December 2003 - cypherpunks-legacy

Re: alt.anonymous.messages considered harmful
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

> >Specifically, if HTTP transactions with > >a popular web server were routinely encrypted, then all reasonably long > >visits to that site would act as cover traffic for a message pool on that > >server. > > Qua? The "length" of the visit is just the time to download a document. > Leaving a page in the browser window doesn't generate traffic... You're absolutely right. I wasn't thinking sensibly about HTTP. I wanted to make an argument about the time it would take to search the pool and serve a results page. But upon reflection, I don't think that even holds up under my HTTP delusions of yesterday, let alone a realistic view. Please ignore the "reasonably long" part of my previous statement. Thanks for pointing that out. -Futplex <futplex(a)pseudonym.com>

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Thanks for this item! Two little excerpts jump out at me. They follow: > Last year, federal and state courts authorized 1,154 wiretaps, of which 48 > percent [snip] > "People are starting to say that seems awfully high," Dempsey said, noting > that > the overall level of such surveillance activity is now a total of 20,000 > to 25,000 > intercepts nationwide over an entire year. So what is it? 1,154 wiretaps? Or 20,000? FBI Director Louis Freeh testified under oath to 1,157. The FBI was asked for the data to support those numbers. The FBI refused to release them until the year 2002. The FBI is being sued under FOIA to support Freeh's sworn testimony. (Of course, he used different numbers at different times....) One last thing. What's so special about the year 2002? .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

4 3

Re: Crypto & Taxes [WAS Re: Cybersecurity]
by Bill Stewart 17 Dec '03

17 Dec '03

A couple of weeks ago, Michael Froomkin <froomkin(a)law.miami.edu> wrote: >> > fully applied crypto (e. g. fully anonymous digital cash) >> > makes it essentially impossible to base a tax system on income. >Hold on. This is more "factoid" than "fact": recall that income is PAID >by people as well as EARNED by people. Most payers have easily >detectible physical presence and assets that can easily be attached by >regulators. It will be a cold day before, e.g., my employer agrees not >to report my earnings. And the same is true for most employers in most >industries. Unfortunately, this is true, at least for people whose employers are subject to income tax somewhere. Taxing businesses doesn't make sense economically - you could collect almost as much money with far less disruption to the underlying economy by taxing it as wages for workers and dividend or interest payments to owners* rather than inside the business itself, substantially reducing the accounting workload of businesses**. But it's still very attractive to governments, not only as a lever for implementing social policy and extracting cooperation, but as a critical tool to force businesses to report wages payed to employees - I don't know if law.miami.edu is a taxable business, but for most employers, if they don't report the wages they paid to their employees, but do report all their revenue, they get taxed on the additional profit, instead of the employee getting hit with the tax; most people I know who've been paid "under the table" have been working for small businesses that are also not reporting cash revenues. Of course, if a business isn't _spending_ money on employees, but is just contracting for work performed by an Anguillan corporation, they still have receipts for expenses, and the financial arrangements between the Anguillan corporation and any of its US employees aren't really their concern.... >And if it ever stops being true, we'll just get VAT, and VAT inspectors. >So the line about death and taxes remains as true as ever, crypto or no. Value is really hard to measure in a service economy. Most of my work over the last N years has been talking to people, typing on keyboards, going places on airplanes to talk to other people and type on other keyboards, and occasionally handing people piles of collated and stapled dead trees, a racket for which people pay my employer lots of money***. Where's the value? When was it added? If the Tax Collectors don't see people handing my employer lots of money, can they demonstrate how much money they can confiscate? - - - - - - * this misses payments to foreign owners and taxes on foreign customers, but any government foolish enough to discourage investment by foreigners and sales to foreign customers deserves to be blamed heavily for lost jobs.. ** US businesses spend approximately 40% as much calculating taxes as they do _paying_ them... *** My previous employer was very good at taking metal, sand, and fermented dinosaur parts, and shaping them into boxes and strings that people would give them money for; they were extremely optimistic that they could get lots of people to also pay them money for sending them people to talk about boxes and strings and getting other people to pay _them_ for talking and banging on keyboards. They shouldn't have been quite so optimistic, and now I'm in the racket on my own, having not yet acquired overseas corporations to shelter my income through :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

5 5

The Crypto Applications we would rather not talk about
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Anonymous remailer and PGP Unusual applications I dont know if anyone else caught it last year but High Times discovered anonymous remailers and PGP for an article last year for anonymous remote control of grow rooms. PGP Wins again? and lately the thule people(bigoted and racist Nazis) have been learning to protect themselves also according to news reports from germany. Crypto and Privacy tools protect everyone from the hero to the anti-hero... the technology itself is neutral I wonder how long it will be before we hear news reports of some of the governments people being caught using internet casinos from the white house network. On other notes CCCF(the chaos computer club France) was shown to have had a high level plant from the french intel services, The founder of the CCCF himself. this story seems to repeat itself over and over when you are doing something of which the authorities DONT approve they WILL attempt to infiltrate and subvert from the inside. The answers are there and have been published in most books on tradecraft, 3 person cells organized as pyramids. Anonymous remail tech and crypto make this system possible with out Face to face contact. When does this lesson finally get learned? anon

2 1

Cypherpunks Santa Cruz Meeting/Party, 95-11-11
by tcmay＠got.net 17 Dec '03

17 Dec '03

I have sent out a detailed announcement of a "Cypherpunks Santa Cruz" meeting/party at my house in Corralitos, California, on Saturday, 11 November. This was sent to the mailing list of interested folks I maintain. If you are on this list, you already got the detailed message. If you are interested in getting on the list, drop me a line. I can also send the detailed announcement to anyone who is interested. As background, the Cypherpunks Santa Cruz is for folks in the Santa Cruz, Monterey, Carmel, Boulder Creek, Watsonville, Salinas, Big Sur, etc. area, or for anyone else on the Central Coast. Or anyone else, for that matter. At the last (and first) party we had Greg Broiles down from Eugene, Oregon, and Jeff Simmons up from San Luis Obispo, plus a bunch of folks from "over the hill" in the Silicon Valley/Bay Area. All told, 25 people. I'm not sure if there is a Bay Area meeting that day. If so, attend one or the other, or both, as my party starts late afternoon (of course, it may be a long drive, depending on where the Bay Aryans are meeting). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Crypto++, Cpunk Icons, list noise
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wei Dai <weidai(a)eskimo.com> writes: >I am still talking to RSADSI's lawyers, but it's taking a lot longer And the efforts are appreciated. Of course, your original efforts can still be appreciated at utopia.hacktic.nl. I don't know about everyone else, but that TCP encryption sounded interesting. Any plans to discuss it on the list? - ----- An anonymous complainer writes: >Well, Perry, my opinion is that there is far too much noise on this list >as it is. I have already seen my words drowned out by bellyaching over >next to nothing. POT-KETTLE-BLACK. Also, since nothing you've written (in your commentary, as opposed to anonymous announcements or releases that most people use anonymity for here) indicates that you're using anonymity for any particular reason, please stop so people can killfile you. Or send it from a nym at alpha.c2.org. I mean, the NSA has your real name anyway, what's the point... - --------- Jay Campbell <edge(a)got.net> writes: >>masquerade as Injuns in the 1800's and waylay Pony Express riders in order >> ^^^^^^ >>I think you'll find the NSA was not in existence in the 1800's. >I'm disappointed at the sheer number of similar pieces of email I received >on this. You'da thought the Capn Crunch reference was silly enough that >people would give me a funny look and trash the original message. Hmm, I guess most of them at least had the sense to not send it to the list. The list still sees FAR too many personal queries and rebuttals. TO THE GUILTY: take your bonehead replies to email please. Jay: I had a similar experience when I mentioned elsewhere that all the primes under 1000 digits were really invented by the NSA over 20 years ago. I recommended wearing garlic around the neck for protection... Everyone: This 1% wiretap thing is getting old. Hint hint hint - ---- Lastly, regarding cpunk icons, the only ones I was able to find were at the BAP site. I've been drawing a few of my own, one of them is done. It's a yellow diamond that says Cypherpunk on Board. And it has the anarchy-A- inside-a-C symbol. It's interlaced and transparent, so it doesn't look too bad. You're all welcome to steal it at http://students.cs.byu.edu/~don. Also working on a PGP icon. BAP has an envelope with PGP being the seal. I was thinking maybe a deadbolt ("PGP") with the inscription "Mommy said to lock the doors at night" or some kind of safety lock-your-doors or lock-your-data reference. For the time being I'm working on a simple PGP/ZLDF icon, it will be on my page Real Soon Now[tm]. If you like my icons please tell me. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMJvC7sLa+QKZS485AQFrIgL/VuRfkh7i+K3W3bLyep26riXdZgIVC557 RRcHf9VcacXOGyVvT03JESqNxV/XRcW2k8WDQ+fwhMDEHbHjkzWT5fUxXm6knRGc K0drBF8WlW0ZobEaiU7SgEnVjus5kFj4 =iAr6 -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Photuris Primality verification needed
by William Allen Simpson 17 Dec '03

17 Dec '03

Folks, I was somewhat disappointed in the response to our previous requests for verification of the strength of the prime moduli. Recently, someone asked for a smaller prime of only 512-bits for speed. This is more than enough for the strength of keys needed for DES, 3DES, MD5 and SHA. Perhaps this would be easier to have more complete and robust verification as well. Here are two "important" primes for Photuris use. If you have some spare cycles, it would be beneficial for in-depth verification of these strong primes. Implementation Optional. A 512-bit strong prime (p), expressed in hex: da58 3c16 d985 2289 d0e4 af75 6f4c ca92 dd4b e533 b804 fb0f ed94 ef9c 8a44 03ed 5746 50d3 6999 db29 d776 276b a2d3 d412 e218 f4dd 1e08 4cf6 d800 3e7c 4774 e833 The recommended generator (g) for this prime is 2. Implementation Required. A 1024-bit strong prime (p), expressed in hex: 97f6 4261 cab5 05dd 2828 e13f 1d68 b6d3 dbd0 f313 047f 40e8 56da 58cb 13b8 a1bf 2b78 3a4c 6d59 d5f9 2afc 6cff 3d69 3f78 b23d 4f31 60a9 502e 3efa f7ab 5e1a d5a6 5e55 4313 828d a83b 9ff2 d941 dee9 5689 fada ea09 36ad df19 71fe 635b 20af 4703 6460 3c2d e059 f54b 650a d8fa 0cf7 0121 c747 99d7 5871 32be 9b99 9bb9 b787 e8ab The recommended generator (g) for this prime is 2. > From: Phil Karn <karn(a)qualcomm.com> > I've used the mpz_probab_prime() function in the Gnu Math Package (GMP) version > 1.3.2 to test this number. This function uses the Miller-Rabin primality test. > However, to increase my confidence that this number really is a strong prime, > I'd like to ask others to confirm it with other tests. > Bill.Simpson(a)um.cc.umich.edu Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

1 0

re:using PGP only for digital signatures
by James Black 17 Dec '03

17 Dec '03

Hello, I am in a discussion (during the week) with a system administrator about seeing if we can just make PGP publically available to everyone, but now the discussion seems to be to just allow PGP to do digital signatures, and I don't think that is the best choice, then. They are not against PGP being used, but there are legal issues as to whether they can offer it to everyone, as some students are international students, and are not allowed to use the version for the US, or so I have been informed, so now I need to see if we can have the international version, so these students can use it. :( Is there any good programs (for the Unix, SunOS) that just does digital signature encryption? What they are trying to do is make certain that no one can send a message to anyone, claim to be in the faculty, and cause problems that way. My position is just a student programmer, but I am trying to learn as much as I can, to answer questions and deal with problems. Thanx. James Black black(a)suntan.eng.usf.edu

5 6

Re: video as a source of public randomness
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:08 PM 11/3/95, Perry E. Metzger wrote: >Timothy C. May writes: >> I don't plan to belabor this point. Radioactive decay sources are >> certainly fine, though not likely to be purchased by most people. > >Video digitzation equipment connected to TV tuners turned to dead air, >your suggestion, are equally unlikely to be purchased by most ^^^^^^^^^^^^^^^^ >people. The geiger counters are very simple and cheap, too. It is not correct to call this my "suggestion." I was responding to a previous post by Andrew Isaacson who said: "How useful would it be to use a video stream as a source of random input to something like /dev/random? I'm thinking along the lines of a Connectix QuickCam (sp?) or the cool videocam that comes with the Indy...." I was commenting on the sources of randomness, such as atmospheric RF variations, antenna configuration, tuner sensitivity, amplifier noise, etc., that would make prediction of snow bits very difficult. As to suggesting setting the tuner to dead air, this was just one facet of the discussion. I have no brief with any of the proposed schemes: nearly any are better than what we have now, if widely deployed and suitable used. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Credentials Without Identity
by tcmay＠got.net 17 Dec '03

17 Dec '03

Rich Graves makes some very good points, but he said something I want to riff on. (And as a measure of how apologetic some folks are getting about discussing anything not on Perry's List of Approved Topics, Rich unfortunately labeled his post "[ID point semi-off-topic]..." In fact, the issue of credentials and identity is NOT off-topic, not even semi-off-topic. It is central to the themes of our list. I urge all to read Chaum's seminal work on "credentials without identity.") At 1:05 AM 11/5/95, Rich Graves wrote: >Proving legal residency requires a combination of two documents, one each >from specified lists. Most commonly a driver's license, green card (which >is actually pink), or birth certificate from list A, and a social >security card from list B. > >Chris Hibbert's SSN FAQ talks a little bit about how this works, and why >it's a Good Thing. Basically, for privacy and security reasons, it is a >very good idea to separate the issues of identity and authorization. > >I don't care how securely you can authenticate who I am -- by PGP, retinal >scan, whatever. I do not want a single digitizable token to be the key to >my identity. Even if that identity cannot be forged (and everything can be >forged), it can be used to track me, by the government, by the Direct >Marketing Association, by the private investigators of certain wacky .... Chris's (or Chris') points are admirable, but getting more and more irrelevant by the day. The notion of unlinking identity and authorization by separate pieces of identification is another form of "security through obscurity." The two forms of credentials can be linked in data bases. Just because one piece of ID has citizenship or voting status and another has other stuff is meaningless, provided the ID forms can be linked. As they can, in multiple ways. The credit tracking agencies can do this trivially, with names, social security numbers, driver's license numbers, addresses, phone numbers, etc. All are pointers into the cloud of numbers that constitutes one's dossier. Happily, Chaum's work on "credentials without identity," based essentially on the kind of "blinding" used in digital cash (with some differences, of course), allows for one to display a credential showing one is old enough to enter a bar or library (in 2005), without revealing a name (which is just another credential). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3