December 2003 - cypherpunks-legacy

Re: 56 kbps modems
by John Gilmore 17 Dec '03

17 Dec '03

I checked the Rockwell home page, which has a pointer to the press release. It isn't very technical, but gives some good clues. It looks like they're doing an interesting trick. The modems aren't designed for use like traditional modems, where the same equipment is on each end. Instead, there is a digital interface on one side of the phone call (like at an Internet Service Provider). The consumer side modem has a traditional analog interface. The rest of this is speculation and fantasy on my part. So, think about it. The analog side will generate voltages and send them to the local central office, where they will be digitized and sent to the destination central office digitally. There, they will be patched into one channel of a T1 line (out of 24) and sent digitally to the ISP's "modem bank". Equipment is already available (and in use all over the uunet network) that plugs T1 into a board full of digital signal processors, decodes each of the 24 channels (each channel running any modem signalling protocol, or ISDN), handles PPP packet framing, and gateways the resulting packets to/from an Ethernet. Now for Rockwell's trick, you get the DSP's in the two modems to talk to each other. They can run some simple coding scheme (say ordinary 2400 baud modem for this example) to pass digital data back and forth while they're negotiating the full blown deal. First, the analog side sync's up with the clock for the 8000 samples/sec that the central office is digitizing (into 8-bit samples). You can do that by sending one voltage and then switching to another; the far side can tell you whether you switched on a sample-boundary or not (was there a sample "in between" before it settled to the new value?). OK, then, in each sample slot, the analog side can send one of 256 different voltages. The digital side can tell it the 8-bit values it received. Then fine-tune that to sending 128 different voltages, taking particular care around the ones that got distorted the first time. As long as you can find 128 distinct voltage levels that the central office will reliably digitize, you're done. You're sending 7-bit samples at 8000 samples/sec. Do something similar for the analog receive side, and you can start passing user data at 56K. If the robbed-bit stuff gets in the way of seeing 128 distinct voltage levels in every byte, you can send solid zeroes or solid ones in each direction and see which bits they're stealing out of which bytes. Use most of the 8 bits available in the other bytes (you can find e.g. 200 different voltage levels that will work), and in the stolen byte, you can find e.g. 100 voltage levels that work. This is more bits than using 128 voltage levels in every byte, and in fact you can probably get closer to 64 kbits/sec than to 56 kbits/sec, depending on the analog qualities of the wire to your central office. A nice trick! It won't speed up analog-modem-to-analog-modem connections, but those will increasingly be a smaller and smaller fraction anyway, as the digital infrastructure becomes cheap. And of course the 56K modems will just be DSP's with decent A/D and D/A interfaces, so they can run all the old analog protocols too, in the case that the phone line isn't digitized, or if they want to talk to an old modem. John

3 2

ANYONES CREDIT CARD # per your request.
by brianh＠u041.oh.vp.com 17 Dec '03

17 Dec '03

Thought this would be appropriate to the list Forwarded message: > From u082.wi.vp.com!alis Fri Sep 20 10:57:39 1996 > Message-Id: <m0v46wy-0002J9C(a)u082.wi.vp.com> > From: alis(a)u082.wi.vp.com (Ali Sajanlal) > Subject: Credit Card information (fwd) > To: nd(a)u082.wi.vp.com > Date: Fri, 20 Sep 96 9:53:03 CDT > X-Mailer: ELM [version 2.3 PL8] > > Forwarded message: > > Date: 20 Sep 96 18:38:16 > > Subject: Credit Card information > > > ______________________________ Forward Header __________________________________ > > Subject: FYI - Check this out > > Author: alis(a)u082.wi.vp[.com > > Date: 9/20/96 10.00 AM > > > FYI - Check this out > > > > Unfortunately, this message needs to be propagated to protect all of us. > > > > Note: Lexis-Nexis is only accepting written or fax requests. You have the > > option to fax your removal request to (513) 865-1930 state your full name > > and complete address. Or mail the request to: > > Lexis-Nexis > > Attn: P-Track > > P.O. Box 933 > > Dayton, Ohio > > 45401-0933 > > > > > > >Subject: FYI > > >Author: Nathan Judge at NYERPOC > > >Date: 9/16/96 2:42 PM > > > > > >Your name, social security number, current address, previous addresses, > > >mother's maiden name, birth date and other personal information are now > > >available to anyone with a credit card through a new Lexis database called > > >P-Trax. As I am sure you are aware, this information could be used to > > commit > > >credit card fraud or otherwise allow someone else to use your identity. > > > > > >You can have your name and information removed from this list by making a > > >telephone request. Call (800)543-6862, select option 4 and then option 3 > > >("all other questions") and tell the representative answering that you wish > > >to remove your name from the P-trax database. You may also send a fax to > > >(513) 865-7360, or physical mail to LEXIS-NEXIS / P.O. Box 933 / Dayton, > > >Ohio 45401-0933. Sending physical mail to confirm your name has been > > removed > > >is always a good idea. > > > > > >As word of the existence of this database has spread on the net, > > Lexis-Nexis > > >has been inundated with calls, and has set up a special set of operators to > > > > >handle the volume. In addition, Andrew Bleh (rhymes with "Play") is a > > >manager responsible for this product, and is the person to whom complaints > > >about the service could be directed. He can be reached at the above 800 > > >number. Ask for extension 3385. According to Lexis, the manager > > responsible > > >is Bill Fister at extension 1364. > > > > > >Please forward this e-mail to everyone we know. > > > > > > > Ali S. > > -- > > > > > > > > > > > > > > > > > > > > > > > > > > > -- //!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\ Brian Hills Varco-Pruden Buildings 1202 Industrial Dr. Van Wert, OH 45891 419.238.9533 - brianh(a)u041.oh.vp.com \\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//

1 0

Re: DL in exchange for fingerprint
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:13 PM 9/19/96, Gary Howland wrote: >Timothy C. May wrote: >> >> (Yes, I disliked being thumb-printed, but I could see no viable >> alternative. I'm sure Duncan has some scheme to declare himself a Botswanan >> exchange student, but I decided being thumb-printed was the lesser hassle.) > >Sure, it's always less hassle doing what they want. Privacy doesn't >come for free. It's easier to let the police search you in the street >than it is to make them arrest you so that you can make a formal >complaint. So, just what it is _your_ method of dealing with this? While it is noble to talk about fighting the system, just how do you go about doing it yourself? Do you simply drive without a valid driver's license? I know some folks who do, of course, but it's not something that's "worth it" to me. (This space reserved for your lecture about how I need to be prepared to go to jail to defend my right not to be thumbprinted, etc. On second thought, why don't you be the one to go to jail, and then you can let us know your experiences.) >> Paraphrasing that famous quote, just which part of "not for identification" >> don't they understand? > >Hmm - who are you paraphrasing here? (Just curious). "What part of "No" don't you understand?" and "What part of "Congress shall make no law" don't you understand?" --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 5

Re: monkey-wrenching GAK
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:46 PM 9/19/96, Ray Arachelian wrote: >Another thing you can do: generate huge key pairs all day long and submit >them to the NSA. If enough people do this, they will be flooded and >overworked, of course they may ignore them, etc, or make it hard to do >so, but if everyone generates a 4K key every hour or two and discards it, >but gives the key pair to the NSA anyway, they will run out of storage >space, or at least it will make it much much harder for them to figgure >out which key you are using for conversation X. Ah, but what about the _fee_ for registering a key? You really didn't think this would be free, did you? (It costs money to register cars, guns, etc., so why would it be "free" to register a key?) Besides being a revenue enhancement tool, charging a fee stops this sort of flooding attack. (Note: One of my biggest objections to GAK, besides the political/civil rights issue, is what it does to systems which generate lots and lots of keys on an ad hoc, continuing basis. GAK, if enforced, puts a major speed bump in the way and increases costs, possibly making certain kinds of systems infeasible.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

OTP seed solution? - strong, tried before???
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

A very simple idea came to me today that I`m sure has been done before and I wanted to find out if it has any problems I haven`t seen: A strong random generator (ie. a BBS) is seeded with a true random seed (derived possibly from keyboard latency) and used each time a message is send to create a message length randon string. This string is XOR`d or added to the message creating a OTP. The recipient has previously been sent a seed value for the generator encrypted under say RSA and signed to prevent a man in the middle attack. Each set of recipient<->sender pairs has a seed unique to them. This seems good to me but the key distribution mess (ie. hundreds of keys about) is the big problem, has anyone done any research into possible solutions to this??? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

2 1

Re:really undetectable crypto made somewhat practical
by Steve Reid 17 Dec '03

17 Dec '03

I'm on FCPUNX instead of regular Cypherpunks, so please excuse me if I'm a little behind the thread. > New Scheme: First, calculate the MD5 hash of all the words in the various > dictionary files used by the password cracker program and create a > database containing every word and the first 4 bits of its MD5 hash. > Given such a database, it would be possible to write a program that > accepts as input a block of cyphertext (the stego message, encrypted), > chunks it up in to groups of 4 bits and then, for each chunk, displays the > words that have hashes that start with those same four bits. The person > running the program would select words that form meaningful sentences but > also produce hashes that combine into the encrypted stego message. This > scheme would send 4 stego bits per word. As a slight improvement, you could turn this into a complete stealth encryption scheme, using only the one-way hash function operating as a MAC. Instead of hashing just the word in an effort to get stego bits, you could hash a key along with the word. In order to get the intended hash you would need to know the key. Since you're probably hashing a whole block of 512 bits (or whatever's specified in the algorithm) appending a key should not affect the speed of the system. I'm certain that this would increase the security, possibly enough that you wouldn't need to use a regular encryption algorithm (but I wouldn't bet on it). Crude example: Assume that Alice can use the words "Greetings" and "Salutations" interchangably without drawing suspicion. Also assume that "PASSWD" is a secret known only to Alice and Bob, and that the stego software looks at the low bit of an MD5 hash. MD5 ("GreetingsPASSWD") = c7bf6e051731a0dcf52baa330c9d2e7d <- low bit=1 MD5 ("SalutationsPASSWD") = 2dd2ba080b5feb060ffbc6d196fd1b34 <- low bit=0 If you say "Greetings" you're sending a 1, if you say "Salutations" you're sending a 0. Eve doesn't know about "PASSWD" so she can't do the hash and figure the bit. Of course, if you're using this to send more bits, you'll need something harder to guess than "PASSWD". The trick is in figuring out which words have stego bits and which don't. It might be better to stego bits into a whole line instead of a word, as that would probably offer more flexibility. ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:)

2 1

Re: The periodic caveat about Timmy May
by DMiskell＠envirolink.org 17 Dec '03

17 Dec '03

>attila <attila(a)primenet.com> writes: > >> In <199609190517.HAA00851(a)basement.replay.com>, on 09/19/96 >> at 07:17 AM, nobody(a)flame.alias.net (Anonymous) said: >> >> = .Timmy May habitually digs into his cesspool of a mind for his >> = .mailing list fertilizer. >> >> this is humour. it tickles the imagination, and the reference >> to tim is lost! > >Can we get all this non-crypto-relevant shit off of this mailing list please? > >--- > >Dr.Dimitri Vulis KOTM >Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps Sorry, dear, but complaining isn't going to change it, and simple telling people to shut the fuck up is going to go nowhere. If you want solely crypto relevent material, subscribe to the filtered list. I mean, come on -- you know this list is suseptable (sp?) to noise and spam. Besides, people suggest to me that you are the anonymous mailer. So maybe you should keep a low profile on this. -- If in fact we are the only intelligent life on this planet, why the fuck are we in this goddamn mess? -- Find my public key on the World Wide Web -- point your browser at: http://bs.mit.edu:8001/pks-toplev.html

3 2

anonymous bacon
by Jonathan Corbet 17 Dec '03

17 Dec '03

The following, from RISKS, deserves redistribution.... Date: Tue, 17 Sep 1996 13:04:47 -0400 From: pcw(a)access.digex.net (Peter Wayner) Subject: Bringing Home the Anonymous Bacon The *Baltimore Sun* reports in its 17 Sep 1996 issue that people in Baltimore are paying for drugs with meat (page A1! [pretty saucy!]). Perhaps this is not yet anonymous digital cash, but certainly anonymous. [Now someone is going to propose keeping a database of all sides of beef, and steganographically watermarking the meat in the context of digitally signed scannable grade-stamps. Perhaps the next step in monitoring the private drug-meat trade would be to escrow the inspectors' private keys, derived from the product of two U.S. Primes, and put the database up on the net: the T-bone connected to the M-bone, etc.? PGN]

2 1

DL in exchange for fingerprint
by Jeff Barber 17 Dec '03

17 Dec '03

Oh joy. You no longer need to be arrested to get fingerprinted in Georgia. On the front page of Wednesday's Atlanta Journal, under the headline "Now you can get driver's license in minutes": The average 45-day wait to get a new driver's license in Georgia will be a thing of the past under a new system that will churn them out while customers wait. "From start to finish it takes about 10 minutes," said chief examiner ... in charge of the Georgia State Patrol's driver's license office in Milledgeville where the system went into effect on Tuesday. Previously, drivers received a temporary paper license that was good for 45 days. ... ... Officials at the Department of Public Safety plan to have the new computer system in 82 locations across the state by Oct. 1. Georgia is the 32nd state with the system. After an eye exam, the applicant presses a finger down on a pad that registers the fingerprint in a state-wide memory bank. Then, the examiner confirms the name, address, and identifying information. ... The licenses have a hologram of the word "Georgia" behind the driver's name, age and address, and a bar code on the back that contains a laser recording of the driver's index fingerprints. "We keep a memory bank that matches your fingerprints with your license," [DoPS spokesman] said. "In other words, if you went to get a new license with a false birth certificate and your fingerprint didn't match the name, you wouldn't get a license. And you could also face possible investigation for fraud from the Public Safety's investigative division." ... "I think it's wonderful," said Katherine Kidd, the first Milledgeville driver to get the instant license. "It's a great idea. Now we don't have to wait forever." [ End quote ] Just what I would have called it: a great idea. Is it true that 31 other states take your fingerprint as part of the license application? I feel sick. -- Jeff

2 1

Re: DL in exchange for fingerprint
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:23 PM 9/19/96, Jeff Barber wrote: >Oh joy. You no longer need to be arrested to get fingerprinted >in Georgia. On the front page of Wednesday's Atlanta Journal, under >the headline "Now you can get driver's license in minutes": ... >Just what I would have called it: a great idea. Is it true that 31 >other states take your fingerprint as part of the license application? >I feel sick. California has it, so that's what about 20 million drivers have to put up with. I'd expect all the states to have this within a few years. (Yes, I disliked being thumb-printed, but I could see no viable alternative. I'm sure Duncan has some scheme to declare himself a Botswanan exchange student, but I decided being thumb-printed was the lesser hassle.) By the way, the next rev of the California driver's license will reportedly have one's *Social Security Number* printed on the card! So much for the statement clearly printed on my card: "For social security and tax purposes -- not for identification." Paraphrasing that famous quote, just which part of "not for identification" don't they understand? (Indeed, I am asked for my SSN in many places. A few times I've refused to give it. Once the clerk just said, "Fine, I have it here on my computer anyway." Refusing to give it is probably no longer meaningful, due to massively cross-linked data bases.) Again, we desperately need an infrastructure of "credentials without identity." --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4