December 2003 - cypherpunks-legacy

Regarding employee rights on company equipment
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

A day or so ago, I reasoned incorrectly that university students and employees were free to encrypt mail they sent through their student or work accounts. This was in response to a statement that the govt could retain at least some control of internet traffic through the universities and businesses. I would credit the person who called me on it, by I do not remember who it was. It seems that, at least for employees, it is totally up to the employer: >From Edupage Feb 8, 1996, INTERNET USAGE POLICIES Neal J. Friedman, a specialist in online computer law, says that "employees are under the misapprehension that the First Amendment applies in the workplace -- it doesn't. Employees need to know they have no right of privacy and no right of free speech using company resources." According to Computerworld, a number of employers are adopting Internet usage polcies, such as one developed at Florida Atlantic University: < http://www.fau.edu/rinaldi/net/netpol.txt > (Computerworld 5 Feb 96 p55) It's still to bad that I was wrong :-(, but such is life. lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller ________________________________________________________________ Digitally sign your mail too! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCPAzEX3QEAAAEEAOGQjhnqGH29pO1WDaXs5GFOVPhCBWyYEk9XEwRmscjveWzH AhA6DeOA480zWNqQURyqE2yPmR8WzT+OXYqmeiQiycKyFA41Vs/Ruf+gXXxe7uXS L5BK3K8oKbfoH0D5/TAkMT4r6BprXFQz4pFc3gY2SSaSPElpMjKHaKBsRsyRABEB AAG0HUplZmYgQ29ubiA8bHVuYXNsaWRlQGxvb3AuY29tiQCVAwUQMRffHzKHaKBs RsyRAQGNhwP9E9xEZ9/LCKnhgtnrqgD7pDoXG2pCy8FoyfFjoImGkG+jF1wELXmB Z0mf8F8CgYkys0mif1XeGDMelr1gzlZAm6LgQt4kcvztMW/aRLn18QP+iwltVT/L p8D37mitOjvuk46sWgAChIaPPPIeg/EaYQjQkmlpWKsEYIoTRy+E8mU= =4Gku -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: Benefits of the V-Chip
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:11 AM 2/9/96 -0500, Clay Olbon II wrote: > >There is one potential side-benefit to the V-chip -- The inverse-V-chip >(the idea for which I stole from someone on this list, sorry I don't >remember who to credit). > >I am looking forward to a time when I will never, even accidentally, have >my TV tuned to "Full House" ;-) The statements i have seen as to what the V-Chip (The V stands for "Verbage"), it will not be that selectable. You might be able get a version that will not show you anything with a sex rating less than x, but then the thought police will come and take you away. (Crimethink in the presence of minors is punishable by death.) You have to remember that such products are brought to you by "People Against Fun In Our Lifetime(tm)" and the "Hell On Earth Foundation". Any misuse of such products will be against Federal Law. (Similar to the laws on other household products.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0

Re: Mailing list
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

>When I wrote: >> Please make me apart of your mailing list. >I meant: > Please take me apart on your mailing list. >Thanks, Jack. POOF! Your wish has been granted :-) lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I (fwd)
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

>jim bell writes: >> >This has gone off into political theory. Could we take it to private >> >mail or some such? >> >> Apparently, other people are just as unhappy with your attempts to act as >> "moderator" of this list. Wake up! Freedom is on the line. > >You are annoying me. How much do people want to bet someone kills >Jim Bell in the next six mont You are annoying _everyone_! How much you want to bet someone kills _you_ in the next month? lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller

1 0

Re: Tell me whats wrong with this
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

avitar wrote: >You probably had no problem with seat belts being manditory eqiupment , >because they >protected YOU and the people YOU cared about. >You probably had no problem with manditory airbags, public building smoke >alarms, unleaded >fuel, restaurant health codes,etc....Because they protected you and or >people you care about, >even though they cost YOU more money. You are your child's seat belt for the internet. There are plenty of tools at your disposal that do not require govt. intervention. As for the television, I'm sure you already have my email on that. I also don't have problems with eviornmental regulations, labor codes, electronic safety standards for computers and such even though those cost me money as well. All of those laws, however, do not restrict my freedom of speech. If not wearing a seat is your idea of free speech, I personally can't vouch for your intelegence (I can't do that anyway:-)), but you still have the right to speak your mind on the matter, as you are now. People talking about gay rights, abortion options, better sex (a la Dr. Ruth) can no longer do that on the net without wondering whether they are in violation of the bill or not. >> >> > All I'm saying is it's tough to raise a child these days without the added >> > distortion of modern programing ... >> >>"Don't do the crime if you can't do the time." >> >> > ... and parents need not be denied any tool that can help them >> > achieve success. >> >>Oh, OK then. Parents should be given access to incendiary equipment >>as a tool to destroy the studios that produce offensive material. >> >It's obvious that you watch a lot television your an excellent sensationalist. >Besides, we both no that the cost of the chip is insignificant. This device >hurts no one! I "no" no such thing. The price of the chip has been estimated to be higher than was stated tonight on the news, that's for sure. (Anyone got a figure? I'd like to hear how much the TV makers will think it will cost.) lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller

1 0

RC2's key schedule and passphrase hashing
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: Cypherpunks, sci.crypt ## Date: 02/09/96 01:44 am ## Subject: RC2's key schedule and passphrase hashing ] Summary: Don't use RC2's key schedule to hash passphrases, with or without the export hack. Instead, hash the passphrase first, and then pass the result into RC2 to get expanded. (This is a good rule to follow with any cipher whose designers didn't specifically intend for it to be used to hash passphrases.) Don't use phase two at all--if you need exportable 40 bit security, generate a 128-bit random value, and leak 88 bits as salt. Hash the value, and use the result as the RC2 key. >Date: Fri, 02 Feb 1996 10:02:37 -0800 (PST) >From: baldwin <baldwin(a)RSA.COM> (Robert W. Baldwin) >Subject: RC2 technical questions >- How does the length of the key influence the mixing > of bits during each pass of the expansion algorithm? >- If the first pass of expansion is viewed as a hash > function that produces 40 or 128 bits out, what are > its properties? These are good questions, and they turn out to be pretty educational. I no longer can see any good reason for the effective-bits hack. Let me explain why, briefly: Suppose I'm hashing a 64-character passphrase, where each character has about three bits of actual entropy, for use in an export- controlled application. Clearly, this gives us plenty of entropy (192 bits) in the whole user key. How much entropy can make it to the last five bytes of expanded key? These last five bytes are a function of the last five bytes of user passphrase (total entropy of about 15 bits), and the previous byte of expanded key (which can't have more than eight bits of entropy). Those are the only inputs that aren't known to all attackers. This means that in this (very degenerate) case, we'd have 23 bits of entropy in our last 40 bits. If we then did phase two of the key expansion based on those 40 bits, we'd wind up with a total expanded key entropy of 23 bits. In short: Guess an 8 bit random number and the last five bytes of the user key, and you've got the entire expanded key. (Of course, if the application always padded the user passphrase with blanks or something to make it 64 bytes long, and then scheduled the key with the export control hack, we'd have *eight* bits of entropy in our expanded key, which probably qualifies for some kind of special thank-you note from Fort Meade or something.) Suppose I'm hashing a 32 character user passphrase. The same analysis applies to the bytes 60..63 of expanded key. Those bytes can have no more than 23 bits of entropy, if each character of the passphrase carries three bits of entropy. This means that bytes 92..95 carry at most 31 bits of entropy, and thus that bytes 124..127 carry at most 39 bits of entropy. If we pad the passphrase out on the right to 32 bytes before sending it into the RC2 key schedule, then we wind up with about 24 bits of entropy in the whole expanded key after phase two. Our assumptions about entropy in user passphrases can make this better or worse. For example, we may assume that it costs us 16 bits to guess the first three characters of any passphrase substring, and one bit per character after that. In that case, processing a 64-character passphrase into 40 effective key bits gives us 26 bits of entropy. If we assume that each additional character after the first three guessed costs us two bits, then processing a 64-character passphrase down to 40 bits gives us 28 bits of entropy, and processing it down to 56 bits gives us 32 bits. Without phase two, long user passphrases simply leave most of the expanded key fairly predictable, especially in the high couple of bits of each byte. I haven't tried to analyze yet what this does to RC2's security, but it's almost never a good idea to have highly-predictable bits anywhere in a cipher's expanded key. The moral of the story seems to be this: Don't use key schedules as passphrase hashing functions, unless they're specifically designed as such. In particular, don't use RC2's key schedule to hash your passphrase. Pass your passphrase (and salt) through a good one-way hash function like SHA1, and feed the result into your key schedule. Can anyone guess what the effective-bits parameter is used for? It doesn't seem to be secure for hashing passphrases, making some reasonable-sounding assumptions about actual entropy per character in user passphrases. I can't see an intelligent use for it. Note that setting effective bits to 40, we have only a 40-bit key--no salt. This means that using alleged-RC2 with phase two of the key schedule and effective bits set to 64 or less, we're potentially vulnerable to a precomputation attack. This is a real problem if we're doing something like encrypting a constant block at the beginning of the encryption, to verify that we have the right decryption key. (It's enough of a potential problem to be worrysome, anyway--note that almost all of my notes to John Smith start out with the same eight characters: "[ To: Jo". Precomputation attacks based on this are quite feasible.) I am very curious about how this is dealt with in practical implementations. The obvious way to do this would be to leave effective-bits = 1024, and just hash an 88-bit salt with a 40-bit session key to get the 128-bit key actually passed into RC2. But that begs the question: What's the use of having the effective-bits parameter? I certainly hope nobody is using RC2 with effective-bits set to 40 in any important, real-world applications. >--Bob Note: Please respond via e-mail as well as or instead of posting, as I get CP-LITE instead of the whole list. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRsR1kHx57Ag8goBAQFzOAQAnjL06eTNMkqgT9OatMa2FRm2dFU7yffU lH3blWxV2Wv8XrMGTB3WTES6ME1D84qJMk641MNxAtH1PAigFzEFDeBHxDr83fR4 tJFECzQ0KWGUu3Pn9/sHJFhjOWUbg6AAtNQ94XN4kBx+NSb3rF/AtoEMyJr6azug FA5T+AQq+Jo= =Y7P+ -----END PGP SIGNATURE-----

1 0

The Resistor
by Sean Gabb 17 Dec '03

17 Dec '03

Does anyone out there know where I can find the latest issues of a magazine called The Resistor? Sean Gabb Editor, Free Life ====================================================================== $$$$$$ $$$$$ $$$$$$ $$$$$$ $$ $$ $$$$$$ $$$$$$ $$ $$ $ $$ $$ $$ $$ $$ $$ $$ $$ $ $$ $$ $$ $$ $$ $$ $$$$ $$$ $$$$ $$$$ $$ $$ $$$$ $$$$ $$ $$ $ $$ $$ $$ $$ $$ $$ $$ $$ $ $$ $$ $$ $$ $$ $$ $$ $$ $ $$$$$$ $$$$$$ $$$$$$ $$ $$ $$$$$$ A Journal of Classical Liberal and Libertarian Thought Production: Editorial: c/o the Libertarian Alliance 123a Victoria Way 25 Chapter Chambers Charlton London SW1P 4NN London SE7 7NX Tel: **181 858 0841 Fax: **171 834 2031 E-mail: cea01sig(a)gold.ac.uk EDITOR OF FREE LIFE: SEAN GABB ______________________________________________________________________ How to subscribe: Send cheque for GBP10 or US$20 made out to the Libertarian Alliance. ====================================================================== FOR LIFE, LIBERTY AND PROPERTY ======================================================================

1 0

Re: Need a "warning" graphic of some kind for CDA
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:18 2/8/96, Bill Stewart wrote: > Before Bill Clinton signed the Exon Internet Censorship Bill, > Tipper Gore brought you Music Censorship. > Uncle Frank says "<quote here>" > >I suppose it's a bit beyond Fair Use? Sounds like fair use to me. Certainly Zappa wouldn't have minded. Then again, he isn't around anymore to defend you against whatever lawers now have the rights for his works. What a shame. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

RE: PGP & Seamless Pegasus
by Tripp Hardy 17 Dec '03

17 Dec '03

Let's not celebrate just yet. While it is a great improvement, it still causes errors if you try to encrypt an attached file and conventional encryption still doesn't work here. The only one that is working all around for me is Private Idaho. We are moving in right direction though. Tripp ---------- From: Adam Philipp[SMTP:adam@sub.toad.com] Sent: Friday, February 09, 1996 4:34 AM To: cypherpunks(a)toad.com Subject: PGP & Seamless Pegasus -----BEGIN PGP SIGNED MESSAGE----- Can I just add a loud HURRAH! on the integration of PGP and Pegasus using the PGPJN add-on. It is by far the smoothest melding of PGP and a e-mail routine to date. The only way it would be smoother is on one program. THe learning curve is also negligible. For all those griping about no good PGP windoze e-mail programs, your wait is over. This mail program won over a die hard Eudora fan in about 15 minutes... Someone else already posted the sites to get this so forgive my laziness of not repeating their words. Oh, did I mention this is seamless under Windoze 95 as well? Adam, Esq. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMRs/RAaMHlrz9swxAQGWUwf/amggouHkGjrjoYQ3JXYXiWblHc2NBvQx wwy1jMSvEEiP0kQD1iaysA6fw4t+xU1bFAftqACRa3rTF7ZgCRRgFuhgwTwhwR8u HZ8zDed5PIgywsn9/jqXW+nqneNx2uboUjq7FsncZiC7EG90/SMK78et8QZ/sT0l ifiCvoLXaYhW4anmIeHMADLwDRqUlhVWX5RX1ccG2MrOrrrKHjJcveG4CF72M8EV hftXDTWdElUuPUHD0JUBlp555+YMuolSUuu4sq1eodwlX0L4tq9vv4QBCwnBvq0H 4XONwa9BaRvEjVJ0Gg6+HjC4/IHOt/5CJ+SfwvQAaysH7Q11nkKTZw== =/zQA -----END PGP SIGNATURE-----

1 0

Re: Regarding employee rights on company equipment
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:32 AM 2/9/96 -0800, lunaslide wrote: >A day or so ago, I reasoned incorrectly that university students and >employees were free to encrypt mail they sent through their student or work >accounts. This was in response to a statement that the govt could retain >at least some control of internet traffic through the universities and >businesses. I would credit the person who called me on it, by I do not >remember who it was. It seems that, at least for employees, it is totally >up to the employer: > >>From Edupage Feb 8, 1996, > >INTERNET USAGE POLICIES >Neal J. Friedman, a specialist in online computer law, says that "employees >are under the misapprehension that the First Amendment applies in the >workplace -- it doesn't. Employees need to know they have no right of >privacy and no right of free speech using company resources." According to >Computerworld, a number of employers are adopting Internet usage polcies, >such as one developed at Florida Atlantic University: < >http://www.fau.edu/rinaldi/net/netpol.txt > (Computerworld 5 Feb 96 p55) I don't think this issue is as simple as Friedman wants to make it sound. (Then again, he may have been quoted out of context.) In any event, what he said is true, modulo explicit or implicit contracts to the contrary, rules about union activity, common-law privacy rights, Title VII, the ECPA and similar state statutes, and so forth. The quote sounds like a self-serving statement intended to scare people into believing that their rights are as limited as the speaker wishes they were. That's not so unusual, but it's not always useful to get legal advice from someone who sees their interests as adverse to yours. (We've gone over the "I think the law regarding employers rights vis-a-vis employees rights *should* be 'x'" ground a zillion times, and another rehash seems unproductive. I don't intend to respond to messages along those lines.) -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0