December 2003 - cypherpunks-legacy

Re: Remember, RC4 is now PC1
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: > >Every time you say RC4 without saying "Trademark of some bunch of > >lawyer scum" you theoretically break the lawyer made law. So let us > >stop doing it. Serve them right. > > You can always call it "Ron's Code 4" or "Rivest's Code 4" or whatever. Bah. I don't think there's much RSA can do, esp. if you use a homegrown implementation. If someone says "A stream cipher compatible with RSA's RC4 (tm)" then what is RSA going to do? It'd be funny if the next time somebody hacks a proprietary code, if they make some changes, redo the key schedule, perhaps in mind of strengthening the algorithm, and then post it to sci.crypt as "hey, I got this idea for a new crypto algorithm... what do you think?". If the algorithm is different enough from the proprietary code version, with no clear connection between them, and the author can give full design rationale as if s/he wrote it from scratch, then what's a company to do? (If the practice of secret/proprietary algorithms continues for the long term future then it's quite possible a genuine coincidence like this will occur... RC4 [officially secret] and RC5 [not officially secret] are some very simply constructed algorithms... what's to say another skilled cryptographer could not have reinvented the wheel?) - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTPauioZzwIn1bdtAQGR9QGAkRVkH2PZFk2LShKcBqGoWJTDkLX87sBL Uc4bo2ksl47YEXQ2slL238auZVLBFCC8 =D1/4 -----END PGP SIGNATURE-----

1 0

Re: Internet shutdown Feb 29?
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Interesting. My ISP was shut down for a day this week because of a "problem with a router upstream from us". <insert emoticon here> It would be nice to see ISPs maintain multiple paths or at least have a set of backup connections to keep outages like this from happening. Simon Spero wrote: > > As a matter of interest, I wonder how much of the internet could be > shut down by concerted effort; obviously individual services can be > trivially disabled by jamming listen queues (not really stoppable by > anything short of IPSEC w/photuris). The BGP backbone could probably be > disabled from within by a traitor planted in one of big companies, and a > confused backhoe around the MAEs could probably do a lot more damage than > people would like to admit. It seems that the internet is getting pretty > brittle- I wonder if it would be worthwhile having some sort of infranet > with a bunch of backups links using dial-up lines or spare transponders > (with a filter to block port 80 :-) > > It's probably not possible with todays routing technology > (slow, flappy links with nightmarish convergence times), plus it's not > sexy like a nice OC-12 SONET. This is the sort of thing the NCSC should > be working on- something to keep the essential services flowing in the > early stages of an info-war, or an info truck-bomb - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTPgOyoZzwIn1bdtAQHhzwF+IpnE8dOwNVq0SXSshqc6oEpMo99knyBC 8VnvSn7qvaHn6AJqTIrIKII2InR9cLR9 =N5QY -----END PGP SIGNATURE-----

2 1

Re: Privacy legislation in CA
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > SECTION 1. The Legislature hereby finds and declares the > following: > (a) All people have an inalienable right to privacy as > declared in Section 1 of Article I of the California > Constitution. Does the bill define "privacy" explicitly? Or is it defined clearly anywhere else in California law? That can be a real problem... (the US Supreme Court seems to limit 'privacy' to what goes on in bed between a married heterosexual couple, for instance.) > (b) Advances in technology have made it easier to create, > acquire, and analyze detailed personal information about an > individual. > (c) Personal information, including information about a > person's financial history, shopping habits, medical history, > and travel patterns, is continuously being created. > (d) The unauthorized use of personal information concerning > an individual is an infringement upon that individual's right to > privacy. What is unauthorized use? Is it still acceptable to collect information on someone? Is a person given the right to know who is tracking them, and what someone else or a corporation has about them? > SEC. 2. Section 43.2 is added to the Civil Code, to read: > 43.2. No person or corporation may use or distribute for > profit any personal information concerning a person without that > person's written consent. Such information includes, but is > not limited to, an individual's credit history, finances, > medical history, purchases, and travel patterns. What counts as written consent? Checking a "Yes, you may send my name to interested advertisers so I can receive lots of junk mail to burn in my stove to keep warm in the winter" box? And once a person has checked off on it, is it ok for a corporation to redistribute that info without asking permission (since it's already been signed off), of must that third party again ask permission? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTPdKCoZzwIn1bdtAQEnvAF/dslZaaBn0j8ZyEHH3t97LyzjBHCai04A ng/kuJ5nkkneIVAl2OJKZAnq8JSaIzqp =0Tmm -----END PGP SIGNATURE-----

1 0

No Subject
by anonymous＠nowhere.toad.com 17 Dec '03

17 Dec '03

Greetings All Does anyone reading this know any details of the crypto scheme proposed for TETRA (The Euro standard digital radio system). Actual concrete details of the system seem to be impossible to find !! Thanks in advance LP

1 0

Cypherpunk remailer
by johan＠eniac.campus.luth.se 17 Dec '03

17 Dec '03

How do I send Email through a cypherpunk remailer? I know that I encrypt with PGP, but where should I write to who the email is for??? I have list of remailers and I have their public keys, but it would be nice if someone could add some remailers to my list! Public keys to them aswell is appreciated! There might be some FAQs about this, but never seen one. -- Please refer to where I can get the FAQ if there is one! --

2 1

Re: E$? Whatever
by jim bell 17 Dec '03

17 Dec '03

At 10:23 PM 2/27/96 EST, Dr. Dimitri Vulis wrote: >A GLIMPSE INTO THE FUTURE OF MONEY, AS CITI SEES IT >Known inside Citicorp as the Electronic Money System, the bank's >version of electronic currency for cyberspace is the result of >four years of mostly top-secret toil by technical wizards who >report to Colin Crook, the New York money-center's top technology >officer. You know, if I were a bank, I'd think twice before I hired a person named "Crook" as the "top technology officer." Jim Bell jimbell(a)pacifier.com

1 0

Re: Numbers don't lie...
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:23 AM 2/27/96 -0800, jamesd(a)echeque.com wrote: >At 11:18 AM 2/18/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >>Finally, no cost is allocated to the sustem required to program/evaluate >>the ponderings of these 100's of ASICs. As anyone who has ever programmed >>a massively parallel computer (which is what they are talking about in their >>brute force machine, it is the boundary communications that kill you. > >Again: Interprocess communication is trivial. A brute force key cracking >machine is *not* a general purpose massively parallel computer. Yeah - the interprocess communications includes handing out keyspace (pretty simple, especially if each chip has a way to find out its name), broadcasting the cyphertext and known plaintext, letting the winner forward the successful key, and broadcasting the "you can stop now" message. Back when the AT&T DSP-32 was new and hundred-CPU machines were exciting, AT&T made a box that had 128 DSPs in a binary tree; each one had a couple flavors of RAM and some communications glue. It would work just fine for this sort of applications (except that the DSP32 was a floating-point DSP and what you really need here is big integers.) And the Inmos Transputer, with its 4 communications channels, would do just fine as well - you could either build the things into large grids or build a large ternary tree, or get fancy and build cubes of 6 chips that you make hypercubes out of, or whatever. A modern version of the same chip, built out of FPGAs or ASICs with enough memory and program on chip, would blaze just fine. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Diffie-Hellman for Matchmaking?
by Dimitris Tsapakidis 17 Dec '03

17 Dec '03

sci.crypters and cypherpunks: This is a followup to my "Dating Problem" question I posted on sci.crypt, some months ago. I am trying to find or design some matchmaking protocols (and implement one of them, eventually) that have all the nice properties, like privacy and fairness. I came up with two or three candidate protocols, but they all rely on the Diffie-Hellman "common key" for mutual authentication. I haven't seen it used for such purposes in the literature, and I am suspicious. The setup is the same as in Diffie-Hellman key exchange. Assume global: prime n and primitive element g mod n. All the participants have a pair of (secret, public) keys, where public=g^secret mod n. By common key I mean g^(secret_a*secret_b)mod n. Person A is interested to match person B, so he computes g^(AB)mod n. B is interested in X, where X may or may not be A, and calculates g^(BX)mod n. Now, they compare these two "common keys" either using some Zero Knowledge scheme that ensures fairness (at no point one party has significantly more information than the other) or through a Trusted Third Party. If they are the same, then this means X=A, so A and B have a match (e.g. a date). The common keys must remain secret (hence the ZK above): if g^(BX)mod n "escaped" to the public, then the real X would find out that B is interested in him. Is anything wrong with this, specificaly with the use of the "common key"? Dimitris -- Dimitris Tsapakidis PGP keyID: 735590D5 dimitrt(a)dcs.rhbnc.ac.uk MSc in Information Security, This space reserved Royal Holloway, University of London for future use. Origin: Thessaloniki, Macedonia, Hellas

2 1

RE:
by brad＠his.com 17 Dec '03

17 Dec '03

At 7:16 PM 2/27/96, Blake Ramsdell wrote: > This also reminds me of a time when a call went out for the MOSS implementors > to raise their hands (on the pem-dev list) -- and only Ned Freed answered. > This could very well be because MOSS implementors don't hang out on the > mailing list, which is somewhat strange since the timeframe in which this > question was posed was very close to the release date of the specification > (10/95). In fact, Dave Crocker recently said that "Clear, corporate > commitments from product vendors ought to confirm or dispel the rumor of the > MOSS demise", and we have not had *any* vendors step up since that statement. Interestingly, I talked to the folks developing the Simeon IMAP-based MUA (the only cross-platform IMAP MUA that I know of; if anyone else knows of one, please tell me), and they told me that they knew of the conference and instead decided to focus on getting the next version of their client out the door. And they're claiming to be implementing MOSS, S/MIME, and PGP (PGP/MIME, I hope?). Pretty surprising answer, coming from a company that I think will be so radically affected by the outcome of that workshop and the continuing work done by the same community of folks. I don't even know if they've got someone subscribed to this mailing list (it sounds like they don't). I have no idea if the rest of the PEM/MOSS commercial community is like this, but I'm not sure it bodes well for them in particular. I mean, if it really is a matter of them being small enough that one key guy can't afford to take a few days out (like both Qualcomm and Z-Code did), then maybe they're too small to survive the shakeout. And if it's a matter of them not caring, well.... > Don't get me wrong -- I don't consider myself to be prejudiced away >from MOSS. > Near the end of the meeting, I specifically pointed out that: First we had > PEM, and it died. Now we have MOSS, which is 47 pages long, and less than > *four months* old, and we are calling it dead also. Somebody else made this observation about the age of MOSS at the workshop, and as I recall Dave's response was something to the effect of "Uh, it's actually a heck of a lot older than that, the difference is that the RFC has only been on the streets for four months." -- Brad Knowles, MIME/PGP: brad(a)his.com comp.mail.sendmail FAQ Maintainer <http://www.his.com/~brad/> finger brad(a)his.com for my PGP Public Key and Geek Code The comp.mail.sendmail FAQ is at <http://www.his.com/~brad/sendmail/>

1 0

Re: PGP to PC mail integration
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 05:09 1996-02-28 -0500, lmccarth(a)cs.umass.edu wrote: >Mike Ingle writes: >> Instead of messing with user interfaces, you set the POP and SMTP >> addresses of your mail program to "localhost". You run locally a Visual >> Basic program that sits on ports 110 (POP) and 25 (SMTP) listening for >> connections. The VB program is configured with the addresses of your >> real SMTP and POP servers, and acts as a proxy. >> >> When your mail program retrieves POP mail, it goes through the VB >> program, and the VB program decrypts any PGP mail it sees. When it >> sends mail, the VB program encrypts any mail it has a PGP key for the >> recipient of. > >Would you be stuck if you wanted to send something unsigned and/or >unencrypted ? Nope. The VB program should give a popup window where you can enter your passphrase to sign/decrypt the message. Such a popup can have a <NO> button if you don't want it to do its thing. But how often do you receive an encrypted letter for which you have the secret key, and don't want the letter decrypted? Actually, I was already working on such a program when these posts came by, so any suggestions to functionality are welcome! Matts

2 1