December 2003 - cypherpunks-legacy

Star Trek: First Contact
by frantz＠netcom.com 17 Dec '03

17 Dec '03

For the fans of E.E.(Doc) Smith, go see this movie. OBCrypto: Data locks the main computer with a fractal cypher. OBMoney: Picard states the they don't have money in the 24th century. Instead they work for the good of mankind. Nanotechnology must have made everything material possible, so the only reward left is status (aka reputation). ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

10 10

how much entropy in common answers
by Pat Farrell 17 Dec '03

17 Dec '03

I've been playing arround with some code to implement CME's secret sharing using low entropy answers. (His write-up is in http://www.clark.net/pub/cme/html/rump96.html) In the write-up, Carl says " That means that it has very low entropy. For example, a person's first name has only about 8 bits of entropy. Car makes and models have only 2 to 4 bits of entropy -- especially if one is naming cars desirable to a teenager." Further on, he says "Therefore, if each answer has entropy E, the attacker must correctly guess T=(EK) bits of answers. If T exceeds 90 bits or so, then the user is reasonably secure from answer-guessing attacks." (where K is the number of questions) My question is, how do we measure the entropy of each answer so we can calculate when we've got 90 or so bits. I know when I was a teenager, the list of car lust objects was short, and everyone wanted a Mustang or Camaro, so the entropy of those two choices was much less than half a bit. A similar idea was mentioned in a critique of the plot of West Side Story. The question is, on a hot night in Spanish Harlem, what percentage of women are named "Maria"? Clearly there are cultural issues involved. The entropy in a question such as "what is your favorite brother's name?" is low in an Irish family like mine where names cluster arround choices such as are Patrick, John, Sean, and Dan. So how do we measure the entropy objectively? Thanks Pat Pat Farrell CyberCash, Inc. (703) 715-7834 pfarrell(a)cybercash.com #include standard.disclaimer

1 0

RE: Mass-market crypto phones
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:40 AM 11/22/96 -0800, Lucky Green wrote: >The LEA's are not intested in saving the public money. They are >interested in preserving and expanding their power. If it costs >$1,000,000 per wiretap, who cares? The government has men with guns that >can always go out and extort more cash from the population. > >--Lucky They could if they would; but they can't so they won't. Governments (like real people) always collect as much revenue as they possibly can at a given time. If they could figure out a way to get more they would. To argue otherwise is to imply that they are not maximizing their total monetary and psychic income and are forebearing to grab all they could. I don't think members of this list should pay The Great Enemy such a compliment. Remember the findings of the Public Choice school. DCF

1 0

Alias list for killfiling Grubor
by Mark O. Aldrich 17 Dec '03

17 Dec '03

For those who haven't explored the rich, sick history of John M. Grubor (aka "aga(a)dhp.com"), he uses a variety of aliases. While the "aga" account seems popular right now, he usually pops over to another when his killfile ratio gets too high. To help save time and effort, the following is offered from the Grubor FAQ that circulates on the Net with some regularity (look in alt.bonehead.john-grubor or alt.general.grubor): Grubor has used, and continues to use, many aliases; usually through free trial AOL, Prodigy or Compuserve accounts; but he has also paid for many accounts on local providers. Some of Grubor's aliases: -manus(a)manus.org (his vanity domain) -anything else at manus.org -drg(a)telerama.lm.com (likely dead) -various pgh.org addresses (apparently another vanity account) -Zeus (an usaor.net account, now dead) -maryjane (a Compuserve address, dead) -DrMacho (drmacho(a)pgh.nauticom.net, dead) -Vwqe99b(a)prodigy.com (formerly using the alias "Amy Martin" now "Stanley Brown"; one of two accounts used for posting the infamous "List of Homosexuals in the Internet"--not dead, but rarely used) -Law Doctor or Doctor of Law used with his drg(a)manus.org and drg(a)pgh.nauticom.net (dead) accounts -two other AOL accounts--lawsystems@ and jgrubor@--are dead. -aga(a)dhp.com (still active, but rarely used) -zando(a)ix.netcom.com (a former favorite, likely dead. He used many different aliases with this one claiming alternately that this account belongs to his mother and his wife. All indications are that he is the only one who used it.) He has also used CyberLawMaster, Lord Grubor, Lord Grub, and others with his manus.org and ix.netcom.com addresses. He morphs his aliases frequently in an admitted attempt to foil killfiles. Possible aliases/morph accounts are: -nancybett(a)aol.com (dead) All other accounts are generally verified as belonging to Grubor or not rather quickly. <end FAQ extract> He is now also using "drgrubor(a)aol.com". Because AOL will toss him fairly quickly if he's too abusive (and he's already posting under that ID using "cunt" and "cock" references), he'll probably not morph over there with the idiocy he's been posting here. If he does post from that account, I'd suggest a mass mailing to AOL the moment it happens. He's got a KOTM award, but the small blurbs they publish don't do justice to this small and pathetic little man. He posts CONSTANTLY to the Usenet, so checking things like DejaNews will help identify if it's really him (his volume of posts seems to _never_ be what you'd call "lite"). His DHP (DataHaven Project) domain is run by two hackers, Wipeout and Panzer Boy. Can't say anything based on fact, but I'd say that from their Web pages that they aren't likely to really care what he says and aren't going to respond to complaints sent to "postmaster(a)dhp.com". If someone with accurate info on who's selling line time to DHP can poney up a responsible party to whom complaints can be sent, that might help. Now, if we could just get this Grubor weenie hooked up with Helena Kobrin, maybe they could cause some impossible "stupidity polarization" and set off an implosion that will drive both of them straight to hell and forever off the face of the Earth. Where's Jim Bell when you need him? ------------------------------------------------------------------------- |It's a small world and it smells bad | Mark Aldrich | |I'd buy another if I had | GRCI INFOSEC Engineering | |Back | maldrich(a)grci.com | |What I paid | MAldrich(a)dockmaster.ncsc.mil| |For another mother****er in a motorcade |Quote from "Sisters of Mercy"| |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

3 2

Re: The public sees no need for crypto at this time
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:25 AM 11/21/96 -0800, Timothy C. May wrote: >I believe that at this time the differential market value to customers of >having strong crypto in telephones is near-zero, and in cell-phones is only >slightly greater. [reasoning deleted]. I generally agree with Tim about consumers. However, I remember working on a theater production where we were using Radio Shack 2-way headphones for communication. One day while we were setting up, we were able to overhear a woman discussing (presumably with a girlfriend) her boyfriend and their sex life over a portable telephone. You can bet that every available headset was in use and all other work stopped. Where I think there is a market and an awareness of a need is in the corporate world. I recently saw a corporate security policy which specifically restricted discussing classified information on portable or cell phones. If I were in France (to pick on just one guilty country), I would not want to discuss secrets involving competitive position vs. a French company on a landline connection. The big driving force for companies is how much the facility costs. (I recently heard a price of $700 for non-crypto phones.) If the cost is low enough, company employees will have these boxes in their homes. The other big obstacle is standards. As far as I can tell, every crypto phone has its own protocol. If there were a standard set of protocols, it would greatly help the market, as it has for so many other products. As a first step, I suggest that Eric Blossom and PGP Inc. work together to develop a mode where their products can communicate with each other. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

2 1

Re: Stewart Baker on new crypto rules
by Hal Finney 17 Dec '03

17 Dec '03

From: "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> > http://www.steptoe.com/oped.htm > > argues that industry won't accept any system that threatens to cut off > backwards compatibility after 2 years, hence DES export liberalization > will have to extend beyond the proposed period. I take a slightly different moral. Baker (former NSA attorney) writes: > If buying key-recovery encryption means customers must give up all > of their legacy encryption systems, key recovery products will carry a > near-fatal burden in many markets where encryption is now used widely. The > transition to key recovery will have to be gradual or it won't happen > at all. What I see this as is a call to come up with architectures that will allow transparent phase-in of government key access (so-called "key recovery") technology. The current HP proposal fits in very well with this model. The appear to be planning on using standard API's so that applications will be able to switch to using key escrow software without changing the applications themselves, just the OS. Maybe there could be a transition period where both the old and new crypto would both be accepted, then after a period of time the old wouldn't work any more. As Baker goes on to say: > Three years ago, no one in the PC world would have bought an operating > system that didn't run MS-DOS. Three years from now, we'll be happy to buy > an operating system that is backward-compatible with Windows 95 but not > with MS-DOS. And then, at last, we'll throw out all our old DOS programs. This suggests to me that we need to be vigilant in watching for systems that will allow for easy "drop in" of key escrow. Hal

10 15

Re: Anon
by Hal Finney 17 Dec '03

17 Dec '03

As I mentioned a couple of days ago, science fiction writer David Brin has an argument against not only anonymity, but _privacy_ as well. Where cypherpunks tend to think of privacy as both beneficial and inevitable, Brin sees it as harmful and doomed. He has an article in the December 1996 issue of Wired discussing his ideas. BTW cypherpunk Doug Barnes is also quoted several times in the long article in that issue by Neal Stephenson (Snow Crash, The Diamond Age) about the undersea cables that carry most transnational information traffic. Hal

6 8

First Contact
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, Is there anything in First Contact to do with Crypto at all? Just that it opened out here today, and I'm going to see it. Yours Sincerely, Benjamin Grosman ------------------------------------------------------------- bgrosman(a)healey.com.au -- http://www.healey.com.au/~bgrosman/ PGP Encrypted Mail Preferred -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzKNX9oAAAEEAOIx4HkRU4vckgguzERhVCxgy5psmngHUoW10Xl8kBkjnuc/ ACysH1K98UXlGfet9zjn/XN4RMnGq64EHXvJu56H7OHhwhoerTpVIW5MUYt+QExk KKnRNrdq8WVGoaMywSM4qKbaJr8aNMBWkldUKR4NElvAjIEEO9z0msNPp33RAAUR tClCZW5qYW1pbiBHcm9zbWFuIDxiZ3Jvc21hbkBoZWFsZXkuY29tLmF1PokAlQMF EDKNX9vc9JrDT6d90QEBxVYEAL5nw1NiyaPpG8R2x7lNcqOcavj/cCmDYT8swT02 Z0AO0C7PGpgp9V38Yyki0FB3yaiJhIQ3Kw6xCtuI8f1F4Vfql/nZebzQERl8kTa4 sI/4xSKRT/Riw/wSGupagU1F1wYIPlXOCdUilIfLzVf4IOsxKjJMdm7aKladSxkV N7Yg =Yapx -----END PGP PUBLIC KEY BLOCK-----

3 2

Counterproductive Dorothy Denning Flames
by mpd＠netcom.com 17 Dec '03

17 Dec '03

William H. Geiger III writes: > Dorthy Denning is a boot-licking fasicist!!! > William Reinsch is a lying bastard. Fucking politions!! > Fucking goverment!! They all deserve a long rope!! It is perhaps a point in Dr. Denning's favor that her most vitriolic detractors can spell neither "Dorothy" nor "fascist". I must admit that I am at a loss to understand the heat which Dorothy Denning generates on the Cypherpunks list, which seems to be second only to the heat generated by posting recipes for roast feline in rec.pets.cats. All of the people I know who have met her find her to be a pleasant person, and the occasional Email messages we have exchanged have certainly been positive and friendly. While she tends to view the Four Horsemen of the Infocolypse as a bit more threatening than the typical Cypherpunk, I don't think her views are so extreme as to justify the continuous screams of "crypto toady", "government suckup", and "wicked witch" which seem to pop up in response to her every utterance. I would even go so far as to say that this list would be a lot more entertaining if she were contributing to it, and sci.crypt is certainly a less interesting place now than it was in bygone days when she was posting there. Perhaps Tim can add his own thoughts to this thread. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 10

Re: market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

At 06:08 AM 11/26/96 -0800, Paul Pomes wrote: >There are some commercial products worth studying. See ><http://rainbow.rmi.net/~comscire/> for one. Thanks for the reference. However, I was very unimpressed with their price of $295 dollars. I don't doubt that there are certain organizations (banks?) which would have no problem affording them, but that's well out of the range of ordinary consumer items. I just bought a 10x CDROM drive for $100; somehow I think that a hardware RNG should cost less than that. Volume is a big issue, I suppose. Jim Bell jimbell(a)pacifier.com

1 0