calendar...
by Michael V. Caprio Jr. 17 Dec '03

17 Dec '03

Here's the latest schedule of events... looks like the only public meeting left is on the 27th. What the heck is the National Security Telecommunications Advisory Committee? (see Oct. 17-19) Any brave cypherpunks in the area of "lecture room B" feel like venturing into the den of the enemy and reporting? NIST is lecturing to the Committee on Applications and Technology... is that a congressional thing? Might there be a chance it'll appear on C-span? ------------------------------------------------------------------------- Schedule of Upcoming Public Events September 14: Telecommunications Policy Committee Department of Commerce 3:45 p.m. - 5:00 p.m., Room 1414 October 11-13: Interchange '94 Renaissance Hotel and Washington Convention Center Washington, D.C. (Co-sponsored by the GITS Working Group, the Federation of Government Information Processing Councils, Public Technology Inc., and the State Information Policy Consortium) October 17-19: National Information Infrastructure Symposium U.S. Naval War College Newport, Rhode Island (Co-sponsored by the President's National Security Telecommunications Advisory Committee (NSTAC) and the Office of Science and Technology Policy) October 27: Committee on Applications and Technology National Institute of Standards and Technology (NIST) Lecture Room B 10:45 a.m. - 11:45 a.m. ----- Mike

1 0

Friendly, neighborhood NSA...
by merriman＠metronet.com 17 Dec '03

17 Dec '03

iiti.doc.gov /pub/newitems/ii_inventory/app_projs/library ================================================== IITF APPLICATIONS PROJECT INVENTORY APPLICATION AREA: Adv. Network Tech. Education Libraries STATUS: PILOT DESCRIPTIVE DATA: PROJECT: Digital Librarian LEAD AGENCY/ORGANIZATION: NSA CONTACT NAME: Norma Davila PHONE #: 301/688-7353 LEVEL OF EFFORT: START DATE: ongoing COMPLETION DATE: DESCRIPTION OF PROJECT: The "Digital Librarian" links together the libraries where information of any type (books, texts, pictures, audio, video, multi-media, etc.) is stored to the librarians who assist the users in navigating through these storehouses of knowledge. This project brings these ideas to the desktop by allowing a user to gain access to any number of information sources, independent of the originating development of the sources. The information sources can be anything from databases to online reference materials to online training materials. The user interacts with these sources through one common interface. In addition, this project enhances textual material searches by providing a hypertext link capability for a user to navigate a document in a more meaningful way. Instead of just paging through a document one page at a time, the system can bring the user to the place in the document where the information is located. In the future, natural language and artificial intelligence techniques will be exercised to increase user efficiency in searching through the library storehouses of knowledge. KEY PRIVATE SECTOR ACTORS: ORGANIZATION NAME: CONTACT: TELEPHONE #: ==================================================================== Out of the kindness of it's heart, the NSA is going to build us all a nice, new, improved WWW! Isn't that just *too* kind of them? I wonder why I have this feeling I'd better not turn my back on them..... - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

3 2

IIT*F* collection
by merriman＠metronet.com 17 Dec '03

17 Dec '03

I've just uploaded a rather eclectic collection of text files to the Cpunks site at csua. They're in an MSDOS .zip file NII.ZIP. Some of the files in the IIT_F_ directories had duplicate filenames, but differing contents. The file is about 1M, unzips to about 3.5M (I was there for a while, okay? :-) Minutes of hearings, reports, project summaries like the the Friendly Neighborhood NSA I posted, and more. There's some scary stuff in there - like the report of the first IITF public meeting in Albuquerque has only *one* instance of the word "privacy" :-( Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Newsgroups email addresses.
by Gary Jeffers 17 Dec '03

17 Dec '03

Fellow Cypherpunks, I am going to be spreading my CEB around the Internet. I need full email addresses to newsgroups including sci.crypt & talk.politics.crypt & any other groups that may be interested in crypt including conspiracy groups. thank you. Yours Truly, Gary Jeffers

1 0

What privacy issues to discuss.....
by ADAM GERSTEIN, _THE_ MACGURU 17 Dec '03

17 Dec '03

Fellow C'punks- I work for my school as a resident advisor, and we have to have two programs every semester. One of them is supposed to be educational, and I think I want mine to be about privacy issues, since it's such a hot topic and not that many of the folks in my school seem to care about Big Brother. What I want from you guys is pointers to papers I can use as references, but stuff that's easy to explain to Joe/Jane College student. I would also like input as to how you folks think I should do it. Should it be a discussion group, or should I just talk and then answer questions? I think a discussion group might be better, but I'm not sure. All input is welcome, adam -=-=-=-=-=-=- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQBPAi3NGo0AAAECAMOrXrau7Kp80+mjsCwqU3tpM1uFZKG9lVlBpMFgo3tPwBPb JHJlP1L+1Jpj27NtFNhlDgFhTAueBPvdAmUopWUAEQEAAbQQQWRhbSBKLiBHZXJz dGVpbg== =6d6B -----END PGP PUBLIC KEY BLOCK----- -=-=-=-=-=- God's last message to his creation: "We apologize for the inconvenience" -D. Adams

1 0

Cyphernomicon
by Black Unicorn 17 Dec '03

17 Dec '03

Could someone give me a current pointer to the Cyphernomicon? -uni- (Dark) -- 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 1

REMAIL: changes to chaos remailer
by Chael Hall 17 Dec '03

17 Dec '03

I have made several changes to remailer(a)chaos.bsu.edu: 1. From: line changed from Anomymous <remailer-admin(a)chaos.bsu.edu> to Anonymous <remailer(a)chaos.bsu.edu>. 2. Reply-To: line added that says remailer-admin(a)chaos.bsu.edu. 3. Errors-To: line added that says nobody(a)chaos.bsu.edu. These changes do not affect nowhere(a)bsu-cs.bsu.edu [yet.] Remember, for information about the remailers, finger remailer(a)chaos.bsu.edu or send a message to remailer-help(a)chaos.bsu.edu. Chael -- Chael Hall, nowhere(a)chaos.bsu.edu

1 0

Think you're a hacker, eh?
by Jeff Gostin 17 Dec '03

17 Dec '03

Bill Baker <bakerw(a)butler.sidewinder.com> writes: > > Well, the only thing the pseudohackers seem to be able to do is > forge-cancel postings that make them feel bad. So here it is again, > with some extra data at the bottom. Maybe I missed the beginning of this thread (I've been remiss in my reading!), but what the heck is going on here? It sounds interesting, but I'm rather clueless. Anyone care to comment? (And no, I've got no live IP, so there's no worries about hacking from me.) --J -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | BOYCOTT SEA QUEST DSV... ask me why. | == == -= | PGP 2.[3a|6] Key Available | ==== ====== +---------------------------------------------------------+

1 0

Re: What privacy issues to discuss.....
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>Fellow C'punks- > What I want from you guys is pointers to papers I can use as >references, but stuff that's easy to explain to Joe/Jane College student. ftp.csua.berkely.edu /pub/cypherpunks/papers :-) > I would also like input as to how you folks think I should do it. >Should it be a discussion group, or should I just talk and then answer >questions? I think a discussion group might be better, but I'm not sure. > Split the difference: explain some of the details and such to them, and then let them work it out. Might help to use something like a phone bill to point out how data is collected that could easily be used by any kind of oppressive regime. It's my understanding (possibly in error :-) that European nations do *not* provide the level of detail in their telephone bills that we do here; the theory being that if who someone calls is unknown, then it makes any effort to do a guilt-by-association and witchhunt more difficult. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Technical Remailer Analysis.
by bogus＠no.return.address 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Yow, I have been trying to send this for a week! BTW, yes I am using the bug to add this note. From: Louis Cypher (Elswhere) In this message I will analyze message reordering in remailers, and traffic analysis in remailer webs. Remailers which immediately resend incoming messages provide no security against an attacker who is able to watch all traffic to and from the remailer. Two proposals have been suggested to solve this problem, latency and reordering. In recent discussions, the consensus was that message reordering was superior to (and the actual intent of) latency. Reordering is not sufficient, a form of latency is required to make it effective. In this analysis, I assume that the reordering is accomplished by keeping a group of n messages at the remailer, and sending a random one whenever a new message comes. This is superior to simply waiting for n messages to arrive, then sending them all at once (I will show this later). The attack on the reordering remailer is simple. The attacker sends a stream of marked messages through the remailer. After the waiting messages have been flushed out, any incoming real message will be flushed out of the remailer before more arrive, allowing it to be uniquely identified coming and going. The defense against this is to only check the group and send excess messages after a time delay. This delay should be the typical time for n real messages to arrive. A mixing of approximately n messages is ensured by this process. If there is no attack, then the mixing is not quite as good as keeping a group of 2n messages. Here is the math on the reordering schemes: 1) Wait for n messages, then mix and send them all. The message is known to be one of those 10 (duh). 2) Keep a group of n messages. Send one of the n+1 when a new one arrives. The message could be any message ever sent after arrival. That is not useful. How many messages does it take before we are 90% sure that the message has been sent? prob that the message has not been sent after x messages is (n/n+1)^x Prob that it has been sent = 1 - (n/n+1)^x Messages till 90% prob: x=ln(.1)/ln(n/n+1) For n=10, x=24, which is much better then 10 for scheme 1. 3) Accumulate b messages, then send a of them (Scheme 2 is a=1, b=n) x = ln(.1)/(ln(a) - ln(b)) This gives the largest x for a=1. In my example of how to defend against the flood attack, a=n, b=2n x = 33 This is misleading, because it will introduce twice the delay as scheme 2. Given the same delay, a=n/2, b=n, one finds that x=16.6 That is better than batching, but not as good as scheme 2. The smaller x is worth it, because a reordering of at least some minimum number of messages is ensured. Some writer proposed changing n randomly to protect against this attack. Obviously that would not work. The attack will consist of many many more than n messages. The second issue for consideration is: Given a web of perfect remailers, how easy is it to identify corespondents? Tim has been asking this one for a while. I assume that there is sufficient traffic through all remailers that any message entering the web could be any message leaving the web. This can be achieved, even with light traffic, by sending fake messages through the web to bit buckets. While they do not improve the security of the web as a whole, they help ensure that no tracking of messages within the web is possible, forcing it to be treated as a black box. I assume that no correspondents are remailers themselves, and that all communications are random (random times with random people). This assumtion that all communications are uniformly distributed is terrible but.... This analysis only applies to indistinguishable messages. Each standard packet size can be thought of as having its own black box (a good argument for message splitting and having only one packet size). To simplify the problem, I am going to treat the web as though it were clock driven. Some number of messages enter and leave the web each "tick" with no messages staying in the web between ticks. This is a reasonable approximation, with the "tick" being the mean time of passage through the web. Define "f" as the fraction of remailer using population sending a message in a given tick. This is also the probability that any individual will send a message in a given tick. The probability of a given pair of corespondents in a given tick is f^2 The probability of a pair of corespondents occurring m times in n ticks is m p= 1 - Sum [(f^2)^i (1 - f^2)^(n-i) n! / (i! (n-i)!)] i=0 Lets put some numbers in there. If people send 1 message per day on average, and one tick is 30 min., then f=1/48. If you watch the web for a month you will see 1440 ticks. If the chance probability of your sending m messages to your co-conspirator is too small then you have been nabbed. The condition for that is: p << (1/population) The results for m=0 to 12 (using the above numbers) are: m = 0 p = 4.64811E-1 m = 1 p = 1.30173E-1 m = 2 p = 2.56257E-2 m = 3 p = 3.86587E-3 m = 4 p = 4.71498E-4 m = 5 p = 4.81967E-5 m = 6 p = 4.23687E-6 m = 7 p = 3.26538E-7 m = 8 p = 2.23961E-8 m = 9 p = 1.38336E-9 m = 10 p = 7.77044E-11 m = 11 p = 4.00273E-12 m = 12 p = 1.91774E-13 So, for a remailer using population of 10,000 you had better send less than 5 messages per month to your accomplice. This only gets worse the longer you keep it up. You can not send 4 per month, month after month. So, that is enough typing for one night. I hope this will staunch the RC4 legality debate for a few seconds. Summoned from Elsewhere: Louis Cypher Here is my key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCcAy52rloAAAEEAK2NyOHpG+yHmhbhu1wFmH7JpDUEs2q6VtYBoiQHhrbr/Duj cva9huWHP8OFWGWIRYQXGVNdYQTENqZ84C6uTtMZad2THzU6OWCKhC6GUTnzea9c kNKWj/BFI9n1461r7/y03nyZkoRT91QscQ+9vKNfDFqNy/I5W6yHUAO76TvRAICA AAAAAAAAAAAAAAAAAAADtBhMb3VpcyBDeXBoZXIgPEVsc2V3aGVyZT6JAJUDBRAu dq6UrIdQA7vpO9EBAf4YBACDO08fVgfsIU25rweXiNFUDZlj/ShOok6NPfXp7v4A w1AOzG+abIWd6w3Hl/bwLzN/7d3VwEj4MlPrsr3mVPWc2UhrV/KZ729Kyrlui1Xw 1nzWorHUGTfNtlmPcbSQkojKFpid5EcHJgtOI/fEnSQcvkux5IBtBWB1VoWGrj8l +w== =c18C - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLopED6yHUAO76TvRAQHotwQAlkXA9esn+OjVM1hrl5qcWL+MpfNEtmn6 dn5Y8vKmyu/CJUddI+8UHmeMFAQrKczIRAetJHfN3+Vz+NARqafskpmAUDJAdCZ3 ON6G45ERrecgb6MvbFSwzKa5+80ksysVVa3Ql74Vi0cYf4x04OUblpVBPLPKgaUP GyD3E0EOWY0= =BGnr -----END PGP SIGNATURE-----

4 3