December 2003 - cypherpunks-legacy

Re: RNG method (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 2 Mar 1996 23:24:04 -0500 > Subject: Re: RNG method > > > > - Use a microphone on your sound card and locate it close to the > > computer fan. > > It's been thought of before, along with scraping the microphone against > the desk. I've been told this works best when first turning the gain up > on the soundcard and setting it for stereo input. > If you use the fan remember in your power supply remember that many of them run directly off the 120 VAC. As a consequence the sound it makes will have a strong 60Hz componant. If you are using a DC bearing fan then there will be a componant in the noise related to the number of balls in the bearing. DC bearingless fans should provide the best white noise provided the bushings are not worn. Once they wear you will be a harmonic related to shaft diameter, shaft length, and the gap between main shaft and bushing.

1 0

Re: PGP 3.0/4.0
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:23 AM 3/1/96 -0500, you wrote: >At the same time am trying to set up a secure mailing system for >80,000 mailboxes (soon to be over 200,000) and the last time I put >together a 6,000 key ring on a 386 it took three days & several Mb. Fortunately, on a site this big, you can afford to use a Pentium or Sparcstation and 32-bit code :-) However, if it took you that long (as opposed to, say 4 hours), you probably were short of RAM and were paging a lot. >This will require a "different" mechanism. Yup. You may be able to do it within the structure of the current PGP, by dyamically managing keys in separate files (e.g. 80,000 files, or condensations into keyrings of say 100 keys) though it would help immensely to hack the key retrieval code. Under PGP 3.0, you'll have libraries to let you do this stuff; until then it's probably not too hard to build a front-end (stealing the non-RSA portions of PGP) that looks at the keys in a file and calls PGP with a request to use the correct keyring file, or some such hackery. Or, of course, you can license RSAREF and integrate the code yourself. Depending on the email volume, it may be cheaper to just license RSA, so you can use better bignum packages like some of the European PGP flavors. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

5 4

Jefferson Wheels?
by Adam Shostack 17 Dec '03

17 Dec '03

Does anyone know where I might buy a Jefferson Wheel cipher? The army version (M-118?) would be fine. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

art-stego
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

The recent discussion "Chaff in the Channel" got me thinking about an alternative to hiding random bit streams in picture files. The goal of steganography, as I see it, is to provide plausible deniability. The problem with hiding bit streams is that you can never be sure if the opponent has developed an analysis technique to prove a particular file contains a suspicious bit pattern. The alternative to hiding bit streams is to not hide them. Use them to generate pretty pictures. For example, modify a fractal image generator to accept a bit stream as input. Use the bit settings to influence the values used to iterate the fractal function. You don't have to use fractals, any function that produces pretty pictures would probably work as long as there was a way to extract the bit stream from the final picture. Brute force would probably work fast enough for humans. One possibility is a screen saver that produces an "infinite" variety of pretty pictures by generating a pseudo-random bit stream and using it to help generate the next background picture. Occasionally, the picture might be so cool you will want to send it your friends or post it on the Net or just keep it around to look at. The goal is to create an innocent reason for passing around unique images that contain random bit streams so we don't have to worry if somebody finds the bit stream. If you live in a country that doesn't outlaw abstract art you have plausible deniability. Jim_Miller(a)suite.com

5 4

Re: M A F_i o s
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: [..] > The title does remind me somewhat of > "Buckaroo Banzai against the World Crime League".... Hm. Remember the scene where one of his buddies in the film could just decode some military crypto just by staring at it... *sigh* Back to the regularly scheduled noise. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTkIRCoZzwIn1bdtAQFvxAGAyVKXhD4fV6CE0ivluAJTLrAmbimmrzo3 v0MDgt0SYpt29XcV77uiaRMIXSkqtx+o =wlQb -----END PGP SIGNATURE-----

1 0

Re: Problems with certificates.
by Greg Rose 17 Dec '03

17 Dec '03

[Apologies if this appears twice -- I had a posting problem.] A. Padgett Peterson wrote: Next rage might well be "vanity" PGP keys. While at the moment it is not known how to create a specific match key to a sequence, if you generate enough keys, there will be some interesting sequences found. Possibly some PGP signatures will even be in violation of the CDA (now that should start a rush 8*). That's not quite correct. The part about it not being known, I mean. I created a key: Type bits/keyID Date User ID sec 1024/DEADBEEF 1995/09/28 Prime Rib Lovers sig DEADBEEF Prime Rib Lovers (note: DEADBEEF seems about the most interesting 8-character hex word -- CAFE doesn't seem to go with anything...) And Christopher Drake (http://pobox.com/~netsafe) has mailed out a key which has a company advertisement in its ASCII armor. Hmmm. I thought I kept it around, but I can't find it. Ahhh. There it is. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.i mQCNAjD/mQAAAAEEAP/////NetSafe+PGP+key////We+provide+inexpensive AntiFraud/theft+etc+Security+Software5tGfKREuINIWsQqsLNS+uAneN9M SuMu37f+NU/U2djtxE/b9h4bJ4wb8h3QkBiuTAS1QjpxpxryQzZ10zzGQe8VAAUR tChDaHJpc3RvcGhlciBOLiBEcmFrZSA8TmV0U2FmZUBQb2JveC5jb20+ =SGC/ -----END PGP PUBLIC KEY BLOCK----- Type bits/keyID Date User ID pub 1024/C641EF15 1996/01/19 Christopher N. Drake <NetSafe(a)Pobox.com> I still assert there are a bunch of attacks related to producing on-demand keyid's. Greg. Greg Rose INTERNET: greg_rose(a)sydney.sterling.com Sterling Software VOICE: +61-2-9975 4777 FAX: +61-2-9975 2921 28 Rodborough Rd. http://www.sydney.sterling.com:8080/~ggr/ French's Forest 35 0A 79 7D 5E 21 8D 47 E3 53 75 66 AC FB D9 45 NSW 2086 Australia. co-mod sci.crypt.research, USENIX Director.

1 0

(fwd) Re: The police came knocking
by unknown＠example.com 17 Dec '03

17 Dec '03

Path: news.aus.world.net!news.us.world.net!news.inc.net!trellis.wwnet.com!nntp.coast.net!howland.reston.ans.net!newsfeed.internetmci.com!news.mel.aone.net.au!newshost.pcug.org.au!blchupin!blchupin From: blchupin(a)pcug.org.au (Basil Chupin) Newsgroups: tip.general,aus.org.efa,aus.legal Subject: Re: The police came knocking Message-ID: <09A420598905(a)pcug.org.au> X-Mailer: Osiris v4.1 Registered To Basil Chupin References: <4gisqm$s4c(a)wabbit.its.uow.edu.au> Date: Sun, 25 Feb 96 17:06:59 +1000 Organization: Back To The Future CBIS, Canberra, Australia Lines: 223 Xref: news.aus.world.net aus.org.efa:1808 aus.legal:2660 In article <4gisqm$s4c(a)wabbit.its.uow.edu.au> Phil Herring <revdoc(a)uow.edu.au> writes: > In article <312beb37.18538395(a)newshost.pcug.org.au> Owen Cook, > rcook(a)pcug.org.au writes: >1. All traffic into and out of Australia passes thru this >building at St Leonards >2. Xty millions of dollars were spent by Telecom and ASIO to >install, secretly, computers in the site. >3. The purpose of the facility was to monitor all traffic thru >keyword searches, originator and destination addressees. > > Erm, no. It's just a version of the "NSA line eater" myth. Aside > from > the fact that there are international links all over the place, > including satellite uplinks and leased phone lines, the plain > truth of > the matter is that the government just doesn't care about the > Internet > all that much. Politically it's of little consequence, and law > enforcement and "intelligence" services have small budgets that > just > don't stretch to this kind of conspiracy. > > On the other hand, the insecurity of email is legendary. ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Date : 10 Mar 94 13:11:46 From : Relay To : All Subject : Government Eavesdropping In New Zealand ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ * Message originally : From: Relay To : All Date: 10 Mar 94 11:42:35 Area: alt.dcom.telcom * Forwarded by Tech Support using Sphinx! 2.0 The following article was posted to the Student Journalists mailing list (STUMEDIA(a)UABDPO.BITNET) by Malcolm Hutchinson (malcolmh(a)waikato.ac.nz) This is an article that appears as the centre feature in our first issue for the year. as the token NZ representative on this list, i thought i would post it to show that the US is not the only country experiencing problems keeping their govt in line when it comes to digital privacy & secure comms. NZ is known around the world for it's anti-nuke stand in the mid- eighties, yet we allow this sort of thing to continue. the waihopai spy base feeds information *directly* to the NSA. it is because of the existance of installations like this that i encourage all my digital friends to take control of their own information and start using strong cryptographic software. PGP is available from any number of anon FTP sites around the world. get it, use it. i apologise if posting an article like this is considered wasting bandwith on this list y'all stay safe mal title: The Biggest Sour Grape in Marlborough At a predetermined signal the two groups of protesters split apart. The group I was in went round the fence to the main gates and started pushing them back and forward making a hell of a racket. The gate was secured in three places. We broke the top padlock and the steel rod holding the gate in the ground. We heard a shout from the other group. They were through the fence. Nine people arrested and many more if we didn't stop our vigorous attack on the main gates. This was it, we were there to do something radical, to make our protest well and truly heard. No-one had breached the huge inner fence of the Waihopai Spybase for years. It was my first protest at Waihopai but not the last. The Waihopai protest just South of Blenheim is an annual event organised by the Anti-Bases Campaign (ABC). Ever since the first survey pegs were planted in the ground in 1987, New Zealand women (originally) and men have protested against the existence of the secretive Waihopai Spybase. Yet despite its colourful history the vast majority of people still don't know it exists. Held from January 27-29 this year's protest was larger than usual. About 80 people (including an unspecified number of university students) from Dunedin to Auckland converged on a makeshift campsite nestled beside the Wairau River to plan what action they would take against the Spybase and all it stands for. The word "spybase" conjures images of undercover cops, secrecy, high security, mystery and murder. While this is a bit dramatic there are similarities. The Waihopai base is run by the Government Communications Security Bureau (GCSB), a discrete organisation which only reports to the prime minister. Hidden in a barren valley deep in the Marlborough outback, the Waihopai base is not something the GCSB wants New Zealanders to know about. Workers at the base aren't allowed to talk about what they do and even their spouses don't know how much they earn. The base has a secret budget and secret objectives. Secrecy is the aim and so far 'they' have been successful. That is until 6.00pm Sunday night of the protest when on TV3 thousands of viewers saw the Waihopai Spybase for the first time. The next day articles were published in Sunday papers, with further articles in major daily papers on the Monday. Supportive comments by Nelson MP John Blincoe added to the debate on a topic usually considered closed. For the first time many New Zealanders became aware that a government agency was spying on our neighbours in the South Pacific and giving that information straight to the United States. What is a Spybase? A more official name for the Spybase is Satellite Communications Station. This sounds very innocent but there's no escaping the fact the base invades the privacy of thousands of people, businesses governments and other organisations throughout the South Pacific without their consent. The information gleamed is not meant for the GCSB or the US, that's why it's called spying. The base consists of an 18 metre receiving dish covered by a huge white dome, an operations building and workshop, all protected by a 14ft security fence backed by another electric fence, security cameras and floodlights. The base monitors communications transmitted via satellite: private and commercial telephone, fax, e-mail, telex and telegrams. These messages are scanned for key words by computer. The information collected is then relayed to the GCSB headquarters in the Freyberg building in Wellington. Useful information is then sent to the United States National Security Agency or the larger Spybase in Geraldton, Australia. Why protest? "The Waihopai Spybase uses your money to invade your privacy for other countries' benefit?" This statement taken from an Anti-Bases Campaign pamphlet about the base sums up the general reason why people are motivated enough to protest, and to be arrested. In the past, politicians like David Lange claimed the Waihopai base will give New Zealand more independence in intelligence matters and that the information would be under New Zealand control. However a document obtained from the US Navy by peace researchers last year has confirmed long held suspicions that the GCSB passes the intelligence collected at Waihopai to the powerful US National Security Agency. This evidence completely contradicts the claims made by New Zealand politicians. What's more, according to British investigative journalist, Duncan Campbell, the Waihopai Spybase is part of a world wide network of spybases monitoring satellite communications for the benefit of the NSA. What really sticks in the throats of those who know about the Waihopai Spybase is that despite the fact that the information is given to the US, New Zealand pays for it. Based on the costs of similar bases in other countries, the Anti-Bases Campaign estimates that the base cost $20 million to set up and up to $100 million so far. Protesters ask why should we be paying for this 'service' especially when we weren't even told about it. The Waihopai Spybase was established without the consent of the New Zealand people and operates without the permission of the Pacific countries who's sovereignty it intrudes on. The Spybase is part of a reliance on military power and cold war politics which reinforces the nuclear powers domination of the globe. Instead of building relationships with our neighbours based on trust, cooperation and peace we are furthering the interests of oppressive military alliances by the world super powers. Under international law it is in fact illegal to intercept international communications. The activities of the Waihopai Spybase contravene the International Tele-Communications Convention to which NZ has agreed. It is also illegal under NZ law to act on such information. The question we must ask ourselves is "Do we want New Zealand to participate in this misuse of technology?" "Do we want to be consulted before we enter into secret military alliances with the super powers? Would we rather the money spent on spying was spent on education or health? Protesters at Waihopai demand a Parliamentary inquiry into the activities of the GCSB, and that the activities of this organisation be subject to review by the judicial system. We also demand the closure of the Waihopai Spybase and the redirection of the money spent on its operations to be put toward a peaceful future. Until this happens we will continue to protest at Waihopai. I didn't try to be unbiased in this article. For a start I was actively protesting the base myself. It is also difficult to get another side to the story when politicians won't talk about it. The head of the GCSB even refused to answer MP's questions in Parliament about the Spybase. But secrets never last forever and thanks to the New Zealand peace movement at least some of the truth is becoming public. The more people who demand knowledge of the Spybase and accountability for its operations, the more likely politicians will take notice. Already Nelson MP John Blincoe (Labour) has come out in support of the Waihopai protest. In the Christchurch Press Blincoe said international circumstances had changed and it was time for the "cloud of secrecy" over the base to be lifted. "The public is entitled to know what is being done from its own soil," said Blincoe. "At the very least there should be Parliamentary scrutiny of Waihopai and the other listening station, Tangimoana, near Palmerston North." Yes there are other spybases, of different sorts, but did you know about them? I find it unnerving to think people could be listening to my phone conversations, that foreign spy networks are operating through New Zealand and I am helping finance something I don't believe in. But then we don't have to like it and nor do we have to accept it. It is our right to question and protest. To find out more information about Waihopai and other bases in New Zealand write to the Anti-Bases Campaign, PO Box 9314, Wellington. [NEW ZEALAND] Paul Smith wc 1345 ********************************************************* Malcolm Hutchinson internet: malcolmh(a)waikato.ac.nz Editor: NEXUS 1994 The Waikato Students' Union Te Wharae Wananga O Waikato Hamilton, New Zealand PGP Public Key available on request ********************************************************* -- Nigel Allen ae446(a)freenet.carleton.ca ---------------------------------------------------------- Basil Chupin Internet: blchupin(a)pcug.org.au Fidonet: 3.620.269.0 +61-6-285-2353 XLTNet: 370.100.1.0 +61-6-285-2353 ---------------------------------------------------------- -- "I mean, after all; you have to consider we're only made out of dust. That's admittedly not much to go on and we shouldn't forget that. But even considering, I mean it's sort of a bad beginning, we're not doing too bad. So I personally have faith that even in this lousy situation we're faced with we can make it. You get me?" - Leo Burlero/PKD +---------------------+--------------------+----------------------------------+ |Julian Assange RSO | PO Box 2031 BARKER | Secret Analytic Guy Union | |proff(a)suburbia.net | VIC 3122 AUSTRALIA | finger for PGP key hash ID = | |proff(a)gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 | +---------------------+--------------------+----------------------------------+

1 0

Re: Cypherpunk remailer
by johan＠eniac.campus.luth.se 17 Dec '03

17 Dec '03

>At 07:24 PM 2/29/96 +0100, you wrote: >>>The mixmaster remailers require special client software on your machine. >> >>What special software? What will the client do? >It's "The Mixmaster Client Software". Mixmaster is a relatively complex >system that breaks up the message into encrypted pieces that get sent >separately to a destination mixmaster, which decrypts and reassembles the >pieces and sends the message on to the final destination. It's more secure, >partly because all the transmissions are encyrpted, and partly because it's >much harder to do traffic analysis on a network of indentical-sized chunks >floating around than on messages with distinct sizes that you can watch. >I think the client only runs on Unix, or at least doesn't run on DOS, >though there's some porting work being done, and you can probably find >it on one of the Netherlands remailer sites. Ok.. that explains it! But If I really need to be that sure of not being tracked down I could use the Mixmaster on my unix shell account!

1 0

Re: Win a free Apache-SSL-US Commercial license
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <Pine.SOL.3.91.960301204634.8380C-100000@chivalry>, Simon Spero <ses(a)tipper.oit.unc.edu> wrote: # On Fri, 1 Mar 1996 sameer(a)atropos.c2.org wrote: # > See http://apachessl.c2.org/ for more details. # Not quite an entry, but am I the only one to pronounce SSL "Cecil" # (SEcure Socket layer), to go along with SHTTP as "Shit-p" (nil)? # Cecil The C2 Web server? The word that always springs to my mind is "sessile." (Granted, I'm a pessimist, at heart... ;) -- Steve(a)AZTech.Net

1 0

Re: PGP PRNG seeds?
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: > I tinkered with the switch > pgp +makerandom=size output.fil > > Is there a way to "seed" the PRNG with another file, say , part of an > encrypted text file? Copy the first 408 bytes of that file to the randseed.bin file in your pgp directory. (I'd save the original randseed.bin file or use a good RNG to generate a new one when you're done). - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTf8qyoZzwIn1bdtAQHrZQF/dM8RgYDEB+pTSmdy9HSIi38YKy9LG9FE yBZtka9z28A2UyVvi37ijP8DrcOYg4zI =duUA -----END PGP SIGNATURE-----

1 0