December 2003 - cypherpunks-legacy

Re: Root Causes
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

[Disclaimer: IASNAL, but I am the host of the Bill of Rights Conference on the U'NI echonet, where these issues are discussed from time to time.] JR> >violation of the right to privacy? JR> JR> Good idea, but I have an idea to upset even *more* people. [9th and 10th Amendment stuff] Them, too. JR> Republicans AND Democrats ALL HATE the 9th Amendment, which is the primary The reason there was no BOR in the original Constitution was precisely that some folks were afraid that the enumeration of some rights would imply that there are none other. The DOI and other writings of the FFs clearly show that rights are naturally inherent in individual human beans, and that the power of government comes from us, not the other way around. But the FFs also knew that the prevailing view was that rights are what is left over after the government is done flexing its muscles. Bottom line: The Bill of Rights was passed in the Congress as a 12-article gang-bang amendment, and the 10 of them that became the BOR were passed as an organic whole by the several states. [And, of the other two articles, which clearly didn't belong in a BOR, one of them was ratified a few years ago even.] This means that without =any= of the 10 amendments, there would be =no= BOR. JR> slow erosion of freedom in this country. My rejoinder is "OK, if we're JR> supposed to ignore it, why not just REPEAL it, after all, it's just sitting JR> there doing nothing, cluttering up the rest of the Bill of Rights." Usually, Don't give them any ideas! The 2nd is already on that list, and part of the 1st (that refers to "flag desecration", which apparently is more serious than =Constitution= desecration)... don't get me started, I'm way off crypto already. JR> talking about Constitutional issues on encryption rights, if for no other JR> reason than to educate the public. In court, of course, I would concentrate JR> on the 1st. Apologies to the various lurking law professors on the list, I Actually, I would kick in 2 and 4. The government has called crypto a munition, and it =is= a valuable tool for the unorganized militia to fight a guerilla war against an occupation force. The 4th amendment protections against search and seizure are the moon which creates the penumbra of Roe v. Wade.> U'NInet Bill of Rights Conference Host * Physician, heal thyself! --- * Monster(a)FAmend.Com *

1 0

Re: SurfWatch for employees (ugh)
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 11:36 PM 7/17/95 -0700, Greg Broiles wrote: >Consistent with the trend towards treating employees like children, I'm not surprised someone sees a market for this. I've worked at a number of customer sites that block access to 900 numbers and local pay-per-call numbers, which also blocks access to Time-of-day and some vendors' customer-support numbers. >Webster Network Strategies has announced (but apparently has not >shipped) a product similar to SurfWatch but aimed at an employment >environment. The product is called "WebTrack" and supposedly supports >access lists of URLs, where access can be allowed to "all but these sites" >or "only to these sites". The product also can be configured to log all >Web usage by users subjected to its reign of terror. :) WebTrack >is priced at $7,500 with an annual subscription to I assume for that price that it's a gateway product, rather than a site license for a censored client (which would require sysadmins to go hunt down everybody's copy of netscape...) If so, I hope the system at least offers caching (to save on outside bandwidth requirements and download time), and has a fair amount of security so it doesn't become a hole in the firewall. >its list of interesting (err, forbidden) sites priced at $1,500. Wow! Folks have finally found a way to get paid for looking for porn on the net! :-) Surfwatch doesn't make it's censored list easily available (otherwise it'd probably get pirated, or used as an "interesting sites" index...), but apparently it blocks access to things other than just pornography - does Webster indicate what categories of stuff they're blocking? # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

3 2

cfs for linux
by zinc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- cpunks, some time ago i inquired about an encryption program for linux. i eventually obtained cfs from Matt Blaze (thanks...). i haven't dealt with this for some time but i have been unable to compile it. if anyone running linux has it working i'd appreciate hearing from you. here are the errors i get if anyone is interested... zifi:~/projects/cfs> make cc -O -c cfs_adm.c -o cfs_adm.o cfs_adm.c: In function `admproc_null_2': cfs_adm.c:47: number of arguments doesn't match prototype admproto.h:183: prototype declaration cfs_adm.c: In function `admproc_attach_2': cfs_adm.c:54: argument `rp' doesn't match prototype admproto.h:186: prototype declaration cfs_adm.c: In function `admproc_detach_2': cfs_adm.c:155: argument `rp' doesn't match prototype admproto.h:189: prototype declaration make: *** [cfs_adm.o] Error 1 thanks, - -pat patrick finerty = zinc(a)zifi.genetics.utah.edu = pfinerty(a)nyx.cs.du.edu U of Utah biochem grad student in the Bass lab - zinc fingers + dsRNA! ** FINGER ME for my pgp public key ** crypto for the masses! zifi runs LINUX 1.2.11 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAxUm03Qo/lG0AH5AQE4DAQAoxA44ESm/7xQ1ke+8yo2VqCemmlrKJkh 2vuJnC4lhayAWEHzKuiqf3G3AAPHHqQdX8JBGNZWt0TAuyoGMWTRI2/U0jTe82AC ew4Y6WzZTEvmdxHaxTFU9R2q6MUOGe4U6Bmdt8tMeU2hy5jDvoijgdiSfBJrU9eS p2Cd2eigAFs= =cQCG -----END PGP SIGNATURE-----

1 0

Is it legal for commercial companies to use PGP?
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- jgrubs(a)voxbox.norden1.com (Jim Grubs, W8GRT) writes: > As I recall, the following is a correct scenario: a customer can use PGP to > send credit card numbers to a vendor he's making a personal purchase from, > but the vendor must use Viacrypt. If the customer is buying something to use > for business, BOTH must use Viacrypt. In practice, I'd probably buy Viacrypt for legal reasons but use PGP anyway. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu5iN74r4kaz3mVAQF11QQAiNccy69sb5OA1jmOpErqqZNJ4sNx3smW tAJQ3lD1op4qlPIO48vxwkvr+IaQyyOkf797+9Ca1z9WtxgwSamo32BQnPQZ6Pbm Vipmpwrabrxq67TOrGgxNp3UN7oBZl3eyad0hIj6ENzs8u1wi3wkHUV/3z341XB7 u953orkOZSk= =UYrt -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

4 3

Re: Free The World Web Server project.. :)
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

PE> Rather than spend five minutes writing something on your own you'd end PE> up something that looks totally fake. I believe that what is going on No, that's "rather than not writing anything at all". I know how to call and write to my congresscritters. The idea of the WWW page is for those who wouldn't take the initiative to do it in the first place. PE> would be discerned by a staffer in moments. Crap like this is called They should know, because they send form letters to constituents all the time, only they don't bother to vary it a bit. PE> "astroturf" by staffers, to distinguish it from "grass roots" efforts. Meanwhile, back at the ranch... If one of our DC members can set up an Imail-FAX gateway, we can publicize some nifty Iddresses for folx to send things in their own words, if possible, and if they don't have any words of their own, they can borrow some. Boilerplate has to be better than nothing. * Is there such a thing as a "gruntled" Postal employee? --- * Monster(a)FAmend.Com *

4 3

Re: RC4 crack
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <21076.9507180656(a)exe.dcs.exeter.ac.uk>, aba(a)atlas.ex.ac.uk wrote: >> Is there an easy way to integrate machines who are not on-net 24-7 >> into this protocol? Not all of us have dedicated lines.:) > >Well you could run a local master, ... or as you are using NT right? >you could use Andy's code when he adds socket support to interface to >masters. > >As to the problem of not having 24-7 connectivity, you could either >use the WWW page, or the server (it will do this anyway) will keep >re-trying to get a socket connect to the master until it suceeds, so >when you next go on-line ... wham it gets through again as >connectivity is resumed and says whatever it has been trying to say. >We need it to retry in case of network out (or horror) big master >falling over, until it gets resumed. On many machines that will mean that it will try to initiate a connection to the host. Please allow for a manual connect option. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMAwdryoZzwIn1bdtAQHrDwGArifMl83/simhOGutmo8FhYgtCMZ+9g5E stSoeOysXuLCvv3EK3PTTUO4LdtPbhnn =rq/L -----END PGP SIGNATURE-----

2 1

Quantum computing/crypto
by cjl 17 Dec '03

17 Dec '03

C-punx, Before the list cratered I had been intending to respond to Doug Hughes post about the quantum computing news piece by James Glanz in SCIENCE magazine, 7th July, vol. 269, pg. 28-29. If you are reading this thread you may be aware of Peter Shor's development of an algorithm that uses quantum logic to factor large numbers. This was discussed on the list last year and the general take on it was that there was no way to build a functioning quantum computer, and even if there were the code-maker would end up ahead of the code breaker. Well, it seems that his work stimulated some further interest in the design and construction of quantum computers and even a conference in Torino, Italy a few weeks ago. In the 15th May Physical Review Letters ther are a number of papers on QC's, including one by Ignacio Cirac & Peter Zoller that describes the construction of a quantum logic gate. This builds on an article in same issue of PRL by Artur Ekert, David Deutsch and Adriano Barenco describing how by trapping ions in an electric field just above zero degrees Kelvin one can build a "quantum wire" which will pass information without measuring it (and therefore collapsing the quantum uncertainty). Chris Monroe and David Wineland at NIST in Boulder have already built a simplified version of this quantum logic gate device, and have written a proposal to factor the number 15 using the technique. The hardware involved will be about 10 mercury atoms. There is airtime at the end of the piece for skeptics citing the calculations showing that "small errors in a QC can accumulate exponentially and no one has figured out a satisfactory way of reaching into the quantum world to correct them". As I mentioned before there is a sidebar talking about the successful demonstration of quantum cryptography over 14 kilometeres of fiber optic cable in Los Alamos by Richard Hughes and colleagues, apparently announced at a conference held last month at the Univ. of Rochester in New York. Alice and Bob can swap bits encoded in the quantum properties of photons that can't be intercepted with out them knowing that something is amiss. C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

1 0

Re: Mandatory key registration
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 1:56 AM 7/19/95, rick hoselton wrote: >In the event of legally required key registration, >I would like to continue to use PGP. My private RSA >key is my own business, so I would like to comply >with the requirements by registering my IDEA keys >instead. There are approximately 2**128 of them, and >I'm not quite sure which one will be used next, so >can I just register ALL of them? Can I do this on-line? >If all the cypherpunks use the same key set, must we each >register all of them, or will a single list do? It seems likely to me that an actual GAK system will require some fee per key. For example, one might have to send in a form, maybe a diskette, and a $25 per key fee for "handling costs." This is the way automobile registrations are handled (and they have become a "revenue source"..I pay $450 per year to register my truck!!!). This makes trying to register 2^128 keys rather expensive. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Is it legal for commercial companies to use PGP?
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jim Gillogly <jim(a)acm.org> writes: > > > Rick Busdiecker <rfb(a)lehman.com> writes: > > From: "Jim Grubs, W8GRT" <jgrubs(a)voxbox.norden1.com> > > > In practice, I'd probably buy Viacrypt for legal reasons but use > > PGP anyway. > > >I'd be interesting in hearing some of the lawyers out there comment on > >this. > > Does RSADSI count as having lawyers? So far as I know they have not > commented in public about whether the ViaCrypt license is valid, but > they have also not (to my knowledge) contested it. However, Jim Bidzos > has explicitly said that it is not acceptable to buy a ViaCrypt license > to cover your use of non-ViaCrypt PGP. Hmm, does that make anyone besides me wonder about that unpulished source code? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAxYot74r4kaz3mVAQESFwP/cws/p52apS7V7xMZ/7jHmarUKLSpxOox nOk8sirst2p9vQqzvR88lwzmGecLb1/lc/mWKzAV1DT4dMAzyljV7d9UIiW0wTvk i5I4o7IQ9ogppdzEt7XdG0rlQCAHHsUYYa1oVufz4OtOd0cHi2SRXje7XSTrxQYF 0FbSsqZsxuw= =YrUs -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Re: Here it is; bi-directional dining cryptographers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Mon, 17 Jul 1995, Andrew Roos wrote: > If the objective is to keep what Alice and Bob say SECRET then we > have a problem if the entropy per bit of Alice's data plus the > entropy per bit of Bob's data is less than one bit, because then > there is only one likely decryption of the "ciphertext", which will > reveal what both Alice and Bob are saying. Yes, but presumably it's expected that they would be using secure encryption on the messages that they're sending. That might still provide some information about the message for traffic analysis, e.g. if you send a PGP message you have your key-id at the beginning, and if you knew the keys of all members of the DC-net you could XOR them and see who's talking to who. I'd have thought the most significant problem would be reserving the blocks in an anonymous fashion while not allowing denial-of-service attacks. Mark

1 0