December 2003 - cypherpunks-legacy

Re: Still more on the Digicash protocol
by daw＠lagos.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.3.89.9512081312.A23124-0100000(a)unicorn.com>, Rev. Mark Grant <mark(a)unicorn.com> wrote: > > Exactly.. once you have an active attack set up, it's trivial, but setting > that up is quite hard. > But before everyone pats themselves on the back, congratulating themselves on how hard an active attack is to set up, look at http://www.EnGarde.com/software/ipwatcher/ Yes, folks, a commercial program which mounts an active attack. (Check out the GUI! Click on the `Watch Mail' control! Activate the `Take over' button! Whee, mom, hacking is fun!) Active attacks may not be trivial, but they aren't exactly rocket science, either -- and they're for sale. - -- Dave `is capitalism the best thing since sliced bread, or what?' Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMqY/ioZzwIn1bdtAQEkGQF/WdJBqbP5HwTDxldi0UDCmP2RZAFz5p2q cPMSoOIgkFbaBS34k4LSFPKcvegw3tJk =Ptyf -----END PGP SIGNATURE-----

1 0

Whew!
by Ed Carp 17 Dec '03

17 Dec '03

I just finished leafing through Schneier's "Applied Cryptography", second edition. Lots of new stuff, good and very thorough coverage of protocols and implementations, including weaknesses and processes behind same. If an idiot like me can understand this stuff (and if you don't believe I'm an idiot, just ask Perry), anyone can. I highly recommend the book, it's an absolute bargain at $50 USD. Should be required reading for anyone before being allowed to post here. :)

1 0

Re: More FUD from First Virtual
by Ed Carp 17 Dec '03

17 Dec '03

> From: Adam Shostack <adam(a)homeport.org> > Subject: Re: More FUD from First Virtual > To: jimbell(a)pacifier.com (jim bell) > Date: Sat, 9 Dec 1995 16:51:58 -0500 (EST) > Cc: cypherpunks(a)toad.com > jim bell wrote: > > [Good points about cost of transactions deleted] > > | The answer, I think, it that there would be no problem finding people to > | take that risk in exchange for the return, ESPECIALLY if they have some > | input into the design (level of security) of the system. They might insist > | on 2048-bit RSA keys, instead of 1024-bit, for example. > > (I know its only an example, but...) > > Key length is not what is needed for better security; more > solid code and better interfaces are needed. (I might also argue for > hardware keys that are more difficult to steal..) Nonsense. The code is pretty solid, the interfaces aren't very difficult. What is needed is better human management of keys. Why brute-force, why look for weak keys, why bother calculating how much safer 2047-bit keys are rather than 1024-bit keys when someone can look on your HD and find your secret key, when they can open your desk drawer and find your pass phrase or password, when they can guess that you used your wife's maiden name as your password? Adam, I don't understand why you wrote nonsense in the first paragraph, then followed it up with textbook attacks such as: > Cryptosystems fail because of bad storage of keys, coding > mistakes, accidentally writing passphrases to disk during a swap, etc. > Moving to 2048 bit keys is no help if you lose the key to a > non-cryptanalytic attack. Moving to keys with a week or day lifetimes > might be better. Moving the systems which automatically issue key revocation certificates, and coupling that with a wide distribution system would be the perfect match to such a scheme. Of course, that means that PGP et. al. needs to be more tightly integrated into existing mail software.

2 1

Re: GAK and self-incrimination?
by Greg Broiles 17 Dec '03

17 Dec '03

Tim May writes: >Consider this hypo: I send an encrypted message to a partner in crime >containing plans for future crimes and descriptions of past crimes. I don't >GAK the message. The government prosecutes me under the Anti-Terrorism and >Child Protection Act of 1997. > >My defense? That GAKKing the message would be tantamount to incriminating >myself, which the Fifth Amendment protects me against. The Fifth protects you against *compelled* self-incrimination - in particular, the right to be free from the "cruel trilemma" of o conviction of a substantive crime, based on your (true) testimony o conviction of perjury, for lying when asked to incriminate yourself o contempt of court sanctions, for refusing to answer but your hypo doesn't seem to create that forbidden situation. In particular, you're free to simply not send the message at all. (this message, sent from my Windows box, isn't PGP signed. Doh. signatures will return when the Unix box is net-functional again.) -- "The anchored mind screwed into me by the psycho- Greg Broiles lubricious thrust of heaven is the one that thinks every temptation, every desire, every inhibition." greg(a)goldenbear.com -- Antonin Artaud gbroiles(a)darkwing.uoregon.edu

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 9 Dec 95 at 21:43, Jeff Hupp wrote: > On 9 Dec 95 at 18:29, Siberia wrote: > : Okay, here's how I understand things with PGP and Pegasus. > : You have two options with Pegasus depending on the set-up > : options you choose. You can either send upon completion of > : your out-going email, or you can have your mail queued > : until you press the send out-going mail button. The actual > : PGP process does not occur until you actually send the > : mail. So the answer would be: don't queue your mail. > That's not really a solution in the Windows environment, if > you have a swap file, you never know what gets written out > to it. The solution is run w/o a swap file or run an > encrypted file system. I run an encrypted file system. Oh, PLEASE! Do you HAVE to go and mix up two completely different issues? Aren't the nontechnical people trying to follow these things likely to be confused enough without your adding to that confusion? For every person who really understands the technical issues there are probably a thousand or ten thousand who are just trying to *use* the stuff without stepping into a deep hole. An OS swap file is one kind of hole. What Siberia is writing about is ANOTHER type of hole. If I wipe my swap file after each use of my machine and don't know that Pegasus is doing this, or think that because of what you wrote I'm no worse off, I've been done a serious disservice. > Pegasus will indeed save your key with your message in the > outgoing queue. This is a problem with the design of > pegasus, not with the design of the add on encryptor. How about saying something USEFUL, like yes or no to the question of whether sending WITHOUT queueing will make any difference? How about agreeing that if David Harris hopes to provide a useful interface to external "encryptors" he will have to do something about this? How about cc'ing David? Somebody else could as well point out that we're all full of crap because we don't use Amigas, and while he might have a point, it wouldn't be a very useful one. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMq8MUjw99YhtpnhAQHA2wIAo72mzD7yNYy2btraeMg92hkekW/ik/hR SILC97a/gTGtZJiHV0MLcGETgZL51kFPQ3pRx+BGZl5g8JdRAQ2ZpQ== =gOtF -----END PGP SIGNATURE-----

1 0

Re: Warning about Pegasus Mail and PGP (fwd)
by Jeff Hupp 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 10 Dec 95 at 12:30, Anonymous wrote: : On 9 Dec 95 at 21:43, Jeff Hupp wrote: : : > On 9 Dec 95 at 18:29, Siberia wrote: : : > : Okay, here's how I understand things with PGP and Pegasus. : > : You have two options with Pegasus depending on the set-up : > : options you choose. You can either send upon completion of : > : your out-going email, or you can have your mail queued : > : until you press the send out-going mail button. The actual : > : PGP process does not occur until you actually send the : > : mail. So the answer would be: don't queue your mail. : : > That's not really a solution in the Windows environment, if : > you have a swap file, you never know what gets written out : > to it. The solution is run w/o a swap file or run an : > encrypted file system. I run an encrypted file system. : : Oh, PLEASE! Do you HAVE to go and mix up two completely : different issues? Aren't the nontechnical people trying to : follow these things likely to be confused enough without your : adding to that confusion? For every person who really : understands the technical issues there are probably a thousand : or ten thousand who are just trying to *use* the stuff without : stepping into a deep hole. : : An OS swap file is one kind of hole. What Siberia is writing : about is ANOTHER type of hole. If I wipe my swap file after : each use of my machine and don't know that Pegasus is doing : this, or think that because of what you wrote I'm no worse off, : I've been done a serious disservice.] So, I shouldn't take the opportunity to tell those non-technical people about the other "hole" they most likely have? After all this only effects Windows users and it is a problem with windows. Read what I wrote, I did not say the original post was in error about not queuing mail and saw no reason to repeat what appears to be a fact. And, if the non technical people don't know about the swap file problem, and just assume that if they don't queue mail they are no worse off then they have been don a serious disservice. BTY, did you check it out? Or just take what you saw as an opportunity to rant? : : > Pegasus will indeed save your key with your message in the : > outgoing queue. This is a problem with the design of : > pegasus, not with the design of the add on encryptor. : : How about saying something USEFUL, like yes or no to the : question of whether sending WITHOUT queueing will make any : difference? How about agreeing that if David Harris hopes to : provide a useful interface to external "encryptors" he will : have to do something about this? How about cc'ing David? : : Somebody else could as well point out that we're all full of : crap because we don't use Amigas, and while he might have a : point, it wouldn't be a very useful one. : Yes, it would have been a WONDERFUL opportunity to drop a O/S v. O/S troll on the list, notice I didn't. What I did do, was write up a problem description and mail it to David Harris. This based on the likelyhood that he doesn't read cypherpunks. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMrgqTUjeCeeebC9AQG3gwf/VdD9J/KJ1Tau3/L8BLoZ1v6ACAc93zcP 4F1MDoeX7EMSjWqGFZvsh0ev9hgciXvId9lu7tfMqIXQdolHzjXiyPXaw3qEa1Id A80j+Z7OKB9RSz9LKHQqjrrqpANDbJ16LIztYW5r9YjMSntWX9OF7MzeZ0BJRYc4 d1oWnhHqnF6K9rX2XWDveXyQJgCnu2sZw6nNXi0V61OdhBc/QmPsjBp+u7aig+i8 vdC7EJh2znKsNqlQqiJmHnfTbGuoVZGQkc/71hpD2reLzcU7W/NQwM7rL4PFGyDg QA15LXcfKsp6p0JCdZc+bvUfpH5mQQFWm4kd6sY7knjO3fKuTc7jpg== =Li0A -----END PGP SIGNATURE----- -- JHupp(a)gensys.com |For PGP Public Key: http://gensys.com |finger jhupp(a)gensys.com A generation which ignores history has no past - and no future.

1 0

anti-copy
by aq068＠detroit.freenet.org 17 Dec '03

17 Dec '03

How would it be possible to create files that KNOW they are a copy? I don't mean ones that look at the mod date, but a system that is near fool-proof. Just something I've pondered... Daark

4 3

Re: The Elevator Problem
by Daniel Miskell 17 Dec '03

17 Dec '03

s1113645(a)tesla.cc.uottawa.ca writes: > > >On Sun, 10 Dec 1995, Daniel Miskell wrote: > >> There is an easy way to develop a secret key in front any number of eves, >>be they experts or not, without the eves knowing what the key is. Even if >>they tap your phone/comm line, ect. There was an article in Discovery >>Magazine a couple of years ago, talking about how to use photons and their >>randomness as the perfect, uncrackable code. Use of the photons aside, >>there was a key generation method discussed, simple, yet secure enough to >>work out on a tapped phone. Let me root around. > >You must mean quantum crypto, by G. Brassard and C. Crepeau of U de Montreal. >Requires a direct fiber optic line from pt. A to B, in order to be >secure, if I am not mistaken. Which makes it impractical for most people, >as there are usually switches (or whatever they're called) and more than one >line in between. Lets you use OTPs with your next-door neighbor though. I think i was misunderstood. I was not referring to the actual use of light in the communications process. I was talking about the key generation method suggested in that article. Of course the use of light is impractical for most - the need for direct fiberoptics aside, you have to be able to test a photon for its polarized orientation. In any case, i dig on. Regards, Munster. --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

2 2

Re: Is there a lawyer in the house? :)
by Glenn Johnson 17 Dec '03

17 Dec '03

On the lighter side (not to be taken seriously): Q: What if Alice and Bob are siamese twins? Could we imagine a constitutional test that turns on whether a majority of organs are shared? Could the dissent cite the fact that some of the shared organs are not vital? Q2: Better yet, what if Alice and Bob were only 2 of say 6 distinct personality manifestations exhibited by one physical person? Again, would we need to arrange for a consensus among at least 2 more personalities to form a majority, thus entitling the collective to shared privacy? The answers to these and other exciting questions on the next episode of "Exhaust that Thread." At 01:27 AM 12/10/95 -0500, you wrote: >On Fri, 8 Dec 1995, Black Unicorn wrote: > >> On Thu, 7 Dec 1995, Jeff Weinstein wrote: >> >> > Black Unicorn wrote: >> > > >> > > On Thu, 7 Dec 1995, sameer wrote: >> > > >> > How about if Bob had a contractual agreement with Alice to keep his >> > key secret? >> >> Then as a defense attorney, I would argue that Bob had an obvious >> expectation of privacy with Alice, and that the fact that he relayed this >> key to Alice only under those circumstances represents a definite >> expression of his intent to keep the key private, thus triggering 4th >> amendment protections. My view is that this would be a very strong argument. > >Bob's Fourth Amendment rights are not triggered by his contract with >Alice. Alice can be compelled to give up the key (by testimony or >production) and giving up that key does not tend to incriminate *Alice* >in a violation of law. Alice can't invoke Bob's rights against >self-incrimination for obvious reasons: Alice isn't Bob. >^^^^ >EBD > > >> >> Note that this is an academic opinion, not a legal one as I am not being >> paid. >> >> > >> > --Jeff >> > >> > -- >> > Jeff Weinstein - Electronic Munitions Specialist >> > Netscape Communication Corporation >> > jsw(a)netscape.com - http://home.netscape.com/people/jsw >> > Any opinions expressed above are mine. >> >> --- >> My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li >> "In fact, had Bancroft not existed, potestas scientiae in usu est >> Franklin might have had to invent him." in nihilum nil posse reverti >> 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information >> >> > >Not a lawyer on the Net, although I play one in real life. >********************************************************** >Flame away! I get treated worse in person every day!! > >

1 0

Re: A challenge ...
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

> According to rumor, Jordan Hayes said: > > > > I've been challenged to try to find a bank account; I win the challenge > > if I can wire in $100 to the hidden account. Anyone have any good > > ideas about how to find an ABA number? > > Depends on what information you have. You looking for a Bank Name/ABA # > lookup, or the other way around? Wiring it successfully is one thing. Escaping the exception report at FinCEN and the Fed is quite another. Just an inspired guess... .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

1 0