December 2003 - cypherpunks-legacy

Re: Theory Question: Why isn't RSA a 0-knowledge Proof
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 06:01 PM 1/13/96 -0500, you wrote: > >Zero knowledge means that the recipient obtains no information that they could >not have obtained without knowing the secret information corresponding to the >key. > >If I authenticate myself to you by giving a signature on a nonce you chose you >have obtained information that you could not have obtained otherwise. Seems right enough. Still pondering though... [1] If I (the signer) choose the series of messages to sign, this still demonstrates that I have a secret without telling you the secret (and without giving you the information you might have been fishing for..) You do get information you would not have been able to create otherwise,(whatever it is I choose to sign) ...but it doesn't matter if you wanted the information or not, what matters is that you got it??? You could get random information (entropy) as part of a protocol, would this destroy the 0-knowledge aspect as well (and make it merely a min-disclosure proof...?)) (if you aren't directly challanging me, there could be a replay or man in the middle attack or whatnot, but the man in the middle attack also applies to 0KP.) What I was thinking of, was a hamiltonian cycle example: [2]where the person that wants to see the proof is getting information regarding the iso-morphism between the various graphs... (For instance, say G is the real graph, Alice knows the path, and Bob wants proof that Alice knows it...) So in the first instance Alice produces H1 and shows it to Bob and proves it is iso-morphic, in the second example she produces H2 and shows the cycle, in the third instance, she provides H3 and it's isomorphism to G... Bob can then conclude that H1 and H2 are isomorphic... I'm not sure about this (this must be where I am in error) but I don't think Bob could have derived the fact easily (if it is plausible for him to believe H1~=H2 based on this protocol) that H1 and H2 are isomorphic without Alice's help here... So in this case, Bob picked up some info he would have not otherwise known for free (similar to the first example) even though this information isn't of any use to him with regard to the solution to G. >If it wasn't for the fact that it is IAP and you apear to be a grad student I >might wonder about somone doing their course assignments via the net... :-) The effect of the eggnaugh hasn't worn off and trying to vamp up... <smile> _______________________ Regards, Is this true or only clever? -Augustine Birrell Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: Shimomura on BPF, NSA and Crypto
by John Gilmore 17 Dec '03

17 Dec '03

Tsutomu says the NSA is inept rather than inherently evil. I think he concluded this because they declined to fund his work. An ept and evil NSA would want Tsutomu on the payroll. Tsutomu's stealth version of the Berkeley packet filter did a lot more than modload into the kernel. He was paid by the Air Force to design one that could patch itself into SunOS kernels invisibly, even into kernels with no modload support at all. It had special code that would search through the kernel binary for references to the address of the Ethernet chip, and patch itself in during the very low level interrupt handling. It was highly optimized so it wouldn't show up by loading down the machine, and it did things like decrement the interrupt counter so that even the extra interrupts caused by running the Ethernet chip in 'receive every packet on the wire' mode wouldn't be visible. He talked about enhancements that would automatically forward packets of interest back out onto the Internet, so the whole shebang would hide in kernel memory, never visible to users, never running any processes or altering any files. Think of it as Digital Telephony wiretap technology for the Internet. The idea was to design something that you could run on a machine without the owner ever finding out about it. To break into that person's network. It's a tool customized for crackers. It's one of the tools that Mitnick was after when he broke into Tsutomu's machine. Tsutomu actually wrote and ran this stealth BPF code (as well as designing it) and got into a tiff with the Air Force. They wanted the code, not just the design paper they'd commissioned. He countered by offering to post the code to the net, with a copyright that let anyone EXCEPT the government use it, if they wouldn't pay him for the paper. I don't know how the situation was eventually resolved. Tsutomu has lots of glib rhetoric about how he just builds tools and they can be used for good or evil. This tool is custom-designed for evil. Maybe in wartime the Air Force will want to inflict evil on an opponent. Or maybe instead they'll pass it to a latter-day J. Edgar Hoover. Either way, it's evil. It doesn't become good when you inflict it on someone you dislike. -- John Gilmore gnu(a)toad.com -- gnu(a)eff.org Don't introduce that Tsutomu to your girlfriend.

4 3

Re: Zimmermann case is dropped.
by John Young 17 Dec '03

17 Dec '03

Responding to msg by nobody(a)REPLAY.COM (Anonymous) on Fri, 12 Jan 2:50 PM > ...and I'm sure they'll be watching VERY closely to >see how version 3.0 will be distributed.... AUSA William Keane in today's WSJ: "This decision shouldn't be interpreted as meaning anything. I caution people against concluding the Internet is now free for export."

4 3

PGP replay attack
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on using replay attacks against PGP recently. However, a timestamp is stored in the signature packet and is signed along with the plaintext intended to be signed. This eliminates the need to include a timestamp in clear-signed data. Someone can still send a signed e-mail to a third party that was not the original recipient and make it appear as though the sender did actually send the message to the third party (e.g. Alice sends signed message to Bob Bob sends message with faked headers signed by Alice to Carol Carol believes Alice actually sent the message to her) Such an attack would have to executed shortly after the message was originally clear-signed. However, including timestamps in text to be signed is not necessary. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPhourZc+sv5siulAQHTTAP/XBlrV7nHd5pR9aTXr2Uk0M0fw4I6IjZZ xeCx++vuIjcQuo/k8xH9YvBbn+MuoE11xbVLD58xYbELuVSdMUzCQ1mpQMho8mzs O0ALr8dahq0N0Gl5kLwb97MzgJOgTwy6NSIK6883NCktAWJMsFoADpdzmDGWQbTc ZzXJ3w5OiAQ= =fWJb -----END PGP SIGNATURE----- -- finger -l markm(a)voicenet.com for PGP key http://www.voicenet.com/~markm/ Fingerprint: bd24d08e3cbb53472054fa56002258d5 Key-ID: 0xf9b22ba5 "The NSA can have my private key when they pry it from my cold, dead neurons." Unknown

1 0

DEC AltaVista Closer To Commercialization [NOISE]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Digital's Samuel H. Fuller, VP of corporate research for Digital, and Alan Jennings, Digital's manager of advanced technology business development, also told Newsbytes that Alta Vista has "re-started its Web crawling," to add even more pages to the total of 60 million Web pages -- representing half of all pages on the Web -- that were already indexed by December 15, when the new "super spider" Web facility opened to the public. "And as Alta Vista took off as the fastest growing Web site, we have quadrupled the capacity of our AlphaServer 8400 system from two to eight processors, and doubled the memory," noted Fuller. This leaves a "factor of two headroom" in terms of both processing power and memory, meaning that a single 8400 system should be able to host and accommodate an index for the entire Web, the VP added. The Alta Vista site also uses a smaller Alpha server to house the "super spider" itself. As reported in Newsbytes on December 15, Jennings previously said that Alta Vista is able to search up to 2.5 million Web pages a day. Lycos, Alta Vista's closest competitor, had searched only 7 million Web pages up to that time, and the World Wide Web Worm about 3 million Web pages, in comparison to Alta Vista's 60 million pages, Newsbytes was told. Alta Vista's high search speeds are made possible by the ability of the super spider to algorithmically "breed" batches of smaller Web crawlers, together with the use of Alpha processing power and high-speed ATM (asynchronous transfer mode) networks, according to Jennings. Fuller and Jennings told Newsbytes this week that Digital is currently assessing Alta Vista usage patterns and the half dozen- or-so "business inquiries" received each day to decide where to take Alta Vista on a commercial basis. On Friday, December 15, Alta Vista received 300,000 hits, a number that grew to 600,000 on Monday, December 18, 1.5 million by Wednesday, December 20, and 2 million per day following the December holidays, according to Fuller. In earlier beta testing, some 10,000 users employed Alta Vista to look up references to themselves and their families, to locate old friends and college roommates, and to access market research, information about the Web, and facts about corporate travel destinations. Like their counterparts within Digital, many Web users among the public at large have been employing Alta Vista for genealogically search purposes, Jennings said. Alta Vista is also emerging as "a real solid research tool covering the breadth of the Web," he asserted. In addition to obtaining an index of all Web sites containing a specified search term, and being able to move to those sites through hotlinks, users can obtain "reasonably good information regarding the characteristics of Web sites," such as "how frequently (the sites) are referenced, and the number of pointers." You can also employ can also employ case-sensitive matches, and limit searches to titles or other specified sections of a document. Digital officials have been impressed by Web users' "ingenuity" in inventing applications for Alta Vista. One company, for example, wanted to get in touch with all other firms with links to its site, he illustrated. Upon learning that Alta Vista is able to search for URLs (user resource locators), or pointers, the user conducted a URL search, and then proceeded to send out a broadcast e-mail message over the Internet to all linked sites. Business inquiries, he reported, have fallen into three main categories: users who want to use Alta Vista internally, license the search engine, or advertise their goods and services on the Alta Vista home page. "We'll start to make decisions on these within the next 30 days, and by the end of the quarter, (the decisions) will be part of our general business plans," Jennings told Newsbytes. "Digital is inching toward decisions on what they're going to do," pointed out Jim Green, an analyst at Summit Strategies. "Clearly, this Web site has met with astounding success. Alta Vista lets you start to make sense of the Internet. It makes you think about exactly what you want, because it will give you everything," the analyst told Newsbytes. "I see Alta Vista as a very useful tool for competitive analysis," observed Greg Kline, director, Network Integration and Management Research, at the Business Research Group (BRG). "I think that as Digital gets closer to finalizing their plans, they'll be speaking more about Alta Vista's most sophisticated search capabilities. And as Web servers become the corporate infrastructure through the "IntraNet,' users will be seeing the need for a tool to index their information assets," Kline told Newsbytes. You can access the Alta Vista home page on the Web at http://www.digital.com . A.E.N.

1 0

exposure=deterence?
by cmerritt＠intellinet.com 17 Dec '03

17 Dec '03

jimbell(a)pacifier.com (Jim Bell) wrote in part: >In my opinion, we (the ordinary members of the public) cannot consider >ourselves to have won this encounter until the REAL enemy here, the >government employees who targeted Zimmermann There is a group of government employees that decided to put William Keane on this case. Someone(s) started sending customs agents around the country. Someone(s) is responsible for making several defenders of privacy miserable. These government employees SHOULD NOT be allowed to hide in their government holes in complete privacy. We need the credits now that the movie is over. How much money was spent? [FOI anyone?] I am afraid that all I could provide is the name of one Customs Special Agent. I dont think she is responsible for anything - she was told go interview so-and-so and off she goes. Who sent her? ---> How could we find out? <--- It seems correct that the NAMES of the government employees and HOW MUCH MONEY THEY SPENT be made public. Deterent enough. I feel that public exposure is enough to put fear into these anonymous government employees. You will note that when they get the mad_bomber some FBI guy jumps right up and takes credit, live, on TV. But when the Air Force orders a $300 toilet seat NO ONE is credited. Boy! Am I pissed! ...cm

7 7

Mail to news gateways
by kolivet＠alpha.c2.org 17 Dec '03

17 Dec '03

Could someone point me to a _current_ list of mail to news gateways? - Kay Olivetti

1 0

Re: (none) [httpd finding your identity]
by James A. Donald 17 Dec '03

17 Dec '03

At 05:16 PM 1/13/96 -0800, Jeff Weinstein wrote: > I've removed the code that uses the e-mail address as the > FTP password for anonymous FTPs. You can still enter it by > hand by using a URL of this form 'ftp://anonymous@ftp.netscape.com'. > > [...] > > The fix for this will be in the next [netscape] beta, and the final > version of 2.0. Thank you. This excellent new feature is more important than you know. The FTC is threatening to regulate the net, and is using as its excuse the claim that advertisers will or are threatening to send junk email to be people who browse their web pages. To protect the internet from this terrible threat they wish to regulate every computer that puts up a web page in a similar fashion to their regulation of TV and radio. This simple technical fix deprives the FTC of that excuse. It will have to concoct a new excuse. Unless someone deliberately configures their netscape browser to provide the information, no one can send them junk mail. > Jeff Weinstein - Electronic Munitions Specialist > Netscape Communication Corporation > jsw(a)netscape.com - http://home.netscape.com/people/jsw > Any opinions expressed above are mine. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: A pooled e-cash FOIA request
by cmerritt＠intellinet.com 17 Dec '03

17 Dec '03

Jim Ray said in part: >a well-placed FOIA >request would be a good thing (tm). I am less interested in the >identities of low-level Customs, etc. employees than I am in what >orders were given, and which political appointees gave them. >As a FOIA request can get a bit expensive, I'd suggest >that those of us who are interested try to pool our efforts/$ as >we did with the ZLDF. This method seems to have worked, :) and >ecash should make it easy... I'm ready. I'm willing to put in some bucks. We need a lawyer, a [virtual] center. I think the easiest part to get would be a financial accounting (partial I bet). I'm sure the DOJ has a (cya) policy of never identifing goons of a failed persecution. It has been suggested to me that individual law suits against the the low level people that CAN be identified might be an approach. Sue for violation of constitutional rights. The depositions would work like a grand jury invrestigation. "Well, Agent Smith, if you were just following orders WHO gave them to you?" Sue your way up the line. Lotsa Ebucks :-(

2 1

Re: Respect for privacy != Re: exposure=deterence?
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> From: s1018954(a)aix2.uottawa.ca > > My apologies for responding to a political post. > > On Sat, 13 Jan 1996, Charlie Merritt wrote: > > > I feel that public exposure > > is enough to put fear into these anonymous government employees. > > You will note that when they get the mad_bomber > > some FBI guy jumps right up and takes credit, live, on TV. > > But when the Air Force orders a $300 toilet seat NO ONE is credited. > > It's interesting how we advocate anonymity for ourselves but not for our > opponents. Feeling righteous? There is a *big* difference between anonymity for individuals, and anonymity for government officials acting in the name of the government. Government has no right to privacy. Individuals do. > Reminds me of the bit from True Names about all the warlocks trying to > crack each other's nyms to enslave each other. Sad? > ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0