December 2003 - cypherpunks-legacy

ERIK HUGHES: EGOTISTICAL PRICK
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

what is all this @#$%^&* about MANDATORY SIGNATURES ON THE CYPHERPUNKS LIST? who is Eric Hughes, DOROTHY DENNING??? who is going to force ME how to use cryptography??? a CYPHERPUNK??? this is BULLSHIT. eric hughes is a TRAITOR TO THE CYPHERPUNK CAUSE. it's so transparently obvious, this is nothing but a big ego ploy. "Look at me!!! I am cool!!! I have accomplished virtually nothing substantial in any cypherpunk area for a long time, all my major recent projects are failures that have gone nowhere, I don't follow my own rules of 'code, code, code', not 'blather, blather, blather', and this is one way I can stroke my ego and show off my utter brilliance in the lack of anything useful!!!" has he written one smidgeon of code to back up his ideas? NO!!! he has philosophized and pontificated about his IDEAS that he is PLANNING to put into code. frankly, I see absolutely NO EVIDENCE WHATSOEVER of the perseverence required to build a solid foundation in this noisy bozo. he flames away against the people who are REALLY doing something. what is this about "founding" the cypherpunks? no one is my leader, I am not a part of a movement that takes credit for MY hardworking accomplishments as glory for "founders". why don't someone ask him why he went to go work with Chaum a long time ago and CAME BACK. I'll give you a hint: HE DIDN'T CUT THE MUSTARD. ask him why he hasn't graduated from college!! hint: HE DIDN'T CUT THE MUSTARD. he is paralyzed by his own perfectionism straightjacket, rather than building SOMETHING that works haphazardly he builds NOTHING that works AT ALL. oh, so he built a remailer. BIG DEAL. what kind of brains does it take to call sendmail with a message? to cut off headers on a file? good lord, how many commands in SED is this? so he wrote it in PERL??? *wow*, I am *really* impressed now!!! this is BS!!!! let's find a NEW LIST. a list is a COMMUNITY PROPERTY. anyone who pulls this kind of prickery, insinuating they are in the "bully pulpit", deserves CYPERSPATIAL EXCOMMUNICATION for HIGH TREASON TO THE CYPHERPUNK CAUSE of TOTAL AUTONOMY FOR THE INDIVIDUAL.

3 2

Re: Scalability of Ecash System / Article on Internet Cash available.
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One thing that could be done with the on-line ecash system would be to decentralize the task of detecting double-spending. DigiCash could set up a large number of coin validation centers on the net, dispersed geographically to equalize the load. Then the merchants would do a simple hash algorithm on the electronic coin to determine which validation center to use. That center only records spent coins which have the specified hash. Since any attempt to double-spend would mean re-use of a particular coin, both instances would hash to the same validation center and so the re-use would be detected. This way if a validation center went down it would hamper but not stop electronic commerce. Other coins could perhaps be offered in payment in place of those which cannot be validated (although this would require a certain amount of trust of the shop, but perhaps not much more than is necessary already). This might address some of the scalability concerns raised with the on-line cash system. Another idea comes from the NetCash people. Here you have the customer get a payment token from the bank which is made out to the specific merchant desired and given a time-stamp, perhaps good for one day. Now the merchant can accept these, check the signature, and check its own database of tokens which it has received earlier that day. As long as the incoming token is not in the database, the merchant can accept the payment with confidence and turn the tokens in to the bank for credit later as in an off-line system. Effectively these tokens would be digital cashier's checks. The big problem with this is the difficulty of the customer getting his payment token anonymously. If the bank knows the customer who is asking for a particular "cashier's check" to be cut then it learns the customer's spending patterns, defeating his privacy. So there would have to be some communication infrastructure to allow for anonymous connections in order for this system to work. Chaum, as it happens, has written on this topic as well, with his "Mix" and "DC-Net" systems for anonymous communications. Unfortunately, these systems have scaling problems of their own and don't appear to be entirely satisfactory for this purpose. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLt651RnMLJtOy9MBAQEzfwIApLw5dPjil4unqa0yToT1Wm5/kczvnE/E IdXrWqhbVz32VqKw1d6QrG/I20t8RiZSG+yuBCPSOcoMi9XMRs2nnw== =EJTS -----END PGP SIGNATURE-----

1 0

2nd release of signing software
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've made a couple of changes to the format of outgoing messages that should hopefully make life easier for readers. The most noticable will be the movement of the blurb, but also very significant is the removal of the "Reply-To: " (feh on the proliferation of MUA behaviors) header, and way down on the "noticable" list is an "Errors-To: " and a "Sender: " header. Thanks for y'all's comments: keep 'em coming. - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt69EyoZzwIn1bdtAQGLEwF8DAyzBUf0Z86xPHPKWsSaGM6cqSWJOrV8 kGDmEaQooJ9WhSYA5aOo1NtVZjgwOUgP =KRYJ -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Paper available on new cipher
by Matt Blaze 17 Dec '03

17 Dec '03

Bruce Schneier and I have been designing a block cipher, called "MacGuffin", based on a new variant of the standard Feistel (S-P) network structure. We are presenting a paper describing the cipher, entitled "The MacGuffin Block Cipher Algorithm", at the Leuven crypto algorithms workshop later this month. Here's the abstract: \begin{abstract} This paper introduces MacGuffin, a 64 bit ``codebook'' block cipher. Many of its characteristics (block size, application domain, performance and implementation structure) are similar to those of the U.S. Data Encryption Standard (DES). It is based on a Feistel network, in which the cleartext is split into two sides with one side repeatedly modified according to a keyed function of the other. Previous block ciphers of this design, such as DES, operate on equal length sides. MacGuffin is unusual in that it is based on a {\em generalized unbalanced Feistel network (GUFN)} in which each round of the cipher modifies only 16 bits according to a function of the other 48. We describe the general characteristics of MacGuffin architecture and implementation and give a complete specification for the 32-round, 128-bit key version of the cipher. \end{abstract} A PostScript preprint of the paper is available via anonymous FTP from: ftp://research.att.com/dist/mab/mcg.ps A forthcoming paper will discuss the characteristics GUFN structure in more detail. Comments and analysis greatly appreciated. -matt

1 0

Re: Brands excluded from digicash beta
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Ralph wrote: >I also have had no luck getting a beta client from digicash. I >"registered" through their WWW forms page, and got no response for >about a month. Then they sent me mail saying that they would be >sending a client, but that they were unrolling it in stages. That was >about a month ago. Perhaps this means I will get my client soon. > >This does not speak well for digicash. If they were not ready to beta >their stuff, they should not have announced it. As it is, it makes >them look like a flake. Here is one possible explanation: As their beta test agreement states, the beta software is not licensed for use in the US. Some legal thing that I don't understand. A few US users are part of the beta test, probably because they kept bothering the guy who hands out the beta UID's early in the morning before he had his coffee. I know that the people on this list have been advocating ecash long before a sinlge line of code was written and that we all deserve an early try of the software. I am forwarding this to some of the folks at DigiCash, perhaps we can convince them to broaden the beta. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. "The very atmosphere of firearms anywhere and everywhere restrains evil interference - they deserve a place of honor with all that's good." <George Washington>

1 0

Tim May is RIGHT!!!
by Anonymous User 17 Dec '03

17 Dec '03

I'm sorry I can't say so under my real name, but I *vehemently agree* with Tim May about the authoritarian, heavy handed, generally outrageous egotism of Eric Hughes of recent. This is REALLY UPSETTING. Eric should be ASHAMED OF HIMSELF for strutting around like a peacock. he is EMBODYING THE DICTATORIAL APPROACH HE CLAIMS TO DEFY VIA CYPHERPUNK PHILOSOPHY. this is truly the most HYPOCRITICAL AND EGOMANIACAL action I have seen by anyone in recent times on this list. Tim May will leave the list? GOOD FOR YOU, TIM. Get the hell out of here. Eric Hughes may have had some good ideas ONCE UPON A TIME but hasn't kept up his end of the bargain of the cypherpunk agenda for a LONG, LONG TIME. just a WASHED-UP HAS BEEN, who defies the very ideals that he claims to espouse in the most dictatorial manner possible. oh, what's this? you're just going to DELAY the messages that don't have signatures? well, I'm sure the government would just love to slightly DELAY THE MAIL of people who don't have the proper ESCROWED KEYS. what's this? you aren't going to move to any more "serious" measures, such as actually BANNING UNSIGNED MAIL, at least, NOT YET? oh, THANK YOU, MR. ALMIGHTY GOD OF CYBERSPACE. ah, I'm sure Louis Freeh feels the same way---we aren't proposing any minor change that PREVENTS YOUR FREEDOMS, are we? gosh, the government is starting to look awfully nice in comparison to the TYRANNY OF A DICTATOR. this scene is getting REALLY STALE. oh, Mr. CYPHERPUNK FOUNDER, please tell me once again how you started this list, and how the volumes of posts by the public are really YOUR PERSONAL PROPERTY, and this is YOUR LIST. we are your "guests"???? BULLSHIT. any host that treats his guests like this is NOT A HOST. this is not graciousness but the crabby and cranky bossiness of a STELLAR INGRATE and a EGOTISTICAL JERK.

3 2

PGP Tools under Linux
by anonymous-remailer＠xs4all.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I am using PGPTools to handle all the crypto functions in the second >generation remailer that I have written. All the copies of PGPTools that I >have found seem to be set up to compile on SUN workstations only. That's interesting, because I developed it under Linux and MS/DOS, and there was a lot of trouble at the beginning with it not running on big-endian machines. It sounds like whoever "fixed" it for sparcs broke it for little-endian machines. The original should still be on ftp.csn.net; get it there and it should work. >Mixmaster is both a remailer and a front end, and therefor must run on many >different platforms. I have been able to compile PGPTools on Linux and >FreeBSD, but PGPTools produces invalid RSA blocks. If you (or anyone else >reading this) have ported PGPTools to other platforms could you send me the >source and makefile, or point me to them. If not, could you help me do it, >the source code is a tangle, and it will take me a long time to do on my own >(I am a brute force programer, not a C wizard). Get the original, test it, and post the results. Some people have asked if I am still around. Yes, I am, and I'm thinking about a major update of PGPTools. The update would involve getting out any persistent bugs I can find, cleaning up the code and making it completely reentrant, and replacing all 2.3a modules with 2.6.x modules so it is patent-safe. It also needs some kind of exception handling for disk errors and the like. A pass-through function for the disk access calls, and a way of freeing all memory before a longjmp to bail out, for example. Before doing this, I need to hear from the PGP development team. There have been rumors of an upcoming PGP API, something similar to PGPTools. If this is the case, let me know so I don't waste time writing an incompatible version. If this is not the case, let me know so I can get started. More information about NexusBucks, please. Is it for real? How many coins in circulation? Have any services been bought with them yet? What is the address of the Magic Money server? Is it fully automatic, or are messages being manually processed? "There's never been a time in our history where it's been possible to place information beyond the reach of the collective efforts of society, but with modern cryptography you can." - Phil Zimmermann "Large primes united, will never be divided!" - Pr0duct Cypher -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt6cDcGoFIWXVYodAQGZ8AP/bZASa9sn+QzDiQkDJqacBAPhpqQHfkhL 7kWh7belMm8gA6KFmLfZcPywCWm3zU1QOS2+xRzPUGP0f7MrQjDuj3h7M4X3fDDV DiybwF4rIUAs2wBubioTYwE+as6N//CmfbtpkRdPVWhg5rnvgEOU+lzEvkhFt0tc 2MzkmHTBvIQ= =CSzj -----END PGP SIGNATURE-----

1 0

CSPAN
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Although it was probably an exercise in futitility, I sent a note to CSPAN suggesting that they have PRZ as a guest on the Booknotes program that Brian Lamb hosts. I figured that maybe they could have him on in conjunction with the book version of PGP that the MIT press is coming out with. In my note I made the argument that policy concerning cryto is really policy concerning wiretapping and surveillance, and that technological changes are eroding the status quo and forcing us to decide whether we want a lot more surveillance (or at least the potential for it) or a lot less, that since this is going to have a lot to do with how the police interact with the public in the future, it's an important issue, etc. At the end, I appended the transcript of the talk PRZ gave in NYC that was recently posted to the list. I found that particular text to be pretty impressive, and I'm hoping that the folks at CSPAN will as well. There are a few details that I hope will go over well: MIT's involvement, the fact that PRZ has debated the NSA's general counsel, the quotes from the FBI director, etc. On top of that, the conference from which the transcript came seems like the sort of event that CSPAN would televise. I don't know Phil, and I don't know if he'd even want to appear on the program. But there are two things about Booknotes that I think would make it a very good forum for the cryto debate. First of all, Phil would have enough time to explain the issues. That's important, because this isn't something that can be easily packed into a sound byte. Also, although I don't know this for a fact, I would imagine that the program would probably be a pretty good way to reach people on this Hill, both members and staffers. Anyway, I sent them Phil's phone number and his email address. The encouraging thing is that I sent this out more than a day ago, and I haven't heard back from them yet. Ordinarily, when you send them email you get a form letter back within an hour or two. That gives me some hope that maybe some people over there are reading the transcript, and that perhaps they're thinking about it. I don't know if CSPAN is open to lobbying or not, but the more I think about it, the more it seems to me that it could be a very useful forum for the debate. I think it would be worthwhile to let them know the next time Phil's going to speak at an event similar to the one I took the transcript from, and see if they'd be willing to televise it. My feeling is that if we can get the word out to the public at large, we're going to win. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt7LBhEpP7+baaPtAQF65AP+OAL3xt66v55U4Spd/5PenHYaRzs1v/vy P7HyVRI8RjH1Y+nR1cpLRYz+uilSrK9Fk1ew4Qhfja0RNh91kVe2aVHmw7dIxWHv rhFv569LFMQWj73JawdtePaXver+6deWhc8d1VL/PkgXgk5feg6mDEjRUB1GsjgZ FfkoHvrEBQA= =cHR2 -----END PGP SIGNATURE-----

1 0

cypherpunk signing service
by sglass＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Operating System: SunOS 4.1.3_U1 Site: netcom12 X-Mailer: ELM [version 2.4 PL23] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Content-Length: 1021 Todd... | The cypherpunks(a)hks.net service is now available. | | It will sign any message sent to cypherpunks(a)hks.net with its (currently | 384 bit) key and forward the signed message to cypherpunks(a)toad.com. Does this look right? pub 384/27D5B76D 1994/12/01 Cypherpunk signing agent <cypherpunks(a)hks.net> Key fingerprint = 85 BA D4 6D B8 9D B6 B7 EB 74 11 48 42 45 61 F2 | I welcome any suggestions on the format of the message and the prepended | message. Why not stealth it and just appear as if the sender signed it? | I've made a couple of changes to the format of outgoing messages that | should hopefully make life easier for readers. Thanks, Todd! | The most noticable will be the movement of the blurb, but also very | significant is the removal of the "Reply-To: " (feh on the proliferation | of MUA behaviors) header, and way down on the "noticable" list is an | "Errors-To: " and a "Sender: " header. Lookin' good. | Thanks for y'all's comments: keep 'em coming. Good work. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt7OeioZzwIn1bdtAQGndwF+JJkJwvNKoSw16//vyK7nbNfxeUxGG3ar 9Ek87KCkqlg+QKbwGcCisaV1PJcu+Lns =vnS5 -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Re: Authentication at toad.com: WTF?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MATERIAL----- > On Wed, 30 Nov 1994, The new cypherpunks signature checking agent wrote: > > The below message was found to have a valid signature from "JEFF LICQUIA (CEI) > > " JLICQUIA(a)mhc.uiuc.edu. Apparently it was a spoof, but whatever. I'd be really bugged by the security implications of software claiming to have validated signatures; software that complains about bogus sigs is fine, since if it's spoofed it's only a warning, and if the warnings are deleted your trust is still somewhat limited unless you've verified the signatures yourself. Trusting someone else's verification is less than ideal security policy :-) Bill -----BEGIN PGP SIGNATURE----- Pgp-version: 32767 uhohovhoehvohfvoihvhoviheoivhefoivhefohvefohv jhjhohhuhvuhiuhewiuvhiuhfveiuhefviuhevhevhvhh -----END PGP SIGNATURE----- Cypherpunks signature checking agent: It's valid - trust me!

2 1