December 2003 - cypherpunks-legacy

Re: TIS--Building in Big Brother for a Better Tommorrow
by P.J. Ponder 17 Dec '03

17 Dec '03

Steve Walker wrote to John Young: (large piece snipped; good stuff though.) + Suppose the U.S. government had never thought of placing export controls on cryptography... We would now have widespread use of encryption, both domestically and worldwide; we would be in a state of "Utopia," with widespread availability of cryptography with unlimited key lengths. But, once in this state, we will face situations where we need a file that had been encrypted by an associate who is unavailable (illness, traffic jam, or change of jobs). We will then realize that we must have some systematic way to recover our encrypted information when the keys are unavailable. When we add a user-controlled key recovery capability to our Utopia, we find ourselves in an "Ultimate Utopia," with unlimited key length cryptography, widely available through mass market applications, and user-controlled key recovery. The first paragraph here bothered me. If a user (or an organization) needs to have access to data that was encrypted by an associate ( or one of its employees) wouldn't sound practice require that the key not be entrusted to just one person? I don't see the need for any fancy "key-recovery" protocol with any outside entities. We can handle this internally in my shop. Some keys I give a copy to Alice, and down the hall Bob has some, too. If I get hit by the bus, they can get my company related data back. We don't need any "service" or "licensee" or "trusted third party" or any of that, thank you very much. And we don't need any one developing OTPs for us either, and we don't need government agencies keeping copies of any of our keys. Am I in the state of utopia already, is this what "user controlled key recovery" means? I think it's just common sense and sound management practice. If you know that your co-worker/colleague/summer intern, etc is encrypting your business related data, you should make sure you can get it back if she doesn't come back from lunch. Let her keep her own PGP passphrase, though. That's her business. -- I am now going to push a button and cause this to quantumly re-assemble in California. Really two buttons (Ctrl-X). One observes, one measures. -- send message body: "unsubscribe cypherpunks yourmailbox@domain" to: majordomo(a)toad.com to drop off the list. Don't put it in quotes, tho.

1 0

Diffie-Hellman parameters
by Eric Murray 17 Dec '03

17 Dec '03

Perhaps this is the wrong list to ask this question on, but does anyone have any pointers to where I could find good Diffie-Hellman parameters? Or source code that will generate some? -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

Cluelessness V.S. Lack of Knowledge
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In the snake oil controversy, I see a couple of issues... There are some people/companies out there who have the attitude that they have some sort of "remarkable achievement in the field of cryptography". In fact, it is SO remarkable that they do not have to submit to any sort of peer review or examination by people with more skill in the field than themselves. Some of this can be explained by being too close to the problem to see any of the flaws. Most of it can be attributed to ego. These people are pretty much hopeless. They can be a great source of entertainment and/or flame fest practice, but rarely do they ever learn by their mistakes. Their ego gets in the way far to often. (IPG Sales (any relation to "Soupy"?) is a prime example of this.) There are companies out there that are trying to build good products. These people can be instructed on the ways of implementing good crypto. Unfortunately, I have seen a number of them pushed up against the "Wall of Attitude" when they do ask for help. Cypherpunks, for good or for bad, have a reputation for being experts in the field. People come here to ask questions because "Cypherpunks know what Good Crypto tastes like". What is happening though is that they are also getting a reputation as people who flame first and give answers later, if ever. This is not a "good thing". If you want strong crypto to exist, you have to make the people who are trying to put it into place able to understand what it is in the first place. Giving them grief when they try to find out the flaws in the ideas (and are willing to learn) is not helpful to the community as a whole. I know of one developer who is trying to implement a strong cryptosystem in his app. He is unwilling to post his questions/concerns here because he is afraid of getting his ass shot off on the first query. Judging by some of the responses I have seen, I do not blame him! I can understand intolerance of the sales droids who push crap. I do not have much tolerance for them either. It bothers me when I see people who are not experts in the field AND ARE TRYING TO LEARN getting "blowed up real good" because they are not experts. Cypherpunks not only need to teach, they need to be willing to teach. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMS4xFOQCP3v30CeZAQEUlwf/SpOqOAnhk/8jZcQrH0IgDHtMgyUtjdIh b3URbqcIpfff6qQm8dT8/bbmEsGxavoYKC8xO6H5fiLtw2TRqaFYLsQX+JyYBurd lW7k+llMtGqRdthOPBjhVthTEnncVMhqqlT4E0axhhZMWPYNvW3h+NRjiDJSBFEl CFXe1MgiYt3wMlwJLu7Xqwem1zDT4Jmx3h2mx4ULeyvbKyM1ZkZZPe6vBuTgrgBN DaVw8204nc5vIO1LjTr2eY2zfwQToEVOlXlg3IgXtzmTz0eA0mFGoG/klapWKXcQ PSGFrWBhf0fmA488z2DlboiA6Q/HaxAQ4SR9sZ05CUKT1CKgGYX+Lg== =FY3m -----END PGP SIGNATURE----- --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

2 1

Re: NSA agent arrested
by Eric Thompson 17 Dec '03

17 Dec '03

> I just heard a very short blurb on CBC radio about a KGB mole within the NSA > from the 60's (?) getting arrested by the FBI. Pretty much no details > were given. Any info? See http://www.cnn.com/US/9602/spy_charges/index.html Eric

1 0

Edited Edupage, 22 February 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 23-FEB-1996 00:27:10.72 ***************************************************************** Edupage, 22 February 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** This is the first I've heard (I think) that theirs will allow electronic cash. Wonder what exactly this means? >ELECTRONIC WALLET FROM ORACLE AND VERIFONE >Oracle, which specializes in database software, and Verifone, which >specializes in credit card verification systems, have formed an alliance >that will allow customers using "electronic wallets" built into Internet >browser software to access a full range of financial transaction methods, >including credit and debit cards, smart cards and electronic cash. The >companies call it an "end-to-end" system for secure electronic commerce on >the Internet. (Financial Times 22 Feb 96 p16) Somehow, the cluelessness of governments sometimes amazes even me. Have they ever heard of companies moving? >TAX REVOLT ON THE INFO HIGHWAY >When officials in Spokane, Wash. thought they could wring some extra revenue >via a 6% tax on Internet providers, they were inundated with e-mail and >phone calls protesting the action. One firm even set up a Web site for >users to vent their opposition. The result was the city council decided to >delay the tax pending further study, but the Spokane experience is likely to >be played out in cities across the country as local governments look for new >sources of cash. (Information Week 12 Feb 96 p10) >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by the Office of Information Technology, >University of North Carolina at Chapel Hill. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >subscribe edupage George Bernard Shaw (assuming that your name is George >Bernard Shaw; if it's not, substitute your own name). ... To cancel, send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >unsubscribe edupage. (Subscription problems? Send mail to >educom(a)educom.unc.edu.)

1 0

Re: Cluelessness V.S. Lack of Knowledge
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:29 PM 2/23/96, Alan Olsen wrote: >There are companies out there that are trying to build good >products. These people can be instructed on the ways of >implementing good crypto. Unfortunately, I have seen a number >of them pushed up against the "Wall of Attitude" when they do >ask for help. Cypherpunks, for good or for bad, have a >reputation for being experts in the field. People come here to >ask questions because "Cypherpunks know what Good Crypto tastes >like". What is happening though is that they are also getting >a reputation as people who flame first and give answers later, >if ever. This is not a "good thing". If you want strong >crypto to exist, you have to make the people who are trying to >put it into place able to understand what it is in the first >place. Giving them grief when they try to find out the flaws >in the ideas (and are willing to learn) is not helpful to the >community as a whole. I disagree. There are several points to keep in mind: 1. There are many sources of information on crypto, including excellent books on cryptography and information theory, and several FAQs readily available. There are frequent pointers to these FAQs, books, journals, and newsgroups. 2. Most of the "harsh criticisms" come when people do one or more of the following: a. announce an amazing new discovery, but refuse to give details ("we have applied for patents on our amazing new discovery") b. show an unawareness of basic facts which any competent cryptologist should at least be familiar with c. expect "the Cypherpunks" to provide free consulting and educational training (this same issue comes up on sci.crypt all the time, too, with people announcing some new cipher--which is usually some variant of a well-known cipher--and expressing frustration that "nobody will help me try to break it.") 3. "The Cypherpunks" is not a freelance consulting group, doing "Underwriter's Laboratories" (as in "UL Approved" on your electrical appliances) tests on proposed new systems. Even weak ciphers take time to break. See above. Or see the many comments to this effect in sci.crypt (in fact, I recall that it's in the FAQ for sci.crypt.) 4. In any case, with 1000 or more subscribers, and no consensus mechanism (no official position), nearly any proposal is going to be met with some negative comments from _someone_. Welcome to the real world. Anyone whose skin is so thin as to be scared off from posting because he fears that _someone_ will criticize his idea is a hopeless case. 5. Genuinely good ideas, or ideas that appear to come from someone who has done some real research and thinking, are usually responded to pretty favorably. I could cite the work on MixMaster, Crypto++, Blowfish, etc. >I know of one developer who is trying to implement a strong >cryptosystem in his app. He is unwilling to post his >questions/concerns here because he is afraid of getting his ass >shot off on the first query. Judging by some of the responses >I have seen, I do not blame him! I can understand intolerance >of the sales droids who push crap. I do not have much >tolerance for them either. It bothers me when I see people who >are not experts in the field AND ARE TRYING TO LEARN getting >"blowed up real good" because they are not experts. > >Cypherpunks not only need to teach, they need to be willing to >teach. There's a huge textbook on crypto: Schneier's book. Also, numerous books by Koblitz, Denning, Meyer and Matyas, and on and on. If your friend has a system which builds on basic principles, he won't be "shot down." If his ideas are good ones, he'll be embraced as a colleague. If he hasn't absorbed the standard theory, he'll be dismissed curtly. As it should be. Breaking a system, even one based on good principles, takes real work. Few people will volunteer to put free time and computer resources into testing the strength of unknown systems. Think about it. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Chain Letter to Congress, TOO!
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

They oughta send it to the congress servers while they are at it. Liked the mailto: tag on the mail Netscrape and Eudora support it. Love Always, Carol Anne -----BEGIN PGP SIGNED MESSAGE----- This is my public PGP key. Signed and certified! Love Always, Carol Anne - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy/ZOrAAAAEEANDo2ZIACDkf8irWB0Pi8UhcBts8hlhPguUputkwXfabtqpo PziaSrj0/qpd+SfjjKyjC4l0TPfc8wrEHbGfNdwbMCmugBgVfaw8SBZnV7J0NxYC GWt819ZZHhgM5+b+MjjY7DftHv6WDuo5ag0aMBW3FuDyDvaVRIrpjEWs1wBlAAUT tBxjYWI4IDxjYXJvbGFubkBjZW5zb3JlZC5vcmc+ =8ToJ - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Uncensored from heavily.censored.org iQCVAwUBMSmN0YrpjEWs1wBlAQFLTAQAjt6NhN0GFNNLUhkVaho6pcUi+VKP1Kw8 8m7Wwyhk4baS25m2wumyeoCxIKQz2nP6pT2EwbNJXmig+g/CeMxuqlInGmSBKeuZ evpGgc8q5rZVdnLW2q8dCyoe/uALcPa1K9WpBB030Mka8Gq/9Lc8Y7WtJ09Cnwrw w7YE0N/X594= =5puG -----END PGP SIGNATURE-----

1 0

Re: NSA agent arrested
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:51 PM 2/23/96, Mike Tighe wrote: >Yeah, I got his name but was not sure of the spelling. Robert Steven >something. Lives in Millersville, PA. I think he is retired. Looks like a >victim of the cozying relationship between the FBI and the KGB-whatever >they call themselves nowadays. Lipka. Details are in the usual news sources, such as Reuters (http://www.excite.com/Bulletin/) under Net Directory in Netscape. No CP relevance that I can see, except that Lipka didn't use remailers to protect his identity when he tried to reestablish contact with the Soviets ()who were actually FBI). Lipka was a low-level 20-year-old when he worked for the Army, probably assigned to the Army Security Agency (considered part of the NSA). --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Digital Watermark
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Financial Times, 22 Feb 96 Digital watermark protects copyright Scientists at the NEC Research Institute in Princeton believe they have developed "a fundamental enabling technology" for protecting the copyright of images and music on the Internet. They have developed a secure method of producing a digital watermark, an invisible code that identifies the owner, which is permanently embedded in the multimedia data. Attempts to remove the watermark would be virtually impossible without degrading the image quality. Moreover, counterfeiting would be almost impossible, says NEC. the Japanese electronics company. The digital watermark is designed to be used in conjunction with cryptography, which limits access to encrypted data to legitimate users. NEC Research Institute: US, tel 609-520-1555 fax 609-951-2481.

3 2

Re: TIS--Building in Big Brother for a Better Tommorrow
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:16 PM 2/22/96 -0800, Timothy C. May wrote: >And we should all remember, again, that basic observation: even if "key >escrow" is needed to recover *stored* files, it sure ain't needed for >*communications*!! If a key is being generated for two way communications, then it should be generated via a protocol like Diffie-Hellman which leaves no recoverable knowlege of the key outside the participants, and discarded when the session is over of frequently, whichever occurs more often. This procedure will reduce the incentive for rubber hose attacks to recover these keys. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0