December 2003 - cypherpunks-legacy

My goof on toad.com lags...
by tcmay＠got.net 17 Dec '03

17 Dec '03

A few minutes ago I wrote: --- At 12:20 PM 10/2/95, Peter Trei wrote: >For those curious about the latency, I'm posting this at 12:08, on the US >east coast. >How long did it take to reach you? I got it at 09:14, Pacific Daylight Time, so there appears to be no lag. --- Well, before you all correct me, yes, I now realize it was my copy, sent directly to me, that I received. As of 09:35 I haven't received the toad.com-delivered copy. But my point remains that many times the lags are on local ISP systems, not necessarily on toad. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

SSH random numbers
by Lance Cottrell 17 Dec '03

17 Dec '03

I have finaly been goaded into using SSH. I seems like a great tool, but I have one major worry. When I install SSH, it generates the host key right away. When I run ssh-keygen, it generates my user key right away. Where is it getting the random numbers. Before I dive into the source I was wondering if anyone else had looked into this? -Lance no PGP sig because I am on a remote machine. ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: CJR for perl-RSA t-shirt
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:58 10/1/95, Robert Hettinga wrote: >>Subject: Mass Market Software with Encryption - 15 Day Expedited Review >> Requested >> >>Subject: Commodity Jurisdiction Request for >> perl-RSA t-shirt, an encryption program > >ROTFL! > I agree. I especially laughed at the part that stated "... also as a bar code, making the t-shirt machine readable as well as machine washable."

1 0

Re: List latency.
by Joel McNamara 17 Dec '03

17 Dec '03

As a non-crypto, latency-related, aside. The USENET newsfeed coming out of uunet to my ISP was non-existent last week. It's improved somewhat, but is still lagging behind by 2 or 3 days (never did this in the past). uunet has not provided my ISP with an explanation as to what is happening. Perhaps it's related to the delay in list messages appearing. Unfounded speculation has been the .edu sites are active again after the summer and are swamping things. Joel McNamara joelm(a)eskimo.com - http://www.eskimo.com/~joelm for PGP key Thomas Jefferson used strong crypto, shouldn't you? >It looks like there's a considerable delay entering and leaving uunet. I'm not sure which >machine gets the blame, but it's either toad&uunet, or uunet&alcor.

1 0

Time Lag (was Re: Yet Another "(Fwd) Internet Euro-Clipper")
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > At 12:20 PM 10/2/95, Peter Trei wrote: > > >For those curious about the latency, I'm posting this at 12:08, on the US > >east coast. > >How long did it take to reach you? > > I got it at 09:14, Pacific Daylight Time, so there appears to be no lag. I got it at 11:53 PDT. I just checked the headers and the delay was split in a couple of places. (Correcting all times for PDT) thunk -> 9:10 -> alcor.process.com. (And they're off and running!) alcor.process.com. -> 9:10 -> toad.com. (delivered in 0 time:) toad.com. -> 11:29 -> relay3.uu.net. (Sat on toad 2hrs, 19 min) relay3.uu.net. -> 11:54 -> mail2.pilot.net. (Sat on relay3 25 mins ) mail2.pilot.net. -> 11:53 -> verity.com. (delivered into the past!) Of course these delays can vary a few minutes either way because of inaccuracies of time clocks on various machines. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

More forged cancels
by jbyrd＠tiac.net 17 Dec '03

17 Dec '03

These were found in control. Note that they all have the string "CANCELLED", and all are timestamped 17:56. The first one is definitely forged. The others look like they probably are. I asked Jukka Santala, and he didn't issue that forgery. I asked Joel Rubin, and haven't gotten a response yet. I haven't asked the other people yet. So I'll go ahead and post this, crossposted to the affected groups. It looks like the Cancelschnauzer is hitting lots of groups. A note to the canceller: if you try to cancel this, I'll just put it back. -----------------begin control message Path: sundog.tiac.net!news.sprintlink.net!in2.uu.net!sunic!mn6.swip.net!seunet!news2..swip..net!plug..ne ws.pipex.net!pipex!tank.news.pipex.net!pipex!usenet.eel.ufl.edu!news.gmi..edu!msunews!netnew s.upenn.edu!ts7-28.upenn.edu!user From: 73323.603(a)compuserve.com Newsgroups: soc.culture.german,soc.culture.jewish Subject: cmsg cancel <73323.603-3009951517290001(a)ts7-28.upenn.edu> Date: Sun, 1 Oct 1995 17:56 GMT Organization: The National Alliance Message-ID: <cancel.73323.603-3009951517290001(a)ts7-28.upenn.edu> NNTP-Posting-Host: ts7-28.upenn.edu Approved: 73323.603(a)compuserve.com Control: cancel <73323.603-3009951517290001(a)ts7-28.upenn.edu> X-Cancelled-By: 73323.603(a)compuserve.com Lines: 1 CANCELLED. ----end control message These others are suspicious, the Santala cancel is definitly forged. I don't have the original posts of any of these, I suspect they are all related to National Alliance. ------------rest of the cancels: Path: sundog.tiac.net!news.kei.com!news.mathworks.com!tank.news.pipex.net!pipex!in2..uu..net!howla nd.reston.ans.net!ix.netcom.com!netnews From: jmrubin(a)ix.netcom.com (Joel Rubin) Newsgroups: soc.culture.german,soc.culture.jewish,rec.radio.shortwave,alt.2600 Subject: cmsg cancel <44lfpn$qoh(a)ixnews7.ix.netcom.com> Date: Sun, 1 Oct 1995 17:56 GMT Organization: Netcom Message-ID: <cancel.44lfpn$qoh(a)ixnews7.ix.netcom.com> NNTP-Posting-Host: ix-sf17-08.ix.netcom.com Approved: jmrubin(a)ix.netcom.com (Joel Rubin) Control: cancel <44lfpn$qoh(a)ixnews7.ix.netcom.com> X-Cancelled-By: jmrubin(a)ix.netcom.com (Joel Rubin) Lines: 1 CANCELLED. ======== Path: sundog.tiac.net!news.sprintlink.net!in2.uu.net!sun4nl!xs4all!mail From: nobody(a)alpha.c2.org (Anonymous) Newsgroups: mail.cypherpunks,alt.privacy.anon-server,alt.2600,alt.stop.spamming,alt..stop- spamming Subject: cmsg cancel <199510010427.VAA28730(a)infinity.c2.org> Date: Sun, 1 Oct 1995 17:56 GMT Organization: Mail to Usenet Gateway at Utopia Message-ID: <cancel.199510010427.VAA28730(a)infinity.c2.org> NNTP-Posting-Host: utopia.hacktic.nl Approved: nobody(a)alpha.c2.org (Anonymous) Control: cancel <199510010427.VAA28730(a)infinity.c2.org> X-Cancelled-By: nobody(a)alpha.c2.org (Anonymous) Lines: 1 CANCELLED. ======== Path: sundog.tiac.net!news.sprintlink.net!in2.uu.net!sunic!sunic!sunic.sunet.se!news..funet..fi!zippo..uwa sa.fi!!jsantala From: jsantala(a)walli.uwasa.fi (Jukka Santala) Newsgroups: alt.2600,news.admin.net-abuse.misc Subject: cmsg cancel <tlqbws0p37xU084yn(a)walli.uwasa.fi> Date: Sun, 1 Oct 1995 17:56 GMT Organization: And you think we're organized? Message-ID: <cancel.tlqbws0p37xU084yn(a)walli.uwasa.fi> NNTP-Posting-Host: walli.uwasa.fi Approved: jsantala(a)walli.uwasa.fi (Jukka Santala) Control: cancel <tlqbws0p37xU084yn(a)walli.uwasa.fi> X-Cancelled-By: jsantala(a)walli.uwasa.fi (Jukka Santala) Lines: 1 CANCELLED. ======== Path: sundog.tiac.net!news.texas.net!newshost.comco.com!news.tamu.edu!news.utdallas..edu!news01.. aud.alcatel.com!gatech!news.mathworks.com!zombie.ncsc.mil!simtel!news.sprintlink..net!in2..uu.. net!sunic!mn6.swip.net!seunet!news2.swip.net!plug.news.pipex.net!pipex!tank..news..pipex..net!pi pex!news1.digital.com!nntp-hub2.barrnet.net!nntp-ucb.barrnet.net!well!usenet From: themed(a)well.com Newsgroups: alt.2600 Subject: cmsg cancel <44mknk$1m0(a)nkosi.well.com> Date: Sun, 1 Oct 1995 17:56 GMT Organization: The Whole Earth 'Lectronic Link, Sausalito, CA Message-ID: <cancel.44mknk$1m0(a)nkosi.well.com> NNTP-Posting-Host: sf-tty7-ppp.well.com Approved: themed(a)well.com Control: cancel <44mknk$1m0(a)nkosi.well.com> X-Cancelled-By: themed(a)well.com Lines: 1 CANCELLED. ========

3 2

Crypto APIs
by Matt Blaze 17 Dec '03

17 Dec '03

A couple of weeks ago I attended a meeting at the NATO SHAPE Technical Center in the Hague to discuss international cryptographic APIs. Several high-ranking NSA types were there, as well as their counterparts from various NATO countries plus a handful of industry crypto people (like me). The idea of the meeting was to find a way to separate cryptographic function from cryptographic interfaces, in a way that allows the applications that call the cryptographic functions to be more freely exported. That is, I can write and export an application that calls the crypto API but that doesn't actually implement the cryptography, and then, when it reaches its destination, the locally-preferred cryptosystem can be plugged right in. Crypto might be implemented in hardware (e.g., Fortezza) or software (e.g., with a shared library or pseudo-device driver). Obviously, this idea is somewhat (completely?) at odds with the criteria presented at last month's NIST workshops for exportable software key escrow systems. One of the requirements given for such systems is that it be difficult to replace the crypto with something that doesn't implement key escrow. But who ever said the government was consistent? Interestingly, it was clear that many people in NSA believe that applications that call an API are controlled under ITAR, but there is some recognition that this may be wishful thinking or may change soon. So while some (maybe most) of NSA wants to prevent development of standard APIs and prevent the export of applications that use them, others recognize that these will evolve by themselves anyway and will be very hard to control once they do. Anyway, the situation is far from clear. It seems best to encourage the realistic side of NSA as much as possible... I learned a few interesting things at the meeting. First of all, overwhelmingly, there is recognition, especially on the part of the non-US government security agencies, that there is enormous value in being able to buy off-the-shelf applications like Microsoft Word or Netscape Navigator and just plugging in the local military cryptosystem and using it for classified traffic. Everyone seemed to agree that there is a growing need for this and that it's too expensive to rely on custom software. There is also movement away from the traditional military ``link encryption'' approach that involves centrally- controlled secure networks in favor of a ``risk management'' approach that favors end-to-end security with off-the-shelf products. In other words, the parts of the military that are concerned with actually securing communications want exactly what we want, and are just starting to realize it. While lots of us have always known this, I had never heard it articulated as quite clearly (or as loudly) by actual comsec/infosec people before. Second, the senior NSA guy mentioned a few things I hadn't heard before. Fortezza is now approved for classified traffic through the SECRET level. Also, the ``type 1'' (classified) through ``type 4'' (unevaluated) cryptography standard is being scrapped in favor of a three ``tier'' system, as follows (these are approximate quotes, from my rough notes): Tier 1 traffic is stuff related to ``national command authority''. (Seems to be secret and top secret and up). It will require NSA cryptosystems, hardware implementation, and will NOT employ key escrow (because of the ``obvious risks''!). Tier 2 traffic is information that, if disclosed, would have ``national implications'' if revealed. Examples given include things like the national power grid, the banking system, etc. It was unclear whether any classified traffic would be included in tier 2. Clearly, some of what is now called ``sensitive but unclassified'' (SBU) will be in tier 2. Anyway, tier 2 systems will be approved by NIST (not NSA, although there will obviously be NSA input into the standards) and will require hardware implementation. Tier 2 traffic will be escrowed, and the government will escrow its own keys. Fortezza is an example tier 2 device (but read on...) Tier 3 traffic will be that which would have ``private implications'' if disclosed. Examples given included personal financial and medical records, etc. Current SBU traffic not in tier 2. Tier 3 would also be handled by NIST, employ commercial or government key escrow (like tier 2) and would be permitted to be implemented in software. Here's the surprise: Tiers 2 and 3 will be interoperable. So there will be published algorithms for tier 3. It is possible that tiers 2 and 3 will have the same algorithms, and that the government will suggest them. It was unclear with interoperability will require that all tier 2 algorithms will be published and implementable in tier 3 software or whether this means that tier 2 devices will also have to implement the tier 3 algorithms. There is an obvious choice of a tier 2/3 algorithm: Skipjack (although there were concerns that this is ``too slow''). So we may eventually find out whether ``S1'' was really Skipjack after all.... -matt

2 2

Re: worldwide announce: New OTP Mail/FTP apps
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: Doug Hughes <Doug.Hughes(a)eng.auburn.edu> >Date: Thu, 28 Sep 1995 19:31:00 -0500 >A company in Israel named Elementrix has just announce at Interop an >entirely new paradigm in secure transactions. They have a secure >one time pad that allows people to exchange mail and ftp files back >in forth in complete security without the worries of key management >or storage or secure random number generation or synchronization. As far as I could tell from your description, this is an autokey cipher -- not a OTP. An autokey cipher starts with a shared secret key and uses previous plaintext or ciphertext as part of the key. DES CBC is an autokey cipher. The original autokey used previous plaintext or ciphertext as the only key. More modern ones mix in the previous text. I had a design for one, several years ago, which kept a mapping in memory and changed the mapping based on incoming plaintext. Therefore, there is state information kept at both sides which keeps changing. One might think that if the attacker never gets in, today's randomness is just as good as yesterday's. That might even be true. However, there are many openings for finding relationships between yesterday's and today's ciphertexts. I look forward to seeing the actual algorithm. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)tis.com http://www.clark.net/pub/cme | |Trusted Information Systems, Inc. http://www.tis.com/ | |3060 Washington Road PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2| |Glenwood MD 21738 Tel:(301)854-6889 FAX:(301)854-5363 | +--------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMHBTU1QXJENzYr45AQHRigP/Yqw0T3n2SDubgRZIrKx8WpUSJtmBwcuf nIBxxwsOwu10sQti7hw3Zcj9tRM6JAcqFNh1U2LbYT3u7ELgh2Hicq0jLcr+3r4h B0H3LlbU9iv7WlETQF8Tw2KQcfDKLkYkeMRnS27cKnJIFHK9w0g4UTwabfB+m5SV sjnUZbv6Q1A= =P9X7 -----END PGP SIGNATURE-----

1 0

Re: The Free Speech Implications of Remailers
by James Caldwell 17 Dec '03

17 Dec '03

On 1 Oct 95 at 22:32, Timothy C. May wrote: > Crypto anarchy means the racists, sexists, speciesists, and other > "ists" cannot be muzzled. I call this a good thing. It's why I'm > here. I don't mind the mail, it's in a bit bucket, just the cowardly nature of it. It was not sent anonymously which can be filtered. I appologize for spamming the list in response to hi message, it upset me.

1 0

Re: The Free Speech Implications of Remailers
by Lynne L. Harrison 17 Dec '03

17 Dec '03

At 10:32 PM 10/1/95 -0700, Tim May wrote: <snip> >Well, guess what? The very technologies we have been so central in >deploying are the technologies that make _conventional_ means of >controlling distasteful material so hard. >system of the various mail delivery systems.) <snip> >Crypto anarchy means the racists, sexists, speciesists, and other "ists" >cannot be muzzled. I call this a good thing. It's why I'm here. Excellent analysis. One can't argue with logic, nor should one forget the purpose and spirit of this list. The fact that spamming is in poor taste is irrefutable. However, some of the "where did this come from"? responses are starting to sound like some people are suddenly against the use of anonymous remailers. I, for one, would hope that people are simply rising to the challenge of tracing the routers. Kill the message if you are so moved -- not the technological messenger. ******************************************************************** Lynne L. Harrison, Esq. Poughkeepsie, New York lharrison(a)mhv.net "Say not, 'I have found the truth', but rather, 'I have found a truth.'" - Kahlil Gibran from "The Prophet" ********************************************************************

1 0