December 2003 - cypherpunks-legacy

TAL_kup
by John Young 17 Dec '03

17 Dec '03

1-10-96. NYPaper: "Group Urges an Internet Ban On Hate Groups' Messages. Joins in Move to Censor Offensive Material." Citing the "rapidly expanding presence of organized hate groups on the Internet," a leading Jewish human rights group yesterday began sending letters to hundreds of Internet access providers and universities asking them to refuse to carry messages that "promote racism, anti- Semitism, mayhem and violence." A sage says, "It is not possible to end idiocy by censoring it. The best response is cellular." TAL_kup

2 1

E-cash and Interest
by Tim Philp 17 Dec '03

17 Dec '03

I had been doing some thinking about E-cash and some of the implications. It seems to me that there is another element in the discussion that has not gotten very much consideration. When you have your money in the bank, you are earning interest on the money (albeit not very much! <g>) and that money continues to earn interest until it is withdrawn. If you write a check to pay for something, that ends your interest accumulation for that money. With the E-cash systems that I have seen, you generate your own E-cash and have it signed by a 'bank' At that moment, it becomes like cash in your wallet and you loose interest that this money could be earning. Has this issue been addressed, or am I missing something? Regards, Tim Philp =================================== For PGP Public Key, Send E-mail to: pgp-public-keys(a)swissnet.ai.mit.edu In Subject line type: GET PHILP ===================================

3 2

Reports available via CTRS
by David J. Bianco 17 Dec '03

17 Dec '03

[Abstracts for, and (in most cases) links to these report titles can be found at the CTRS site, http://www.itribe.net/CTRS/ ] 1.Tuomas Aura, Modelling the Needham-Schroeder authentication protocol with high level Petri nets, Technical Report B14, Espoo, Finland, September 1995. 2.Arnold G. Reinhold, Diceware for Passphrase Generation and Other Cryptographic Applications, Cambridge, MA, July 28, 1995. 3.Arnold G. Reinhold, A Diceware Word List, Cambridge, MA, July 28, 1995. 4.Arnold G. Reinhold, Results of a Survey on PGP Pass Phrase Usage, Cambridge, MA, July 28, 1995. 5.Arnold G. Reinhold, "Common Sense and Cryptography" , Internet Secrets, John Levine and Carol Baroudi (Ed.), Foster City, CA, 1995, pp. 115-150. 6.Arnold G. Reinhold, On the Function of MHC-Antigen Specificity, Cambridge, MA, March 3, 1989. 7.VeriSign, Inc., FAQ: Answers About Today's Digital IDs, July 15, 1995. 8.Roos, Andrew, A Class of Weak Keys in the RC4 Stream Cipher (Preliminary Draft), Westville, South Africa, September 1995. 9.Terry Ritter, Substitution Cipher with Pseudo-Random Shuffling: The Dynamic Substitution Combiner., Cryptologia, vol. 14, no. 4, 1990, pp. 289-303. 10.Terry Ritter, Transposition Cipher with Pseudo-Random Shuffling: The Dynamic Transposition Combiner., Cryptologia, vol. 15, no. 1, 1991, pp. 1-17. 11.Terry Ritter, The Efficient Generation of Cryptographic Confusion Sequences., Cryptologia, vol. 15, no. 2, 1991, pp. 81-139. 12.Terry Ritter, Voice and Video Cryptography in a DSP Environment., Proceedings of the Second Annual Texas Instruments TMS320 Educators Conference, Houston, Texas, August 5-7, 1992. 13.Terry Ritter, Estimating Population from Repetitions in Accumulated Random Samples., Cryptologia, vol. 18, no. 2, 1994, pp. 155-190. 14.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, An Efficient Fair Payment System, India, Mai 1996. 15.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, An Efficient Electronic Payment System Protecting Privacy, Lecture Notes in Computer Science, vol. 875, pp. 207-215, Berlin, November 1994. 16.Camenisch, Jan; Piveteau, Jean-Marc; Stadler, Markus, Blind Signatures Based on the Discrete Logarithm Problem, Proceedings of EUROCRYPT 94,Lecture Notes in Computer Science, vol. 9505, pp. 428-432, Berlin, May 1994. 17.Stadler, Markus; Piveteau, Jean-Marc; Camenisch, Jan, Fair Blind Signatures , Proceedings of EUROCRYPT 95,Lecture Notes in Computer Science, vol. 921, pp. 209-219, Berlin, May 1995. 18.Kocher, Paul C., Cryptanalysis of Diffie-Hellman, RSA, DSS, and Other Systems Using Timing Attacks, Stanford, California, December 1995. 19.Schoenmakers, Berry, An Efficient Electronic Payment System Withstanding Parallel Attacks, CS-R9522, Amsterdam, Netherlands, March, 1995. =========================================================================== David J. Bianco | Web Wonders, Online Oddities, Cool Stuff iTribe, Inc. | Phone: (804) 446-9060 Fax: (804) 446-9061 Suite 1700, World Trade Center | email: <bianco(a)itribe.net> Norfolk, VA 23510 | URL : http://www.itribe.net/~bianco/

1 0

SSN collection prank
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I haven't seen this here. somewhat amusing. ------- Forwarded Message Date: Sun, 7 Jan 1996 19:49:14 -0500 (EST) From: Brad Dolan <bdolan(a)use.usit.net> To: snet-l(a)world.std.com Subject: (fwd) Private SSN Collection Project <cool!> (fwd) - - ---------- Forwarded message ---------- - - ---------- Forwarded message ---------- Date: Sun, 31 Dec 1995 00:01:48 -0800 From: Clint Danbury <danbury(a)shell.wco.com> Thank you for your response. Please send Full names and Social Security Numbers of anyone you know, including government officers and/or employees, to: Clint Danbury, Box 750037, Petaluma, CA 94975-0037 email: danbury(a)ssnShirt.com Questions And Answers On The Nationwide SSN Collection Project. - - -1- Why are you collecting SSNs ? Answer: For fun and amusement. - - -2- What do you plan to do with them ? Answer: Put them on sweatshirts and sell them through specialty clothing retailers. It has been suggested also that I post them on large billboards along the Mexican border, but I don't have enough capital to pull of such a stunt at this time. - - -3- How long do you intend to continue this ? Answer: Until it becomes illegal. The moment any legitimate government authority informs me of the specific laws which (A) Forbid the collection, recording, and distribution of SSNs by private parties, and (B) Provide legal recourse for the individual citizen against private parties which do so, I will stop. - - -4- What if the government finds out what you're doing ? Answer: First off, the government knows very well what I'm doing. I've been "reported" multiple times to the SSA and the Secret Service. Secondly, the government can find me quite easily (I'm in the phone book). Third, I will cooperate completely with any legitimate government authority. - - -5- Here's my ex-spouse's SSN; will you make him/her miserable for me ? Answer: Hell No ! If you want me to engage in illegal activity for you, then go somewhere else ! - - -6- Isn't what you are doing illegal ? Answer: Not according to the SSA. They have declared the private use of the SSN unrestricted. (More on this in a few questions) - - -7- If My name/SSN were in your database, would you tell me ? Answer: In order for me to confirm this, you must first tell me what your full name and SSN is, then I will tell you if you were already in there. If this sounds like two-faced hypocrisy, great! I got the idea from CBI-Equifax; that's their very own policy. If you don't tell them what your SSN is, they won't tell you what they've got on you. Therefore, I have decided to do the exact same thing. (If you don't believe it, then why don't you call them and ask for yourself?) - - -8- What if someone did the same thing to you ? How would YOU feel ? Answer: This already has happened to me. I told the SSA office about it, repeatedly, and they would take no action. (The story appears in the next answer.) - - -9- How did this all start ? Answer: In 1985, a co-worker learned that I object to the "Uni-Number" concept of identifying a single person across multiple databases. I was (and still am) specifically concerned about the use of the SSN for Non-Tax identification. The company placed our SSNs on our name tags, which, thankfully, we did not have to wear constantly, although we would occasionally have to display it for a guard during certain times. This co-worker went poking through my briefcase while I was out of my office, copied down my SSN, and then, for his own fun and amusement (I'm guessing at his motives, I don't know his true reasons) displayed it for me, and would not tell me where he got it. Seeing that this angered me, he then went to other co-workers, who joined him in making my SSN even more public. They then went to the personnel files, (which the company made no attempt to keep locked) and double-checked the number with my job application. After that, they memorized it, and, (again, I'm guessing here) for their own amusement, they would recite it in unison around the lunch table. (I know this sounds impossible, but it really did happen.) After that job ended (not very happily, surprise) I let myself cool off for a few months, and then moved to another city. During my time in that other city, I contacted the SSA office there, seeking another SSN. I made dozens of phone calls and wrote letter after letter, all to no avail. My letters got shorter and to-the-point, not long drawn out things. It took only 30 seconds to read them. This continued for several months. The result was always the same: words without action, and no replacement SSN. The company in that city went down the tube, and I had to move again. I wrote and called off-and-on over the next few years, and got the same treatment; empty words, stall-him-off, and they would make no statement one way or the other. In September of 1993 (perhaps an earlier date, I'm not sure) the SSA finally came out and gave their official written approval for unrestricted use of the SSN by private individuals and private organizations for any purpose, including fun and amusement. The pamphlet is entitled "Your Social Security Number", is SSA Publication 05-10002, and dated September/1993. You can get a copy by calling them at 1-800-772-1213. On page 9 of that pamphlet, they have finally removed all restrictions on the private use of the SSN and they've put it in writing... "Because there is no law concerning the use of a person's Social Security number by a private individual or organization, Social Security has no control over such use." So, if those are the rules they've made, fine. Those are the rules by which I'll act. The collection and distribution of other people's SSNs is (as you've just read) a legally unrestricted activity and that's exactly what I'm doing. - - -10- Where do you get the SSNs ? Answer: "...there is no law..." so, just like CBI, TRW, TU, et.al., I don't have to tell you where I got yours. Ask CBI where they got your SSN; they won't tell you, and neither will I. - - -11- How do you check for accuracy ? This question bothered me a lot at first, however, it has become astoundingly simple to check whether a number is accurate or not. So, just exactly how do I do this ? CBI doesn't have to tell, and neither do I. "...there is no law..." - - -12- How can I get a copy of your list ? Answer: Unfortunately, I have found the drones to outnumber the worker-bees by a factor of about 10-to-1. This is not the soup-kitchen, it's a group project. If you want SSNs from me, then I want SSNs from you. In the past, I offered a 1-for-1 exchange. I will no longer make that public offer. What is offered is this: If you will send me full names and SSNs of prominently elected officials, media-babes, et.al., then I will (to the extent my database allows) send you back full names and SSNs of other prominent politicians and media babes, 1-for-1 if I can. Of course, full names and SSNs of any individual or group are still welcome, they just don't qualify for the 1-for-1 offer. Copyright, 1995 by Clint Danbury (Better Living Thru Better Living) ************************************************************************** X SNAIL ME + GABRIELLI'S (Mendocino,CA, USA) 0 X YER ROSEHIPS + 0 X IF YOU LIKED THIS POST! + *Pinot Noir* & *ASCENZA* (WHITE-BLEND)-YUMMY!0 ************************************************************************** [Ask Fer "Mendocino,Ca. -- *Gabrielli Wine*" at yer local wine shop if'n ya want to tend yer rugosa] Let your voice be heard in the campaign to save the life of Mumia Abu Jamal ++++ more info: http://www.calyx.com/ ++++ - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

More on Belgian 'key escrow law'
by lvhove＠vnet3.vub.ac.be 17 Dec '03

17 Dec '03

I looked up the law mentioned in the newspaper article and it goes like this (non french speaking cypherpunks, please see comments below <grin>): ---- "Loi du 21 décembre 1994 portant des dispositions sociales et diverses" - published in the 'Moniteur Belge' (= the official journal in which all laws are published), Vol. 164, Nr. 250, Friday 23 December 1994, p. 31878-31963. (p. 31960-31961): " Art. 202 Il est inséré dans la loi du 21 mars 1991 portant réforme de certaines entreprises publiques économiques, un article 70bis, rédigé comme suit: <<Art. 70bis - Le Roi fixe, par arrêté délibéré en Conseil des Ministres, les moyens techniques par lesquels Belgacom et les exploitants des services non réservés qu'Il désigne doivent permettre, le cas échéant éventuellement conjointement, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications privées dans les conditions prévues par la loi du 30 juin 1994 relative à la protection de la vie privée contre les écoutes, la prise de connaissance et l'enregistrement de communications et de télécommunications privées.>>" (p. 31961): " Art. 203 L'article 95, alinéa 1er, de la même loi est complété comme suit: <<5° l'appareil terminal rends inefficaces les moyens permettant, dans les conditions prévues aux articles 88bis et 90ter à 90decies du Code d'instruction criminelle, le repérage, les écoutes, la prise de connaissance et l'enregistrement des télécommunications.>>" ---- Simplifying it all seems to boil down to this: The 1994 Law ammends a 1991 Law; that is, it adds a couple of articles/paragraphs. Art. 202 stipulates that Belgacom (= Belgium's leading telephone company) and other telecom companies have to cooperate with law enforcement when it wants to tap telephone lines - no, sorry, make that telecom lines (!). Note that tapping is only allowed under certain circumstances stipulated in the so-called Privacy Law (see also my previous posting to this list). Art. 203 is the most important as far as key escrow is concerned. It completes Art. 95 of the 1991 Law which stipulated 4 conditions in which telecom equipment may be seized. These initial conditions are rather harmless (equipment does no longer conform to the initial specifications, it hinders public broadcasts, presents health risks for the users,...). Art. 203 adds a 5th and stingy one: equipment that makes tapping impossible may be disconnected from the network and seized ... On the face of it - I'm not a lawyer, so don't pin me down on this - this means no crypto (or only with key escrow) ... Ciao, leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels Vox: +32 2 629.21.25 Fax: +32 2 629.22.82 e-mail: lvhove(a)vnet3.vub.ac.be VUB's Web site: http://www.vub.ac.be _________________________________________________________________________

1 0

[local] Minneapolis CP get-together
by Kevin L Prigge 17 Dec '03

17 Dec '03

Who: Minneapolis Cypherpunks What: Local get-together & key signing party When: Saturday, Feb 10th @ approx 5pm -> ??? Where: Applebees (3200 W Lake St) I'll be facilitating a key signing, send your public key to me before hand to get on the list. If you have any questions or need directions, let me know. -- Kevin L. Prigge |"Have you ever gotten tired of hearing those UofM Central Computing | ridiculous AT&T commercials claiming credit email: klp(a)tc.umn.edu | for things that don't even exist yet? 010010011101011001100010| You will." -Emmanuel Goldstein

1 0

Re: [rant] A thought on filters and the V-Chip
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:56 AM 1/26/96 -0800, Alan Olsen wrote: >I have known too many adults that believe that by restricting their kids >access to information, they can prevent them from growing up. In these >parent's minds, such information is what makes them want to hump their >little brains out. Biology has nothing to do with it in their limited way >of thinking. Cluelessness does not just cover computers with these people. >It also covers any other topic that required more than two brain cells to >understand. Actually, if you place a child in one sort of environment or another you do get a different "product." The behavior of Amish children raised on farms in rural Pennsylvania differs significantly from the behavior of children raised crack-addicted parents in Bed-Stuy. In fact, you get almost non-overlapping bell curves for every characteristic. I would guess too that if you switched kids at birth between these two populations, the final results wouldn't differ by much. What parents are attempting to do when they restrain their children's access to "sex and drugs and rock and roll" (or Republicanism for that matter) is to mediate their "spiritual" environment to keep them from becoming hardened. They know the kids will grow up, they just want them to grow up in a nice way. Children who listen to Vera Lynn's singing and Cole Porter's songs will end up quite different from those who favor louder, less vocal music. Note that in spite of what liberals might think, fundamentalist christians are less likely to divorce, less likely to report spousal beatings, less likely to kill themselves, and more likely to measure high personal satisfaction levels on standard psychological tests than are, say, readers of The Nation. The cypherpunks relevance of all this is that it should soon be possible to create completely mediated environments for ourselves and our children. Through the use of implants and real-time VR processing, it will be possible to edit our "interface" with the Real World such that unpleasant aspects are edited out. We will be able to change the attire, hair, facial expressions, voice, and even smell of those around us to conform to our own esthetic desires. Likewise with our physical surroundings. Safety may discourage making a complete transformation in one's surroundings, but one can certainly soften the edges. Note that this is just an easier-to-implement version of what we can do already with our own minds. It will be interesting to see the effects on people who live in these mediated worlds. DCF "My grandmother didn't like to use the word 'Democrats' in the presence of the children. She called them 'bastards' instead." -- PJ O'Rourke

1 0

KOH "Helpful" Crypto Virus
by Laszlo Vecsey 17 Dec '03

17 Dec '03

I'm looking for more information on the KOH Virus, a 'helpful' virus which kindly asks to infect your system and encrypt all of your data. It spreads to floppies (upon request) and to other systems, encrypting all files. I read about it in Boardwatch magazine, which surprisingly states that the U.S. government forbids the distribution of all cryptographic programs in binary form; source code can be freely distributed. Please point me towards the source/binary, or further information. (define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n)))) "SGI and Linux both run Motif and X11. They both compile c++ cleanly (using gnu g++). They're the same!"

1 0

Re: The FV Problem = A Press Problem
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:42 PM 1/30/96, Jonathan Rochkind wrote: >I'd say _all_ news, not just software news, is P.R. controlled, these days. >You can largely hold Edward L. Bernays, the "father of public relations" >(who just died last year) responsible for that--or the societal conditions >that allowed Bernays to do his thing. Bernays developed expertise in >"engineering of consent" turned the news into a commercialized and Interesting term, similar to Chomsky's "Manufacturing Consent" (which obviously must've come later...). >Now, the news you read is manufactured in press releases to sell a product, >and is there because a well written press release convinced a reporter or >editor that a marketting ploy was actually a newsworthy event (or, perhaps, >because the advertising dollars that went along with the press release >convinced him). Witness FVs demonstration of key capture becoming a >newsworthy event. Maybe I've from the old school, the school that says one should be more modest, objective, and circumspect. Then, if it's really news, and not just a PR scam, the journalists will come. (Understand that I'm not saying I'm sort sort of paragon of modesty. Far from it. But I try to control myself.) I think that the view that "all news is hype" is overly harsh. In fact, corrective forces tend to slow this headlong rush into P.R. For example, the reaction here to the Nathaniel Borenstein/First Virtual hyperbole, and the fatuous, credulous article by Simson Garfinkel (sorry, Simson, but I call 'em as I see 'em), will undermine their credibility for a long time. Crying wolf, and all that. The FV "discovery" that insecure machines can cause all sorts of problems rated at most a brief paragraph in the papers, not the full-page treatment Garfinkel and his editors gave it in the "San Jose Mercury News" (and maybe other papers that picked it up, or will in the next few weeks). Newspapers and magazines that run "fluff" pieces, taken almost directly from press releases, lose credibility. (Nathaniel B. claims that the Simson G. piece ran _first_, before his Press Release. Well, how did Simson first learn of the FV "discovery"? How did the FV President arrange to be photographed? It seems pretty clear to me that FV was involved in the development of the story, perhaps even planting the seed for it. Not necessarily a dishonest thing to do, of course, just a bit tacky given that the "discovery" is not news. >If you want to effect what's in the media, maybe you should learn how to >issue press releases. Nope. I think it a very poor model for getting information out. With all due respect to Sameer, who has done many fine things, I gag every time I see a press release from Community Connection in which Sameer interviews himself. Or, put another way: [Embargoed for release until Jan. 30, noon PST] Crypto Anarchy Foundation Releases Views on Self-Interview Press Releases Corralitos, CA. The Crypto Anarchy Foundation, the world's leading think tank on crypto anarchy, today is announcing its views on press releases. According to Crypto Anarchy Foundation founder and President, Timothy C. May," "We think these press releases are a phony means of pumping up a story." When asked for more details, he added: "The self-interviews are really tacky. Can't you ask me some better questions?" The Crypto Anarchy Foundation, the world's foremost provider of information about crypto-mediated anarcho-capitalism, may be reached at 408-728-0152. CAF spokesperson Tim May can arrange interviews with CAF founder Tim May. --Tim May, CAF founder, chief technical officer, and media relations specialist Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: [NOISE] Borenstein's Fatal Spam
by daw＠boston.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <pgpmoose.199602010813.60849(a)paganini.sydney.sterling.com>, Greg Rose <Greg_Rose(a)sydney.sterling.com> wrote: > A number of people have written words to the > effect of: > First Virtual, you lost a lot of ground with me. > (sounds like others feel the same way, too). > > I disagree. I think there is a big difference > between "knowing theoretically that X, Y and Z > are possible" and "look, I have a program that > does X, Y and Z in a certain order, and very > fast, and surprisingly successfully, and this has > major implications for the banking community". [...] > I think most of the problem here is that we heard > about it in media words first, and in a reasoned > argument second. That's life. Ok. Fair enough. Good points. Personally, what I found most distasteful about FV's post was their conclusions, not their experimental procedure. I agree that their keyboard-sniffer lends more evidence to the well-known argument that, to make good use of crypto, you need secure endpoint machines. I disagree when FV concludes that this makes crypto useless. Instead, I'd contend we just need to work to secure our endpoints better; then we can do all sorts of neat stuff with crypto. I found their conclusions to be academically displeasing. But I guess that's what happens when you're trying to sell a product... - -- Dave Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQ/lHSoZzwIn1bdtAQG3bQF6AnSQY/3Hy6ha35vI5YrbyF8w7Xq/IcN9 IIwNqUKmrqlugKuduk0A9VqDG9Zi0Ksm =7awQ -----END PGP SIGNATURE-----

1 0