December 2003 - cypherpunks-legacy

(Fwd) White House mail bomb protest?
by Deranged Mutant 17 Dec '03

17 Dec '03

In regards to the few messages about mailbombing the prez's box... ------- Forwarded Message Follows ------- |From jms(a)tennis.opus1.com Sun Feb 11 06:57:22 1996 |From: jms(a)tennis.opus1.com (Joel M Snyder, writing fool) |Subject: High mail volumes at whitehouse.gov |Newsgroups: comp.mail.misc,comp.security.misc,news.admin.net-abuse.misc |Date: 9 Feb 96 16:03:20 -0700 |Organization: Opus One, Tucson, Arizona |Message-ID: <1996Feb9.160320.495(a)tennis.opus1.com> Folks: Good day. By way of introduction, I'm the consultant who did the "anti-mailstorm/anti-mailbomb" software that runs on the MX host for WHITEHOUSE.GOV. Now that the Telecom. Act of 1996 has been signed, the volume of mail through WHITEHOUSE.GOV has gone up significantly. For example, there were about 85,000 lines in the mail log file yesterday. Most of that is just people who want to express their opinion. However, several misguided individuals have decided that they want to throw a monkey wrench into the works by storming the President's email. I'm writing this to let any system administrators out there know that you may find mail from your site to WHITEHOUSE.GOV is not moving very quickly. This is normal; it's a sign that the automatic protections of that system have kicked in. Without going into details, if too many messages come from a single site, the mail handler will throttle back accepting messages. Eventually, though, the mail will be accepted for delivery. If you have legitimate mail, it will eventually get through (many messages from the same correspondent will be flushed without acknowledgement). However, correspondents who were used to getting a reply within seconds telling them that their message was accepted may see a substantial delay. Finally, if any users on your site have any delusions about the effect of a mail bomb or storm of mail, let me help you dispel them: (1) no one important enough to make a difference will be affected or know or care; (2) if the messages are nasty or threatening enough, someone equally nasty may come and visit; (3) what you'll succeed most in doing is ruining the weekends and/or days of underpaid civil servants as well as wasting federal tax dollars. Please feel free to redistribute this or use parts of it in your motd. Joel Snyder (jms(a)opus1.com) PS: I don't read these newsgroups and am spending most of the weekend trying to make sure that the mail system doesn't melt down anyway, so if there is discussion on this, I won't see it. --------- end forwarded mesage ------------- Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

3 2

PGP PRNG seeds?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! I tinkered with the switch pgp +makerandom=size output.fil Is there a way to "seed" the PRNG with another file, say , part of an encrypted text file? Thanks JFA

1 0

Mainstreaming PGP on Usenet
by Bruce Baugh 17 Dec '03

17 Dec '03

I'm surprised nobody has brought this up before.... FIRST CALL FOR VOTES (of 2) moderated group soc.culture.russian.moderated <snip> 6. Individuals in the database of known readers may post freely to the group, subject to the conditions in sections 1-4 above. If need arises, the robomoderator may perform PGP verification of the identity of the known reader and, if the reader requests so, automatically reject all the submissions from the reader without a valid PGP signature. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

4 8

Re: RNG method
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: > > I thought of that for a long time. > > - Use a microphone on your sound card and locate it close to the > computer fan. It's been thought of before, along with scraping the microphone against the desk. I've been told this works best when first turning the gain up on the soundcard and setting it for stereo input. The raw data and be processed cryptographically (with a cipher or run through a hash). This method will be an option for the NOISE.SYS driver eventually. - --Rob PS - noise049.zip has been uploaded to a few sites today. When I get confirmation I'll announce it... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTke4SoZzwIn1bdtAQHQ3wF9GsZjk+jbtWrap8sKcSXDQ3n8GVksofBX CaVPqXKiE7CxB41hbo2ftSFqQ+P3XhFX =gdTO -----END PGP SIGNATURE-----

1 0

Re: RNG method (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 2 Mar 1996 23:24:04 -0500 > Subject: Re: RNG method > > > > - Use a microphone on your sound card and locate it close to the > > computer fan. > > It's been thought of before, along with scraping the microphone against > the desk. I've been told this works best when first turning the gain up > on the soundcard and setting it for stereo input. > If you use the fan remember in your power supply remember that many of them run directly off the 120 VAC. As a consequence the sound it makes will have a strong 60Hz componant. If you are using a DC bearing fan then there will be a componant in the noise related to the number of balls in the bearing. DC bearingless fans should provide the best white noise provided the bushings are not worn. Once they wear you will be a harmonic related to shaft diameter, shaft length, and the gap between main shaft and bushing.

1 0

Re: PGP 3.0/4.0
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:23 AM 3/1/96 -0500, you wrote: >At the same time am trying to set up a secure mailing system for >80,000 mailboxes (soon to be over 200,000) and the last time I put >together a 6,000 key ring on a 386 it took three days & several Mb. Fortunately, on a site this big, you can afford to use a Pentium or Sparcstation and 32-bit code :-) However, if it took you that long (as opposed to, say 4 hours), you probably were short of RAM and were paging a lot. >This will require a "different" mechanism. Yup. You may be able to do it within the structure of the current PGP, by dyamically managing keys in separate files (e.g. 80,000 files, or condensations into keyrings of say 100 keys) though it would help immensely to hack the key retrieval code. Under PGP 3.0, you'll have libraries to let you do this stuff; until then it's probably not too hard to build a front-end (stealing the non-RSA portions of PGP) that looks at the keys in a file and calls PGP with a request to use the correct keyring file, or some such hackery. Or, of course, you can license RSAREF and integrate the code yourself. Depending on the email volume, it may be cheaper to just license RSA, so you can use better bignum packages like some of the European PGP flavors. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

5 4

Jefferson Wheels?
by Adam Shostack 17 Dec '03

17 Dec '03

Does anyone know where I might buy a Jefferson Wheel cipher? The army version (M-118?) would be fine. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

art-stego
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

The recent discussion "Chaff in the Channel" got me thinking about an alternative to hiding random bit streams in picture files. The goal of steganography, as I see it, is to provide plausible deniability. The problem with hiding bit streams is that you can never be sure if the opponent has developed an analysis technique to prove a particular file contains a suspicious bit pattern. The alternative to hiding bit streams is to not hide them. Use them to generate pretty pictures. For example, modify a fractal image generator to accept a bit stream as input. Use the bit settings to influence the values used to iterate the fractal function. You don't have to use fractals, any function that produces pretty pictures would probably work as long as there was a way to extract the bit stream from the final picture. Brute force would probably work fast enough for humans. One possibility is a screen saver that produces an "infinite" variety of pretty pictures by generating a pseudo-random bit stream and using it to help generate the next background picture. Occasionally, the picture might be so cool you will want to send it your friends or post it on the Net or just keep it around to look at. The goal is to create an innocent reason for passing around unique images that contain random bit streams so we don't have to worry if somebody finds the bit stream. If you live in a country that doesn't outlaw abstract art you have plausible deniability. Jim_Miller(a)suite.com

5 4

Re: M A F_i o s
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: [..] > The title does remind me somewhat of > "Buckaroo Banzai against the World Crime League".... Hm. Remember the scene where one of his buddies in the film could just decode some military crypto just by staring at it... *sigh* Back to the regularly scheduled noise. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTkIRCoZzwIn1bdtAQFvxAGAyVKXhD4fV6CE0ivluAJTLrAmbimmrzo3 v0MDgt0SYpt29XcV77uiaRMIXSkqtx+o =wlQb -----END PGP SIGNATURE-----

1 0

Re: Problems with certificates.
by Greg Rose 17 Dec '03

17 Dec '03

[Apologies if this appears twice -- I had a posting problem.] A. Padgett Peterson wrote: Next rage might well be "vanity" PGP keys. While at the moment it is not known how to create a specific match key to a sequence, if you generate enough keys, there will be some interesting sequences found. Possibly some PGP signatures will even be in violation of the CDA (now that should start a rush 8*). That's not quite correct. The part about it not being known, I mean. I created a key: Type bits/keyID Date User ID sec 1024/DEADBEEF 1995/09/28 Prime Rib Lovers sig DEADBEEF Prime Rib Lovers (note: DEADBEEF seems about the most interesting 8-character hex word -- CAFE doesn't seem to go with anything...) And Christopher Drake (http://pobox.com/~netsafe) has mailed out a key which has a company advertisement in its ASCII armor. Hmmm. I thought I kept it around, but I can't find it. Ahhh. There it is. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.i mQCNAjD/mQAAAAEEAP/////NetSafe+PGP+key////We+provide+inexpensive AntiFraud/theft+etc+Security+Software5tGfKREuINIWsQqsLNS+uAneN9M SuMu37f+NU/U2djtxE/b9h4bJ4wb8h3QkBiuTAS1QjpxpxryQzZ10zzGQe8VAAUR tChDaHJpc3RvcGhlciBOLiBEcmFrZSA8TmV0U2FmZUBQb2JveC5jb20+ =SGC/ -----END PGP PUBLIC KEY BLOCK----- Type bits/keyID Date User ID pub 1024/C641EF15 1996/01/19 Christopher N. Drake <NetSafe(a)Pobox.com> I still assert there are a bunch of attacks related to producing on-demand keyid's. Greg. Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr/ French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director.

1 0