December 2003 - cypherpunks-legacy

Re: Reefer madness
by Mark Grant 17 Dec '03

17 Dec '03

On Thu, 12 Jan 1995, Russell Nelson wrote: > I really *don't* think that New York State plans to > ban encryption, not now and not over this issue anyway. His thrust is > 1) to have the legal authority to sufficiently punish someone who goes > after children (which they don't have now), and 2) to educate guardians > about the risks of untoward communications from adults to children. But what happens if, say, a minor is solicited for sex when they are pretending to be older than they are ? Or if the solicitation comes via a remailer ? Or a minor with a grudge fakes email to show that someone attempted to get them to agree to sex/picture-taking or whatever ? Once you pass laws making some forms of communication illegal, you're immediately getting into dodgy territory requiring is-a-person credentials and so on. That isn't neccesarily a problem if it's voluntary (e.g. your kids accounts might be set up to only accept mail from people who're certified to be under 18 or whatever), but governments are unlikely to do things that way. Mark

1 0

Re: Chain and Shifting Remailer Addresses
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Offshore Assets writes: > I use Hal Finney's 'Chain' a lot: Uh, I think you probably mean Lance Cottrell, not Hal -- unless Hal's also written a similar utility with an identical name, about which I haven't heard. > [...] But it won't PGP correctly with the Usura > and the Flame remailers because these two have e-mail addresses that > have changed and/or are different from the addresses specified in their > public keys (Usura, for instance, is now <usura(a)replay.com>, but this > is not the address given in its public key ID). Alex de Joode posted a copy of the usura key edited to reflect the domain name change to alt.privacy.anon-server. It's presumably on the keyservers.... Oh, and the flame remailer passed away with the closure of the jpunix remailer, as far as I can tell. (I vaguely recall something to the effect that sinet.org is/was registered as a subdomain of jpunix.com, but I might well be wrong.) Hope this helps. -L. Futplex McCarthy - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxWIfyoZzwIn1bdtAQHcYwF/alAsviWQvyzf4Qg1JR+G0l1sP3o6AGZN xvaxIZsKhhX03RNogflWZPBah3y8DnCa =aVDR -----END PGP SIGNATURE-----

1 0

LPF Statement on the GIF controversy
by Dean Anderson 17 Dec '03

17 Dec '03

[ Please repost this wherever you think is appropriate! ] Until now, most computer professionals and companies have ignored the problem of software patents. The GIF format for graphical images was adopted widely on the net, despite the Unisys patent covering the LZW data compression algorithm. The patent dates to 1985, but its enforcement has been carried out with private threats; most victims are afraid to talk about it. Now the patent has shown its teeth. For a few days, the Internet community was shaking with anger at the surprise demand to pay license fees for the use of GIF format. It turns out that the license being offered today is only for Compuserve users. Compuserve accepted an offer from Unisys that they couldn't refuse. Compuserve users can accept this offer now, or face Unisys later on their own. The rest of us don't have a choice--we get to face Unisys when they decide it's our turn. So much trouble from just one software patent. There are now over ten thousand software patents in the US, and several thousand more are issued each year. Each one may be owned by, or could be bought by, a grasping company whose lawyers carefully plan to attack people at their most vulnerable moments. Of course, they couch the threat as a "reasonable offer" to save you miserable years in court. "Divide and conquer" is the watchword: pursue one group at a time, while advising the rest of us to relax because we are in no danger today. Software patents may not seem like an urgent problem until you find one aimed at you. We all have other fires to fight, and most developers have hoped that the patents would never blaze up. In an ironic way, Unisys has done us a favor--by showing that the problem is too serious to ignore. What people first feared, could just as well have happened. Each of the thousands of software patents has the potential to devastate a segment of the community, both software developers and users. There will be more nasty surprises. They are part of a system. Unisys has given us a chance to work together to change the system--rather than waiting to be sued one by one for this patent or that. We can win the fight against software patents, if we speak loud and clear against them. What can people do? * Express your disapproval to Unisys by writing a letter to its CEO. Tell him what you think of his company's actions: James Unruh CEO UNISYS Corp. PO Box 500 Blue Bell, PA 19424 fax: 215-986-6850 Please use snail mail--a physical pile of letters is more impressive, psychologically, than a big file of email. Keep it short--ten lines is enough. Don't spend hours composing your letter; there's no need. But do write it in your own words, because sending a form letter written by someone else is not impressive. Make it clear that the usual excuses--"We're just exercising our property rights; look how reasonable we are being (compared to what we _could_ have done)"--won't wash with you. Avoid saying anything nasty that would give Unisys a chance to paint itself as the victim. Cold condemnation is more powerful than flames. Please email a copy of your letter to the League for Programming Freedom at gif-letters(a)lpf.org. We might ask you for permission to publish your letter. * Don't sign a license--stop using GIF. The World Wide Web consortium at MIT will probably be coordinating the move away from GIF, and offering advice and assistance. See `http://www.w3.org/'. * Join the League for Programming Freedom. The League is a membership-based organization whose aim is to bring back the freedom to write software. The League says that no one should be able to dictate what kinds of programs you can write. You can contact the LPF by email to lpf(a)uunet.uu.net, or look at its Web pages at `http://www.lpf.org/'. ** Note: the recent license demand came in the name of Compuserve; but the impetus for it came from Unisys. Compuserve developed the GIF format many years ago, not knowing there was a patent on LZW. (Most programmers have no idea what patents their programs are vulnerable to--there are too many patents to keep track of.) When Unisys threatened to sue them, Compuserve had to give in to Unisys's demands. Compuserve arranged to be allowed to offer Compuserve users a sublicense, but the "offer" was formulated in a way that was tantamount to an ultimatum. Compuserve may bear responsibility for some of the details of how this was handled, but the main responsibility falls on Unisys. It is Unisys that claims the power to dictate what kinds of software you can write. Unisys decided to use the power for aggression; Unisys forced Compuserve to participate. =++=+=+=+++==++=+=+=+++==++=+=+=+++==++=+=+=+++==++=+=+=+++==++=+=+=+++= Dean Anderson Dean(a)hi.com President League for Programming Freedom

1 0

Re: Data Havens..A consumer perspective
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 4:30 AM 01/12/95, Nesta Stubbs wrote: >> 4. It is no concern (only idle curiosity maybe) where the data is parked. > >it matters alot too me, that's the security of the dat, what if your data >is sem top secret plan to bomb the pentagon, and you are using the data >haven to distibute to your band of anonymous terrorists, I am sure you >woudln't want your data stored ona public access Unix system, or in >plaintext. You shouldn't ever give the operator the info in plaintext. Encrypt it, public or otherwise, and distribute the key to your Band of Merry Men. Then it doesn't matter even it's sitting on a public access Unix system, no one can read it anyhow. The main point of this kind of data haven seems to be providing you a remote location to store your data, in an anonymous way, so even if it does end up being found out, you can't be linked to it. I wouldn't trust the operator to do anything particular with the data other then keep it safe enough so I can retrieve it later, and I'd take the neccesary precautions to account for that lack of trust. The only reason I'd trust him to even keep it safe for me, is because of reputation market. If he routinely loses people's data, word is going to get around. On the other hand, if he routinely shows people's data to the FBI, no one is even going to know about it. I don't trust him not to routinely show the data to the FBI, or store it in public. Use encryption. Of course there are different purposes for data havens, which would require more trust of the operator. But I'm not sure how well those are ever going to work, because I'd much rather trust my encryption then trust the operator.

2 1

Re: How do I know if its encrypted?
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The data haven concept as I understood it held data for public access in some form (for sale or for free) which would be illegal in some jurisdiction. This might include credit information that was older than the legal limit, libelous claims, damaging medical records, etc. Frankly, I suspect that most usages would be directed towards reducing, rather than increasing, individual privacy. So this is not an area I am interested in working towards. The idea of offsite storage doesn't seem that helpful since you can just store the data on your own disk in encrypted form. Maybe if encryption gets outlawed it would be useful, but then you can't use encryption to communicate with the haven. As far as remailers requiring encryption, one purpose would be to reduce complaints by making it impossible to send some kinds of messages which people would object to. It would be hard to post to usenet, for example, in a useful way. And mail to private individuals could not contain obvious obscenities or other objectionable material. The problem with this is that if people become able to handle and deal with incoming encrypted mail in a transparent way, this restriction is no longer effective in the latter purpose. Someone could get encrypted hate mail and have it transparently decrypted and displayed just like normal mail. They will be just as upset as people are today when they get objectionable mail from the remailer. As far as usenet posts, if a particular decryption key were widely and customarily used in a particular newsgroup, objectionable material could still be widely read if encrypted with that key. Tim May's example of a fake encrypted post containing inflammatory material is a good example of the heat which could occur, especially when the message is real and not a fake one like he did. So I don't think this restriction would really accomplish the desired goal except perhaps in the short term. If the purpose is to have plausible deniability by the remailer operator, I feel we can still get that by publicizing the remailer software source, which has no provisions for manual filtering. A policy of sending only encrypted mail so that the operator can't filter would be no more acceptable to critics of anonymity than a policy of just not filtering at all. Entropy checking is not adequate to detect encryption, as compressed files have maximal entropy as well. For these purposes, compression may be nearly as good as encryption, except that standard compression formats are already widely used. An entropy checker might well pass a gif, jpeg, or zip file, so this filter would by itself be useless to prevent posting of unencrypted graphics. It would probably have to be augmented at least by some checks for these special file formats. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxVgSRnMLJtOy9MBAQF66wIA3a01avgc0jBjKXH6IMjO+6wj4tBeSUmM ZeRl+xFZFZ4Cfsrik1ghuHXI31isiHUzrPAIVEZfFIpTw6w9T0QdSQ== =YVRq -----END PGP SIGNATURE-----

2 1

Multiple symetric cyphers
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- One of the possible weaknesses in public-key messages is their dependence upon a particular symetric cypher for the message with the session key being contained in the block encrypted by the antisymetric cypher. IE, if a weakness in IDEA is discovered, it can be exploited against all PGP messages. I'm wondering: would the strength be increased by using a randomly selected symetric cypher? IE, as PGP uses IDEA and RIPEM uses DES/3DES, what if a random cypher were selected from a set of cryptographically strong symetric cyphers and information about the cypher selected were encrypted in the RSA-encrypted block? I guess this reduces to: do strong cyphers have "signatures" of some sort, by which the type of encryption can be derived? And if so, can this "signature" be reduced by including part (eg, the first and last bytes) of the ciphertext in the RSA block rather than the "clear" cyphertext block? Just a thought, - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxQorxNhgovrPB7dAQF+HgP/b6RVkLS0vyjpVoHy1iF8IDgH1VFwci03 ZpD4tvQ+amZ3OLfMPNvM3jV3br6+/xVKax07yP0r26jbqV3T0RCNMzKLrQjnoyep /h+DBNfboeU4BkhhJFIayLp0w+ykJRvzWoa72l4Uzos66Nu9n/spXwBbrGYD3awe dUUr4YzLnhU= =xON2 - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxRjjSoZzwIn1bdtAQEt2gF/bnrL7r8CycdWz5H80DLpEFGRvDFy7zfF OQQjnGTDmdSv+d3lQOfnqP7mKJJbyqo4 =QXEU -----END PGP SIGNATURE-----

5 5

Crypto functions
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- What crypto functions are considered modern and usable? The list I have right now is: RSA IDEA DES 3DES RC4 RC5 BLOWFISH MD4 MD5 (and FLAMINGO, a trivial test case, which consists of xor'ing every 8 chars with "flamingo".) Pointers to code for any other schemes will be greatly appreciated. Thanks, -- Todd - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxL+YSoZzwIn1bdtAQGmbgF+Il9/8OU3smhe+DqhKBX5a51N9H15/ElN 4ByTAiKfNjXu21HWyV29kSxEBofo5003 =j55J -----END PGP SIGNATURE-----

7 8

Re: Reefer madness
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort Ever seen a Turkish prison film, Reuben? ......................................................... I don't get it. (I haven't seen one) Blanc

3 2

REQUEST: Privacy/Free Speech URLs
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On the request of a few law-related professors and other faculty, I'm trying to put together a web page that brings together resources from all over the net that are related to issues of free speech, privacy, libel, censorship, etc. If you have a few URLS with materials related to the above, I'd appreciate it if you could drop them in an emailee to me. Basically, any URL that ends up pointing to issues of rights and rules on the net, and possibly related software (such as PGP and the like). Thanks much :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxq8aTokqlyVGmCFAQGPXwP+LpyRgw+fuV4HXzt3ObGyu4ME8XsgBbRz Z2yyhVsbeK9DnhJuYPRiaHGjOmO3rl+9qmjisxbmQA8YkmKIyIGB8ViP7RKLoUlg vCUzr00AbQHc9SZKuuQCyOSHirDNZfc/3A92U1MsEXZl/gACoNxOq3+uSqyE9LWu bQrXW4xbl+0= =2H+w -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> I am Pentium of Borg \/ Finger for PGP Public Key <=> you will be approximated

1 0

Re: Pgp where?
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <ab3c722e200210036071(a)[192.187.167.52]>, Dave Del Torto <ddt(a)lsd.com> wrote: >FYI, I keep the most recent version of Mike Johnson's excellent guide on >where to find PGP in: > > ftp.netcom.com:/pub/dd/ddt/crypto/crypto_info/where_is_pgp?.txt I also have an infobot on pgp-faq(a)hks.net. Sending mail there will get you a fast autoresponse with a reasonably recent version of the same FAQ. >Send email to <pgp-questions(a)lsd.com> if you have further questions. And, I'll remind everyone that we need volunteers for the pgp-help mailing list (Dave's on it). It's important that we be able to identify what the worst barriers to PGP use are and the best way to do that is to answer folks' questions. Send mail to pgp-help-request(a)hks.net to be added. Thanks, - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxqYhRNhgovrPB7dAQH+4AP/RsK7SdY+KVmxuEn3JU8INnK0XnAsi3et jw5jtTfcFJmIKN0u1PmcFeeOwbrgqahzPvOpTJvXQHA73zi94XLGbAR5hrDRAD7N Sfm/4h6lngQV2tzAephZg0J5aV3X6wcCrhd3h3sG01QeaT8YWBzmeRKTXBpAkpWw Nf7opd5EXhM= =t88d - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxrTxSoZzwIn1bdtAQGTzgGAlbPDZqyvoI+5nSZS8NaAnXL5iUXIVRip bu3AM/mGFK/3Y0AsfKnhr4b3ZnZP1KXS =4gk2 -----END PGP SIGNATURE-----

1 0