December 2003 - cypherpunks-legacy

Re: PGP reveals the key ID of the recipient of encrypted msg
by John Pettitt 17 Dec '03

17 Dec '03

>At 2:25 3/11/96, savron(a)world-net.sct.fr wrote: > >>I began testing PGP a few days ago ( I'm a PGP newbie ) and I found >>that it gives out the key ID of an encrypted message . From this you >>can get the identification of the recipient of the message , if it's >>someone who has publicaly distributed his key (keyserver , homepage >>...) . So even if you are unable to decode the message you can find >>who is the recipient of a given message . I think this is a big >>privacy problem . > and "Robert A. Rosenberg" <hal9001(a)panix.com> replied: >There is little that can be done about this. There must be something in the >message to identify who it is intended to be read by. As someone else has >stated, you can always set up private keys to be used to send to you that >are different from your Public KeyID for cases where you want to hide your >identity or that of the party you are communicating with. > I can see a case where one would want to broadcast a message (say on usenet) with *no* indication of the intended recipient (not even a non registered key-id). It would seem to be easy enough to hack up something that does not have key-IDs - to know if it's for you try decryption and if it works then it was for you. This does not scale well as the recipient must trial decrypt all messages which could use *a lot* (tm) of CPU time. John John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

1 0

Re: A lengthy preliminary analysis of the Leahy bill.
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:26 PM 3/11/96 -0500, Peter D. Junger wrote: > >This is a preliminary draft of my preliminary analysis of the Leahy >bill. In it I am primarily concerned with the affect---if any---of >that bill on the constitutionally protected freedoms of speech and of >the press. [much scary but, sadly, probably accurate concerns deleted for space.] > "\S 2804. Unlawful use of encryption to obstruct justice > > "Whoever willfully endeavors by means of encryption to obstruct, > impede, or prevent the communication of information in furtherance to > a felony which may be prosecuted in a court of the United States, to > an investigative or law enforcement officer shall- > > "(1) in the case of a first conviction, be sentenced to imprisonment > for not more than 5 years, fined under this title, or both; or > "(2) in the case of a second or subsequent conviction, be sentenced > to imprisonment for not more than 10 years, fined under this title, > or both. > >This provision is completely incoherent. There is no telling how the >government will interpret it, but at a guess they will use it to make >people reveal their keys: ``if you don't tell us your key, we are >going to charge you with impeding the communication to me of >information about the felony I am investigating.'' Thank you, Mr. Junger, for your entire analysis, but particularly this comment on that atrocious section. I'm repeating it, because I think it bears vast significance to the problems with this bill. The bill needs a complete rewrite. The one thing that makes me hopeful is the fact that the people around here who seem to think that this bill must be accepted as written, with this section included, all claim that there is great opposition to it. If that is true, then all I need to do is to convince people who nominally should be on "our" side that the bill is bad, as written. Mr. Junger's careful, albeit prelimary analysis does that in spades. Jim Bell jimbell(a)pacifier.com Klaatu Burada Nikto -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUSagPqHVDBboB2dAQEXpwQAiLfZk/xPqhTI0UNbgAY/oQh7wR5ElRYH Cb3QZDHGrPmPBF7MZEFW9bL9U+U/33l0kK/q/20vGvLZMFALImcOPgdFjcidjVRA zqHAHPTnJWsyROJsv1fgO2l6u0QRkONFxT5MF2tyqGp9ArYAOSwZy4NMXgwX4CrM QnqwvuKnZfU= =Qm0E -----END PGP SIGNATURE-----

1 0

Re: PGP : what to do when a user ID has multiple RSA keys
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:25 AM 3/11/96 +0000, you wrote: >My DOS version of PGP 2.6.2 came with a built in PUBRING.PGP >containing two keys ( 1024 and 512 size ) with the same user ID . >For testing purposes I wanted to encrypt a message with the 512 >length key , but only the 1024 size key could be used . > >How can I select the right key , apart from making a clone >PUBRING.PGP with only the key I want to use ? You need to use the hex id of the key. (I have this problem as well.) To get the hex id of the key, try "pgp -kv <yournamehere>". That will give you the hex id (right after the key size). For example, if -kv returned: 2048/F7D02799 you would use "0xF7D02799" instead of your name. (No quotes and case does not matter.) This does have some Cypherpunks relevence... Many of the PGP front-ends I have seen do not use the key ID, and thus, do not pick the correct keys in this curcumstance. (And some use it for some, but not all, operations.) But then, I would like to see key management handled alot differently than it is now. (For example, I would like to see PGP use multiple keyrings with an order of precidence. Search the most used keyring first and then check the mega-keyring if nothing is found in the first one. I expect that kind of feature is a ways off...) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Cut the mystical artist crap. (No crypto relevance here)
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

>Was it Thoreau who said "Consistency is the hobgoblin of >simpletons"? Wrong, my somewhat hysterical anonymous young woman. It was Emerson who wrote, "A foolish consistency is the hobgoblin of small minds." Please, try Bartlett's prior to again making an ass of yourself.

1 0

Re: TCP/IP Stego
by savron＠world-net.sct.fr 17 Dec '03

17 Dec '03

It seems that bit fiddling involve a direct connection of two partners having each one a TCP/IP Stego adapted kernel to work . This is a direction to study , but we can't forget those who can't directly connect with their 'stego' partner . We can't forget also those who can't hack their kernel . Any comment welcome

1 0

PGP : what to do when a user ID has multiple RSA keys
by savron＠world-net.sct.fr 17 Dec '03

17 Dec '03

My DOS version of PGP 2.6.2 came with a built in PUBRING.PGP containing two keys ( 1024 and 512 size ) with the same user ID . For testing purposes I wanted to encrypt a message with the 512 length key , but only the 1024 size key could be used . How can I select the right key , apart from making a clone PUBRING.PGP with only the key I want to use ? Any comment welcome

2 2

Re: How would Leahy bill affect crypto over HAM radio?
by Deranged Mutant 17 Dec '03

17 Dec '03

> It is illegal for amateur radio operators to use codes and ciphers per part > 97.117 of the FCC rules. Therefore, the Leahy bill would have no impact on > "ham" radio. But doesn't the bill grant the right to use encryption? That's my point... the Internet and even international phone calls render that rule meaningless, since there are other (easier?) ways to communicate internationally using ciphers. Leahy's bill doesn't restrict what media encryption may be used on. I am aware that (as of now) crypto is banned on HAM, but my question is whether one can consider the Leahy bill to lift that ban. (It might also be useful for HAMs to get an amendment of some sort to the bill...) Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: Stego - images and sounds
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sasha1(a)netcom.com" "Alexander 'Sasha' Chislenko" 9-MAR-1996 22:59:54.01 >At 12:19 PM 3/8/96 -0800, Jim McCoy <mccoy(a)communities.com> wrote: >> >>Provided the bits are random in the way that they should be... The low-order >>bits in such files were chosen by implementors of stego programs because >>modification would not be noticed by the person viewing or listening to >>the file, not necessarily because there was actually randomness at this >>level which could be replaced. Does anyone know of a survey of images or >>sound files which tested the statistical randomness of these bits? They >>may not be as random as people think they are. >> > This should depend on how the image/sound was obtained, though I am pretty >sure in most cases there would be easily detectable patterns. They would >be the strongest in software-generated files, smaller in good reproductions >of precise recordings, and very small in noisy recordings. In all cases, >the number of lower bits used for stego-messages may be chosen lower than >the existing noise of the signal. Changing all lower bits in a good >rendered image may still be unnoticeable for the human viewer, but really >easy to detect to a program. Unless the picture, sound, whatever has a periodic function, the LSB ought to have an approximately random distribution (barring all 0's and all 1's, for full color saturation). The periodic function part could be a problem. -Allen

1 0

The Future of Electronic Commerce
by John Young 17 Dec '03

17 Dec '03

"The Future of Electronic Commerce," released March 11 by The Aspen Institute's Communications and Society Program, describes the new economics of transacting business in cyberspace, from consumer privacy to potential advantages for entrepreneurs. The 270 kb report in .PDF format is available at: http://www.aspeninst.org.

1 0

re: Video resolution
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:14 AM 3/11/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >Note: this refers to the IBM PC & clones only > >> The point is that they do a lousy job on dithering. So does Microsoft >> explorer. They probably purchased the identical code from some clot. >Have been watching this go back and forth & get further from the original >question as usual. I suspect that if the original poster looks in her/his/ >its/other SYSTEM.INI file, the line "display.drv=vga.drv" will be found in >the [boot] section. This is the default 16 color driver installed by >Windows to be compatible with every 256k 640x480 VGA card. And I also remembered to turn the computer on. I can assure you that I know how many colors my screen supports, and I have numerous dithering programs on my computer, two of them written by me. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0