December 2003 - cypherpunks-legacy

Call For Papers - Conference on Redistributable Software
by John Gilmore 17 Dec '03

17 Dec '03

[I'm hoping that we can get some papers on freely redistributable *crypto* and *security* software -- like PGP or PEM or SSL_eay or Kerberos or brute-force tools or SATAN or Java tools or whatever! I'm on the program committee and am trying to make the conference as broad as possible, not just focusing on "traditional" free software. Help! --gnu] CALL FOR PAPERS First Conference on Freely Redistributable Software Sponsored by the Free Software Foundation 2-5 February 1996 Cambridge, MA Over the past 15 years, free and low-cost software has become ubiquitous. This conference will bring together implementors of several different types of freely redistributable software and publishers of such software (on various media). There will be tutorials and refereed papers, as well as keynotes by Linus Torvalds and Richard Stallman The Conference will be held at the Cambridge Center Marriott, 2-5 February 1996. Papers are invited on any aspect of GNU, Linux, NetBSD, 386BSD, FreeBSD, expect, PERL, tcl/tk, and other tools for which the code is accessible and redistributable. Extended abstracts are due on or before Thursday, 30 November 1995. Authors will be notified no later than 8 December. Full papers will be due Thursday, 4 January 1996. Program committee: Peter H. Salus, chair Robert J. Chassell Chris Demetriou John Gilmore Marshall Kirk McKusick Rich Morin Eric S. Raymond Vernor Vinge Abstracts of 350-750 words (in troff, PostScript, or straight ASCII, only) should be sent to conf96(a)gnu.ai.mit.edu -- ----------------------------------------------------------- Peter H. Salus #3303 4 Longfellow Place Boston, MA 02114 +1 617 723 3092 -----------------------------------------------------------

1 0

Re: forging headers (with more header information)
by Lee Tien 17 Dec '03

17 Dec '03

My apologies. I followed Tim's advice and turned on verbose headers, and this is what I got. Lee Return-Path: freeh(a)fbi.gov Received: from nimitz.MIT.EDU (NIMITZ.MIT.EDU [18.80.0.161]) by well.com (8.6.12/8.6.12) with SMTP id NAA20123 for <tien(a)well.sf.ca.us>; Tue, 24 Oct 1995 13:06:23 -0700 From: freeh(a)fbi.gov Message-Id: <199510242006.NAA20123(a)well.com> Received: from sgigate.SGI.COM by nimitz.MIT.EDU with SMTP (1.37.109.4/16.2) id AA00301; Tue, 24 Oct 95 16:07:08 -0400 Date: Tue, 24 Oct 95 16:07:08 -0400 Apparently-To: tien(a)well.sf.ca.us X-UIDL: 814570964.056 > How difficult is it to forge headers? How difficult is it to trace a > message to the actual sender if the header is forged? Not very difficult at all (to forge, that is). This is a quick and dirty example that should be somewhat traceable. If you want pointers on how to trace it, post the whole thing, including headers, to cypherpunks. Louis

1 0

Sign my own certificates?
by cjs＠netcom.com 17 Dec '03

17 Dec '03

Oh jesus, I need to get myself a certificate for the netscape servers at work. All I need are three forms of identification, two written letters, an authorized signature, $300, mailed and faxed, along with an e-mail or two. I think this is an amazing pain in the ass. Any way I could sign a certificate by myself for myself and have it work with the netscape products? Just curious, Christopher

1 0

CYB_lip
by John Young 17 Dec '03

17 Dec '03

11-7-95. Washrag: "Cyber Liberation." The future of American politics is being decided in semiconductor plants in Santa Clara, in the cluttered offices of all-night software designers in Redmond, and, of course, all over the Internet. "At some point in the not-very-distant future," says Newt Gingrich, "somebody is going to have encryption you can't break.... Governments are not going to be able to stop it." This brave new world is closer than you think. It will drastically change the focus of politics because control will be extremely difficult, if not impossible. We're on the brink of a revolution that will make what the Republicans are doing this year look trivial beyond belief. The Internet has the potential to set us free -- to learn anything and do anything, whenever we want. No wonder politicians want to regulate it to death. CYB_lip (7 kb)

1 0

Re: forging headers (with more header information)
by David E. Smith 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995 09:08:39 -0800, Lee Tien wrote: >Return-Path: freeh(a)fbi.gov >Received: from nimitz.MIT.EDU (NIMITZ.MIT.EDU [18.80.0.161]) by well.com >(8.6.12/8.6.12) with SMTP id NAA20123 for <tien(a)well.sf.ca.us>; Tue, 24 Oct >1995 13:06:23 -0700 >From: freeh(a)fbi.gov >Message-Id: <199510242006.NAA20123(a)well.com> >Received: from sgigate.SGI.COM by nimitz.MIT.EDU with SMTP > (1.37.109.4/16.2) id AA00301; Tue, 24 Oct 95 16:07:08 -0400 >Date: Tue, 24 Oct 95 16:07:08 -0400 >Apparently-To: tien(a)well.sf.ca.us >X-UIDL: 814570964.056 Without having any access to anything but the headers, it looks like you are an employee for SGI and sent the message from there. Look at the last Received: header. It went from sgi.com to mit.edu to well.com and then to you. Dave ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745 +1(314)339-3814, "dsmith(a)midwest.net", PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith/

1 0

Re: Exporting software doesn't mean exporting (was: Re: lp ?)
by Mark Murray 17 Dec '03

17 Dec '03

> > Mark Murray writes: > > Hmm. Not only is this law unenforceable, it is unenforced. Anyone, > > non-US or otherwise can buy crypto books - you just can't get the code > > on floppy. Bruce Schneier went through this procedure when he CJ'ed > > "Applied Cryptography". > > To my knowledge, Bruce Schneier never CJ'ed "Applied > Cryptography". Phil Karn did that. Point is, it got CJ'ed, and easily too. In fact I understand that the process was 'trivial'. Just the software on floppy was a problem. M -- Mark Murray 46 Harvey Rd, Claremont, Cape Town 7700, South Africa +27 21 61-3768 GMT+0200 Finger mark(a)grumble.grondar.za for PGP key

1 0

So much for free speech...
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:34 PM 11/6/95, s1113645(a)tesla.cc.uottawa.ca wrote: >On Mon, 6 Nov 1995, Dr. Frederick B. Cohen wrote: > >> In the United States, we have the right to express whatever view we >> wish, so long as it doesn't endanger others (e.g., insight to riot, >> scream "fire" in a crowded theater when there is no fire, etc.). >> Everyone has an inherent right to question why a person seeks moments of >> anonymity or privacy. > >You're forgetting our good friends the libel laws. Another reason to go anon. >You have the right to say whatever you please, but you'll have to be able >to defend it in court if it damages someone's reputation. It can also get >you fired. (or shot if you're MLK) Sadly, the tradition of "free speech" is under assault. On many fronts. The new "civil rights" laws are just one avenue for the suppression of what was once considered free speech. Submitted for your disapproval: "13-year-old student arrested for racial slurs" (Santa Cruz Sentinel, p. 1, 3 November 1995) by Michael Green, Redding Record Searchlight "REDDING -- When a 13-year-old Redding student was arrested for allegedly making racial slurs, police and school administrators said it was necessary to maintain order and send a strong message against racism. "But some legal experts take a dimmer view of the boy's arrest, saying that calling someone names, even offensive ones, is not a crime and in fact is constitutionally protected. ... "The Redding-area boy, who is white, allegedly made racial insults toward a 12-year-old Hispanic student before being arrested last Thursday. ... "Police Chief Bob Blankeship said he would encourage officers to use the civil rights laws to stop racial harassment if prosecutors determine it is appropriate. ... "The boy was arrested on suspicion of violating the Hispanic student's civil rights. Penal Code section 422.6 makes it a misdemeanor to interfere with another person's rights or harm their property because of their race, gender, religion, disability or sexual orientation." ----- Wow! "Verbal abuse." Throw away the key. "Freedom does not mean the freedom to think bad thoughts," as Big Bro once said. If they don't get you for illegally using random numbers, they'll get you for uttering incorrect words. Back to reality. No word on whether prosecution will take place (I doubt it...this will likely be dropped, now that the message has been sent to the students, and now that civil rights folks are getting interested). Children are usually not accorded full constitutional protections, especially not in public schools, but this does not mean the police should arrest those who utter the wrong words! (Maybe suspending the student, though I certainly wouldn't do that.) This is the "safe and secure" world we are in, where bad thoughts and bad words are punished. Or threatened with lawsuits. Anarchy seems infinitely preferable to me. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

5 4

Re: Sign my own certificates?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Oh jesus, I need to get myself a certificate for the netscape servers >at work. > >All I need are three forms of identification, two written letters, an >authorized signature, $300, mailed and faxed, along with an e-mail >or two. > >I think this is an amazing pain in the ass. You forgot about the sperm sample. I wouldn't necessarily consider that pain, though... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

DejaNews all over again--a URL for Usenet Searching (fwd)
by Charles Gimon 17 Dec '03

17 Dec '03

Forwarded message: > > I usually avoid passing on URLs of interesting sites, in the name of > conserving bandwidth (*), but this one really has me jazzed: > > http://dejanews.com/ > > It allows searching of Usenet archives (a few months' worth, from what I > can see). > > > " Want to know what people are saying about some new book? About > some political topic? Most importantly, about you behind your back? > Check it out! Lots of fun, and a bit scary." > Or to paraphrase Huey Long, "Every Man a Kibo".

4 3

RE: using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- > While in theory the output of PGP would be ``random'' enough for a > one-time pad, you need to take into account that there is ``header'' > information in a PGP message. This info in the first several bytes > indicates which key was used, how big the message is, whether the > receiving PGP should save the decrypted file, etc. This part is not > very random at all. i understand the non-random portions of the pgp output, which is why i specified in my origional message that the 1st 20 or so lines would find their way to the bit bucket. > The weakness in this method is that the ``key'' to the OTP is composed > of the PGP encryption key and the plaintext used to generate the > pad. Both would have to be fairly well protected to prevent a bad > guy from either a) generating his own copy of the OTP by obtaining > the key and plaintext or b) forcing you to use a known OTP by munging > your copy of the key or plaintext. i'm confused here. how would the 'key' to the otp be related to my pgp encryption key? if i strip off all the identifying information that pgp uses to recognise how to decrypt a message, and destroy the 'clean' copy of the file(s) that eventually became part of my otp, how could the resulting output be tied to my key? if it could, then pgp is less secure than i give it credit for being. if your objection is based on the fact that my public key is a known entity, , this can easily be bypassed by creating a brand new key from a freshly unzipped copy of pgp. use that key to create the otp, then destroying the key(s) used to create it. > This technique does have its uses. For instance, if you use DES you > can ``seed'' it with a value, then by re-encrypting the output of DES > repeatedly you can generate an essentially random sequence of > values. This can be used as a OTP for a stream cypher. isn't this essentially what i'm doing? if it is necessary, i can do this...(assuming a virgin key) 1. create a cyphertext of a file. 2. strip the indentifying lines. 3. create a new cyphertext from the resulting file. 4. repeat until paranoia level < comfort zone. my point here is that _if_ pgp output is random enough, i wouldn't need hardware. even i, with my extremely limited programming skills could create a .cmd file or program that could be used as imput for a stream cypher. imo, for crypto to be useful, it has to be easy. i'm trying to find a way to do this that can be implemented anywhere.

3 2