December 2003 - cypherpunks-legacy

Encrypted internet traffic to Singapore??
by Joe McGuckin 17 Dec '03

17 Dec '03

A client of mine wishes to set up a connection to their Singapore office using the internet rather than a dedicated leased line. They would like to encrypt the data going between the branch office in Singapore and the home office in California. I am considering using something like swIPe for this? Seem reasonable? The data is not very secret, they merely wish to foil 'hacker' type eavesdroppers. Also, what are the legal ramifications? Can I get an export license for this? Is there an encryption method that doesn't require an export license? What laws does Singapore have on encryption? Is swIPe legal? That is, are any patents being misappropriated by the current version? I see announcements on this list about DH and Public Key software being released. I would assume that these software tidbits are technically illegal for commercial use? Thanks, Joe

2 1

FC's Typs? (NewsClip)
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

FBI may have partial set of Unabomber's prints Washington, Aug. 6 (Reuter) -- The FBI may have a partial set of fingerprints from the elusive Unabomber, now considered the country's most wanted man, Newsweek magazine reported Sunday. The partial set of prints, lifted from an explosive device mailed several years ago, were uncovered with newly available forensic technology, the magazine said. While not certain the fingerprints belong to the serial bomber, the report said federal agents believe that identifying the prints could lead them to the Unabomber, whose letter bombs have killed three people and injured 23 others over 17 years. Federal agents are seeking the bomber by looking for machines he might use to construct his home-made pipe bombs, and are trying to track the manual typewriter used to write the bomber's lengthy anti-technology manifestos, Newsweek reported.

1 0

Quibbling about definitions of "proof"
by tcmay＠got.net 17 Dec '03

17 Dec '03

Look, you all, I'm *really sorry* I even brought up the subject of proofs of correctness! As I feared, any mention of certain loaded words immediately brings the quibblers out of their lairs to dissect the "real meaning" of one or more terms. I had thought that my carefully worded mention of the Boyer-Moore prover and that this means little for actual implementations would deter quibbling over the cosmic significance of "proof." (An interesting topic, by the way, as Ray's knowledgeable article makes clear. But metamathematics is an arcane subject and short articles are rarely persuasive...we debated the same stuff a couple of years ago on the Extropians list.) With 700 subscribers, quibbling is the usual state of affairs. No matter what is said, someone will quibble over terms or meanings. No wonder it is the major venal sin at West Point. The Boyer-Moorer theorem prover is an accepted ("Huh? Define what you mean by "accepted"! Not all of us accept that term.") term of art. If you disagree, or wish to raise the possibility that the computer glitched during the proof, there are entire newsgroups devoted to such arcania. On a more mundane note, my Internet Service Provider of the past 6 weeks just sent out an urgent notice tonight announcing that they are no longer "sensemedia.net" and have become "got.net" (as in "got net?" as in "got milk?). This means my 3 years as "tcmay(a)netcom.com" is followed by 6 weeks as "tcmay(a)sensemedia.net" and an as-yet-undetermined time as "tcmay(a)got.net" (at least until the "Got milk?" ad people get wind of this pun and tell them to change to something else. --Tim May Special note: My ISP has changed its domain name from "sensemedia.net" to "got.net" (as in "got milk?"), so I have to again ask you all to bear with me and use my new e-mail address, "tcmay(a)got.net". ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

5 5

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.taylored.com This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp. hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"crown"} = "<mixmaster(a)kether.alias.net> cpunk pgp hash latent cut mix ek reord"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek"; $remailer{"gondolin"} = "<mixmaster(a)gondolin.org> cpunk mix hash latent cut ek ksub reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. 21 Apr 1995: The new version of premail (0.33) is out, with direct posting, perl5 and better MH support, and numerous bug fixes. Last ping: Mon 7 Aug 95 6:00:20 PDT remailer email address history latency uptime ----------------------------------------------------------------------- spook remailer(a)spook.alias.net *****+***-*+ 1:17:21 99.99% gondolin mixmaster(a)gondolin.org * -++*-+**** 43:12 99.98% ford remailer(a)bi-node.zerberus.de .*-**++**-** 15:34 99.97% portal hfinney(a)shell.portal.com ***#####**** 3:17 99.94% bsu-cs nowhere(a)bsu-cs.bsu.edu ***##*#+#** 6:11 99.94% replay remailer(a)replay.com ****+******* 11:17 99.87% rmadillo remailer(a)armadillo.com ++.-+*++-+** 1:36:12 99.84% alumni hal(a)alumni.caltech.edu ***##****** 4:08 99.83% hacktic remailer(a)utopia.hacktic.nl ************ 12:39 99.74% crown mixmaster(a)kether.alias.net ----------- 2:05:54 99.74% vox remail(a)vox.xs4all.nl .-..-..... 23:52:15 99.99% rebma remailer(a)rebma.mn.org -..+-.+..-- 16:26:15 99.68% vishnu mixmaster(a)vishnu.alias.net *****+* **-- 36:02 99.32% penet anon(a)anon.penet.fi - -**++-++*+ 2:39:49 98.59% hroller hroller(a)c2.org * -+*-#**+* 44:23 98.16% syrinx syrinx(a)c2.org - -------- 2:33:46 97.89% mix mixmaster(a)remail.obscura.com -__.-------- 6:25:13 97.55% c2 remail(a)c2.org * -++-+++-+ 1:34:04 97.30% extropia remail(a)extropia.wimsey.com -.__..--.-. 15:02:35 96.68% ideath remailer(a)ideath.goldenbear.com ..- .-.-- 12:33:17 95.40% flame remailer(a)flame.alias.net ++++++++++ 52:48 95.20% rahul homer(a)rahul.net ****#**++*** 5:28 99.99% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

(Fwd) Re: Law enforcement and PGP ban in Australia (fwd)
by Rev. Ben 17 Dec '03

17 Dec '03

Followup on the Ozzies banning PGP: ------- Forwarded Message Follows ------- Date: Mon, 07 Aug 1995 16:44:12 +1000 From: "Danny Smith, AUSCERT" <D.Smith(a)auscert.org.au> To: mauvais(a)ocelot.llnl.gov Cc: first-teams(a)CSRC.NCSL.NIST.GOV Subject: Re: Law enforcement and PGP ban in Australia Organization: FIRST, the Forum of Incident Response & Security Teams Reply-to: "Danny Smith, AUSCERT" <D.Smith(a)auscert.org.au> Paul (et al), > I'm curious about what people have heard about this? > > I'm trying to find out more from this end....doesn't look good... Surprised you didn't come to us first. :-) > Subject: Australia next to ban PGP I believe you can treat this as net.rumour. I have the paper now, and will read it tonight. I will also talk to the author whom I am led to believe is rather annoyed at the misrepresentation of the content of his paper. More information later this week. Danny Smith. ========================================================================== Danny Smith | Fax: +61 7 3365 4477 AUSCERT | Phone: +61 7 3365 4417 c/- Prentice Centre | (answered during business hours) The University of Queensland | (on call after hours for emergencies) Qld. 4072. Australia | Internet: auscert(a)auscert.org.au

1 0

Over 350 'Munitions T-shirts' Shipped
by dhenson＠itsnet.com 17 Dec '03

17 Dec '03

As of 27 July 1995, we have shipped over 350 of the RSA/Perl Munition T-shirts. Orders are still pouring in. Don't be left out. Order your's today. Now you can wear a TSHIRT that has been classified as a MUNITION by the US Goverment. That's right! The US International Traffic in Arms Regulations (ITAR) makes exporting cyrptographic materials illegal. ITAR further defines export as providing cryptographic information to a non-US/Canadian citizen even if you are inside the US at the time. Providing information is further defined as telling or showing information to a non-US/Canadian citizen. The Munitions Tshirt has a Perl implementation of the RSA algorithm (the one used by PGP) printed on the front along with a bar-code of the same algorithm. What all the above means is that if you wear the Munitions Tshirt where a non-US/Canadian citizen can see it, even if it is inside the US, you have just exported cryptographic material (which is already freely available outside the US) and have become a criminal in the eyes of the US Government. Now you too can become an international arms dealer for the price of a tshirt (US$15.95 - US$19.95, depending on size) and the guts to wear it. If you are a non-US/Canadian citizen, you can still own a Munitons Tshirt by ordering the tshirt from a source that is outside the US. The email response to a request for info (see next paragraph) includes full instructions for ordering the tshirt no matter where you live. For more information on how to own this classic example of civil disobedience, just send email to dhenson(a)itsnet.com with the subject of 'SHIRT'. (You don't have to be a US/Canadian citizen to request the info.) Or, if you have WWW access, just point your Web browser to: http://colossus.net/wepinsto/wshome.html By the way, 25% of the profits from the sale of the tshirt (in the US/Canada) goes to the PHIL ZIMMERMANN LEGAL DEFENSE FUND to help defend the author of PGP from harassment and possible prosecution by the Fedgoons. And if you get arrested for wearing the Munitions Tshirt, we'll refund your purchase price. :-) Get your Munitions Tshirt now. Who knows how long they'll stay in production! Don Henson, Managing Director (PGP Key ID = 0X03002DC9) West El Paso Information Network (WEPIN) Check out The WEPIN Store at URL: http://colossus.net/wepinsto/wshome.html

3 2

NYPotpourii
by John Young 17 Dec '03

17 Dec '03

Abject beg: it's easier for the 'droid to act on each item separately, do please request 1-by-1. 8-7-95. NYPaper: "A Cyberspace Front in a Multicultural War: Finding alternatives to a world where only English is typed." With the explosion of worldwide interest in the Internet, the dominance of English, stemming from the network's beginnings in the United States, has become a sensitive matter. A fear is that English, already the international language of business and science, is becoming the lingua franca of the computer world as well, further casting other languages in the shade. And some countries, already unhappy with the encroachment of American culture are worried that their cultures will be further eroded by an American dominance in cyberspace. A consortium of American computer companies has developed a universal digital code known as Unicode to allow computers to represent the letters and characters of virtually all the world's languages. SEZ_who "Digital Commerce: 2 plans for watermarks, which can bind proof of authorship to electronic works." Denise Caruso's column. As information becomes currency in the global economy, that so-called digital watermark technologies are beginning to appear. As with their paper and broadcast counterparts, the concept behind digital watermarks is to provide a secure means to certify the origin, ownership and authenticity of digital works. And by doing so, they can provide the first line of defense against piracy of digital media like music, photographs, film, words and video games. MUN_due "Windows 95's Big Value May Be as a Lure to Network System." Is Windows 95 a decoy? For all the attention being paid to the Aug. 24 introduction of the Microsoft Corporation's updated personal computer operating system, some experts think the software's true strategic value to Microsoft is not the few billion dollars in sales it is expected to bring to the company over the next few years. Instead, the long-term value may lie in luring customers and software developers into adopting the company's other operating system: Windows NT, for corporate computer networks. COY_ote "Selling Virtual Reality, in Indiana: The owners were shocked by how few understood the technology." "Seeing the potential for educating had an incredible impact on me," said John Hammond, an Indianapolis businessman who stumbled on Virtually Yours when he and his son went to the shopping center for pizza. Mr. Hammond wants Virtually Yours to supply expertise and equipment to Sunship Ministries, a group of Christian business executives developing a design for a school, hospital and church complex suited for missionary work in developing countries. Mr. Hammond sees virtual reality as a marketing tool for getting developing countries to welcome them; he sees programs re-creating Bible stories as a powerful tool for preaching to nonreaders. "You could let people interact with a virtual Jesus," Mr. Hammond said. GIT_rel "Dark Sun: The Making of the Hydrogen Bonb." [Book review] In the author's view the story of the hydrogen bomb is only secondarily a technological one. What mainly drove American physicists to design the more powerful bomb was the news that the Soviet Union possessed an atom bomb. And the reason the Russians had achieved the bomb was mainly spying, Mr. Rhodes insists. So his story of the H-bomb is not so much technology as the interaction of politics, diplomacy, war, espionage, theoretical and practical physics and paranoia. JOX_onu

1 0

RSA/Perl Shirts
by Rev. Ben 17 Dec '03

17 Dec '03

Has Joel Furr shipped his shirts yet? I see some people on the list have gotten shirts and i was wondering as I still have not gotten mine. Ben. ____ Ben Samman..............................................samman(a)cs.yale.edu I have learned silence from the talkative, toleration from the intolerant, and kindness from the unkind; yet, strange, I am ungrateful to those teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND! For information Email: zldf(a)clark.net http://www.netresponse.com/zldf

2 1

Re: Two-faced Security Problem? Dammit Janus?
by Chris Brenton 17 Dec '03

17 Dec '03

In reply to: > > >After poking around for a week, I discovered that my home machine, >newray.digex.net, is listed in the Digex's nameservers TWICE! Once with the >IP address that my home machine is waiting for (199.125.128.5) and once >with some other IP address in the digex space (164.109.211.61). If you do >an nslookup on the name, you get both addresses. I believe that the >technically correct thing for someone to do is to choose one of the >addresses at random to distribute the load between two machines pretending >to be one. This explains the connection failures that happened half of the >time. > >This has led me to wonder, though, whether this is some sort of security >breech. For instance, could there be someone out there mascarading as me? >Normally I run Eudora, Netscape, Telnet and other outward bound >applications. It was almost a fluke that I noticed that there were two >entries. > More likely this is a matter of someone assigning a host name to a system without realizing it has already been taken. Yes it can be a security breech but as you experienced the connection is broken easily. If someone wanted to grab your identity they would more likely busy your system (by flooding you with ping requests or something similar) and then grab you IP address. >Does some software need to find its IP address in a DNS table? For >instance, does Eudora need to look up 164.109.211.61 to find >"newray.digex.net"? The lookup typically goes the other way around, from host--->IP address. Dependant on the cache hits either address could be returned.

1 0

Re: ACLU Opposes Exon-Like Speech Crimes in Managers Amend. to House Telco Bill
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Thu, 3 Aug 1995 11:06:19 -0400 >From: ACLUNATL(a)aol.com > The amendment would have the >effect of actually usurping control from parents in favor of a government >approval panel. Anecdote: I was in Cambridge MA this past weekend visiting old friends, some at church. I sat across from one such at lunch -- a young guy up from Texas going on about how good it is that people are fighting cyberporn. I brought up parental control in attempted rebuttal and he switched immediately to the idea that `parents usually *are* the child abusers and we need to protect children from them -- not give parents control over what gets communicated electronically'. I was surprised at the speed with which he switched to that line of thought. It's clear that this chess game opening has been played by or around him before. [Come to think of it now, it's completely consistent with the anti-abortion stand: that children (starting at fetus) are the property of Society and parents are required to serve Society as soon as a child is conceived (or perhaps as soon as they start having sex). If it's child abusers you're talking about, that line of reasoning can carry emotional appeal. However, I lived in Utah at a time when it was illegal for parents to instruct their children about birth control (I was told (I didn't read the law personally.)).] - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

2 1