December 2003 - cypherpunks-legacy

This is an E-Mail Chain Letter!!!!!!!!!!!!!!!!!!!
by ahoier＠juno.com 17 Dec '03

17 Dec '03

I'm passing around this letter so write a comment on it then forward it to some friends wonce you see 100 names on it E-MAIL it to ahoier@juno.com.......K -------------------------------------------------------------------------------------------------------------------- Write 1st comment here then pass on to friend...K

2 1

No Subject
by Harry Tuttle Remailer 17 Dec '03

17 Dec '03

someone wrote: >>A. It's unsolicited spam. Not a big deal. >>B. The way they gathered the list of addresses is questionable, >> and likely off Jim's HD. Its pretty straightforward for interested perties to get a list of everyone on a mojordomo mailinglist even if the who command is disabled as long as we have our old friend sendmail and his trusty sidekick expn. nc toad.com 25 220 toad.com ESMTP Sendmail 8.7.5/8.7.3; Tue, 29 Jul 1997 12:59:12 -0700 (PDT) expn cypherpunks 250-<"|/u/majordom/bin/wrapper resend -p bulk -l cypherpunks -f owner-cypherpunks-unedited -h toad.com -s cypherpunks-unedited-outgoing"@toad.com> 250 </gnu/mail/cypherpunks-in(a)toad.com> expn cypherpunks-unedited-outgoing 250-<jxx(a)pipeline.com> 250-<sxxxxx(a)slecrs2.sbc.com> 250-<sxxxxx0(a)laf.cioe.com> 250-<wmxxx(a)direct.ca> 250-<toxx(a)sk.sympatico.ca> 250-<zacxx(a)netcom.com> 250-<waxx(a)mls1.HAC.COM> 250-<dm+cypherpunks-unedited(a)amsterdam.lcs.mit.edu> 250-<paxxx(a)fatmans.demon.co.uk> ------ more addresses cut ---------- I have xed out the names but you get the picture. no need to go through the effort of watching a list for posts or searching through someone's old mail. If you have any complaints email: expn owner-cypherpunks-unedited 250 Cypherpunks Admin <cpadmin(a)toad.com>

2 1

Entrust Technologies's Solo - free download
by Michael C Taylor 17 Dec '03

17 Dec '03

Entrust Technologies (www.entrust.com) has made Solo available for download, free for 30-day evaluation & edu/non-profit. For Win95/NT. A mere $49 Cdn (~35 US) for commerical usage... For e-mail / file encryption, digital signature Solo uses 128-bit encryption, which is CAST-128, the royality-free algorithm invented at Entrust/NorTel. It also uses 1024-bit RSA public-key cryptography and has DES, Triple DES available. Also follows FIPS 140-1 validated security kernel. It is compatible with other Solo clients (of course), Entrust/Lite and Entrust. It looks like PGP Inc might have some decent competition. I assume that it won't have the market pentration of PGP, but at least it will make a dent and might force PGP Inc. to make their product robust and flexiable. "Offer not valid in Libya, Iran, Iraq, Cuba, Angola, Syria, and North Korea" I do not have any affiliation with Entrust or NorTel other than both being in Canada. I don't even have a copy of Entrust/Lite. -- Michael C. Taylor <mctaylor(a)mta.ca> <http://www.mta.ca/~mctaylor/> "Not speaking on Mt Allison University's behalf"

4 3

7-29_b8_EXTRA_Internet.html
by Damaged Justice 17 Dec '03

17 Dec '03

Tuesday July 29, 1997 [1]ImageMap LA Fitness Web gaming is 'ripe for fraud' _________________________________________________________________ By Patrick Wilson Washington Bureau _________________________________________________________________ WASHINGTON - Two senators toured Internet gambling sites Monday as they listened to warnings the growing online casino industry could be ripe for corruption and consumer fraud. Sens. Jon Kyl, R-Ariz., and Richard Bryan, D-Nev., looked on as Wisconsin Attorney General Jim Doyle presented what he characterized as questionable Web gambling sites. Doyle appeared before a Senate technology subcommittee studying a bill by Kyl to ban gaming on the World Wide Web. Doyle said Web gaming has grown from a "sleeping giant" to a developed industry that must be stopped. To demonstrate how easy it is to gamble online, he played a videotaped sample of online casinos such as the "Golden Palace," where Web surfers can use credit cards to play craps, keno, slots and blackjack, among other games. Doyle noted the Internet gambling industry even has its own online newsletter, "Rolling Good Times," which now is conducting an online poll where people can bet - for fun - on whether Congress will pass Kyl's bill. "Who knows what's on the other end of this screen?" Doyle said. "Who knows if those cards are fair? Who knows whether organized criminal activity is involved?" Bryan said he has "no confidence whatsoever that gaming on the Internet can be regulated now or at any time in the future." "Unlike the heavily regulated casinos in Nevada, Internet wagering is unregulated, and since many of these sites operate off-shore it is beyond the reach of U.S. authorities," he said. "Such a scenario is ripe for consumer fraud." Web gambling is catching on rapidly, with one estimate reporting 25 gaming sites and 100 more in the works. Bryan called Internet betting "something that's kind of mushroomed." Internet users can gamble online with a credit card or by setting up an account. There is no way to stop children from gambling on the information superhighway, say supporters of the Kyl bill. "Bringing gaming directly into people's homes, as we are beginning to see through the Internet, is so full of potential problems and so far beyond the ability of any state to regulate that despite whatever business potential it may have it needs to be prohibited on a national level," Bryan said. Kyl's bill, backed by the National Association of Attorneys General, would punish those who set up Internet gaming Web sites with a fine of up to $10,000, two years in prison or both. Those who made an online wager would face one year in prison and a $5,000 fine. [2]| Top of page | References 1. LYNXIMGMAP:http://www.dailybulletin.com/news/7-29_b8_EXTRA_Internet.html#na… 2. http://www.dailybulletin.com/news/7-29_b8_EXTRA_Internet.html#a

3 3

Queries from a Cyper-newbie?
by Chris Avery 17 Dec '03

17 Dec '03

Anybody willing to offer a bit of help to a cypher-newbie? I'm trying to sort out a few of the basics: (and if not answers, just a few pointers on where to go for info? ) Thnks. 1. PGP 5.0 -- good software? If not, what problems? Why to use DSS vs/ RSA keys? How is 5.0 different than 2.6.3i ? Which is better? 2. Are emails encrypted using PGP 5.0 decypherable by PGP 2.6.3i (and vice versa?) Using RSA keys? 3. I understand certain encryption s/w cannot be legally exported, I am aware that such s/w is nevertheless being used (and built) abroad. My queries: Is purely domestic use being threatened by the pending legislation? Is it already illegal to send an encrypted msg out of the US? If so, is it illegal to receive an encrypted msg from outside the US? 4. How strong is strong? My MS Explorer has the 128 bit encryption scheme to secure domestic financial transactions (such as credit cards). How "un-encryptable" is this? I read some recent postings here re difficulty of breaking 128 bit keys -- but this had reference to stronger methods of encryption than MS Explorer uses, right? So 128 bits is hard to break (umptyump years, terrawatts, etc.)? Then why does my PGP 5.0 software offer keys that are 768, 1024, etc. up to 4096 bits in length? Are these numbers on the same scale? Any "strength" differences between RSA, DSS, and Diffie-Hellman? IS there some layman-understandable difference between these? 5. Is international data traffic somehow monitored (or monitorable) to detect encrypted traffic? Thanks for any help.

3 2

Australia and Encryption Policy
by denning 17 Dec '03

17 Dec '03

Ross Anderson posted a message on the net recently stating that Australia was proposing an encryption policy that would force residents to use weak cryptography while banks would get key escrow. His source was a talk by Steve Orlowski, who is Assistant Director, Security Management, in the Australian Attorney-General's Department. Attached is a copy of an open letter by Mr. Orlowski in response to that post. He is not proposing that individuals be forced to use weak encryption. Key escrow would be an option available to anyone wanting a high level of encryption. Organizations and individuals could escrow their own keys if desired. This message and his letter may be forwarded. Dorothy Denning --------------- Dear Thank you for your comments on the subject of the use of encryption by private individuals. Firstly I would like to make the point that the debate has arisen from one person's interpretation of a paper I gave at a conference on "Cryptography Policies and Algorithms" The full text of that paper is now available on the net at http://commerce.anu.edu.au/comm/staff/RogerC/RogersHome.html The paper carries a disclaimer at the top that the views are mine and do not necessarily represent the views of the Australian Government. The paper sets out the Government's policy on telecommunications interception, which includes the issue of the use of cryptography as: "As a result of the Report, Australia is, among other TI issues, monitoring the impact of encryption in the telecommunications interception area and will re-examine matters in 1997 following the opening of the telecommunications area to full competition." Telecommunications covers both voice and data communications. The last paragraph of the paper says that there is a need to expand the cryptography debate to cover the needs of individual users in the context of the information superhighway rather than current Internet users. The paper also points out that issues suh as cost, convenience and public confidence in cryptography systems will be the main issues. Public confidence is explained in terms that as long as it meets the general requirement for privacy it will be acceptable. I still maintain that the general user of the superhighway in the next century will be satisfied with a lower level of encryption which will meet that and cost and user friendliness requirements. On specific point made in the Internet message, the paper does not suggest, either directly or by implication, that individuals should be banned from using encryption. Regarding the use of higher level encryption, the paper supports the concept of commercial key escrow where organisations hold their own keys but may be required to provide them in response to a court order. The same would apply to individuals who could either hold there own keys or store them with a commercial body. Access to those keys would be by court order and in that respect is no different to existing procedures for the interception or seizure of telephone conversations or paper records. There is no suggestion that these basic principles, and protection of individual's rights in general, should be changed If individuals were to use lower level encryption there would be no need for them to maintain copies of any keys for such systems. To my mind this is preferable to a requirement for keys to be maintained for all encryption systems, which could be the result if universal key escrow were introduced. Finally on the question of interception, the general public expects a reasonable level of law enforcement to ensure the protection of their person and property. Governments are required to find a balance between this and the rights of individuals to privacy. Part of this balance is to ensure that law enforcement authorities convince a court that there is a need to carry out an interception. There is no suggestion that this fundamental approach should be changed. The paper certainly does not suggest tha the Attorney-General's Department should become a centralised interception authority. In fact such a role would not be consistent with its role as a source of advice to Government. I hope the above clarifies both the Government's policy and my personal views on these matters. I consider this to be an open letter and have no objection to it being used as such. Yours sincerely Steve Orlowski

1 0

Re: Random Hiss from Mac mike
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Wed, 23 Aug 1995 19:09:35 +0100 >From: Andrew.Spring(a)ping.be (Andrew Spring) >I've been looking at using the Mac's Sound Input Manager for hardware RNG. [...] >I suspect there's much less entropy in that signal than even this estimate, [...] >Does anybody have any experience/advice in this area? I would try injecting noise and seeing how well you can control the output signal. I would also do a Fourier transform of the output and look for cyclic behavior -- then see how the frequency spectrum can be modified by turning machinery on and off, turning radios on and off, .... You can also try various compression algorithms to see how much entropy they claim to see. When that's done, you can then use some of my ranno conditioning code, free on the net (although written for UNIX, for now): http://www.clark.net/pub/cme/html/ranno.html I especially like running a pseudo-random stream through ranM and then a hash, to obliterate any patterns which might sneak past your analysis. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0

Random Hiss from Mac mike
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

I've been looking at using the Mac's Sound Input Manager for hardware RNG. The advantage of it is that (1) most macs have a microphone port these days, (2) it doesn't involve any user interaction, (3) the API is easy. What I don't know, is how secure it is. Or more precisely, I don't know how much entropy is contained in the signal. In the simplest case, where the microphone is not attached, the signal consists of long runs of '0x80's alternating with '0x7f's. Now, I have no problem transforming this into uniformly distributed RN's : just hash the buffer with MD5. My question is, how many bytes get fed into the hash? Obviously, enough bytes so that I have 128 bits of entropy. Preliminary tests give me a max entropy of about .65 bits per sample byte. That's not very much, but if I can sample at ~20 KHz, that's 1625 bytes per second. That's estimated by recording the length of runs and computing the entropy over the entire sample: i.e. the sum (for k = 1 to 120) of -(fraction of runs of length k * log2 of that fraction). That works out to about 3.3 bits per run with an average run of 5.1 bytes. I suspect there's much less entropy in that signal than even this estimate, but I don't have any way to conduct tests with pure 50 cycle power and uniform ambient temperature. Or whatever else biases the signal. For all I know, every time someone in this building starts his microwave it biases the signal. Does anybody have any experience/advice in this area? -- Thank you VERY much! You'll be getting a Handsome Simulfax Copy of your OWN words in the mail soon (and My Reply). <Andrew.Spring(a)ping.be> PGP Print: 0529 C9AF 613E 9E49 378E 54CD E232 DF96 Thank you for question, exit left to Funway.

3 2

Denning questions/reverses her position?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm too old for this! I never thought I would see the day that Dorothy Denning would terminate her star role as a shill for the Clinton/LEA encryption ban! from: http://www.news.com/News/Item/0%2C4%2C13000%2C00.html?nd Two supporters of Clinton administration's stance on encryption released a report today finding that encryption has not inhibited law enforcement efforts, with at least one author questioning her belief in the administration's position. The authors--Dorothy Denning, a Georgetown University computer science professor, and William Baugh Jr., vice president of Science Application International Corporation-- ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM+Eh5L04kQrCC2kFAQF9wwP+INGEAnc+1akKc+dP7re8fleX4PJrmsYU UKzxgBZAsWcZC7L5WkaOygckHznOc+a37iHzDFtt3sr86DP0D/4j675qJdt/O4B+ jbxXumJ8EXmTN9bOvXK8x9JRGjR9aWzjeaJKN3X+fH4Bjbw76FR9xIFkhhNvZqnM ahBzZyL2cZ4= =MlQZ -----END PGP SIGNATURE-----

1 0

PacBell's idea of a good password
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From the PacBell Messsage Center (voice mail) brochure: "Make it easier to remember your password by choosig a code you use already, i.e. a PIN number or birth date." - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMDu1OyoZzwIn1bdtAQEvlAF+ObOioS3uF8obI6BRhtjfkZdvRAztTlUa uCjeR0AH2MzNEgTFM0mCSXuTnyy/trG0 =rg3O -----END PGP SIGNATURE-----

1 0