December 2003 - cypherpunks-legacy

revised time quantization package (Unix & WIN32) available
by Matt Blaze 17 Dec '03

17 Dec '03

A revised version of my simple CPU time quantization package is now available for most Unix and, thanks to the efforts of Frank O'Dwyer (Rainbow Diamond Ltd), WIN32 platforms. The package provides a simple interface to encapsulate code blocks that must run in a multiple of a coarse-grained "quantized" amount of CPU time. It is useful in building various on-line cryptographic protocols in which an attacker could otherwise learn key information by observing the time the target takes to perform calculations that use the secret (c.f., Paul Kocher's recent attacks). The basic idea is that you can specify a "quantum" such that at the end of an encapsulated block the CPU will busy-wait until the next quantum multiple. Fine-grained (below the quantum) timing information is thereby denied to the observer (including unprivileged processes on the same machine). The code is quick-and-dirty and only runs on Unix-centric and WIN32-based platforms. Test and use at your own risk. There are (basically) no restrictions on the use or distribution of the (very simple) code. Get it from: ftp://research.att.com/dist/mab/quantize.shar The quantize package is also part of Jack Lacy's cryptolib package (watch this space for details). -matt

1 0

Re: Java and timing info - second attempt
by frantz＠netcom.com 17 Dec '03

17 Dec '03

>Jim Miller (jim_miller(a)bilbo.suite.com) writes: >Of course it would be a lot easier for the applet to just try to read the >secret key file, encrypt it with an embedded public key, and post it to >alt.anonymous.messages. If I understand Java security correctly, the applet can just send data back to the server it was loaded from, but can't read random files on the machine it runs on (even if the user running it can read them). Java is beginning to become cluefull about the idea that a program is not the same as the person running it, and should not have the same privileges. In this area, most OSs (inluding Unix) are totally clueless, which is why the Orange Book has mandatory security requirements at the "B" and above levels. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

DES modem
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

I recently aquired a DES modem. It's a MESA432 made by Western Datacom. The writing on the front proclaims "9600 bps NBS DES ENCRYPTION MODEM". It has all of the usual front lights, plus one labled 'encrypt'. On the back it has jacks for leased-line and dial-up, an RS232 connector and an external speaker connector. Has anyone ever used one of these? Can anyone give me any information on it? I realize that without a second modem it's not much use.

1 0

Re: Political Cleanup program
by jim bell 17 Dec '03

17 Dec '03

At 02:04 PM 12/17/95 -0800, Detweiler wrote: > >JB: >>Politics is traditionally corrupt, it appears, because donors to politicians >>and political campaigns expect a quid pro quo for their donations. Various >>unsatisfactory solutions include campaign spending limits, etc. > >I have an unusual view that I've never seen elsewhere: the problem with >our government is not that money or PACs are involved, but that the system >does not handle or resolve the conflicts between them very well. in other >words, in contrary to the current view that all PACs are evil, I think the >problem is not that we have PACs, but that our current system does not >balance their demands in some sensible manner. the system is >susceptible to corruption. it is conceivable however that there would be >a system that involves money and politics but still avoids corruption. Here's a question I have never heard anyone else ask (or answer!). "What is the purpose of a PAC? To be more specific, a PAC simply seems to be a funnel through which individual donations flow; why do we need a PAC? Is it to keep records of "who's naughty and nice"? Any contribution that can be made by a PAC could just as easily be made by one individual. >>It occurs to me that it would be a major advance if a system could be set up >>that would "blind" campaign donations as to their source: The donor could >>be satisfied that his donation gets to the candidate or cause, but the >>candidate couldn't know who actually paid the money (and the donor would be >>unable to prove that he made a donation, for example). Admittedly there are >>a lot of details that need to be worked out, but if this could be >>accomplished it would change politics as we know it. > >what you describe would allow anonymous bribes. Which, I suggest, is better than a non-anonymous bribe. > the giver could always "always"? Are you sure about that? >identify his cash donation "out of band" to the receiver. It is exactly this that the system I'd propose would prevent. I realize that you may not be able to imagine such a system, but that doesn't mean that such a system could be designed. (Before 1975, most of us would not have been able to imagine public-key encryption, for example.) A giver could CLAIM to make any sort of donation at all; but if the system were properly designed he could simply be lying to the officeholder. > moreover, other observers >would not be aware of the relationship. Not IMMEDIATELY, perhaps, but eventually the books could be opened, perhaps as much as years later. (Let's say, 3 months before the end of the term of the politician. And the amounts donated could withheld, with only the total donated reported every 3 months or so. (And perhaps only to 1 or 2 significant digits of accuracy.) For example, a Senator will be told on January 1, 1996, that up until that point he's received "about" $1.4 million dollars of donations. He would not be able to link these donations with any particular claim. Somebody could claim to have given him "$2000" of donation, which wouldn't even show up to the accuracy of the amount told the politician. Further techniques could be used to disguise the rate of giving. >why do you think this would be an improvement? Easy. It would remove much of the reason for a politician to treat one citizen differently from another citizen. >to the contrary our current system works hard to require >the disclosure of who donated what to a candidate, so the candidate's potential >hidden agendas and ulterior motives can be revealed. seems reasonable to >me. _EVENTUAL_ public disclosure of such information is not inconsistent with my idea. >you are probably barking up the wrong tree here on cypherpunks, however, >because most of the key "insiders" here are convinced that democracy is >a proven failure, and that in fact government is invariably corrupt and >oppressive, no matter what the implementation. the "solutions" advocated >here are chiefly withdrawal and subterfuge. I don't disagree with that assessment. However, that does not mean that I don't want to make life as difficult for the politicians as possible until they are swinging from a rope. >needless to say I disagree with this. I wonder if some day someone will >invent a "killer app" that doubles as a political governing system. >it seems to me politics is one of the last most intractable areas of >human interaction when many others have been harmonized and systematized >by the information revolution. I suspect it will eventually succumb to >technological ingenuity as well. the end result would be a government >that is not perfect, but is at least as good as the population that >drives it, and no worse. (in contrast today we seem to have a government >that is no better than the least common denominator). > > >JB, I have to wonder however how your ideas about campaign reform tie into >your prior advocation "Prior"? It's not "prior." I haven't changed my previous position one bit. > of political assinations as a legitimate form of >citizen power. have you given up on the idea of murdering politicians as >a means of political reform? Not "political reform." Political ELIMINATION. I want to eliminate the entire concept of a heirarchial government. > or are you now just coupling that idea with >campaign reform to put some new bells and whistles on >your overall ideological package? I repeat my previous statement. I'm happy to see them squirm before they are led to the gallows. Making life as difficult as possible for them is my goal. Using technology to disable their normal methods of corruption would be an excellent start.

3 2

Antiterrorism Bill Dead
by Duncan Frissell 17 Dec '03

17 Dec '03

At last some good news from the Hill. The House Judiciary Committee has announced that they are unable to vote on Chukie Schumer's Antiterrorism bill at this time. It is "dead for now." That means that the $500 million for the telecoms companies to carry out the Digital telphony Initiative is also dead for now. Thanks to an heroic coalition of leftist civil liberties types and right wing nuts (including the Fundies) for squashing it for now. Now if we could only convince the Fundies that the Klinton Admin was going to use the Exxon amendment to outlaw religious speech on the nets on the grounds of political indecency. But maybe the Telecoms bill will die too. It did last time. DCF

2 1

Re: What ever happened to... Cray Comp/NSA co-development
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:15 PM 12/18/95, Derek Atkins wrote: >Correction of another detail: > >> > tcmay(a)got.net (Timothy C. May) writes: >> > When you've done this, and concluded that RSA-129 could be done in, say, X >> > minutes, then move on to RSA-384 (the BlackNet key cracked by the MIT >> > group), and on to the 1024- and 2048-bit keys. Tell us how many years or >> > centuries it will take. (Hint: Rivest and Schneier have done these > >RSA-129 is 129 decimal digits, not 129 bits. This computes to about >425 bits, which is actually more difficult than the 384-bit Blacknet >key. I'm not having much luck on this example, am I? The RSA-129 I remembered correctly as being 129 decimal digits, but I spaced out on the 384-bit key and mislabelled it as "RSA-384." It'll be _many_ years before a 384-decimal-digit number is factored, I suspect. Let alone a 600-digit modulus, with or without the mysterious "transphaser" technology mentioned by Anitro. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

cyphernomicon FTP site?
by Vinod Valloppillil 17 Dec '03

17 Dec '03

Anyone know where I can FTP a full copy of the cyphernomicon? ------------------------------+----------------------------------------------- Vinod Valloppillil | LibertarianismTelecommunicationsFreeMarketEnvi Engineering/Wharton | ronmentalismTechnologyCryptographyElectronicCa University of Pennsylvania | shInteractiveTelevisionEconomicsPhilosophyDigi vvallopp(a)eniac.seas.upenn.edu | talPrivacyAnarchoCapitalismRuggedIndividualism ------------------------------+-----------------------------------------------

1 0

PGP's randpool()
by Adam Shostack 17 Dec '03

17 Dec '03

What does PGP do when it exhausts randpool? I've scanned the source, and found some useful tidbits, but RANDPOOLBITS seems limited to ~408 bytes. I can invoke commands that should exhaust PGP's randpool, but don't seem to. Doing "pgp +makerandom=4000000 foo" repeatedly seemingly would cause PGP to prompt me to type in some random stuff, but it doesn't. I'm trying to see how pgp reacts to me taking all its random bytes because I'm writing some shell scripts that use pgp to generate random passphrases. (This is a case where I don't think bunches of system data are enough.) (Note to reporters who might be listening: This is an fairly unusual invocation of PGP where a user would not interact with the program at all to supply new randomness. Its not an attack on PGP's security in any interesting or newsworthy sense.) random.c: * - Every time you run PGP, especially when responding to one of PGP's * prompts, PGP samples the keystrokes for use as random numbers. * It is a shame to throw this entropy (randomness) away just because * there is no need for it in the current invocation of PGP [... Further down...] /* * Performs an accumulation of random bits. As long as there are fewer bits * in the buffer than are needed (the number passed, plus pending bits), * prompt for more. [heavily cut] void trueRandAccum(unsigned count) /* Get this many random bits ready */ { LANG("\nWe need to generate %u random bits. This is done by measuring the\ \ntime intervals between your keystrokes. Please enter some random text\ \non your keyboard until you hear the beep:\n"), count-trueRandBits); -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

RE: Political Cleanup program
by Kurt Buff (Volt Comp) 17 Dec '03

17 Dec '03

Ya won't have complete equity amongst lobbyists, until ya remove the power of bureaucrats to control people's lives. When laws can be used to deprive people of their livelihood, via either taxation or regulation, you will create situations where people can make money from it, and therefore unscrupulous people will take advantage. The only defensible argument for government at all is to protect people from depredation, either from fellow citizens or from external threats. When you prevent people from engaging in peaceful commerce, you open the floodgates to tyranny. Thus, the solution is less government, not to try to legislate human nature. Kurt [speaking for myself, of course] ---------- From: Richard Huddleston[SMTP:reh@wam.umd.edu] Sent: Monday, December 18, 1995 6:12 To: jimbell(a)pacifier.com; vznuri(a)netcom.com Cc: cypherpunks(a)toad.com Subject: Re: Political Cleanup program Detweiler wrote: * >JB: * >>Politics is traditionally corrupt, it appears, because donors to politicians * >>and political campaigns expect a quid pro quo for their donations. Various * >>unsatisfactory solutions include campaign spending limits, etc. * > * >I have an unusual view that I've never seen elsewhere: the problem with * >our government is not that money or PACs are involved, but that the system * >does not handle or resolve the conflicts between them very well. in other * >words, in contrary to the current view that all PACs are evil, I think the * >problem is not that we have PACs, but that our current system does not * >balance their demands in some sensible manner. the system is * >susceptible to corruption. it is conceivable however that there would be * >a system that involves money and politics but still avoids corruption. Not to sound like a dupe or anything, but every time I get discouraged at the rampant mealyism of our political system I go read the first couple of paragraphs of a text from GOVT 101. There, I get reminded that the way most political debate is handled elsewhere is with bullets. Personally, I welcome a complete equity between all lobbyists seeking to obtain a politico's ear. Take the money out of the equation, and let the merits of their causes, if any, stand on their own. Happy holidays, Richard

1 0

Applescripts for monitoring Netscape Activity
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

The recent Netscape beta bug mentioned here raised a technical question? Anyone here have a pointer to an applescript, frontier or macperl script for monitoring what programs do to your system folder and desktop? Otherwise, I'd better write one. It'd be a good way to learn more about the behavior of apps. Thanks and happy holidays, Bill Humphries Call your Representative and Senators and demand an end to attempts to censor the Internet. More info at http://www.vtw.org/ *** The answer to porn speech is free speech -- via Molly Ivins ***

1 0