December 2003 - cypherpunks-legacy

Re: PGP [2d try]
by travel23＠juno.com 18 Dec '03

18 Dec '03

Apologies but the word-wrapping was different than the appearance it had as I typed my previous message. It should have read: >...as fertiliser as .... ^^^^^^^^^ "Fertiliser" was, of course, the word to which I was referring when I stated that this was the British/European spelling. I found it to be an interesting clue regarding the author's identity - FWIW..... T.T. ................................................................................. Just consider me an acorn who is trying to deal with the rest of the nuts .................................................................................

1 0

Technically Recoverable Encryption Functions
by Bill Stewart 18 Dec '03

18 Dec '03

David Sternlight's netnews posting, which Dmitri forwarded to cypherpunks, was about the 2nd Ave. Deli, but it does apply quite well to crypto, and the current government attacks. >>Congregant: "What does "kosher style" mean? >>Rabbi: "Tref". What does "Recoverable-Key Encryption" mean? "Unsecure" # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Dole web site cracked?
by Duncan Frissell 18 Dec '03

18 Dec '03

Long ago, someone registered dole96.org and has been running a satirical site for some time. The Dole campaign registered dole96.com and dolekemp96.org, and dolekemp96.com (and maybe more). It is hard to get all of the variations of a domain name registered. DCF

2 1

List of reliable remailers
by Raph Levien 18 Dec '03

18 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)rigel.cyberpass.net> mix cpunk pgp hash latent"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash ksub latent cut ek mix reord"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (cyber mix) The alpha and nymrod nymservers are down due to abuse. However, you can use the cyber nymserver. The nym.alias.net server will be listed soon. See http://www.cs.berkeley.edu/~raph/n.a.n.html for details. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. Hopefully, this is fixed by now. The penet remailer is closed. Last update: Mon 7 Oct 96 6:48:08 PDT remailer email address history latency uptime ----------------------------------------------------------------------- jam remailer(a)cypherpunks.ca *****. *--** 21:20 100.00% dustbin dustman(a)athensnet.com ++---. ++--+ 1:50:34 99.98% exon remailer(a)remailer.nl.com -#***# *#### 3:27 99.94% balls remailer(a)huge.cajones.com ****** *-*** 5:37 99.86% amnesia amnesia(a)chardos.connix.com ---+-. ---- 3:40:20 99.53% haystack haystack(a)holy.cow.net *####* ** ## 4:32 99.49% winsock winsock(a)c2.org -..-+. -+++ 3:31:52 99.14% cyber alias(a)alias.cyberpass.net **+**. -*- 43:47 99.14% mix mixmaster(a)remail.obscura.com --+ _ +++++ 6:57:10 98.90% extropia remail(a)miron.vip.best.com ----_. --- 10:51:38 98.43% squirrel mix(a)squirrel.owl.de +++ . +--- 2:28:31 98.04% lead mix(a)zifi.genetics.utah.edu .-*. +---+ 1:20:44 97.84% middle middleman(a)jpunix.com - + -. - -- 3:47:45 96.62% replay remailer(a)replay.com ** *. *** 10:42 77.10% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Dallas Semiconductor turns on Internet commerce at the touch of abutton
by Robert Hettinga 18 Dec '03

18 Dec '03

Dallas Semiconductor turns on Internet commerce at the touch of a button; wearable computer chip generates uncrackable codes using public key cryptography ---------------------------------------------------------------------- DALLAS--(BUSINESS WIRE)--Oct. 7, 1996--"Attention, cyber-shoppers! Your `electronic wallet' is almost ready." Internet users have been waiting for personal, trusted computing to conduct commercial transactions -- mere pennies or big bucks. Now it has been successfully demonstrated. Dallas Semiconductor (NYSE: DS) Monday announced development of the Cryptographic iButton, a very personal computer in a 16mm, stainless steel case that provides for the safe transfer of Internet e-mail -- including credit card numbers -- even if the client computer, software and communications links are not trustworthy. The Crypto iButton is the result of a multi-year development at Dallas Semiconductor to reach the pinnacle of computer security. "Think of it as a wearable, digital accessory," said Michael Bolan, vice president of marketing for the 12-year-old manufacturer that produces 120 million chips annually. "You can attach it to your wallet, keychain, jewelry (ring or bracelet), wrist watch, or badge. With the electronic wallet, the iButton communicates without the user even having to open the wallet, providing convenience and security. "This credential cannot be duplicated because it contains information that is never revealed. It positively authenticates a person to a server computer or to another person using two-factor security: personal possession of the iButton plus a PIN (Personal Identification Number)," Bolan explained. iButton users will have universal access to their World Wide Web e-mail at public Internet connections (hotels, airports, kiosks) and still be confident that their mail is kept private. Sensitive information like credit card numbers can be transmitted safely by secure e-mail using the Cryptographic iButton. Mobile employees -- so-called "road warriors" -- can improve their productivity with economical, secure access to corporate databases. iButton Overcomes PC Vulnerability When software and PC hardware are hacked, information remains safe in the physically secure iButton chip. In one service model, the iButton chip randomly generates a public and a private key set. The private key is known only to the Cryptographic iButton; it is never revealed, not even to its user. The large key size of 1024 bits (308 decimal digits) makes guessing insurmountable. The iButton ensures both parties are truly authorized to communicate by rendering messages into unbreakable digital codes using its high-speed math accelerator. The Crypto iButton addresses both components of secure communications: authentication and safe transmission. Physical attacks on the iButton by technologically savvy criminals are thwarted. The continuous steel perimeter triggers a tamper response upon intrusion. Critical security parameters, including the private keys, are rapidly erased. Vulnerabilities of Smart Cards to certain physical attacks, recently reported by computer scientists at Bellcore, were anticipated during the design of the Cryptographic iButton. Even if the iButton is subjected to extraordinary physical stresses, it does not leak out information that can be useful for inferring secret data. Included on the monolithic chip is a True Time Clock, a real-time clock with tamper evidence. It provides a trusted time stamp and audit trail for microcash metering or other off-line transactions, as well as aiding in the detection of fraud by putting time limits on service. When the clock reaches a pre-set time, the chip self-expires and requires reactivation before service can be renewed. Unlike a loose plastic card, the iButton stays attached even while communicating, making misplacement less likely. Messages or transactions are authorized only after the PIN is validated by the iButton, the same technique automatic teller machines use to dispense cash. Microcash Stimulates I-Commerce "We don't expect to make money obsolete, although our small cash version of the iButton is currently doing millions of transactions as an electronic coin purse for mass transit riders in Istanbul, Turkey and for patrons of Laniel vending machines in Canada," said Bolan. "One strength of the Crypto iButton," he continued, "is its ability to meter extremely small amounts economically in off-line distributed systems. A secure micro-payment system for electronic property will ultimately enrich the content on the Internet by giving producers a monetary incentive to distribute their work. "For example, reading the front page of a newspaper may tabulate only 1 cent worth of microcash in a subscription meter while downloading a Java software applet may tabulate a larger amount in a copyright meter. The multiple meters of the iButton count the usage information over the network for easy revenue collection by the service provider's clearinghouse," he said. One of the earliest anticipated uses will be by the U.S. Postal Service, which has already notified its postal meter customers that it will replace its current postage meters using a Postal Security Device (PSD) connected to a PC. Using the Cryptographic iButton as a PSD, the USPS will be able to refill its postage meters over the Internet. Implementation and Availability The iButton is touched to a Dot Receptor which can be fitted to any of the 200 million existing personal computers in a matter of minutes without opening the computer's enclosure. The Dot Receptor is cabled to the printer port, forming a $15 pipeline to the PC. In this way the iButton can be the physically secure co-processor to any PC. Dallas Semiconductor will activate Crypotographic iButtons issued to individuals or co-issued by service providers. The devices will be activated from the manufacturer's Web site. Dallas Semiconductor plans to begin delivering the Cryptographic iButton and Dot Receptor in the first quarter of 1997. The company projects that it can drive down the cost of using its Cryptographic iButton to $12 per year. The street price of the Dot Receptor is $15. Less sophisticated versions of the iButton are currently available. The simplest version, the DS1990, costs $1.59 in 1,000-piece quantities. For more information, visit the iButton Web site at www.iButton.com. Dallas Semiconductor (NYSE:DS) designs, manufactures and markets CMOS chips and chip-based subsystems. In its 12-year history, the company has sold its products to more than 8,000 customers worldwide. These include Original Equipment Manufacturers (OEMs) in instrumentation, factory automation, personal computers, office equipment, telecommunications, medical equipment, and mainframe computers. Chips and subsystems are sold through a direct sales force, software developers, distributors and manufacturers' representatives worldwide. ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Libel & Pseudonymous Reputation
by Stanton McCandlish 18 Dec '03

18 Dec '03

A new item at the EFF archives might be of interest: http://www.eff.org/pub/Legal/CyberLaw_Course/cyberlaw.038 - CYBERSPACE LAW FOR NON-LAWYERS: Topic: Libel 7: Injury to a Pseudonym's Reputation? -- <HTML><A HREF="http://www.eff.org/~mech"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org"> Electronic Frontier Foundation </A><P> Program Director </HTML>

1 0

Re: Statism/Theocracy What's the difference--LDS
by Ryan Russell/SYBASE 18 Dec '03

18 Dec '03

So Snow, Should your parents be (have been) allowed to pass curfew laws along with the rest of the community so that their wishes about you not going out could be enforced? Ryan ---------- Previous Message ---------- To: attila cc: cypherpunks From: snow @ smoke.suba.com @ smtp Date: 10/06/96 01:11:58 AM Subject: Statism/Theocracy What's the difference--LDS Attila said: > In <v03007808ae7af10d0afb(a)[207.167.93.63]>, on 10/04/96 > at 09:03 AM, "Timothy C. May" <tcmay(a)got.net> said: > Frankly, we do not wish curfews, and there never were curfews > before the immense immigration into the area, mostly from So. CA, > However, these people, Mormons (some good, some inactive) and (inactive=bad?) > well, that prompted the curfew, but they found it also > maintained the semblance of peacful family oriented community > among the lost and alienated families --so it is apparently here > to stay. other than the fact we are telling tparents who do not > wish to manage their children they must keep them home or take them > somewhere, what does the law do? <snip> > >.Telling people when they > >.can be on public streets and when they cannot is no different than telling > >.them what they can read and what they cannot. > that was my initial reaction -you wouldn't tell me that! but > consider the right of society to legislate and regulate in the > common good, despite both my and your abhorence of law in an of > itself. GAK is for the "common good", after all, it is only the people who are doing wrong that will be hurt by having their data scanned by the Government, it is just maintaining decency standards. > > it is an effective means of forcing parents who do not seem to > care, or parents who wish to shift their responsibilities to social > workers who are not available, they have a responsibility. what > happens to the violators --few are arrested, they are asked to go > home. there is no great wild-west roundup of teenaged cattle! any > who resist or commit minor vandalism are taken to the center --but, For most of my life I have had insomnia, and when I was in my early to mid teens, I used to wait until my parents had gone to sleep, and go out and wander the neighborhood, Mostly alone, sometimes until 2 or 3 in the morning (during the summer, not when I had to be at school). Why _shouldn't_ I be allowed to do this? In my case, it was against my parents wishes, but I still harmed nothing, commited no crime (there was no curfew where I lived). My father almost caught me (he knew I did it from time to time, but figured as long as I wasn't causing trouble, he wouldn't be able to stop me). Just because other children cause trouble, why should _mine_ be restricted? Just because it gives the APPERANCE OF MORALITY? I'll say that again, THE APREARANCE OF MORALITY. Forcing someone to follow a given set of rules doesn't make that person moral, it makes them a slave. Morality only comes in when there is choice. Also, the waters are calm on the surface, but what about underneath? What is going on behind closed doors? Here in the outerworld, we have fornication on the streets, but we know who is doing it, we _know_ who the problems are. Do you? > unlike every other city I have seen, they do not mix the > 'miscreants' with the juvenile delinquents, repeat offenders, and > the teenagers who are obviously on their way to the dead end. Almost all teenagers are on their way to a dead end. It is called "Adulthood", which if you look at it a certain way looks a lot like A Dolt Hood. I don't necessarily think it is a bad idea to mix kids (mid to late teens) picked up for "real" crimes in with "real" criminals, but then I don't think that staying out late should be a crime. Fear can be a powerful motivator. > what is the penalty? call their parents for a ride home. they > are not fingerprinted and mugged, etc. very few are required to > even see a social worker. consistent repeat offenders eventually > enter the system --as they should. Really, I should be in "the system" because I like wandering around at night? Real libertarian of you. > >.I still urge Attila to rethink his enthusiastic support of state-enforced > >.curfews, or state-imposed bans on alcohol (not that I recall him supporting > >.this particular law), etc. > actually, the curfew laws are local laws, and I reluctantly > decided to support curfew laws for minors after looking at the > means and results --it does provide an early point of intercepting > behavioral patterns with the *parent* being the judge and warder, > and hopefully give those parents a wakeup call they need to guide > their children as they are fast approaching adulthood where they > are fully accountable. Mr. May's usage of "state" means "governing body" rather than "state of the union". But you knew that. There are many other "interception" points that can be utilized to identify children whose parents are not providing them with the state approved ideological underpinings, Let's take a look at some shall we? Your children do well in school correct? Straight A's in most classes? it is obvious that you are driving your children too hard, teaching them tp be overacheivers. You shouldn't push them so hard, they should stay at the level of their classmates. Ok, that was hyperbole. Seriously tho', if you talk to many "social workers" <pardon me--*spit*> they can give you certain behavior patterns that indicate a child is being abused in the home. They could (and I am sure some would like to) go so far as to include certain types of religious and political indoctrination as abuse. If the state (city/county) mandates it, and it gives the apperance of "stopping crime", or simply provides a smooth surface, is it worth it? alcohol is available at any large grocery store; it has not been > banned to any extent since prohibition, but not necessarily avail- > able in rural areas. Not in your area, and maybe not my LDS's, but try Pell City Alabama. Same mentality, different name on the church house door. > I do not think you can prohibit anything from adults --drugs, Can, or should? Let _me_ run the DEA, and give me a good budget, and I will stop it. Yeah, people will die, but they are dying anyway. > certainly we are justified in ranting against any abridgement of > our right to freely (and privately) communicate, freedom of > *peaceful* assembly, a truly free press --certainly not the New > World Order blinded press printing the official line dictated by > political/economic Boss Tweeds of what is effectively an oligarchy > --they do not possess common principles sufficient to even be > called 'national socialists' (fascists). Yet you argue for the abridgement of freedoms based on age. Does the state know better than a parent when a minor is old enough to be out after midnight? > or, there is a government like Washington where they are trying > to, and may anyway, implement President Hillary's "It takes a > Global Village" so the state can dictate everything and raise a new > generation of robots in the mold of their revisionist history which > we are now suffering by attrition.... Which really only pisses most people off because it is a different revisionist history than they want taught. > If Bubba and the President are reelected with a Democratic > Congress, we will not recognize our once almost free country in Or, he will push too far, too fast, and it will snap back in his face. Remember, Klinton can't do it without congressional approval. Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

Bellcore Smart Card Hack
by John Young 18 Dec '03

18 Dec '03

There is more info on Bellcore's research on flawed smart cards at: http://www.bellcore.com/PRESS/ADVSRY96/medadv.html with links to facts of the crypto hack. ----- Thanks to Mr. Ken Bransom at Bellcore.

1 0

You can be forced to turn over your encryption keys?
by Geoffrey C. Grabow 18 Dec '03

18 Dec '03

I thought we had a 5th amendment. Isn't turning over your key that may (or may not) expose encriminating evidence an extension of self-encrimination? Haven't there been dozens of famous witnesses (Patty Hurst, Oliver North, etc) that "take the 5th" dozens of times on the stand. Why couldn't I "take the 5th" when asked for my encryption keys? When asked for your key, can't you say: "I'm sorry your honor, but I respectfully refuse to answer that question on the grounds that it may incriminate me.". Any legal-eagles out there? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | Great people talk about ideas. | | Oyster Bay, New York | Average people talk about things. | | gcg(a)pb.net | Small people talk about people. | |----------------------------------------------------------------------| | PGP 2.6.2 public key available at http://www.pb.net/~wizard | | and on a plethora of key servers around the world. | | Key ID = 0E818EC1 | | Fingerprint = A6 7B 67 D7 E9 96 37 7D E7 16 BD 5E F4 5A B2 E4 | |----------------------------------------------------------------------| | That which does not kill us, makes us stranger. - Trevor Goodchild | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: Can we kill single DES?
by stewarts＠ix.netcom.com 18 Dec '03

18 Dec '03

At 07:50 AM 10/6/96 -0700, Declan McCullagh <declan(a)eff.org> wrote: >> >1. Is this a good idea? What will happen if DES becomes perceived >> > as insecure? >> That's Declan's department (and other non-clueless journalists - [...] >This is the meme I've been trying to spread -- that 56-bit DES is *not* >secure. In particular, it's N>>20 years old, the NBS originally certified it for five years, and kept recertifying it primarily because triple-DES was too slow on the popular bank computers of the time (e.g. cash machines and then PCs), and hardware implementations of 56-bit DES would need to be replaced if the algorithm were decertified. Public-key encryption was developed a few years after DES, with a solid mathematical background that lets it remain secure today. It's far more secure than DES but far slower, so it's only been practical the last few years. Newer encryption technology which is several times faster and much stronger than DES has been developed over the last decade. >This cuts through all the rhetoric about differences between key >recovery and key escrow, who's going to be in this industry alliance, etc. "Key Recovery" is the latest sleazy meme from the Government. The only difference from so-called "Key Escrow" is that it's deliberately obscure about who gets to keep your master keys, while "Escrow" implies that it's definitely somebody else besides you. >From the "Eternal Vigilance is Better than Hindsight" department, we should have seen this coming and done a pre-emptive strike on the term. One of the papers on Dorothy Denning's web site is a May 20, 1996 SUBJECT: Draft Paper, "Enabling Privacy, Commerce, Security and Public Safety in the Global Information Infrastructure" from OMB, which is one of the Clipper 3 announcements, and it uses the term "key recovery". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0