December 2003 - cypherpunks-legacy

Posting Long Documents
by DON_HENSON＠delphi.com 17 Dec '03

17 Dec '03

In the interest of saving money (for those of us who have to pay for our internet access), please DO NOT post long reference documents, such as the 'ASCII version of ECPA' directly to the list. A much better way to get this information out would be to post an anonymous FTP site where the document can be obtained. Would appreciate muchly. Don Henson PGP key avail on server or on request

1 0

Macintosh System 7 Pro, e-mail, encryption
by msattler＠netcom.com 17 Dec '03

17 Dec '03

I installed Macintosh System 7 Pro (7.1.1) onto my PowerBook today. I'd heard that e-mail was part of the new package, but I was amazed to see how integral it is. When you start up for the first time you are asked for a userid and a password to protect your "PowerTalk Keychain". A mailbox and a "catalog" appear on your desktop; the latter is a list of entries in different domains (like AppleTalk, EtherTalk, etc.) so that you can authenticate yourself on all the places you exist with one login. E-mail comes free with the system and works automagically when multiple users install the new system. I haven't used a lot of this system since it's so new, but I sent this message because it heralds a new era of turnkey mail/network-identity. I'm investigating how this works with AppleEvents to see how PGP can be seamlessly integrated. A friend of mine went to the product launch at Apple and got a free "signed" RSA user identification voucher. I'd be very interested in hearing from others who have a clue about this stuff. ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 358-3058 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) Evil will certainly triumph if good people do nothing at all.

1 0

Re: Standard Headers for Anonymous Remailers
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

> From: Karl Lui Barrus <klbarrus(a)owlnet.rice.edu> > > The attitude expressed by the individual on io.com shows a problem we > will have in educating others - "anonymous posts CAN destroy a civil > conversation". Yes, maybe so, but in my experience on mailing lists, > bbses, etc. I've noticed that "flame wars" and "anonymous posts" have > NO correlation, and are quite independent of one another. > > Since I've seen "flame wars" on systems with absolutely no anonymous > posting facilities (or none that were used), I conclude that civil > conversation is destroyed by strongly held differences in opinions (or > some other factor I can't pin down). I'll second that. The main menaces against "civil conversations" have been, on Netnews, flame wars and wars between two individuals. After the first few messages, the flamers and the opponents are clearly identified. They are usually proudly posting under their usual Name (as they are all fighting for their Reputation, and for establishing their opponent's Incompetence) (... do we recognize anybody yet :-? ) I actually can't remember such a war involving an anonymous poster (as in "using penet or similar"). What destroys discussions (and forces people to leave them...) is the tendency of threads to start genuine, and to end as flame wars. Certainly, for-money systems would tend to shorten flame wars.. On the other hand in the few discussions against anonymous posting, some people were arguing for "accountability" who were clearly forgetting the proportion of people who use handles or pseudonyms as their default setup. These are not anonymous per se, but in the current fickle netnews, what's the difference? (BlackNet would make a difference :-) Only in the most outrageous fraud cases (votes, forgery...) are pseudonyms tracked back to their account holder. Solution (1/2 kidding): Build an anonymous remailer that gives a choice of "obviously anonymous output", or "random pseudonym output". You could even take the pseudonym from the phone book, or from the names of the people who used the newsgroup in the past :-) Pierre. pierre(a)shell.portal.com

1 0

Digital Cash Primer
by DON_HENSON＠delphi.com 17 Dec '03

17 Dec '03

Shari Steele writes: -> Hey 'punks. Anyone know of an elementary primer on digital cash? I'm trying to get up to speed on this. <-- I would like an elementary primer also. How about posting the info to the list vice just to Shari. Thanks, Don Henson PGP key avail on server or on request

2 1

brin on privacy
by peter honeyman 17 Dec '03

17 Dec '03

david brin spoke in ann arbor recently at a library science school alumni meeting. his talk was titled "Information and the 21st Century: Privacy, Wealth and the Newest Threat to Freedom." here are my recollections; hopefully they're not too dim or biased. getting right to the punch line, tNTtF is this: privacy laws will be used as a weapon by the Rich and Powerful to restrict the free flow of information. brin feels that privacy laws will be ineffective against the RaP, will be sold to the rest of us through effective propaganda, and that they will be used by the RaP as a means to cement their power base. he argues that complete and open access to information provides the greatest social benefit and best serves The American Dream. asked about clipper, he suggested that key escrow was exactly the sort of tool that the RaP would use, and that we would all benefit by banning cryptography. asked whether private citizens should be barred from insuring personal electronic privacy, he replied that he felt that such measures would be ineffective agianst the RaP. (i concluded from these answers that cryptography is not brin's strong point.) brin's message was basically a populist one. he is concerned that the moguls of data will have the opportunity to control what we see and hear. what i found most fascinating about his talk was that while i generally agree with the social objectives he backs, i am in 180 degree disagreement on how to accomplish these ends. peter ps: anybody else get the willies (as it were) reading paul goggin's note about foia, where the asst atty genl was asked about fbi foias against individuals, and replied that the new foia regs presumed disclosure? hey brin, there oughtta be a law!

1 0

What happened to FEE
by Larry Gadallah 17 Dec '03

17 Dec '03

I wonder what happened to the fast elliptical encryption (FEE) encryption software that NeXT was working on about two years ago? I heard that the US authorities took a very dim view of it and I assume that this was because it was either very fast or very strong or both. Pardon my ignorance if this is an old thread, but I haven't seen it mentioned anywhere for quite some time and certainly not in the last month since I was on the cypherpunks mailing list. Thanks, --- --------------------------------------------------------------------- Larry Gadallah Amateur Radio VE4TCP Lac Du Bonnet, Manitoba, Canada IP: [44.135.114.9] SMTP: larry(a)owrlakh.wl.aecl.ca AX25: VE4TCP(a)VE4PIN.#PIN.MB.CAN.NA ---------------------------------------------------------------------

1 0

A new twist on the electronic horizon...
by fergp＠sytex.com 17 Dec '03

17 Dec '03

excerpted from: RISKS-FORUM Digest Tuesday 5 October 1993 Volume 15 : Issue 06 - -- Date: Fri, 1 Oct 1993 11:43:00 -0600 From: tmplee(a)tis.com (Theodore M.P. Lee) Subject: RISKs of trusting e-mail Until such time as either the general population learns what to expect or digital authentication (such as PEM) becomes widespread, I suspect we will hear more of this kind of incident. This academic year the University of Wisconsin started providing e-mail accounts to all students at its Madison campus. (6,000?, maybe) The students, both technical and non-technical, are being encouraged to use e-mail as a way of interacting with their instructors. They access the accounts either through University-supplied machines scattered throughout the campus or through dial-up Serial Link Protocol (SLIP) connections. A mix of Macintosh's, PC's and other assorted workstations are involved. Last week (note how early in the school year) a group of five students, several from the Honors floor of one of the freshman dorms, were caught having forged several pieces of e-mail. Most potentially damaging was a note saying it was from the Director of Housing, to the Chancellor of the University, David Ward; note that the previous Chancellor is now Pres. Clinton's Secretary of HHS, so the present Chancellor is new to the job. The forged message was a submission of resignation. Ward's secretary had just returned from vacation and apparently assumed the proferred resignation was legitimate. The secretary accepted it and started to act upon it -- it was only during the course of that that it was discovered to be a fake. The students also sent messages purporting to be from the Chancellor to other students asking them to pay their tuition. They also forged a message from the Chancellor (my information doesn't say who it went to) saying he was going to "come out of the closet" and announce it Sept. 25. The students were only caught through a combination of circumstances. First, since they used one of the dial-in connections there were logs of who dialed in when. Secondly, during the course of their experiments they botched some addresses which caused enough traffic to go to the dead-letter office that the investigation could narrow what was happening. (It should be pointed out that the forgery was fairly easy to accomplish using the Eudora mail client on a Macintosh: the user has complete choice over the "from:" field of a message.) The FBI is investigating whether any federal crime was involved and, needless-to-say, the students are likely to be expelled at the least. Ted Lee, Trusted Information Systems, Inc., PO Box 1718, Minnetonka, MN 55345 612-934-5424 tmplee(a)tis.com Paul Ferguson | privacy \'pri-va-see\ n, pl, -cies; Mindbank Consulting Group | 1: the quality or state of being apart Fairfax, Virginia USA | from others 2: secrecy fergp(a)sytex.com | ferguson(a)icp.net | Privacy -- Use it or lose it.

1 0

Re: RSA examples required
by Derek Atkins 17 Dec '03

17 Dec '03

Here is the response I sent to Peter Simons: Well, your example that you sent isn't even correct! Your example said: p = 5 q = 7 xy = 4*6+1 = 25 x=5 y=5 Well, you just chose some bad primes. Here is a better example: p = 5 q = 11 N = pq = 55 m = (p-1)(q-1) = 4*10 = 40 Now, we need to choose our public and private decryptors, E and d, such that Ed = 1 mod (m): E = 3 d = 27 So, the Public Key (N, E) is (55, 3) and the Private (Secret) Key (p, q, m, d) is (5, 11, 40, 27). Now, to encrypt a message, S, you take C = S^E mod N, and to decrypt you get S = C^d mod N. So, say the message you want to send is, oh, "8" (for lack of a better example off the top of my head). So, you try to encrypt this message, and you get: C = 8^3 mod 55 = 512 mod 55 = 17 You then send this message to the recipient, who then calculates the message back: S = 17^27 mod 55 = 1667711322168688287513535727415473 mod 55 = 8 And you get the original message back. -derek

1 0

Re: Start up costs and paying for speech...
by peter honeyman 17 Dec '03

17 Dec '03

> I wouldn't worry about either. I don't see how enforcement of > copyright will be possible under crypto-anarchy any more than > taxation will be. If one person pays for a posting, what's to keep > him from sharing it anonymously with whomever he wants? Is there any > way that crypto-anarcy won't bring the death of "intellectual > property"? well, i wouldn't equate reading with spending (if i may simplify). i think the thing that mystifies me about off-line digicash is the cryptographic protocol that constitutes spending. other people are asking about it, too. it seems to be on everyone's mind. so here, for the very first time on cpunx ;-) well maybe not but who's counting is the protocol from chaum's crypto '88 paper "untraceable electronic cash": to pay bob one dollar, alice and bob proceed as follows: 1. alice sends C to bob 2. bob chooses a random binary string z sub 1, z sub 2, ... , z sub {k over 2} 3. alice responds as follows forall 1 <= i <= {k over 2} a. if s sub i = 1, then alice sends bob a sub i, c sub i, and y sub i. b. if z sub i = 0, then alice sends bob x sub i, d sub i, and a sub i xor ( u || (v + i)). 4. bob verifies that C is of the proper form and that alice's responses fit C. 5. bob later sends C and alice's responses to the bank, which verifies their correctness and credits his account. not very illuminating so far ... let's go on. the bank must store C, the binary string z sub 1, z sub 2, ... , z sub k and the values a sub i (for z sub i = 1) and a sub i xor (u || v) (for z sub i = 0). gee, what is that "||" operator, anyway? ah, concatenation. ok. going on ... if alice uses the same coin C twice, then she has a high probablility of being traced: with high probability, two different shopkeeprs will send complementary binary values for at least one bit z sub i for which B sub i was of the proper form. the bank can easily search its records to ensure that C has not been used before. If alice uses C twice, then, with high probability, the bank has both a sub i and a sub i xor (u || (v +i)) with high probability. thus the bank can isolate u and trace the payment to alice's account. hmmm. hmmm. well, this is very complicated. with high probability, i mean. i'm going to have to study this paper. peter ps: what are the B sub i you ask? don't ask. oh golly, they are blinded candidates, formed by alice and sent to the bank. hmmm. hmmmmmm sup k mod 1/p.

1 0

Re: need deadbeat pubkey
by strick -- henry strickland 17 Dec '03

17 Dec '03

# # Here is my public key. Would you sign it? # # DEADBEAT <na5877(a)anon.penet.fi> # heh heh ... i won't, but my friend will. it doesn't take much of this to polute the pgpspace, does it? -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 mQBNAivfNEsAAAECALxgaciRLaLJDPE1VxeOggXf600OrQksi3pN6DGaYFOIS0TU yFmklmcG2dwTQnwxL3cSYoTrYj1sCrcgyAwlQ2UABRGwAQC0KHN0cmlja3BlcnNv biAjMSA8c3RyaWNrQG9zYy52ZXJzYW50LmNvbT6wAQCJAJUCBRAr+HB7P4P8NX9Y 9rMBAd79BADUf4llIbsBvZ8on9AFNn6prbYmQxH/vRi7IIhIF/g3QInpJZBhw8jF ZPBfn1KdimGUj8J0q5cP3oHA/SUYfzY4b/W0uoqQ+YReXW2y8bBpodFY2aq2mndP 3NXt4BbZbBmlaFyVXyHmGKbaS0nDhhX9e/UUWm4cPWVh61JXoHth8bABAIkARAIF ECv4a8fSnR8fnm9wlQEB0fcBd0a+FOwGASUhJD7943gOGaPpFsbzplZHEy5648jl x6liXrdHT8pjGV/j4O6UzGrlsAFAiQBVAgUQK/h5bkozmKNUUeyZAQEoYQH6A93U C1SdZKEMxzUNwcrbW5eMaeI6vcRRuE7oSQ/ESIOMltPb4/qnFHd8T16muM6xCDb4 nBPEBxhkzDClLu1hU7ABAIkAVQIFECvfZWgKtyDIDCVDZQEBUkECAJHjGr9vRG6H /cURrvJk65/GyRQ8tRZ+mXsByBIGZvlBO7Joee9yXh6Uz0JHeohq30MoJr2wPn/9 gukJ83NF426wAUCZAD0CK0u0jAAAAQGAuiPN8WeiSbPqMic9gc2eRG1EWK4c2hVZ tfKDtO3ubfAR5cIvUmDoj/FZTpBW/B35AAURsAEAtB9ERUFEQkVBVCA8bmE1ODc3 QGFub24ucGVuZXQuZmk+sAEAiQBEAgUQLLOx3NKdHx+eb3CVAQG7PgF2NoQ/MUc7 SmZz8hz3dn71zOurlOik1XtBR1gsh/EkKKiPhXg7RYXTAglGhgZIabqwAUC0H2Rl YWRiZWF0IDxhbjU4NzdAYW5vbi5wZW5ldC5maT6wAQCZAD4CK99mfAAAAQF3Y8xT 4Ml6MtaBmKqcpl78nO8mNdb3/tNgQqtyiXcNoL6c1jOIlPUw0p0fH55vcJUAEQEA AbABALQSYm9ndXMgYmlsbCBibG93am9isAEAiQBVAgUQK/h2awq3IMgMJUNlAQEH eQH/R12f2Q8xU/SiUSWrTLGcbKWt8RxQhFPEppPUcClrjWFrfcYVXaOBUEiADBWx zHIomhejqkEMlnTuJomVJvUV6bABQIkARAIFECv4dj/SnR8fnm9wlQEBfiUBdRmv 5eSfhbyqVNGXDgw7qM7xeg/sQZ9bBFKwdOQdEBiUo5HkFZPUGggwd2UF7mWSsAFA =smHT -----END PGP PUBLIC KEY BLOCK-----

1 0