December 2003 - cypherpunks-legacy

Jefferson Wheel Cypher
by kkirksey＠world.std.com 17 Dec '03

17 Dec '03

Message-Id: <v01510103ab5ed2c136c8@DialupEudora> -----BEGIN PGP SIGNED MESSAGE----- A couple of questions regarding Thomas Jefferson's Wheel Ciphyer: 1) How would you classify this cipher? It looks to me like a polyalphabetic with the plaintext also being the key, kind of like an autokey. Am I correct, or is this cipher a different animal entirely? 2) Can anyone point me to references on the cryptanalysis of this cipher? Many thanks in advance, Ken = Ken Kirksey And the Clinton administration launched an attack on = = kkirksey(a)world.std.com people in Texas because those people were religious = = Mac Guru & Developer nuts with guns. Hell, this country was founded by = = religious nuts with guns. - P.J. O'Rourke = -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLzkjt+sZNYlu+zuBAQEwPgP/XMWm/qDr1A0D49iBJdYNOX18j3DNbBvG xTOvSrzNziq9jq4026+TNpM3+PVGiji85yL3053jG26I0dJbckkVFr1PBfXmLrua nHBt5t/qy7RSvjsW80ZreeqVKwulo3NtT+XuWjU7EXZDSPUZts4JuHnGdlqQRiMo 1ERDP4+StM0= =PcEo -----END PGP SIGNATURE-----

2 1

RE: a new way to do anonymity
by Wei Dai 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > I'd suggest just getting something running first, to get some > prototyping experience. Now that I've just spent some time compiling and playing with Matt's ESM program, it seems almost perfectly suited for prototyping Pipe-Net since you can use it to do nested encryption. All that's needed is to hack it so that it implements link encryption (i.e., send a constant stream of random data in between keypresses). This is what the user would do: (LESM for Link Encrypted Session Manager) lesm -l lesm -l login to server 1 lesm -s lesm -l (or better yet take over a free LESM session already running between server 1 and server 2) login to server 2 lesm -s lesm -s I wonder if Matt has the time and interest do this... If not then I guess I can try, but I've never done real crypto programming before... Wei Dai -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzlIdDl0sXKgdnV5AQFKuwQAqhJulKWcPV8GWUM11+2zonT+EQ8q18YV TAymUlhjuYo0csHP/nmoMDRpf/9veISdBQE/GlRkc1k0JsWpPBD0+6e0nA7kCTMO xqVoXdM3F/qN31CXjMT9rgAanIXFat2Ox3bjT3g07ReaN372TPnGGvNauxO69Z52 kvWajSSXiSY= =yF/i -----END PGP SIGNATURE-----

2 1

The drumbeat against anonymity continues....
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

In addition to the articles and editorials, I'm seeing articles slamming anonymity and pseudoanonymity (we need a better word!) in business contexts. See the latest RISKS Digest (16.79, available on Usenet in the group comp.risks) for a couple of articles of interest. One is about the Singapore plans for an automatic vehicle intentification (AVI) system to implement "road pricing" on congested roads. Phil Agre's article makes some good points, and mentions using digital cash to avoid the Big Brother problems, but notes that Singapore is not seriously considering it. The real "drumbeat" article is about cellular phone fraud and toll-free number fraud. Actaully, a couple of related articles. (Everyone should at least skim "RISKS.") Anonymity is cited as a problem. But this misses the point, that the real problem is lack of a proper payment model. As David Chaum points out, there are really only two basic payment approaches: transfer of something of value or an account-based transfer. Cash or barter are examples of the first, checks or credit card payments are examples of the second (though each has some wrinkles). Digital cash, when online cleared, behaves mostly like real cash. The phone companies that are complaining about fraud have inadequately arranged for security and need to adopt a mode that fixes this. Since physical money can't be fed into the slots of a handheld cell phone (or at least can't then be delivered to the service owner!), the solution has traditionally been an account-based payment system. (Accounts can also be better protected against fraud by having PINs, etc.) What about telephone calling cards? I don't recall the details well enough to know if they could be used on handheld units. Maybe they could be used. This could eventually be a market for digital cash. (If fraud is a serious-enough problem, costing enough, then a service which could lower costs by using digital cash could make market inroads.) What we need to watch out for are proposals to limit anonymity, to mandate national ID cards, so as to somehow limit such cases of fraud. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

Re: Judges-L FAQ
by Michael Sattler 17 Dec '03

17 Dec '03

At 12:43 2/8/95, Craig A. Johnston wrote: >I must inform you that this FAQ is copyrighted material, and >you are requested not to distribute it. What good is a FAQ if you can't distribute it. The judges are confused in more ways than one. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | You couldn't get a clue during the clue mating season in | a field full of horny clues if you smeared your body with clue musk | and did the clue mating dance. - Edward Flaherty |

2 1

S. 314 and existing situation
by Richard F. Dutcher 17 Dec '03

17 Dec '03

Gee, fellas, looking over this bill, *most* of what's going on is just porting existing telephone law over to cybercomm. Given the existence of 900-sex-talk, the phone companies are clearly not being held responsible for content. They are required, of course, to cooperate when complaints of harassing or obscene calls are made, to obey properly warranted requests for wiretaps, etc. It's perfectly reasonable to expect similar requirements on net service providers. > > Read carefully. There are indeed implications for Internet service > providers in terms of their responsibility under the law for the content > of their systems and services. > Yeah, but First Amendment and common carrier law is a morass of conflicting statutes, interpretations, and case law. After all, libel law puts some content liability on newspapers [too much, IMHO, but it has hardly destroyed freedom of the press]. As several posters have noted, the placement of the key words "knowingly" and "intentionally" are critical. It doesn't appear, though, that any "knowingly"s or "intentionally"s have been removed. I am forwarding copies of this and the whole bill text to my brother, the former DA in Telluride, to see if he sees any unusual craptraps. I'll post any useful reply ... > > (a) Prohibited acts generally > > Whoever - > > (1) in the District of Columbia or in interstate or foreign > communication by means of [telephone] telecommunications > device - > > (A) [makes any comment, request, suggestion or proposal] > makes, transmits, or otherwise makes available any comment, > request, suggestions, proposal, image, or other communication] > which is obscene, lewd, lascivious, filthy, or indecent; > > (B) [makes a telephone call, whether or not conversation > ensues, without disclosing his identity and with intent to > annoy, abuse, threaten, or harass any person at the called > number] makes a telephone call or utilizes a telecommunications > device, whether or not conversation or communications ensues, > without disclosing his identity with intent to annoy, abuse, > threaten, or harass any person at the called number or who > receives the communication; > > (C) makes or causes the telephone of another repeatedly or > continuously to ring, with intent to harass any person at the > called number; or > > (D) [makes repeated telephone calls, during which conversation > ensues, solely to harass any person at the called number; or] > makes repeated telephone calls or repeatedly initiates > communication with a telecommunications device, during which > comversation or communication ensues, solely to harass any > person at the called number of who receives the communication; > or I.e., *just like with phones,* you can't send harrassing or obscene messages to unwilling recipients. Is there a lot of slack for bullshit? You betcha! A major change from the present? Doesn't look like it. [no intention of holding up the present as paradise, of course ;-] > > > (b) Prohibited acts for commercial purposes; defense to prosecution > > (1) Whoever knowingly - ^^^^^^^^^^ [applies to A & B below] > > (A) within the United States, by means of [telephone], > telecommunications device makes (directly or by recording device) > any obscene communication for commercial purposes to any person, > regardless of whether the maker of such communication [placed the > call] placed the call or initiated the conversation; or > > (B) permits any [telephone] telecommunications facility under such > person's control to be used for an activity prohibited by > subparagraph (A), shall be fined in accordance with title 18 or > imprisoned not more than two years, or both. > > (2) Whoever knowingly - ^^^^^^^^^^ [applies to A & B below] > > (A) within the United States, [by means of telephone, makes] > by means of telecommunications device, makes, knowingly > transmits, or knowingly makes available (directly or by recording > device) any indecent communication for commercial purposes which is > available to any person under 18 years of age or to any other person > without that person's consent, regardless of whether the maker of > such communication [placed the call] placed the call or > initiated the communication; or > > (B) permits any [telephone] telecommunications facility under such > person's control to be used for an activity prohibited by subparagraph > (A), shall be fined not more than [$50,000] $100,000 or imprisoned not > more than [six months] 2 years, or both. > =================================== Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ... ====================================

4 3

Meeting Anncouncement for Sat. Feb. 11 1995 SF Bay Area Meeting
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

What: Cypherpunks SF Bay Area Physical Meeting When: 13:00 February 11 1995 Where: Silicon Graphics, Inc., Building 5 (SGI's Iris Cafeteria) 2025 North Shoreline Boulevard, Mountain View, CA, Earth, Sol, MW Topic: Crypto Networking Protocol Hygiene Agenda: (listed times are almost all a joke) 12:00 Brown Bag Lunches, AV Debugging, Loose Talk 13:00 Meeting Begins (MBONE broadcast begins) 13:02 Meeting Announcements, Agenda Rewrite 13:08 Hugh Daniel on "When What Goes Where: Good Networking Protocol Hygiene" 13:45 Eric Hughes on "Sendmail as a Multiplexor" 14:30 Michael Sattler on "Announcement of CryptDisk v1.0" 14:40 General Announcements, Questions, Confusion etc. 15:00 BREAK! 15:30 Doug Barnes "Stream-oriented, analysis-resistant public-key protocols over UDP" 16:15 Raph Levien & KT Kislitzin on "Design philosophy for the upcomming PGP 3.0 API" 17:00 Hot New Topics of the Week & General Free For All! 17:59 Mbone Broadcast ends 18:00 KP room, Thank our SGI hosts & GOTO Dinner Presentations: "When What Goes Where: Good Networking Protocol Hygiene" Hugh Daniel <hugh(a)toad.com> When designing, coding and testing programs we are confronted with a myriad of choices as to how various parts of the solution communicate. Much is known about how to design 'protocols' that are flexible, debugable & robust. We are currently encoding cryptographic protocols in our systems and networks at a furious rate, yet there are new challenges in keeping such systems robust, secure and sometimes even anonymous. I hope to touch on some of the well known tricks and dangers, what is new when cryptographic and anonymous systems are combined with todays systems and where we might learn from the past. "Sendmail as a Multiplexor." Eric Hughes <eric(a)remailer.net> The basic architecture of sendmail is a recognizer and a dispatcher. These two elements provide a good framework for designing systems that can be changed piece by piece. Even when a facility seems to have stabilized, it's often a good idea to keep the flexible framework around for future experimentation and expansion. "Announcement of CryptDisk v1.0" Michael Sattler <msattler(a)jungle.com> CryptDisk (for the Macintosh) is an example of the kinds of [mostly] transparent strong crypto that we need. Integrated smoothly with the operating system, CryptDisk provides IDEA encryption on a block read/write level for a virtual hard disk. It's beauty lies mainly in that it does exactly what the user expects and requires no more setup than remembering a pass-phrase. Source code is available upon request. Warning: Some governments might consider this software a "Munition", not suitable for "private possession" by free peoples. "Stream-oriented, analysis-resistant public-key protocols over UDP" Doug Barnes <dab(a)Tadpole.COM> Many cypherpunks projects have a need to reliably transmit variable-length (sometimes quite long) data over unreliable networks. TCP lends itself to traffic analysis and is not well-suited for use in a hypothetical system of packet laundries that would lead to packets within a particular stream appearing to come from a variety of sources. We have designed and are currently implementing a UDP-based, hidden-streams protocol that utilizes fixed-length blocks and pseudo-random sequence numbering to provide reliable, stream-oriented services to higher-level applications despite extremely creative routing and laundering of packets. Raph Levien <raph(a)netcom.com> & KT Kislitzin <ktk(a)sgi.com> "Design philosophy for the upcomming PGP 3.0 API" PGP is getting a major upgrade soon, some of the team doing the work will talk about the motivations and directions the work is going in. --------------------------------------------------------------------------------

1 0

Not necessarily crypto but scary anyway...
by root 17 Dec '03

17 Dec '03

Hi all, A friend advises me that today House Bill 666 passed. This supposedly would allow police officers to use evidence collected illegaly if they 'believed' that it was collected in good faith. Any word on it? Thanks.

10 13

Re: Effects of S.314 (Communications Decency Act)
by Carl Ellison 17 Dec '03

17 Dec '03

>Sender: owner-cp-lite(a)comsec.com >X-Signed: PGP-Detached-2-3, > iQBXAwUBLzhSutC3U5sdKpFdAQEEqwIMCg1PFWC19WuW2BhwmzUyg84RthT/61x9 > vLrIPbgrYcCXCNB8F51tQogs5lBrry/aOk2Fk3Izl//XC4KDl+cADrCz >Date: Tue, 7 Feb 95 21:24:01 PST >From: jpp(a)markv.com >of the very most important rights. To hold the owner of a buliten >board responsible for the illegal messages posted to it, is to force >the buliten board owner to become a government censor in all but name >(and wages). anyone heard of "no unfunded mandates" ?

4 3

Re: Judges-L FAQ
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 3:43 PM 02/08/95, Craig A. Johnston wrote: >It has come to my attention that the Judges-L FAQ is being distributed >by someone who obtained it on this list, and being sent to people made >to look as if it has issued from David Stodolsky. > >I must inform you that this FAQ is copyrighted material, and >you are requested not to distribute it. Huh? What kind of an FAQ is it, that can't be freely distributed? If you don't expect people to redistribute the text, don't call it an "FAQ". The phrase "FAQ list" is understood internet-wide (or at least usenet-wide) to mean a freely distributable list of information someone might want on a certain topic. (It doesn't neccesarily mean "Frequenty Asked Questions", literally, these days. Cause there are often FAQs distributed that just contain general information on a certain topic, but not actually questions that have ever been asked before. The Judges FAQ might be a good example.) If you don't want people to redistribute the thing, the really should change it's name. And write very explicitly at the top of the document that no one should copy it without permission of the author. These things just aren't generally supposed to be true of FAQs.

1 0

Re: Not necessarily crypto but scary anyway...
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

> > On Wed, 8 Feb 1995, Ben wrote: > > > On Wed, 8 Feb 1995, root wrote: > > > > A friend advises me that today House Bill 666 passed. This supposedly would > > > allow police officers to use evidence collected illegaly if they 'believed' > > > that it was collected in good faith. > > > This sounds like a spoof. Look at the number. > > Unfortunately, it is not. World Wide Web yourself over to > http://thomas.loc.gov/ and search for hr 666...you will find it. > > "A Bill to control crime by exclusionary rule reform..." maybe if > "control" means "aiding and abetting" > > -Thomas > I haven't looked it up yet, but I did hear about the bill on news last night, so I would say it is legit. The number of the devil indeed. ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX http://spirit.aud.alcatel.com:8081/~droelke/

1 0