December 2003 - cypherpunks-legacy

Anonymous Interview
by Duncan Frissell 17 Dec '03

17 Dec '03

"Anonymous" the author(s) of "Primary Colors" (the Clinton Campaign novel) conducted an interview with a Time Magazine writer using his/her/their agent's online account. A demonstration that borrowed accounts can overcome account ID control attempts. DCF

1 0

Re: Unscribe
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:34 AM 2/2/96, Ewout Meij wrote: >unscribe cypherpunks(a)toad.com ^^^^^^^^ > >unscribe emeij(a)pi.net ^^^^^^^^ > >There is a theory which states that if ever anyone discovers exactly >what the Universe is for and why it is here, it will instantly >disappear and be replaced by something even more bizarre and >inexplicable. There is a theory which states that the correct way to unsubscribe from mailing lists is defined by the mailing list charter and principles, and that sending misspelled "unscribe" messages to the wrong place, and including "unscribe" messages intended for other lists, is bizarre and inexplicable. --TCM P.S. to Ewout: Send a message to "majordomo(a)toad.com" with a body message consisting only of "unsubscribe cypherpunks". Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: new release of apache-ssl
by Jyri Kaljundi 17 Dec '03

17 Dec '03

On Wed, 31 Jan 1996, sameer wrote: > Apache-SSL 0.4.4 will soon be on the ftp site, and commercial > licensees may request upgrades from apachessl(a)c2.org. If someone put's this up on some European ftp site, please tell us. Right now only version 0.4.2 is available on utopia.hacktic.nl and ftp.funet.fi. Juri Kaljundi, DigiMarket jk(a)digit.ee

1 0

Japanese Firm Announces E-cash Implementation
by Andrew Barrett/CheckFree Corporation 17 Dec '03

17 Dec '03

Multimedia Business Analyst via Individual Inc. : NTT has developed a secure electronic cash system for smart cards and Internet-based transactions, reports Reuter. Using very secure encryption algorithms, the system allows users to transfer cash from their bank accounts to smart cards after verification by the issuing bank. NTT researcher Mikio Suzuki said the Japanese telecom operator plans to begin trials of the system with a number of major city banks in the near future. These are expected to include Fuji Bank and Sakura Bank.

1 0

digital signatures and "meaning"
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Digital signatures can have many different uses and meanings. The most popular application of digital signatures is proof of authorship. A person signs something when he claims that he wrote it and if the signature is invalid, the message must have been altered. However, digital signatures are used for many other applications. Typical applications include timestamping, digital cash, and validating a document or statement. The problem with these applications is that there must be some way to distinguish and timestamp signature from a proof of authorship. There are several different ways to do this: - Make all digital signatures prove proof of authorship. Someone would include the text of the document he wants to sign and put a message saying at the end such as: "This document existed on such and such date" or, in the case of digital cash, "This coin was blinded and signed by the bank using standard protocols." - Append some kind of electronic tag to the message that represents a certain kind of authorization. This is identical to the previous method except it relies more on protocols. - Specify the type of signing that is to be done with a key. This could be included in the text of the user-ID field of the public key in a PGP-like program. It could also be done by extending a key generation and management protocol to include a tag on the key itself specifying what this key is to be used for. There are advantages and disadvantages to each of these. The first has the advantage that it requires no protocol modification but relies on "legaleese." The second method does require that protocols be slightly modified, but these modifications could be made by just pre-processing and post-processing the message with another program. However, this is more limited than the first method because it essentially uses "canned" messages. The final method relies on either no modification to the crypto program used or a non-trivial modification. Personally, I tend to think that anything that uses a standardized protocol is a Good Thing. This is why I think that the second and third methods listed above would work better than the first. Comments? - --Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 PGP: Because sometimes, a _Captain Midnight_ decoder ring simply isn't enough. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMQ1agLZc+sv5siulAQFKtwP/Xs7gOm1vP2FeDJDjahymYbMum3JrFqh0 VKXrkjmlh42ygX9y2sLfivN7DMsAGIF86NRaW67x0LD2uPuBl00KyvC18bqEPfiF kMbvOZv96xL4fBssheRR7F4YH/oaASxCagxuAkIqBxi9uEzAppNloxMYHy87w0kY h+48n+YH3D0= =QTZp -----END PGP SIGNATURE-----

1 0

Re: Lotus Notes
by Rich Salz 17 Dec '03

17 Dec '03

Thanks for the explanation -- in all my discussion with RSA and explanation to our lawyers I was thinking strictly API. Your quote of the RSAREF license says they won't refuse anythign reasonable, and one would be hard-pressed to say that changing keysize for something already not exportable isn't reasonable. I'll have to read our license when I get to work tomorrow. /r$

1 0

The Boys From Brazil - thoughts on cloning Nazi servers
by Simon Spero 17 Dec '03

17 Dec '03

I've tried to stay out of this thread, as it is mostly off topic, but I do have one suggestion to people setting up clones of the zundel site. There's a fine line between defending someones freedom of speech, and actively promoting that speech. The reason these mirrors have been set up is to counter the restriction on access to the original site that has been put in place by Deutche Telecom; however, in addition to defeating this restriction, this approach also makes the material more widely available than it was previously, which could be seen as crossing the line between defence of free speech, and active promotion. One approach that would stop this line being crossed would be to configure the clone servers to only allow access to sites in Germany affected by the original restriction. This compromise defends freedom of speech, but does not give the site any wider promulgation than it would have had had no government restrictions been emplaced. Simon

1 0

Re: Unscribe
by Alex de Joode 17 Dec '03

17 Dec '03

TCM sez: : At 1:34 AM 2/2/96, Ewout Meij wrote: : >unscribe cypherpunks(a)toad.com : ^^^^^^^^ : > : >unscribe emeij(a)pi.net : ^^^^^^^^ : > : >There is a theory which states that if ever anyone discovers exactly : >what the Universe is for and why it is here, it will instantly : >disappear and be replaced by something even more bizarre and : >inexplicable. : There is a theory which states that the correct way to unsubscribe from : mailing lists is defined by the mailing list charter and principles, and : that sending misspelled "unscribe" messages to the wrong place, and : including "unscribe" messages intended for other lists, is bizarre and : inexplicable. : --TCM [pi.net] 'Planet Internet' is the dutch equivalent of AOL. -AJ-

1 0

Re: Downsizing the NSA
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

A semiparanoid thought struck me: Maybe the NSA doesn't these extra 20K people, they just don't want them to go out into the industry and build crypto for the outside world. So they continue to pay them salaries and have them do nothing useful. This would be kind of analogous to how when Russia no longer needed so many nuclear scientists, the U.S. helped create "make work" jobs for them, just so they wouldn't go to work for the likes of Iraq. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Crypto-smart-card startup Inside Technologies
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:41 PM 1/31/96 -0800, Peter Monta wrote: >jim bell <jimbell(a)pacifier.com> writes: > >> > [ Inside Technologies ] >> > ..."In public-key cryptography, 512-bit keys are typical and >> > already vulnerable. So we are looking at 640-bit-long keys >> > supported by a scalable design." >> >> This kind of thing disgusts me. We already know 512-bit keys are weak. As >> I recall, I was told that 512 bit keys could be cracked in 20,000 >> MIPS-years. If the ballpark formula holds that adding 10 bits doubles the >> security, that merely means that 640 bits is 2**(128/10) or 8000 times >> strong. While obviously better than 512, it is not ENOUGH better to make me >> confident that this is a long-term secure length. 768 or 1024 bits should >> be considered the minimum. A deliberate design of 640 bits makes it look >> like it's intended to be crackable in 5-10 years, much as DES was suspected >> of a similar design decision in limiting its keylength to 56 bits. > >But the "scalable design" presumably means the hardware can deal >with a variety of modulus lengths. As you say, they would be >short-sighted to make a fixed choice. I hope you're right about this. But there's something to keep in mind. Let's suppose that in 10 years 640 bits are "easily" cracked. Anybody with the storage (money) to keep all these messages will have the power to sort through everything you said in 1996, '10 years later.' Who has the money to even store these messages, as well as the inclination? You guessed it, the government. I realize that it is arguable that this would be possible, no matter what keylength is chosen. True, someday 1024-bit keys might be easily cracked, but that will probably be 30-50 years from now, not 10. In other words, "stretching" the technology today on the "encrypt" side makes storing these messages far less attractive, meaning that the government will have less motivation to do it, and will not be able to make the effort pay off for a few more decades. I would like to see laws: 1. Prohibiting the government from storing encrypted messages it can't currently decrypt for over, say, a couple of years. 1a. Prohibiting any USE by the government of such messages obtained and stored by other entities, including individuals and private corporations, without the express permission of the sender AND receiver of the message. 2. Prohibiting the government from even ATTEMPTING to decrypt a domestically-obtained encrypted message, without a warrant which is simultaneously given to the source of the message: In other words, alerting him to the government's interest. This is just a start. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMREY2/qHVDBboB2dAQGZdgP+MjIK02fU6iysN77g1aWb1gx9bzDrZoh4 ePWmd9RRD3gnzYOSIng5dRCxEpT+0Cqe4cFQEqbD6GhHlfNOKwkTU/LAfhvOdKpo QJ9t93Af3aCaLtFmtXyj1Ce20GNqkp7qqP5DLKjYSEH/bR64aTA0pfZ70aes/8C1 w1AYLdvglXA= =p+3A -----END PGP SIGNATURE-----

2 1