December 2003 - cypherpunks-legacy

Re: IPG hoax?
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:32 PM 2/21/96 -0800, Wink Junior wrote: >I must admit that after the first day I've been wondering if this whole >IPG thing isn't some kind of deep troll or early April Fool's joke. It is part of the "Trolling Cryptographers Protocol Internet Protocol". The "TCP/IP" is a secret government project to keep cryptographers busy by posting trolls to various newsgroups where they hang out. (Sometimes they cross post to various groups using the same technique. This is known as a "Troll Bridge".) It is a followup to the evil and ancient "Asyncronous Protocols of the Elders of Zion. (Also known as IPv1.) The next upcoming plot is when they Imminatize the Eschaton with the most evil plot of all... IPv666! (Thankfully it only works under Windows 95 so far.) | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: PRNG in VB
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:05 PM 2/20/96 -0800, you wrote: >I am answering the courteous inquiry from Thomas Womack about my request for >help with a Visual Basic-only PRNG. The premise is that those who will not or >can not afford hardware-based RNG's need something relatively secure in the >face of nothing at all or at best a lesser implementation. ... >the getcurrenttime() Win API a lot. Said to have 50 millicent increments. The ViaCrypt PGP has a nice feature that pops up a window for you to wave your mouse around in or type random characters if you'd rather. It's _much_ nicer, and generally faster, to wave the mouse. If you need a few bits of randomness when you're putting up the splash screen, you could also watch the mouse any time it's in your window on the way to the "ok" button, though of course that doesn't help if your users are using the Enter or Esc key instead of the mouse. Of course, if you're trying to do crypto processing, you probably also feed the data into MD5 before using any of it. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281 ! Frank Zappa for President !

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> Unlike Mr. Silvernail, we have a much simplier definition of what we mean > by a one time pad - given a message/file of length N, where N is a finite > practical number say less than 10 to the 1000th power, that the encrypted > ciphertext can be any of the N to the 256th power possibile clear/plain > text messages/files. To prove that the IPG system does not work, all you > have to do is to prove that is not the case - that our system, without > artifically imposed boundary conditions will generate a subset of those > possibilities - that is simple and strsight forward - not > hyperbole but action - everyone stated how simple it was to break the system, > now everyone is back paddling aa fast as they can, like Mr. Metzger and some of the other big bad cyphermouths. We can be generous and characterize this as a typo. If N is the length in bytes, then the number of possible such messages is of course 256 to the Nth power, not N to the 256th power as the message says. For N=1, for example, 256 to the Nth is 256, while N to the 256th is 1, and of course there are 256 possible one-byte messages, not 1. The wording is a little unclear, so let me offer this proposed clarification, and see if IPG would agree. It is a slight rewording of what they wrote but I think means the same as what they said: > Given a ciphertext of length N bytes, where N is less than 10 to the > 1000th power, the corresponding plaintext can be any of the 256 to the > Nth power possible plaintext messages of length N bytes. I haven't followed the IPG discussion, but if their cipher actually does satisfy this criterion it would be at least pretty close to a one-time pad. One definition of a OTP is that the output tells you nothing about the input (except its length). For any given output, all possible input messages of that length are equally possible. The definition proposed by IPG is similar to this; they say that for a given output, the input could be any message of that length (at least, I think that is what they are saying). To be really as strong as a OTP they should further have it that all these possible inputs are equally probable. However I suspect that if they can actually arrange that all inputs are possible, then they will actually be equiprobable. It follows from their definition that for a given plaintext message, all possible cyphertexts of that length might result. (Because if there was some ciphertext that didn't result from a given plaintext, then for that ciphertet message it would not be the case that the plaintext might be any of the 256 to the Nth possibilities; it could not be that one.) One thing I don't quite understand is whether keys are in fact reused from message to message. If the system is capable of encrypting, say, a 2K byte message such that all possible 2K byte cyphertexts might result, then it should be capable of encrypting two 1K byte messages such that the outputs are unrelated even if the inputs are the same. So I don't see why a system capable of satisfying the definition above would reuse keys. Can we agree that if the IPG system meets the definition they offered (as clarified here) it would be as good as a OTP?

1 0

OECD Canberra Papers
by John Young 17 Dec '03

17 Dec '03

Papers from the Australian/OECD Conference in Canberra are starting to appear, though none are specifically identified as coming from the restricted Group of Experts meeting on February 9: _________________________________________________________________ http://www.nla.gov.au/gii/papers.html Joint Australian/OECD Conference on Security, Privacy and Intellectual Property Protection in the Global Information Infrastructure Canberra, 7 - 8 February 1996 _________________________________________________________________ The one by Shane Simpson thoughtfully examines the way technology is affecting the sharing of information once considered to be proprietary or secret or private. Among other topics, it also explores the release of government information, prying by Big Bro in the "public interest" and other long-standing practices being re-shaped by technology. Some mention of the spread of cryptography and the consequent power disputes. _________________________________________________________________ http://www.nla.gov.au/gii/simpson.html Managing Risks in the Global Information Infrastructure Professor Shane Simpson Founder and Director, Technology Risk Management Centre, Faculty of Law, University of Wollongong

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 11:10 AM 2/21/96, lmccarth(a)cs.umass.edu wrote: >Clay writes: >> Given that N is the length of the message in bits. The number of >> possible combinations of bits is 2^N. For any message length N > 1, >> 2^N < N^256. > >Uh, nope. 2^N grows asymptotically faster than N^256. Actually, for any >constants A and B, A^N grows asymptotically faster than N^B. For A=2, B=256, >the crossover happens somewhere before N=4096. >2^4096 = 2^(16*256) > 2^(12*256) = (2^12)^256 = (4096)^256 > >If the IPG people are using N=5600 (weird choice) then certainly >2^5600 > 5600^256, for what little that's worth. > >(Ah, my computer science B.S. pays off ;) > >-Lewis "You're always disappointed, nothing seems to keep you high -- drive > your bargains, push your papers, win your medals, fuck your strangers; > don't it leave you on the empty side ?" (Joni Mitchell, 1972) Oops. Thanks for pointing this out. I should probably just shut up about this, but snake-oil salesmen really get under my skin. Of course, being wrong hasn't kept me from opening my mouth in the past so ... Clay --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

1 0

Re: Easy Nuclear Detonator
by jim bell 17 Dec '03

17 Dec '03

At 10:56 PM 2/21/96 -0500, Black Unicorn wrote: >On Sun, 18 Feb 1996, jim bell wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> >> At 10:25 PM 2/18/96 EDT, E. ALLEN SMITH wrote: >> > I've been kind of busy recently (the reason I haven't responded to >> >the more recent Assasination Politics stuff), but I'm curious what >> >your method is for achieving simultaneous explosions. >> >> >> "Multiple very thin flexible hollow tubes (1 mm ID? teflon?) filled with a >> homogenous liquid >> explosive (for example, pure nitromethane), length accurately cut to produce >> the exactly desired delay. Kept separated from each other by foam spacers >> to avoid inter-fiber detonations. Detonated from a single cap, with an >> intermediary chamber of liquid explosive to stabilize the shock front, the >> detonation wave travels along each tube simultaneously at (presumably) >> identical velocity." > >This method is so dependent on the uniformity of the initiator (the cap >in this instance) as to be nearly useless. Normal blasting caps do not >detonate with the uniformity required to initiate each of the tube paths >at the same time. In the off chance that you contemplated surrounding >the cap with liquid explosive of a sufficent type, (which still wouldn't >assure proper uniformity with any certainty as the liquid explosive is as >likely to detonate slightly off left to right as up to down) you still have >extremely difficult problems to overcome. Re-read my whole statement. I copy the relevant commentary that you sloppily forgot to read: >> Detonated from a single cap, with an >> intermediary chamber of liquid explosive to stabilize the shock front, I already entirely anticipated your objection. And destroyed it. >1> Interference from the milling shape and accuracy of the openings to >the tubes containing the liquid explosive. Quantify, quantify. How much of a problem? (Hint: If you seriously believed there was a problem with this idea, you would be able to give a few examples on how to avoid them. Reading your commentary, you did none of this. >2> Mild to obscure impurities in the liquid explosives causing >differences in velocity with respect to other tubes. All the tubes can be filled at the last minute by pulling a vacuum on the system and letting atmospheric pressure fill all the tubes. No impurities, or at least it's a perfectly homogeneous mixture. > Even small changes >in pressures within the tubes might cause enough timing problems to make >uniform initiation of the primary high explosive assembly impossible. "might"? Well, could you be more specific? How many nanoseconds would be too many? >3> Interference from the milling shape and accuracy of the terminus of >the tubes containing the liquid explosive. So what's your point? >4> Overpressure in the device causing premature detonation of the near >portion of the high explosive assembly. Sure about that? >All of these might cause enough timing error to prevent uniform pressure >and thus prevent uniform compression and make supercriticality impossible. Pigs might fly. >Remember, kryonic switiches are necessary even when dealing with the >speeds of electric conductivity. The velocities of even hydrazine based >explosives are signigicantly lower. The margin for error is similarly lower. How low? Be specific. >Plutonium gun is still the easiest method for the home grown nuclear >device, even if it requires more fissile material. The "gun" design wasn't used with the plutonium, because IT WOULD NOT HAVE WORKED! "Fat Man," the bomb dropped on Nagasaki, used the implosion method. "Little Boy," the gun-method bomb, used U-235. Plutonium detonates far too rapidly to use the "gun" method. The scientists knew that in 1945. You seem to be at least 50 years behind the times. Sheesh! I guess we now know what field YOU don't know about, huh? Or, perhaps more likely, this is a specific DIS-information campaign. You want someone to waste a critical-mass worth of plutonium.

2 1

CPU_nks
by John Young 17 Dec '03

17 Dec '03

SciAm, March, 1996 "Privacy and Data Collection on the Net." There are still a few eccentric souls who gamely try to hold on to what lingering shreds of anonymity they possess. They never fill out questionnaires; they give their Social Security numbers only to their bank and to their broker. They encrypt their e-mail; they bypass the supermarket discount card that links identity to purchases; they pay cash for medical procedures they do not want known; and they wait patiently for e-cash to become a reality. Joining these hardy individualists are privacy advocates such as EPIC and Net groups like cypherpunks which believe in untraceable communications and in the technology needed to achieve it. CPU_nks

1 0

Re: IPG hoax?
by Wink Junior 17 Dec '03

17 Dec '03

Arley Carter sez: >Fess up guys. You are either: >1. A team of undergrads or graduate students conducting an "exploit". >2. A Detweiller tentacle. Dr. FC ? >3. The return of Alice D'nonymous ? >4. The reason the coderpunks lists was started. I must admit that after the first day I've been wondering if this whole IPG thing isn't some kind of deep troll or early April Fool's joke. Has anyone actually spoken on the phone with IPG or confirmed their existence in any way? For the record, I'd like to state that I saw their ad posted in comp.security.firewalls and forwarded an edited copy (technical details only) to the list, but if this turns out to be a hoax of some sort, I was and am not a willing participant. Would IPG Sales please post an address and phone number so we can confirm the company exists? Wink

1 0

Re: NOT CRYPTO (Sort of): Fwd: OPPOSITION: AFA seeks to expand CDA
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

One wonders if anyone at the American Family Association is selling ISP stock short? If so, and it could be found out, it would be kind of embarrasing to them. -Allen

1 0

Edupage, 20 Feb 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 21-FEB-1996 11:56:31.71 >***************************************************************** >Edupage, 20 February 1996. Edupage, a summary of news items on information >technology, is provided three times each week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >***************************************************************** As I recall, this is incorrect. Without a signature/physical presence, it's the _merchant_ who is liable. Thus, a lack of (sufficient) encryption is a problem for the merchant, who thus may decide to not sell products via the Net - a loss for the consumer. >CREDIT CARD SCARE TACTICS >Sending your credit card information over the Internet is really no big >deal, says Simson Garfinkel, author of a book on Pretty Good Privacy >encryption software. "The whole thing about encryption over the Internet is >that it's not to protect the customer -- it's to protect the credit-card >companies. By law, if there is no signature, the customer is liable for >nothing. If there's a signature, they're liable for $50. The reason the >credit-card companies want cryptography is to limit their own liability. It >has nothing to do with protecting the consumer." And although Netscape >Navigator sends a stern message each time a user attempts to send >information over the Web, Garfinkel labels the warning just another scare >tactic: "Netscape Navigator is printing those messages because they're >trying to sell encrypted servers. It's an ad. It doesn't look like an ad, >but it is." (Tampa Tribune 19 Feb 96 B&F3) Friendly policy: >BANYAN SPONSORS E-MAIL SWITCHBOARD >Banyan Systems is offering a new service on the Web -- a directory of e-mail >addresses and other information for 93 million people and 11 million >businesses worldwide. Switchboard includes a feature similar to Caller ID, >that alerts a listed person whenever someone asks for that person's address, >and allows them to decide whether to allow that information to be given out. >The service also features public key certificates for secure communications >between users. < http://www.switchboard.com > (Information Week 12 Feb 96 >p24) Sigh... why am I not surprised? >EUROPE BACKS V-CHIP >The European Parliament has followed the lead of the United States in >supporting the use of Canadian-developed V-chip technology that allows >parents to screen violent or adult content from their televisions. >(Montreal Gazette 20 Feb 96 C7) >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: >send a message to: listproc(a)educom.unc.edu and in the body of the >message type: subscribe edupage Abraham Lincoln (assuming that your >name is Abraham Lincoln; if it's not, substitute your own name). ... >To cancel, send a message to: listproc(a)educom.unc.edu and in the body of >the message type: unsubscribe edupage. (Subscription problems? Send mail >to educom(a)educom.unc.edu.)

1 0