December 2003 - cypherpunks-legacy

Re: using PGP only for digital signatures
by tcmay＠got.net 17 Dec '03

17 Dec '03

Pop Quiz: If you are a citizen of the U.S., prove it. At 11:33 PM 11/4/95, Simon Spero wrote: >On Sat, 4 Nov 1995, Derek Atkins wrote: > >> student from coming to the US. By allowing the student into the US, >> the gov't is implicitly giving them the right to use PGP within the >> US. > >This is kind of a risky policy to take. The general feeling I get that >allowing non green-card holders access to strong cryptography is sort of >decriminalised, in that the police aren't likely to break down your door >and have your AFS server accidentaly fall down stairs. However, it is >still against the law, and could be used against the university in other >unrelated circumstances. > >It seems that licences allowing foreign nationals access to cryptographic >software within the US are pretty easy to get, and especially for >something like PGP on a central machine. We really need to put this one to bed. As has been said several times recently, for the purposes of law, non-U.S. citizens who reside in the U.S are effectively "U.S. persons." Subject to U.S. law and generally having the same legal rights. (Can't vote. Can be drafted. Must pay taxes. Must have a SSN. Must obey traffic laws. Must not discriminate against the differently clued, etc.) All of the nonsense about wearing a "munitions shirt" in front of a "foreigner" seems to miss this essential point. Ditto for PGP use. Consider this: most people in the U.S. do not have a "credential" that shows them to be U.S. citizens. (Hint: most people in the U.S. do not have passports.) They have driver's licenses, which say nothing about citizenship (at least California and Virgina licenses do not). Social Security cards are the same. (Second hint: most people are hard-pressed to locate a birth certificate for themselves. Many people take the easy way out and simply buy a new one for the $25 a good one costs.) Therefore, there are few ways that citizenship can be "checked." Period. A foreigner who wishes to "prove" his non-U.S. status could, of course, show his green card. But this is different from proving citizenship. As to the USF--or was it SFSU?--student worried about "allowing" PGP to be used...I despair at this outlook. Why not simply ignore the issue, not "give" them PGP, but instead have a few pointers to where PGP may be gotten. As to the point about students impersonating faculty, if the faculty starts signing their messages (doubtful), then no one can impersonate _them_. (Except that it sounds like all this PGP stuff is to happen on campus computers, in which case there are several ways their private keys and passphrases can be snarfed.) The issue of a "credential" for faculty members, something that says "This person is a member of the Foo U. faculty," well, this is a different kettle of fish; such credentials are not part of the PGP system, though webs of trust could in principle be used in a klugey kind of way. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: Photuris Primality verification needed
by Hilarie Orman 17 Dec '03

17 Dec '03

> Recently, someone asked for a smaller prime of only 512-bits for speed. > This is more than enough for the strength of keys needed for DES, 3DES, > MD5 and SHA. Perhaps this would be easier to have more complete and > robust verification as well. Depending on what you think of the strength of those algorithms, the 512-bit mod p system may not be strong enough. The *strength* of 512-bit mod p DH systems is only about 56 bits. You need 1024-bit primes for a *strength* of 80 bits. In contrast, the 155-bit elliptic curve in the Photuris draft has a strength of about 76 bits.

1 0

using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- greetings c-punks, i may have posted this at some time in the past, as i have asked it elsewhere and gotten different responses. i'm interested in that the folx here think about it though, so here it is... i want a source of data for use as a otp. i don't want to have to hook up any external devices to my pc to do it. (although some of the methods mentioned in the past few days are quite interesting.) i'd like to know if there was a reason not to use the output of pgp to do it. i've been playing with the following method. i take a file and encrypt it to a key with the '-a' flag on. this generates an ascii file that is easily editable using simple, standard rexx calls. i strip the first 20 or so lines and the last 20 or so lines and put the resulting file aside. then i perform the same operation again and append the file to the previous result. i repeat until the file is sufficiently large for my purposes and then give the resulting file to the person(s) i want to have it. i still need a program to make use of the otp i've produced, but havent gotten that far as this is still pretty much a thought experiment and something for me to waste time with. once i'm ready to make use of it i'll either find a program or attempt to write something to use to make the data i've generated useful. i would think that the output of pgp should be pretty darn random. if it isn't, then it's usefulness is less than its reputation imo. as you can tell if you've read this far, i'm not a cryptographer. i just like the stuff and am working to become more proficient in its use as i think it is important if we are to maintain our privacy in an increasingly digital world. what are the holes in this? why would it be unadvisable to do it? otoh, would it be a good basis for a otp? amp <0003701548(a)mcimail.com> <alan.pugh(a)internetmci.com> PGP Key = 4A2683C1 November 5, 1995 1:16 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMJxWxigP1O9KJoPBAQFzxggAmRyJlfZVt8s6shqkkvFxmSpJdyZvaSEw O/hQEb5fJK4FuxZaIyw2Enp4Ca1/vGeEaw1Zc8JM2wSk2Km4Vjl7zlJjmIpOJ6Nw QAJfpHwwz77NMpMiWLj/m9nwkBeQs3IPcgDywIBu2Hfw6o79bndUS+GbEoG0f/+L jH7y0bZ+pNX/fLYaPZRnPPGVDqPn7VkfuvByT5Op5rNbHU56kSneW3bC79M1SO3K sYXpdGYU6mWC5xbYq1eQI9sCpkdB4pftMC3cizvKdueXGTMnXbngwBnu+Hk7GONz KOx9x6rWPJ/NBTJONiz4Scg28XelnziBP5OYXSWzBNFBoauZpcK0MQ== =8lYe -----END PGP SIGNATURE-----

5 5

Re: [NOISE] Re: 800_ape [FUQ Win95 List]
by Rich Graves 17 Dec '03

17 Dec '03

> On Sat, 4 Nov 1995, Rich Graves wrote: > > > I'm putting together a "Windows 95 Frequently Unanswered Questions File." This little P.S. attracted a lot of attention in private email. FYI, it's now available at: gopher://quixote.stanford.edu:70/0R1400265-1416663-/win95netbugs and in the newsgroups. It's short. Several points are of interest, if not direct relevance. Point D.8., apparent bugs in handling of longints, if confirmed, could have beaucoup crypto relevance. For the record, I hadn't noticed the acronym, but I like it. A lot. -rich

1 0

That's not what I wrote!
by tcmay＠got.net 17 Dec '03

17 Dec '03

Some of you may think this is a trivial correction, but I think it important, albeit bizarre: At 2:41 AM 11/5/95, Rich Graves wrote: >On Sat, 4 Nov 1995, Timothy C. May wrote: >> Rich's (or Chris') points are admirable, but getting more and more >> irrelevant by the day. The notion of unlinking identity and authorization >> by separate pieces of identification is another form of "security through >> obscurity." No, that is NOT what I wrote. It has been changed, with no indication that it is not what I wrote. If you check my original you'll find that what I wrote was: --- Chris's (or Chris') points are admirable, but getting more and more irrelevant by the day. The notion of unlinking identity and authorization by separate pieces of identification is another form of "security through obscurity." --- I can guess why Rich "corrected" my post, but he was in error for at least two reasons. First, because he didn't indicate that he'd corrected me. Second, because my item did not need correction. I originally wrote "Chris's," referring to Chris Hibbert, and then thought about the grammatical rules about forming possessives out of words ending in "s," and so I added the alternative "(or Chris')". Perhaps a minor point, and not one I'll lose sleep over, but I think it a bad thing to _ever_ correct the words of another in quoted material without indicating so. Editors who worry about typos and misspellings in quoted material usually put a "[sic]" in the text, mainly, I think, to let themselves off the hook for letting an error through. (Though I think another reason is to show graphically the igorance [sic] of the quoted author.) This point about Rich's post should not distract from his good comments that I responded to (or the points in the post that contained this correction, points I have not yet read). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: The Crypto Applications we would rather not talk about
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:00 AM 11/5/95, Nathan Loofbourrow wrote: > > The answers are there and have been published > > in most books on tradecraft, 3 person cells organized > > as pyramids. > >I've read only fictional accounts about the 3-person cell. Any >pointers to nonfiction material? "Tradecraft" didn't seem to be the >magic keyword in the local card catalog. It's easy to work out the relationships from first principles...I'm not sure what a book would add to your understanding. I suspect Kahn's "The Codebreakers" contains at least a brief mention of cell organizations, thought that was not Kahn's focus. Or, look at any of the various books on Soviet spy rings in the U.S., or various spy rings in WW II. For example, I think the true-life book "I Led Three Lives" might still be available--it was the basis of a t.v. show I used to watch in the early 60s. (The t.v. show presumably went to the same Politically Incorrect resting place as "Amos and Andy," mourned by Sapphire, The Kingfish, and me.) --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

To Repeat: Credentials Not Considered Necessary
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:03 AM 11/5/95, Simon Spero wrote: >On Sat, 4 Nov 1995, Timothy C. May wrote: > >> Therefore, there are few ways that citizenship can be "checked." Period. A >> foreigner who wishes to "prove" his non-U.S. status could, of course, show >> his green card. But this is different from proving citizenship. >> > >And here we have the rub. People with permanent residency (i.e. green >cards) are fully entitled to access to strong crypto. Most foreign >students are on J-1 visas, which do not grant permanent residency. Irrelevant. J-1 persons are still accorded the basic rights of citizens, save for a few things like voting, holding certain offices, and perhaps jury duty (not sure about this, as my recent jury summons was apparently based on my Calif. Driver's License and required no form of identification whatsoever). My basic point was that "J-1," "permanent resident," "citizen," "undocumented," and "completely and totally without proper papers" are, for the purposes being discussed here, all essentially identical. Any sysadmin who expects to have papers proving "citizenship" or any other status will have a tough time. Saying "People with permanent residency (i.e. green cards) are fully entitled to access to strong crypto." and--presumably--implying that J-1 visa holders are _not_ entitled to use strong crypto within the U.S. (or, for that matter, in their own countries, but this is another issue), is misleading. The laws about "showing a foreign national" certain items do not differentiate, so far as I have seen, between various kinds of visas. In any case, sysadmins generally do not ask for any kind of ID or proof of citizenship, morality, residency, etc. (On my many computer accounts over the years, as but one example, _never_ have I have been asked for credentials of any kind. Never. Not even a driver's license, let alone a passport or birth certificate or whatever. My current Internet Service Providers, netcom.com and got.net, are blithely uncaring about the fact that I am technically a citizen of Ruritania, and am not in the U.S. legally.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Telephone switch capacity -Reply
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:43 11/3/95, Rich Graves wrote: >[about the FBI supposedly wanting the ability to tap 1% of all phones in >the US simultaneously] [...] >Of course the FBI doesn't have the staff to listen to all these lines, and >they need an individual court order to authorize each individual >interception, so this numbers game is a bit of a joke. One more time. Despite what you read in the papers, despite what most people - even in the legal profession - believe, telephone wiretaps do _not_ require a court order. They haven't required a court order in over a year. The Digital Telephony Bill, which passed Congress by an overwhelming margin, _explicitly_ allows for wiretap authorizations other than a court order. The law does not impose any rules for these "other forms of authorization". "The captain signed it off" may suffice. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

[NOISE, if interesting NOISE] Assassins
by Black Unicorn 17 Dec '03

17 Dec '03

Interested parties might want to discuss the effectiveness of murder in politics with the world's most recent assassin. Or at least leave interesting mail to the security forces who will likely be running through his e-mail. Here's your chance to make your life REAL interesting, and test PGP, just send some encrypted mail to our friend and gunman Mr. Amir at: la59(a)popeye.cc.biu.ac.il --- "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Re: lp (134.222.35.2)?
by Richard Huddleston 17 Dec '03

17 Dec '03

134.222.0.0 is a Class B network, so if you do 'whois' on 134.222.0.0 (instead of the individual IP addresses) you find: European Unix Users Group (NET-EUNET-X25) Kruislaan 413 NL-1098 SJ Amsterdam NETHERLANDS Netname: EUNET-X25 Netnumber: 134.222.0.0 Coordinator: EUnet Ltd (EU-NIC) hostmaster(a)nic.eu.net +31 20 5925109 +31 20 5925165 (24hr Emergency) +31 20 5925163 (fax) Domain System inverse mapping provided by: NS.EU.NET 192.16.202.11 SUNIC.SUNET.SE 192.36.125.2 192.36.148.18 NS.UU.NET 137.39.1.3 NS2.NIC.FR 192.93.0.4 Record last updated on 07-Mar-94. ...what does this do to your traceroute dumps? Richard

1 0