December 2003 - cypherpunks-legacy

Lawsuit over publishing how-to-murder book
by Deranged Mutant 17 Dec '03

17 Dec '03

>From LI Newsday today, p. 18: Suit Follows Muder by the Book Publisher of how-to 'Hit Man' manual is blamed in 3 killings The Associated Press (Greebvelt, Md.) - James E. Perry committed muder by the book. Now the book's publisher is accused of aiding and abetting his crimes. In a case that legal scholars say could set a precedent in First Amendment law if allowed to proceed, a federal judge yesterday said he would rule in 30 days on a motion against the publisher of "Hit Man: A Technical Manual for Independent Contractors". [..] The $10, 130-page book has sold 13,000 copies since it was published in 1983 by Paladin Press of Boulder, Colo., a small company that sells mostly through mail orders from its catalog. [..] No mention of the Internet or four-horseman in the article.

1 0

RE: Responding to Pre-dawn Unannounced Ninja Raids
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

perry(a)piermont.com writes: >Jefferson could have been a mass murderer for all I care. His words >may be evaluated fully independently of his actions. They are not >interdependent. Many of our current politicians would be heartened by your sentiment: Do as I say, not as I do. Personally, I incline more towards the other cliche: Actions speak louder than words. It is possible to evaluate a persons words independent of their actions, but, given that environment has some effect on behaviour, it is not at all clear that you can treat them as independent. Nor, more importantly, would you want to. It could prove to be a good breeding ground for cynicism. Or is it sarcasm... ;-) James

2 1

Re: NSA Lawyers Believe ITARs Would be Overturned if Tested in Court (fwd)
by Vincent Cate 17 Dec '03

17 Dec '03

My arms trafficker page has been up since April 26th. We have 838 arms traffickers and a public file with a list of 360 "known arms traffickers". It was mentioned on CNN. So far, nobody from the NSA or anywhere else has complained. I am sure if this went to court they would loose. They have to claim that clicking a mouse button on a web form so that 3 lines of text go back to where they just came from, makes someone a criminal. "May it please the court, the charge against these 838 criminal clickers is international arms-trafficking." In a country where a double murderer can walk? I am sure they realize this, which is why I feel it is safe for me to do this (also I believe that EFF etc would so love to have my case as a test case that they would pay my legal bills). -- Vince Cate http://online.offshore.com.ai/arms-trafficker/ http://online.offshore.com.ai/publicity/cnn.html

1 0

Re: Responding to Pre-daw
by pjn＠nworks.com 17 Dec '03

17 Dec '03

>> ichudov(a)algebra.com (Igor Chudov @ home) writes: >> David Sternlight wrote: >> <spam spam spam spam spam spam spam spam spam spam spam spam spam> > >> It is not surprising that after the society decided to label >> natural economic activities (drug dealing) as crimes, it has >> to resort to unnatural methods of enforcing the unnatural >> legislation. >> ... > Please do not respond to anything "Dr." David Sternlight posts to this > mailing list, no matter what nonsense he says. The asshole is starved > for attension. He's just trolling for flames. Please ignore him. Thank > you. > -!- Get real... I dont like him or his posts, but he has the right to do so, and you have no right to censor him or anyone else. If you dont want to read his posts, then dont...Its that simple... For a mailing list that has so many people complaining about the government censoring people... P.J. pjn(a)nworks.com ... (A)bort (R)etry (S)mack the friggin' thing ___ Blue Wave/QWK v2.20 [NR]

2 1

Re: Bare fibers
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:30 AM 7/23/96 -0500, Douglas R. Floyd wrote: >> >> * Carbons sent to: In: jimbell(a)pacifier.com >> >> -=> Quoting In:jimbell@pacifier.com to Harka <=- >> >> In> The fiber is usually coated with a very thin layer of clear plastic to >> In> protect against moisture and abrasion, and the diameter is around 0.5 >> In> to 1.0 millimeters in diameter. >> >> >> Doesn't that make it vulnerable (detectable) to Tempest attacks? > >Not really sure how. I have had heard of ways to tap a fibre optic link >noninvasively, but its not related to Van Eck or anything like that. You could break the fiber and add a repeater (if you know enough about the light protocol). Plastic fiber can be cut with a pocket knife, glass requires a machine which will make a square cut and polish the end. Those machines are not yet cheap. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

Re: Digital Watermarks for copy protection in recent Billbo
by Alex F 17 Dec '03

17 Dec '03

> Sniffers aren't much effort, and if I sniff your tagged purchases and > put them out over the net anonymously, they are traced to you. Actually I was thinking more along the lines of physically stealing, but if someone sniffed an electronic transfer of a record then the laws would become even more useless as far as enforcement goes. > Probably, but the Billboard article discussed using CC numbers as an > ID in the online watermarked transactions. Doesn't mean they were > correct, of course. Considering that their sources are probably more reliable (even though less knowledgable), and considering the idiocy of such an idea, I would risk saying that they are right :) > AFAIK, most "bootlegging" is of unreleased concerts or out-takes. > Digital watermarks would be of little use. There are solutions to this that work. 1) The Greatful Dead approach - let everyone bootleg live shows. Who cares? 2) The Frank Zappa Approach - take the bootlegged copies, use better equipment, and possibly your own soundboard recordings of the same show, and put them out yourself. Since you are capable of putting out a better product sonically, then beat them at their own game ("Beat the Boots") Alex F =-=-=-=-=-=-=-=-=-=-=-=-=- Alex F alexf(a)iss.net Marketing Specialist Internet Security Systems =-=-=-=-=-=-=-=-=-=-=-=-=-

1 0

Re: Netscape
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:07 7/23/96, Tom Weinstein wrote: >The Deviant wrote: >> >>> You should only break rules of style if you can | Tom Weinstein >>> coherently explain what you gain by so doing. | tomw(a)netscape.com >> >> Style is standing up for what you beleive in. Netscape obviously has >> none, or they would be activly fighting the ITAR. > >Anyone who believes that Netscape is not actively fighting ITAR is a >fool. Amen. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Brute Force DES
by Peter Trei 17 Dec '03

17 Dec '03

> Peter wrote: > >Any one up for a distributed brute force attack on single DES? My > >back-of-the-envelope calculations and guesstimates put this on the > >hairy edge of doability (the critical factor is how many machines can > >be recruited - a non-trivial cash prize would help). Duncan wrote: > I volunteer my 120 MHZ Pentium. A lot more Pentiums are out there now than > a year ago. That makes it more feasible. A lot more people with full net > connections. Like most Americans, I have a flat rate net connection and a > flat rate local phone connection so could run a cracking session permanently > (as long as no one tells my ISP). We need a full test of the Winsock > cracking client in any case. It wasn't working very well last time. > > DCF <back-of-envelope> In my terminology, 'hairy edge of doability" means we have a shot at success, but I wouldn't bet the farm on it. I thought that I might bet a couple hundred bucks, though. Sadly, after further calculation, I'm not so sure if it's doable just yet. What I'm looking at is a known plaintext attack on single ECB DES, using a brute-force test to cycle through the key space. People would get chunks of keyspace to test from a central server or servers, and would be motivated to take part by a cash prize for the lucky person who finds the key. Lets do the numbers: Single DES has the security of 56 bits of key - there are 64 bits in the keys, but 8 of them are parity bits which add nothing to security. 2^56 = 7.205e16 keys (which is a whopping big number) Let's guess that we can recruit the equivalent of full-time on 1000 machines. 7.205e13 keys/machine. Let's guess that we have about a month before people start to lose interest - so we want to be more than 1/2 done by then. Lets say we want to sweep the whole space in 40 days. 1.8e12 keys/machine/day ~21,000,000 keys/machine/second The fastest general purpose, freely available des implementation I'm aware of is libdes. by Eric Young. With this, I can do a set_key in 15.8 us, and an ecb_encrypt in 95 us/block. That adds up to about 9,000 keytests/sec (this is on a 90 MHz P5, running NT). I'm looking at ideas to speed up DES - if I'm willing to use honking great lookup tables, the permutation steps can be done more quickly than libdes. I'm also looking at implementing the algolrithm in hand-optimized P5 assembler. (It's been years since I've done a major assembler project - the P5 has some truely weird features to be considered, but also has (some) internal 64 bit registers to play with). Let's guess that I can speed up a key-test up by a factor of 10. (This is not a slur on Eric's code - it's extremely clever, but not optimized for any particular processor, or for key-testing. Note that the keytest described above takes about 10,000 cycles/test.) That gets my workstation up to about 90,000 keys a second, which is still almost a factor of 250 too slow. I'm going ahead with my work on a faster DES keytester, but unless optimizing gives an astounding win, I now think a distributed bruting effort is a bit pre-mature. What will make this brute doable, if not now, then in the near future? 1. Faster Processors - Moore's Law is still holding. A year ago, my 90 MHz Pentium was one of the faster machines taking part in the 40-bit RC4 crack. Now, it's passe. 2. More processors. The number of people on the internet continues to grow rapidly. 3. More interest - Crypto awareness has greatly increased in the last year, and a real cash prize (say, over $500) will generate both publicity and interest. These factors all multiply together. The number of cycles that could probably be recruited is increasing at a fast rate. A major part of the work will be a keyspace distribution mechanism which can handle the load (this was a major stumbling block last year). </back-of-envelope> Peter Trei trei(a)process.com Disclaimer: This has nothing to do with my employer.

8 9

Schelling Points, Rights, and Game Theory--Part I
by tcmay＠got.net 17 Dec '03

17 Dec '03

Part I I thought I'd write a brief piece on a very interesting angle on "rights," especially given the discussion recently about rights of privacy, children's rights, parent's rights, the role of schools, gun rights, and so on. This also shows the role of game theory, imperfect as it is. (I mention "imperfect" because some have mentioned that game theory does not explain things perfectly...of course not.) Here's a simple example of what a Schelling point is: Alice and Bob decide to meet on Friday in the Washington, D.C. area. They forget to say when and where. Is it hopeless? Can they find each other? Given the millions of places they could be, and the hundreds or more of time-slices to consider, e.g. "10:23 a.m., 345 Crestwood Drive, Arlington," how could they ever meet? Well, there are certain "mutually more probable" times and locations. Absent any time specification, "noon" is what each will expect the other to also think of. (Followed perhaps by 6 p.m., and other on-the-hour times.) And absent any location specification, there's a short list of likely places: NSA headquarters (after all, Alice and Bob are well-known there), in front of the White House, at the base of the Washington Monument, at the entrance to the Air and Space Museum, on the steps of the Supreme Court, etc. I'd say they have about a 10% chance of finding each other, absent any prearrangement. (In smaller cities, the probabilities are even higher, as the central plaza is a major Schelling point for such encounters.) The game theorist Richard Schelling developed this notion, circa about 1960. There are analyses based on "algorithmic information theory," a la Chaitin and Kolmogorov, which I find appealing, to wit: a Schelling point has a shorter "description" in terms of mutually-known building blocks than non-Schelling points. Thus, "noon in front of the White House" has a shorter description, or is more "compressible," than is "10:23 a.m., 345 Crestwood Drive, Arlington." (Don't think in terms of just ASCII characters, but in terms of readily recallable building blocks.) How does this relate to rights? This is more controversial, and less-developed. David Friedman gave me a paper he's done on this..."Schelling points" are a Schelling point between us, as it were. Part II will get into this briefly. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Anonymous web servers
by Hal 17 Dec '03

17 Dec '03

[This is somewhat of a follow-up to Black Unicorn's idea about private web pages a few weeks ago, also motivated by thinking about Ross Anderson's Eternity service, about which I just posted.] Right now you can get anonymous web pages at various places. But these are basically just regular web pages where you haven't told the service provider what your name is. If somebody doesn't like what you have posted there they may be able to get your pages shut down just as easily as if you were non-anonymous. I was thinking about ways to allow more truly anonymous web pages. The goal would be to allow them to operate even if someone powerful didn't like them. I'm not sure the idea I have really works but I thought I'd lay out some possibilities. The web is basically a client-server environment. The server sits there all the time ready to accept connections from users running clients (browsers). The client connects briefly to a web page and downloads the data for the page. It disconnects and displays the data. Some of the newer technologies have extended this model but it is the original concept. The idea I have is to provide a meeting place for anonymous servers and clients. There would be a sort of "meta-server" which runs software which just pairs up interested parties. The idea is that both servers and clients would be relatively transient. Two people would arrange in advance to interact via web protocols, and agree on a transient URL which they would share. The client and server both connect to the "meeting place" host, specifying the magic name they have agreed on. The meeting place software would then pair up connections which shared the same name and allow them to interact via conventional protocols. URL's for the meeting place server would be interpreted in this context rather than simply as file names. In some ways the role of the "meeting place" software is similar to an IRC server. In fact, this concept could be thought of as HTTP over IRC. The big question mark is whether the meeting place would be blamed for the possibly illicit transactions it facilitates. It can argue that it didn't know what people are doing (it might require people to use SSL for their transactions so it doesn't see them). But in practice it may be easy for attackers to prove that illegal transactions are going on (they just arrange to connect to an illicit server and download incriminating evidence). It does seem though that IRC, despite having a reputation as a place where a lot of illegal transactions occur, manages to keep running, without the servers taking the blame. Maybe it is just a matter of having a low enough profile? You'd also have a problem if a server, protected by anonymity, decided that being transient was stupid and arranged to always be ready to respond to one of the anonymous URL's. Then there seems effectively no difference between the "meeting place" with an anonymous server URL, and an ordinary host with an objectionable file available via URL. In each case clients connect and get the same illegal data. One thing we haven't seen (AFAIK) is anonymous posters offering to supply illegal data to anyone who asks for it. Something like "just post your email address and I'll mail you (anonymously) some Holocaust revisionism" (or Christian literature, or whatever else may be banned in your particular jurisdiction). This is the kind of application where it would seem that the anonymous web pages would be effective. Maybe there is not much demand for it, after all. Hal

2 1