December 2003 - cypherpunks-legacy

FBI Technical Assistance Draft
by John Young 17 Dec '03

17 Dec '03

Thanks to Willis Ware we offer the full text of the FBI's August 28 "technical assistance draft" for encryption legislation, a few paragraphs of which Declan posted here: http://jya.com/fbi-tad-s909.htm (57K) Although prepared to revise McCain/Kerrey's S 909 to satisfy law enforcement, it's the source for the various amendments to SAFE which copied much of it unchanged, and some portions not yet lifted may foretell what's coming.

1 0

Re: Remailer latencies
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David E. Smith wrote: >> Incidentally, if somebody offered you colocation space, would you be >> willing to set up your machine there? > >I wouldn't, and I hope not many other remailer operators would >either. A lot of the security on my machine comes from having >physical control over it. Good point. Also, using a dialup gives you another layer of physical privacy. You could even move the machine around from time to time. This could even foil the Big Boys if they don't want to reveal how well they can track things. (Corollary: Even if PGP is NSA breakable, you can still use it for drug dealing and bribery.) >(That includes the ability to rapidly delete things with extreme >prejudice should the spooks come knocking at the door.) If I'm not >sleeping in the room next to my machine, I don't have that kind of >control. What is on your machine that has to be deleted? I suppose you'd want to power cycle it since the private key (or a passphrase) will be sitting in memory. Is there anything on the disk that must be deleted? More operations questions: according to Raph's chart, your machine has an "uptime" of 99.64%. I assume that means Raph's experiments showed that 36 messages out of 1000 disappeared. Did I assume correctly? If so, what accounts for these message losses? I would expect that if your machine was down, even for a couple of days, that the incoming messages would be queued up on other machines and none would be lost. BTW, my intention is not be critical of your volunteer work running a remailer, but to develop an understanding of the issues involved. Even a response like "the machine was down for three days because I was in Las Vegas partying" is useful because it would suggest that remailer operators are not adequately compensated for their work. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCyf1JaWtjSmRH/5AQG1lAf9HS5Hu9HX32Uij93MEaWzG4BOqgj9/mok W+Ngjnz2yDKW3g7MoN+Ypvy05EGPNtwZjhigRkUzSIHfT7gYGlbclcf1p2aZk4L5 MT1wP1zdT0cdUoIjTwSa/VXgHuuPLTo68LhnbdCTVgLjbqMaC7DxvrGam7C7CXcT POxjh7bpwrz8LJ0YmALuhqITv+QxPqv0jeCigsYqtv9wEcPdIp9Y+If4+u5+aln4 FejVogjqSGl8E8bICc5GMNFifXKcpGkGNb992P4IUHjyZmmgQRqMhuS6yWjHM2cM uWj0fbH+/Yab+svKsULz0aqbG670A5VzriP+800JAJd8XtZd7T5y9w== =gqzn -----END PGP SIGNATURE-----

2 1

Re: Remailer Attack
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert A. Costner wrote: >>Also, by my reading of the "uptime" statistic in Raph's remailer >>chart, a reply block is not going to be very reliable for receiving >>mail. > >The Redneck remailer, for instance, has a 99+% uptime rate. The >reason for this being high is that it is run under a business model. >The connectivity basically cannot go down. There has only been 23 >minutes of connectivity downtime in the last year. Redneck is run on >a business quality network with multiple backbone feeds. But things >break down after that. Redneck also runs on an underpowered 486 with >no "hotfix" backup machine. It is not considered to be a mission >critical piece of equipment. I might notice Redneck have a problem >at 1:00 am, but it can wait until in the morning to get fixed. >Situations like this, combined with software upgrades account for >downtime. Thank you for this detailed description. One more question: When redneck is down, do other remailers discard their mail if they cannot connect to it? If this is the case, it would seem to be a serious design flaw, probably prompted by the desire to save disk space. A quarter per message would probably cover the cost. Another general comment on remailer statistics: 99+% uptime sounds good, but really it isn't. For some reason, we are accustomed to the idea that remailers should lose messages. Well, they shouldn't. A remailer is just electronic mail with a few extra features and electronic mail is exceptionally reliable. According to Raph, redneck has an uptime of 99.83%. By my understanding, this means for every 1000 messages handled, redneck loses 17. That's actually pretty high, especially if it's your message that gets lost. I do not mean to pick on redneck in particular, or, really, any of the remailers. But where the remailer network stands right now, it cannot be used for everyday mail which cuts down its usage quite a bit and makes it a lot harder to build nifty things on top of it like reply block systems. >This is similar to the AOL effect. It is often hard to have respect >for an unknown poster from AOL. The remailer at EFGA is new. I've >come to realize that this natural hostility towards a remailer is a >good reason to put the remailer on a separate domain. We might do >this. Ideally the domain would be shared by other non-anonymous users, but hostility would probably be reduced even if the domain were something like "guest.efga.org", even if many people knew that really meant "anonymous". Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNC2EIJaWtjSmRH/5AQESzQf+NzGRBRjoYL7mQl9q50VsphcnkgQiq1wR XW+UKjrCokfW/Bwt6vMKKJco9cquZiuOkISoCX9+JZlhJkm2l5YxswUcrxaaVNpr T4w1aVQGzcNSDVq3oUwfFiG29S4DQaKV6HD+hz9ffS8fCMtyoA4wkFgLLALqxJpE MsHPQoI2vZtAU7Ht8HgFg2dQsJqoYDAWp8Un9CFnWNYECQ2yPZNVvbiQ7jlmplP6 IrOBQ9E5dk+gaAq4yPfoWD0GTAjBIIaaLMbh+rg+0oUe9LaK0Vl/kIbHx9DvuRN+ 0IbxUy5kwGDhBhWLznDo0B19Xl5QQdj65qBp3TmZqqtQC2MCpeynFA== =2Oiw -----END PGP SIGNATURE-----

2 1

Peter Landrock's CRYPTO 97 rump session
by Chris Hall 17 Dec '03

17 Dec '03

I know that many of you attended this years CRYPTO and probably went to the rump session too. Does anyone remember the details of Peter Landrock's presentation? If I recall correctly, he presented an amusing talk in which an attacker tried to blackmail a bank by claiming knowledge of the bank's RSA private exponent. He did this by revealing successive bytes of the exponent starting with the most significant. The ransom doubled with each successive byte revealed (and I believe he got up to 52 in his example). The catch was that any person can do this for the first X number of bytes of the exponent *without actually knowing d* (where X varies depending at least upon n). What I would like to know is what the details of the attack were: 1) Am I out of my mind and there was no such attack? 2) Given an RSA modulus n and public exponent e, can someone determine the X most significant bytes of e (presumably X is less than half of the byte length of e)? 3) If so, what are the restrictions on e? Are there choices of e which make this attack infeasible? 4) If so, does one get only the most significant bits of d that are non-zero (i.e. if d=0x0078... then one gets 0xF000 back as the result)? Or does one actually get the "length" of d (i.e. log_2(d) can be derived)? Please post any response to the list (so other people can have the info), but please Cc me too. I am subscribed to a filtered version of the list and may not see the reply. Thanks, Chris Hall

2 1

Remailer Ecash Bounty
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I, Monty Cantsin, will pay fifty dollars to the first operator of a remailer on Raph's list to get a machine up and running which accepts ecash as payment to forward a message. Offer expires October 27, 1997 C.E. Disputes are to be settled by Tim May. If Mr. May declines to participate, Monty Cantsin will decide. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNC10kJaWtjSmRH/5AQEY5Af+PBBY0QU8ixNYgqIpWQkHEDf22lhVleaB JJ81Pe4TCllk3KJ0WU8+B7fVdt3oQEzaZLKobQqP6NJOfXai3dwxc5C4MPQe+YGw N6jQbcKetIwX7EUb2siKOq07W1hxVhYm6liYxeUHEBR8hWjCeUM1JiJ3IC3GALAi bJ0mDhkhEIugYkfBXl2mBm4VjQRPWSt8GxqhWDneyn4maJjmOs1lco1WvGuLC+GA fK1F9PnJIKZITzeAEjTB87H7LFxhy0eRuL+r9y8Fqw288bSkKC6aG//fTLOV7B8d MeIXu2UHa2HuB/L1MWmAVFGyKfoI0xJqeXeWCNmrLRlcp6GdCrQgig== =sNwa -----END PGP SIGNATURE-----

2 2

Re: Stronghold
by Anonymous 17 Dec '03

17 Dec '03

Lucky Green <shamrock(a)cypherpunks.to> writes: > On Thu, 2 Oct 1997, Anonymous wrote: > > > > > C2Net was wrong to censor the cypherpunks list in the guise of moderation. > > It was wrong to send threatening letters to people who claimed its > > products were weak. The whole moderation/censorship experiment was a > > terrible mistake. The actions taken by C2Net were completely unjustified. > > Where do people get these bizarre ideas? C2 didn't censor the list. A guy > who happened to work for C2 dropped some messages from one list. The > messages still went out on the unfiltered list. Had he worked for Mc > Donald's or the the NYC Sanitiation Department, would you blame them for > this as well? Are you serious? The messages dropped were those which made (spurious) claims of weaknesses in C2 products. And later messages were dropped which attempted to discuss the dropping of earlier messages. The effect was that subscribers to the filtered list not only were not exposed to the messages critical of C2, they were prevented from knowing that a controversy existed about the filtering policies. There can be little doubt of the truth of these facts. One of us is remembering things wrongly. And yes, if the moderator were a McDonalds employee and he not only dropped messages which criticized McDonalds, but also filtered out later messages complaining about his actions, then I'd jolly well blame him.

1 0

Re: "Show me an example of terrorists using the Internet or crypto"
by Blanc 17 Dec '03

17 Dec '03

Individuals need ways to defend themselves from the physical aggression of others. One of the reasons why people associate into societies, cities, and governments, is for the advantages of protection which can be achieved by large numbers of people acting in concert against their common enemy. They also insitute police forces and national defense agencies for the same reason: defense against physical aggression. Everyone on the planet has enemies, and anyone can become, or behave essentially as, an enemy - even someone's physically stronger kid brother who decides to hit them with a stone because of talking on the phone too long, even a former lover/husband who decides to kill their girlfriend/wife out of jealousy. Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real animals from the animal kingdom, strike at the most inopportune times, when there are no officially sanctioned police forces around to be of help. But even if there were security guards constantly available at every street corner or planted inside one's house, the principle is the same: people are physially vulnerable and need defense from those who would take advantage of them, who would by weaken them and do physical harm. Guns are imperfect tools and humans are often imperfect fools in the use of them. Se la vie. Nevertheless, until the design of guns is improved, or until there is a better weapon, a better tool invented which can be used by individuals - independently of organized defense agencies - for their own use in regard of their own safety, guns will be manufactured, sold, and bought. And used. Killing people is a Bad Thing, but there exist people who don't prevent themselves from doing harmful, destructive things to others. At that particular point in time, when they are about to commit their crime against another, their potential victims are in the position of having to do something of practical use, and quickly. They could use karate, or ju-jitsu, or ninja stars, or call their dog to attack, or yell for help, or use their special pocket knife, or run, or use a gun. But they must do *something*, they must employ some means to prevent from being harmed, or from having their valuables taken, or else suffer the consequences of debility or death. Such is the position which an "out-of-control" person can put one in. It is possible to reason that such uncontrolled people need to have been raised better, could have received psychological assistance, should have been given an alternative view of life, might have been presented with better values and philosophies, etc. But you have to also consider how much intellectual support any individual must be provided - must they be programmed from birth with the proper structure of behavior, in order to have around oneself the convenience of living with "good people" who are not inimical to the society? (and would that be a society of real humans, of interest to other real humans) Is what a person makes of themselves ultimately a personal project, or is it to be pre-determined and continuously managed by others (parents, teachers, guidance counselors, psychologists, government clerks, policing agencies, government agencies, government leaders). When you relate to a person, will you be relating to someone with their own identity and personal ambitions, who make independent decisions about the actions they take, or only to a product of other people's influence? In any case, when someone behaves counter to your own wishes and seeks do with you what they will, or to take from you what they will, including your life, you must determine whether to allow it or how to prevent it - and if moved to prevent it, what will work to accomplish that. It might be necessary to kill that Bad Person (though not their whole family or relatives or neighborhood or race or country). .. Blanc

1 0

Re: Forwarded mail... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Forwarded mail... (fwd) > Date: Thu, 2 Oct 97 18:52:18 -0400 > From: "Brian B. Riley" <brianbr(a)together.net> > None of these targets shoots back ... none of these targets pump up > much adrenaline. I have been shot at several times, some were hunting accidents and some were intentional. I did not freek out nor did my adrenalin rush impede my ability to think or to react. I did shoot back in each case. I am still alive and don't have a single bullet hole in my body so I must be doing something right. Don't know about them, I left the area in every case ASAP. > can tell you of making several 25-35 yard snap shots in the jungle at > moving shooting targets with the adrenaline driving my eyeballs > through the roof My house at 1am is not comparable to the jungle nor is the psychological situation comparable either. I am not confused about where or what is going on nor am I worried about making my tour. I am faced with the clear situation of somebody who wants to do me bodily harm. That doesn't scare me, it pisses me off to no end. When I get a rush I don't shake and such, I get very calm and methodical. It's only after the crisis has passed that I tend to sit down and shake like hell. > The point is, "shooting to wound" is a dangerous delusion! No shit. Let me make this clear. The ONLY way I would even consider shooting to wound was if the burglar was CLEARLY UNARMED, and the only reason that would happen was because in Texas shooting unarmed persons, even burglars, is illegal other than that you'd be dead. In any other situation my intent is to kill, kill, kill. As I said before, I would start with a center chest body shot and work up (which is natural since the aim point for successive shots will rise). > have always followed is don't take out your gun unless you are going > to use it; don't use it unless you intend to kill. Makes decisions > much easier on that basis. We agree on this point. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: "Show me an example of terrorists using the Internet or (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 02 Oct 1997 18:22:26 -0700 > From: Blanc <blancw(a)cnw.com> > Subject: Re: "Show me an example of terrorists using the Internet or > crypto" > Stalkers, thieves, rapists, drug addicts, perverts, etc., or just real > animals from the animal kingdom, strike at the most inopportune times, when > there are no officially sanctioned police forces around to be of help. I have to object to the inclusion of drug addicts, they do what they do because the legislators and police want to stick their noses in other peoples business. If drug addicts resort to crime then society as a whole must garner some of the responsibility of putting them in that situation. In short the methods we use to control drug use in this country promote crime. This does not apply to others who would do this anyway and happen to take drugs, which means the drug laws are clearly unreasonable. > something of practical use, and quickly. They could use karate, or > ju-jitsu, or ninja stars, or call their dog to attack, or yell for help, or Isn't killing dogs a bad thing? I am shure my dog thinks so. Perhaps their is a lesson to be had in comparative psychology here. It's much easier to ask another entity to die for you because you consider them different and therefore of less value in the grand scheme of things. Human history is full of such instances. This also happens to be the rationale a lot if not all burglars use to justify their actions as well. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: "Show me an example of terrorists using the Internet or crypto" (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 2 Oct 1997 16:47:32 -0400 > From: Anonymous <anon(a)anon.efga.org> > Subject: Re: "Show me an example of terrorists using the Internet or crypto" > The only conclusion that can be drawn is that civilians, even armed > civilians with combat experience, are so overwhelmingly peace loving > that they will bend very far backwards to avoid trouble, even if it > means thousands of hours of work. Can the same be said of career > military or government people? A D E C L A R A T I O N By the REPRESENTATIVES of the U N I T E D S T A T E S O F A M E R I C A, In GENERAL CONGRESS assembled. [deleted material] Prudence, indeed, will dictate that Governments long established should not be changed for light and transient Causes; and accordingly all Experience hath shewn, that Mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the Forms to which they are accustomed. [deleted material] ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0