December 2003 - cypherpunks-legacy

Re: Nuclear Weapons Material
by David K. Merriman 17 Dec '03

17 Dec '03

> >Occasionally coverage in the press does reflect events in the real >world. >-- >Jim Dixon > Christ, don't let the press find out they screwed up like that - otherwise, we'll *never* hear another bit of Real News (tm) again! Dave "I wish I wasn't joking so much" Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

A couple comments: (1) They are not offering any form of encryption -- seem to feel that the intervening Internet mail spools are secure from would-be blackmailers. (2) Are suicide hotline communications, like psychiatric counseling, privileged communications? In what jurisdictions? ------------------------------ Subject: Support for the Suicidal - Full Launch - jo(a)samaritans.org Press Release August 17, 1994 The Samaritans are a non-religious charity offering emotional support to the suicidal and despairing. A test of "Help By E-mail" launched on July 14, 1994 proved so successful that an Internet domain is now open and is reached by mailing jo(a)samaritans.org. The E-mail service is run from Cheltenham, England, and is reached from anywhere with Internet access. At the launch, Mike Haines, the Director said: "During the test month we received over 200 messages. Many were from well wishers, journalists and academics but there were around 15 very desperate people as well. The need for a full launch of our service with an easier address was amply demonstrated." The Samaritans have been offering support to the suicidal and despairing for over 40 years by phone, visit and letter. Callers are guaranteed absolute confidentiality and retain the right to make their own decisions including the decision to end their life. Samaritans are carefully selected and prepared for this work (for which they are not paid). Those working with E-mail have additional training. Volunteers read and reply to mail every day of the year. A nominal end date of December 31, 1994 has been set but initial results have been so encouraging that it is likely to run indefinitely. The idea of an Internet service was born when a volunteer was exploring the UK based CIX conferencing service. Here, he discovered the "suicidehelp" self help group and Newsnet groups such as "alt.support.depression". After discussions with The Samaritans General Office it was decided to try offering a service from Cheltenham. The kind donation of a modem by US Robotics was a great help as was the assistance of staff at Compulink Information Exchange (CIX). The Samaritans of Cheltenham and District 3 Clarence Road CHELTENHAM Glos England Emergency phone: +44 242 515777 Press enquiries: +44 452 854017 E-mail: jo(a)samaritans.org (samaritans(a)cix.compulink.co.uk retained) Anonymous E-mail: samaritans(a)anon.penet.fi (Extremely Slow!) <end>

1 0

Re: Voluntary Governments?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > Here, someone will surely object that by this definition, the Mafia can > > be considered a government. > > Well, yes, of course. It has quasi-governmental functions in southern > Italy. ... and in Central New Jersey and parts of upstate New York as well :-)

1 0

Re: Nuclear Weapons Material
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Jim Dixon <jdd(a)aiki.demon.co.uk> writes: > I was told by what I considered to be reliable sources that > plutonium was extremely toxic. Upon reflection, I am sure > that this is the word that was used: toxic, not radioactive. Plutonium-239 emits alpha particles, which are helium nuclei, at an energy of approximately 5 MeV. Such particles are bulky and can be stopped by a few centimeters of air, or a thin piece of paper or metal foil. In order to cause damage, alpha emitters like plutonium must come in intimate contact with a material, such as the tissues of your lungs or bones or the inside of your favorite memory chip. A billionth of a gram of plutonium inhaled or swallowed is something to seriously worry about, but you can hold a lump of the stuff in your hand as long as it is covered with a leakproof cladding or vitrified into a ceramic. It is in this sense that plutonium is extremely toxic and hazardous to the environment, while at the same time not being particularly radioactive. Heavy shielding is not required between you and it. Of course once fissionable fuels are irradiated, they become extremely radioactive due to a wide spectrum of short-lived fission byproducts and then require precautions when they are handled. > By "clad", do you mean coated in lead? No - the desired properties of cladding are resistance to corrosion and heat, as well as a low absorption cross section for thermal neutrons. We're talking about materials like zirconium and iridium here, as well as specialized alloys of stainless steel. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

$10M breaks MD5 in 24 days
by Hal 17 Dec '03

17 Dec '03

I am not attending the Crypto conference, but I sat in on the evening "rump session" the other day. One of the more interesting papers had a claim (with little detail, unfortunately) that for ten million dollars you could build a machine that would "break" MD5, in the sense of finding another message which would hash to the same as a chosen one, in 24 days. This result did not depend on any internal structure in MD5, but was purely a result of the hash size (128 bits) and the time it takes to calculate a hash. The main new result which allowed this was a more efficient way of handling a parallel search for collisions (two messages which hash to the same thing). In some earlier methods, n machines provide only a sqrt(n) speedup. The new method improves this, although my notes don't show exactly how close they come to an n-fold speedup. The Secure Hash Standard (SHS, aka SHA) is, they said, 64K times slower, hence this technique would take 64K times longer (or cost ~64K times more?) to break that hash. I don't think this is probably anything to really worry about, but maybe it points out a need for a longer hash in the next few years. Hal P.S. The paper was by Paul C. van Oorschot & Michael J. Wiener.

5 6

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Kudos to Hal Finney for his descriptions of Stefan Brand's offline cash. As with other offline cash protocols it contains the following assumption: > Let's call the user Irving, and > the number which encodes his identity (it might just be his bank account > number in this case) we will call I. What happens when we've caught Irving double spending (or million spending?) Is it guaranteed that Irving will have enough in his bank account to cover the fraud? I don't see any way to guarantee that except for absurdly large security deposits. Also, are bank accounts required to be in True Names so that multi spenders can be caught and punished? If so, how do we prevent the use of numbered accounts, Duncan Frissel's nom de guerre accounts, etc. and do we really want to set up that kind of True Name infrastructure? Also, what about stolen coins? If Irving can succeed in stealing a coin from Jane without her knowledge, Irving can spend it untraceably as many times as he can get away with (perhaps thousands or even millions, depending on what security precautions we layer above the offline cash), and Jane gets fingered. On the other hand, Jane might simply give Irving some coins, plausibly claim they were stolen, and split the proceeds from Irving's spending spree. In general, multi spending might occur because of accident, malice, or a combination of those two factors. How do we distinguish between accident and malice to determine liability, reputation loss and/or punishment?

1 0

U & Pu is good for U
by Brad Dolan 17 Dec '03

17 Dec '03

>From: IN%"jdd(a)aiki.demon.co.uk" >To: IN%"psmarie(a)cbis.com" >CC: IN%"cypherpunks(a)toad.com" >Subj: RE: U & Pu "poisoning of the environment" > >In message <9408251512.AA11369(a)focis.sda.cbis.COM> "Paul J. Ste. Marie" writes: >> > > Epidemiologic studies of workers [even wartime workers with impressive >> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> > > body burdens/ exposures] in a number of uranium bomb-making centers have >> ^^^^^^^^^^^^^^^^^^^^^^^^ >> > > found ~ no health effects. >> > >> > This is quite similar to saying that nerve gas is harmless because >> > scarcely anyone working in storage areas has been killed by it. Or >> > that bullets won't harm you because people handle crates of them and >> > they don't get shot. >> > >> No, it is not. If you had read the message more carefully, you would >> have had to phrase your example as, "This is quite similar to saying >> that nerve gas is harmless because scarcely anyone who has inhaled >> substantial amounts of it has been killed by it." > >In all of these cases there is a serious attempt to make sure that the >workers are not harmed by the dangerous substances involved. I must >say that the phrase "impressive body burdens" is fairly incomprehensible. I grant you that "impressive" is not too specific but "body burden" is a common way of referring to the material which is taken into the body and retained. Typically, most material inhaled or ingested is quickly exhaled or excreted out of the body. Some exposure (and dose) accrues during this time. If some material remains deposited in the body, exposure continues. >But nevertheless, my point stands: workers are carefully protected from >the plutonium and U235 in nuclear weapons plants. By the standards of the time, workers during WWII were pretty well protected. By our standards, which may be overly conservative, some WWII-era workers received large doses and/or body burdens. Because these workers (1) had exposures and (2) were monitored, they are the group of choice for epidemiological studies. > When their radiation >badges show what is considered a high level dose, this does not mean >that they have been exposed to anything like, say, the radiation from >a kilo of unshielded plutonium. I would be happy to hold a kilo of unshielded plutonium in my hand. I would probably think it wise to wash it later. Pu is an alpha emitter. Its radiation will not penetrate the dead layer of the skin. I have held pieces of uranium in my hand. I'm still here. >If radioactive substances are used as weapons, the intention will be >to do the maximum possible damage. I don't think that anyone would >survive for long after exposure to, say, a suspension of plutonium >in air designed to be breathed in, perhaps as an aerosol. I would bet that you could get a lot more effect for your terrorist dollar with aerosols of any number of other, more commonly available substances (like gasoline). I don't have ready access to a good library right now to go pull references but if you follow up on the references to these three papers, you should find more than you will ever care to read on the topic: Wilkinson, G.S.; Tietjen, G.L.; Wiggs, L.D.; Galke, W.A; Acquavella, J.F.; Reyes M.; Voelz, G.L.; Waxweiler, R.J. Mortality among plutonium and other radiation workers at a plutonium weapons facility. Am. J. Epidemiol. 125:231-250; 1987. Checkoway, H.; Mathew, R.M. Shy, C.M.; Watson, J.E. Jr.; Tankersley, W.G.; Wolf, S.H.; Smith, J.C.; Fry, S.A. Radiation, work experience, and cause specific mortality among workers at an energy research laboratory. Br. J. Indust. Med. 42:525-533; 1985. Peterson, G.R.; Gilbert, E.S.; Buchanan, J.A., Stevens, R.G. A Case- Cohort Study of Lung Cancer, Ionizing Radiation, and Tobacco Smoking Among Males at the Hanford Site. Health Physics, 58:3-11; 1990. >To repeat my point: you say that statistical studies of workers in >nuclear weapons plants which are specifically designed to minimize >the effects of radiation show that radiation has done little harm. Loosely put, the studies say, "Workers at facility X whose exposures varied from {small} to {large} showed/did not show increased death rates from {long lists of diseases}." >Well, I should hope so. >On the other hand I say that such studies are poor criteria for >judging the effects of radiation intended to do the maximum possible >harm. Well, these studies are about all we have to go on right now. The wartime residents of Hiroshima and Nagasaki do provide a large set of folks exposed to "radiation intended to do the maximum possible harm" but, darn it, none of them were wearing dosimeters. People do study these groups, making educated guesses about doses, but it's hard to draw precise conclusions on that basis. To draw this off-topic topic to a close, I recommend the following to help bring the various risks into perspective: Cohen, B.L.; Catalog of Risks Extended and Updated. Health Physics, 61:317-335, 1991. >I think that this is really indisputable. >-- >Jim Dixon Sorry for disputing. Brad bdolan(a)well.sf.ca.us

1 0

Re: Using PGP on Insecure Machines
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > Also importantly, the user interfaces for PGP simply suck as it > > stands, making people like Tim uninterested in going through the .... > At the risk of repeating myself, what's the problem with wrapping PGP in > a shell script? Works for me - see a previous mailing, complete with > wrapper scripts. I can send either encrypted or just signed email > without especially noticing it. Wrapping PGP in shell scripts is only useful for people who use shells, and a lot of people either use GUIs instead (often non-extensible ones), or keep their PGP on PCs at home rather than their networked Unixen at work where they get their mail. This means that to use PGP, they need to do things like kermit from home to work, read their mail, save it in files, kermit the files to their PC, PGP-decrypt and read them on the PC, etc. It's a bit easier if people have remote-scriptable terminal emulators on their PCs, which let the Unix end run a script to save the file and download it and maybe fire up PGP on the PC, but it still feels annoyingly like work, and if your Unix box can download files to your PC and run them, it can run pgp-steal-keys just about as well as real PGP. Similarly, if you've got TCP/IP running on your PC, whether through SLIP or directly, you've still got a security risk to worry about. You can reduce these problems by running a _real_ operating system on your PC, but it's tougher to run your favorite applications that way, and you still need to either run all your mail down to the PC, which isn't practical for lots of people, or explicitly forward the stuff down there from your main mail system. There's another transparency problem, at least for reading encrypted mail - you either need to type in your passphrase each time, which is annoying and increases exposure somewhat, or you need to leave it aorund in environment variables, etc., which also increase exposure. On the other hand, a shell script approach can be just fine for signature checking, as long as your mailreader has a painless interface, since there isn't much security risk from having PGP on a machine without your real secret key and passphrase there. There's still some risk - if the machine is shared with other people, someone may be able to replace PGP with pgp-cc:-kgbvax or pgp-nsa-sig-verify - but it's a start. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

Re: Nuclear Weapons Material
by Patrick Juola 17 Dec '03

17 Dec '03

In order to cause damage, alpha emitters like plutonium must come in intimate contact with a material, such as the tissues of your lungs or bones or the inside of your favorite memory chip. A billionth of a gram of plutonium inhaled or swallowed is something to seriously worry about, but you can hold a lump of the stuff in your hand as long as it is covered with a leakproof cladding or vitrified into a ceramic. It is in this sense that plutonium is extremely toxic and hazardous to the environment, while at the same time not being particularly radioactive. Heavy shielding is not required between you and it. My understanding is that the heavy metal toxicity of Pu exceeds the radioactive toxicity by several (10?) orders of magnitude. In other words, the fact that Pu is an alpha emitter is irrelevant to the risk -- it's simply like lead poisoning only several billion times worse. Simple arithmetic yields that the amount of alpha exposure from a billionth of a gram of an alpha emitter with a half-life measured in thousands of years is infinitismal. - kitten

2 1

Re: Nuclear Weapons Material
by thad＠pdi.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com Subject: Re: Nuclear Weapons Material >> Roy M. Silvernail says: >> Plutonium oxide has a reputation for causing eventual lung cancer when >> inhaled in microgram quantities. But if the plutonium metal is sintered >> into a ceramic, it's not loose and breathable. I can't say how >> otherwise toxic it might be, but I'd expect it to be similar to other >> heavy metals. So the poker chips sound pretty safe. They'd be safe unless the pot got really big. I recall hearing a radio show in which some nuclear engineer was saying that such-and-such and incident couldn't have really gone critical, because when that happens, it starts to glow sort of bluish color, and you feel heat as if you were standing in front of a really big oven. The way it sounded, I got the impression that unintended criticalities did happen now and then. Thad Beier Pacific Data Images 408)745-6755 thad(a)pdi.com

1 0