December 2003 - cypherpunks-legacy

Mailing List
by Joseph Halstead 17 Dec '03

17 Dec '03

I would like to be included in your mailing list. jhdeval(a)soho.ios.com

1 0

Re: Digital postage and remailer abuse (was Re: Novel use of Usenet and remailersto mailbomb from luzskru@cpcnet.com)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:47 PM 1/13/96, Alan Bostick wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In article <v02120d02ad1ce02500bc(a)[192.0.2.1]>, >shamrock(a)netcom.com (Lucky Green) wrote: > >> I am not sure that postage would solve this problem. The geeks would >> individually pay for it. Still, nominal postage would solve a lot of the >> problems that plague remailnet. > >Maybe I'm misunderstanding how using digital postage with remailers would >work. I was assuming that the postage stamp would be included *inside* >the encrypted envelope, that what the remailer would do on receipt of >mail would be: (a) decrypt the envelope; (b) validate the postage stamp; >and (if the stamp is valid) (c) forward the message according to the >now-decryped instructions. The basic idea of digital postage means, as Lucky said, that individual users and individual messages would have their own stamps. (Being just numbers, it is certainly possible that multiple messages could have the same exact "stamp," but then only one of them would be valid...in the model I usually think in terms of, the first to "redeem" the stamp gets the money, all others get nothing.) So, each transmitter of a message would have to "pay the freight" with his own stamp. The idea of N different messages all carrying the "same" stamp is inconsistent with how digital postage would operate in practice. >Using this model, if the perpetrator doesn't include a postage stamp, >then the message is ignored. If the perp includes a stamp, the first >horny net geek's message is relayed but subsequent ones get bounced for >invalid postage. Yes. >If the message requires external postage (remailer processing cycle is >process postage *before* decrypting envelope), then at the very least >the horny net geeks have to get their own postage stamps, putting a step >in the way of instant gratification. What's more, doing this would >require *some* understanding of how the remailer network operates. One >should never underestimate the degree of cluelessness present on the >net, but knowing how to use remailers makes it more likely that somebody >could recognize this as a mailbomb rather than a legitimate offer. Yes. >The very nature of this attack makes me wonder whether it would be >worthwhile to implement a digital postage scheme for remailers that >doesn't happen to be backed by real money. The remailers would continue >to be free to use, and currency exchange hassles would be avoided, but >many of the benefits of abuse prevention would be in place. So would >the infrastructure to upgrade to pay-to-play remailers at a later date. I think someone tried this a couple of years ago, offering coupons for remailer use. The idea of "coupons" acting as stamps is the one most often discussed as an alternative to having full convertability to money. A person buys a block of numbers, each can be used once and only once. It's up to the user not to let the numbers out of his possession (as they can be used by whoever gets them). So long as the numbers are in the outer encrypted envelope, packet sniffers and sysadmins won't see them. So long as the remailer operator is honest enough not to claim the numbers have already been used--a reasonable assumption, at least at this time--then this should work. Coupons also get around laws about cash, banking, etc. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Digital postage and remailer abuse
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:47 AM 01/13/96 -0800, Jonathon Blake <grafolog(a)netcom.com> wrote: > >On Sat, 13 Jan 1996, David K. Merriman wrote: > >> snailmail; particularly if the remailers were able to issue 'books' of stamps. >> It might even be possible to have each remailer issue Estamps (tm) of >> different 'kinds', much as there are different postage stamp 'themes'. > > I can see it now. The 1997 Scott Standard Estamp Catalog: > Remailers of the World. > Or perhaps Famous Cypherpunks? So maybe a bad example, but the analogy is quasi-valid :-) >> Having different stamps from each remailer would also allow some means of >> tracking spammers and rip-off artists ("hmmm. an 'Elvis' Estamp. That came >> from hactic; let's see if they can tell us who they sold this book to.....") > > OTOH, if hactic keeps records of who the stamps are sold to, > that sort of defeats the anonymous nature of the remailers. > Perhaps a little, but considering *why* Estamps would be used, I think it would be an acceptable 'hazard'. Of course, it's not any kind of requirement, simply a means of resolving a *significant* problem. Or not. :-) Dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPc9h8VrTvyYOzAZAQHl0wP+LY/Lw9EzM8kH5Eyr7rLRzEFwKSmWIeTf sElMTzxQbTyqXrmzI0nB43Dmx1Cpkb+8mSCFVnXwvZDQzrP8cFidYGlNF/hG00ig d16+D6Le07YgO65pCngNhv11CLKtd/1GZf4r8YXZV7zbMcbslooUHt/mVWkl5zGT AP0ssH0WAI4= =TQ04 -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

> The U.S. Commerce Department will recommend easing > export controls on encryption software after a study by > the department and the National Security Agency found > that American firms are being hurt.... Avoid the rush, start generating those 42 bit keys now! And don't forget tonight's victory celebration in Shimomura's hot tub!

1 0

New Mailing List (encrypted)
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello everyone, I have installed PGPdomo on vishnu.alias.net. I've also created a new mailing list that you can join if you wish. It's a closed mailing list, so subscriptions must be approved. What makes this mailing list different is that all submissions are encrypted and all outbound messages are encrypted to the PGP key of the recipient. This means you can discuss whatever you wish without fear of discovery or retribution. The name of the mailing list is cypher-list and it's home is vishnu.alias.net. The theme of the mailing list is basically anything one might discuss about cryptography, crypto-politics, remailers, government, Kevin Mitnick, etc. It's kind of like cypherpunks but accepts a wider discussion base. The difference is encryption. As mentioned above, the list is handled in a secure fashion. I've included the help file for PGPdomo below to assist in subscribing to the list. Here is the simplified for for subscribing: Send email to cypher-list-request(a)vishnu.alias.net In the body of the message specify: subscribe cypher-list [your PGP public key in ascii-armored format] You will be added to the mailing list and emailed the welcome message. Here's the help file: You have reached the J. P. and Associates "Majordomo" mailing list manager, version 1.93. This is a modified version of Majordomo 1.93 that includes PGP support. Majordomo's public key is available at: ftp://vishnu.alias.net/pub/majordomo.pgp Additionally, the public key for Majordomo(a)vishnu.alias.net can be found on the PGP keyservers. Majordomo(a)vishnu.alias.net will accept the following commands in clear-text (i.e no encryption): help; lists; info; and which. All other clear-text commands must be sent to the specific list using the email address: <listname>-request(a)vishnu.alias.net Where <listname> is a valid listname without the <> characters. In the description below, items contained in []'s are optional. When providing the item, do not include the []'s around it. It understands the following commands: subscribe <list> [<address>] [-----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBoq Your PGP version 2.6.2 EKOUFKNl+Ytk+O QphsZ8zNU compatible Public Key u0SDZVbcTP7lt6 mP+fZPdMq in ASC format goes here izFrag5L4ZAAUR tDxNYWpvc use pgp -kxa my_pubkey.asc to create pvcmRvbW9AaGF3 d3cuaGEub3NkLm1pbD4= =l3kH -----END PGP PUBLIC KEY BLOCK-----] Subscribe yourself (or <address> if specified) to the named <list>. subscribe commands should always be sent in clear-text to <listname>-request(a)vishnu.alias.net. Only include your PGP public key for PGP protected lists. We prefer (but not require) 1024 bit key lengths. We reject Public keys with less than 512 bits. If subscribing to a PGP protected list, include contact information such as DSN or commerial phone number. unsubscribe <list> [<address>] Unsubscribe yourself (or <address> if specified) from the named <list>. get <list> <filename> Get a file related to <list>. index <list> Return an index of files you can "get" for <list>. which [<address>] Find out which lists you (or <address> if specified) are on. who <list> Find out who is on the named <list>. info <list> Retrieve the general introductory information for the named <list>. lists Show the lists served by this Majordomo server. help Retrieve this message. end Stop processing commands (useful if your mailer adds a signature). Commands should be sent in the body of an email message to <list>-request(a)vishnu.alias.net. Commands in the "Subject:" are line NOT processed. If you have any questions or problems, please contact Majordomo-Owner@vishnu.alias.net@vishnu.alias.net. Additional PGP information: When submitting entries to a PGP protected list, please comply with the following: o encrypt the entire submission for Majordomo(a)vishnu.alias.net (-e option of pgp) o use Transport Armor (.asc, radix-64, the -a option of pgp) o sign your submissions (-s option of pgp) o use the linefeed conversion option (-t option of pgp) 'pgp -east submission Majordomo(a)vishnu.alias.net' where submission is your file should work nicely. John Perry - KG5RG - perry(a)vishnu.alias.net - PGP-encrypted e-mail welcome! Packet Radio - KG5RG(a)WA4IMZ.#SETX.TX.USA.NA WWW - http://www.alias.net PGP 2.62 key for perry(a)vishnu.alias.net is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPgLL6ghiWHnUu4JAQHB5gf/RAwOwOdFGNGLhdQUE1z4VrAl1jYb3efg a/C9nEAIb59VKZ3IwbehBzYqUxSDSXoarPQldoHfcKBJxfJahfu5U+09mMBbZ9VT WYnQ1+KQiltQmAP8hcOdOazs0JrlTTOQJxoX095T8ZInJ904OuXA+V3sd8Tg/Nyc Id/yfyfOeXndULj4UJxLWCsVGHSwx+CCa5Ct7g/yHZPQf7QtOPkDKF33vfsrQ+0d 04KemYL6PYLXPuLcgnOT1FiKccqR/q5340mUJBfs2yz7bx9UwFkexKuu/rkFDeno wTjvUavyPpvV17eCEQMDaUggW6hZbQz7C72NHQ8NPi2XG/QrOCZZhA== =kKgj -----END PGP SIGNATURE-----

1 0

Re: CelBomb
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

> Can anyone in IL, or elsewhere, report more on the head-job > of The Engineer: > I don't know beans about it, but I've never let that stop me before. > Any crypto used to authenticate the target for the boombox, > or to obscure links to the assassin? > > How was the blast specifically targeted at him and not a > phone borrower? > > How it was set off -- by user-dialing, remote control, some > other means? > Try this scenario. Bomb in cell phone's trigger is activated by a tone, say the DTMF tones for the numbers 8 and 6. Assassin calls phone number, and performs the following authentication protocol: "Hi, this is J.Random Assassin. May I speak to Mr. Intended Victim Please?" "Speaking." "Message for youuuuuuuuuuu...." Beep Boop BOOM!!!

1 0

tsu's bpf
by Mark 17 Dec '03

17 Dec '03

>> Shimomura on BPF, NSA and Crypto: >> >> One of the tools I modified for my work was a sophisticated >> piece of software called the Berkeley Packet Filter. ... >> Unlike the original BPF, my version was designed to bury > ^^^^^^^^^^^^^^^^^^^^^^^ >> itself inside the operating system of a computer and watch >> for certain information as it flowed through the computer >> from the Internet. When a packet from a certain address, or >> for that matter any other desired piece of information >> designated by the user flashed by, BPF would grab it and >> place it in a file where it could be kept for later >> viewing. > >This is *exactly* what BPF does, always did and was designed to do. As >for writing the packets to a file, everything but opening and closing >the file are described in the man page. You could code it in 10 lines. Get off your high horse Julian, he means it's a modloadable version of bpf, much like the modloadable NIT that is also available. There are at least two sniffers that can use both the modloadable NIT and bpf packet interfaces, maybe more. It certainly is easier than recompiling your kernel to include the functionality which is generally the way things were done. I prefer bpf as it is much more efficient, typically 10% of the impact that NIT has on a machine. Some rough figures are a NIT might use one or two minutes of CPU a day to monitor a reasonably quiet network, whilst bpf will only use several seconds cpu time. (Most of the work is hidden in the kernel anyway). Mark

1 0

RSA accellerators on ISA/PCI cards?
by Simon Spero 17 Dec '03

17 Dec '03

Does anybody have any recommendations for a good RSA accellerator available on an ISA/PCI card? I'm looking for something that can be used with numerous public/private keys, though the ability to have one tamperproof key would be a bonus. Thanks Simon ---- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

Re: Novel use of Usenet and remailers to mailbomb from luzskru@cpcnet.com
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- An entity calling itself ABostick <abostick(a)netcom.com> probably wrote: > > -----BEGIN PGP SIGNED MESSAGE----- (BTW, it verified here.) > > If "digital postage" is ever implemented, this sort of > distributed-origin mailbomb-through-a-remailer would be stopped > immediately. All the messages that the horny net geeks send would > necessarily contain the same postage stamp, and the remailer would > notice this right away -- and throw away messages containing the used > postage stamp. > > One more motivation for e$-like digital postage for remailers. Unfortunately this is not the case. The perpetrator would simply have to convince the horny net geeks to pay their own postage. In fact, it is *in general* impossible to have both anonymity and prevention/control of mail-bombing. Of course digital postage will help the problem somewhat by making the bombers pay for it, and smarter filters on the recipient's end will help, but in general it is a problem we are going to have to live with if we want anonymity. Regards, Bryce PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMPgkE/WZSllhfG25AQFRhwQAnA9teB4oKYONpvSe++VaFR8vqi8t2Zs3 pI+qNPrFMyejrL84Vtwo7GKagUJCabEIYXuZ69X39kDjs3tiRIGllT0cqq9Ijb9Q pog4YklGDDSirnsgfYatkguRA2VWqNPr67hVyQ6KQLHTBHTnW5bfgWrwlT7PyxJ0 f9FOMrqrIPE= =zd6Y -----END PGP SIGNATURE-----

1 0

bad PGP signatures
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Yet another bad PGP signature via e$pam. Date: Sat, 13 Jan 1996 12:13:03 +0600 To: cypherpunks(a)toad.com From: "David K. Merriman" <merriman(a)arn.net> Subject: Re: Digital postage and remailer abuse That's the third today (although the second was fixable by concatenating the Subject: onto one line.) Would everyone please get into the habit of formatting their messages to be much less than 80 columns? All Phil's travails are ill- rewarded when we can't get basic clearsigning to work via mailing lists. (Or if we don't bother to *use* clearsigning via mailing lists, but that is another topic...) On a related subject, cpunks traffic recently alerted me to how effective replay attacks can be against PGP. Don't PGP signatures include a time-stamp from the system clock? I'm going to get into the habit of including a time-stamp in the clear-text from now on. (I have sent so many PGP-clearsigned messages, and many of them quite short, that an attacker could almost hold up my end of a conversation using them. :-) ) Bryce PGP sig follows Sat Jan 13 14:48:23 MST 1996 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMPgoy/WZSllhfG25AQGGlgP9HhxLLpfrsyTBc8ed9jjToJnUOl37S+3z 8zac6FJXk+3dsKhXe2UhiKQrLDx6wIodvy+6DkpBNEEWuzkaVlRkZ9QFiDIuKkm2 ixc8HaZ6yJQLKg5NX19vStpwyQGsDx9tCVAM8BtEYXHuzVqb7AuANVmS/EJWd5js yz+pz6COpxE= =PzVY -----END PGP SIGNATURE-----

1 0