December 2003 - cypherpunks-legacy

Re: that internet security scanner
by Stanton McCandlish 17 Dec '03

17 Dec '03

Well, seems some folks took exception to my remarks about the CERT post. I was simply kidding, and have no problem with CERT warning SysAdmins about possible hazards. I thought it might be humourous to sound mock-alarmist, in response to some shouting and nay-saying over EFF warning SysOps about possible hazards. -- DISCLAIMER: This message represents only my OWN opinion, not that of EFF. Stanton McCandlish Electronic Frontier Foundation Online Activist mech(a)eff.org NitV-DataCenter BBS SysOp Fido: <tba> IndraNet: 369:111/1

2 1

Re: academician seeks critique of cryptographic paper
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <9310070630.AA17189(a)longs.lance.colostate.edu> >Subject: academician seeks critique of cryptographic paper >Date: Thu, 07 Oct 93 00:30:51 -0600 Richard, This reminds me of what I had to go through to get approved to get married in the Roman Catholic Church. I ended up having to say, for the record, "I have no intention of using mechanical methods of birth control" (pre-safe-sex days) when what they wanted was for me to say I would avoid all birth control. I'm now ashamed I stooped to that non-confrontive statement (especially since the marriage didn't last :-). I should have said, "No, I don't accept your view of birth control and have every intention of using it." At least I did say that my fiancee was on the pill and we intended to continue using it. I would be happy to review your paper and to suggest others who might be good reviewers. Furthermore, I have no intention of violating the export laws (even though I disagree with them and work very hard to change them). However, I do not grant the NSA the power to control the publication of theoretical information. I have published papers on cryptology in the international press, without offering the NSA the chance to review what I write ahead of time, and I intend to continue doing so. They have their internal publications, no doubt, and we have our public ones. I don't tell them what to publish internally and I will not allow them to tell me what I can publish out here in the public. That is my policy, for my own writing. If you send me your paper to review, I will not disseminate it. That's a matter of respecting your wishes -- not the NSA's. My acceptance of your paper will not constitute any agreement on my part to give the NSA control over publications of ideas. - Carl - <<Disclaimer: All opinions expressed are my own, of course.>> - Carl Ellison cme(a)sw.stratus.com - Stratus Computer Inc. M3-2-BKW TEL: (508)460-2783 - 55 Fairbanks Boulevard ; Marlborough MA 01752-1298 FAX: (508)624-7488 -----BEGIN RIPEM PUBLIC KEY----- User: cme(a)ellisun.sw.stratus.com PublicKeyInfo: MIGbMAoGBFUIAQECAgP+A4GMADCBiAKBgCl79/jl0DEVl1GQzOHlzjDmChDDxnWO Acd7jShj2x1vclFh6vbHx9IJqkQdwNhNAWf8XnTrqBDN+VSBc1qdT6nSEAbNPxHD XcvY2DudhuRaRBVLgUQ4scTK657m90Q+bTL5yIh2MaFipUw9BgbIXPTDlksSskWP 9oHjo+pCJC+lAgMBAAE= MD5OfPublicKey: 39D9860686A9F075A9A83D49589C677A -----END RIPEM PUBLIC KEY-----

1 0

Re: Digital Cash Primer
by peter honeyman 17 Dec '03

17 Dec '03

> Likewise, the Simmons books on "Contemporary Crytology" has good stuff > on digital money no it doesn't. (or am i blind?) peter

1 0

Re: MacPGP 2.3 source
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

Apparently there's a basic incompatibility between ftp and the auto-backup program which runs every now and then on my Mac, which brings everything to a halt if anyone connects to ftp while the backup is being done, so I'll have to remove the MacPGP source from the ftp area on my Mac. But I'd only promised to keep it there until this morning anyway. However, the sysadmins happen to have just set up a properly supported anon ftp area, so I've put the stuff there instead, where it can probably remain indefinitely. The site to ftp to is ftp.sys.uea.ac.uk, and the files are in the directory ftp/Macintosh. (Ignore the .finderinfo and .resource subdirectories -- it's an AppleShare thing, your computer wouldn't understand, at least not over the Internet.) -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

The death of the list as we know it (tm)
by Robert J Woodhead 17 Dec '03

17 Dec '03

I've only been monitoring the list for a couple of days, but already it is clear to me that the traffic is _way_ too high to manage as a mailing list. Apart from the volume, the very structure of Email tends to dis-associate message from reply, and make it difficult to do any filtering before reading (one of the great joys of using _nn_ IMHO). A humble suggestion: someone undertake to create alt.cyperpunks and shadow the newsgroup and the mailing list (so that posts to one also go to the other). In my case this would cut my reading time in half and increase my "harvest" by a factor of two. The mailing list would still be available for those who cannot get the group. In addition, as the number of people getting the mailing list would decrease, it would probably delay the death of the net by bandwidth overload for a few hours (currently, it is scheduled for sometime in June 1997, last time I checked). Also, even an unmoderated alt group can be made moderated (and thus, filter out most of the forgery, etc) by appropriate use of technology described in this mailing list. +---------------------------------------------------------------------------+ | Robert J. Woodhead, Biar Games / AnimEigo, Incs. trebor(a)forEtune.co.jp | | AnimEigo US Office Email (for general questions): 72447.37(a)compuserve.com |

8 9

Re: FIDONet Mail filterin
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > J >So how do I prevent what happened to SJG, killer, etc from happening > > J >to me? How do I prevent the LE types from showing up one day and > > J >saying 'hey, did you know there's a meg of kiddie porn on your > > J >machine and we're taking it all away'? Well, keeping things encrypted helps, especially backup disks - one site was being generally harassed and may be convicted because of possible child pornography that the sysop had deleted but was still on backup floppies in his re-use bin. (Police got a 15-year-old kid to log in for them and find some adult material, but dropped that attempt probably because it would have been thrown out as entrapment; the child-porn gave them a much nastier charge to use to steal the computer.) Perry> Censoring your users mail will not lower your risk, so why do it? On the other hand, making sure your users *have* email on the system, especially mail in transit to other systems, is good protection, since the ECPA limits what they can do with it.

1 0

Newbie question on PGP
by lear＠cp10.es.xerox.com 17 Dec '03

17 Dec '03

I had heard about PGP and have been meaning to get and use it Real Soon Now for a few weeks. When I heard it was an endangered species, I started looking around seriously. Haven't found it yet, but I did find cypherpunks (I'm not sure if this is a blessing or a curse, but it is entertaining). Anyway, can someone point me to an ftp site that still stocks PGP? I'm running SunOS4.1.1 if that matters. Thanks, Russell.

1 0

Re: FIDONet Mail filterin
by Duncan Frissell 17 Dec '03

17 Dec '03

J >So how do I prevent what happened to SJG, killer, etc from happening J >to me? How do I prevent the LE types from showing up one day and J >saying 'hey, did you know there's a meg of kiddie porn on your J >machine and we're taking it all away'? As soon as you get the 10mbps line into the home (next year for you Continental cable customers), mirror your machine with another located overseas (or just run the machine overseas). Duncan Frissell --- WinQwk 2.0b#0

1 0

iss source
by accom!erc%accom＠uunet.UU.NET 17 Dec '03

17 Dec '03

I've been rather swamped by folks asking for the ISS source code, so would anyone mind if I posted it here? It's only 19K tarred, gziped, and uuencoded... -- Ed

2 1

Diffie-Helman example in g++
by cman＠IO.COM 17 Dec '03

17 Dec '03

Here is a little demo using the big Integer routines from libg++ illustrating how Diffie-Hellman key exchange works. Basically, I wanted to prove to myself that it works, and thought others might appreciate it. Doug =============================================================== // Demo of mathematics for Diffie-Hellman type key exchange // // Useful to convince oneself that it really does work and that // a patent on it is pretty silly. // // Douglas Barnes (cman(a)io.com) // // Based on algorithm from Cryptography and Data Security, by Dorothy E. // Denning, 1983, Addison-Wesley. // // Note: you will need to have GNU libg++, or hack it to use big integer // math you do have. #include <stdlib.h> #include <time.h> #include <sys/types.h> #include "Integer.h" Integer& RandBigInt(int bits); Integer& FastExp(Integer& A, Integer& B, Integer& p); #define keysize 644 main() { Integer p; Integer a; Integer XA, XB, K1, KA, KB, YA, YB, T; char state[256]; pow(2, keysize, p); p = p - 1; // Does anyone have a clue what good values of 'a' are in this // algorithm? a = 127; // Set up random stuff initstate(time(0), state, 256); cout << "A and B pick random numbers in the Galois field [0, p - 1]\n"; cout << "where p is (2^" << keysize << ") - 1:\n" << p << "\n"; XA = RandBigInt(keysize); cout << "\nA picks a random secret XA: \n" << XA << "\n"; XB = RandBigInt(keysize); cout << "\nB picks a random secret XB: \n" << XB << "\n"; YA = FastExp(a, XA, p); YB = FastExp(a, XB, p); cout << "\nA gives B a message YA (a^XA mod p): \n" << YA << "\n"; cout << "\nB gives A a message YB (a^XB mod p): \n" << YB << "\n"; KA = FastExp(YB, XA, p); cout << "\nA now knows the key is (YB^XA mod p): \n" << KA << "\n"; KB = FastExp(YA, XB, p); cout << "\nB now knows the key is (YA^XB mod p): \n" << KB << "\n"; cout << "\nComputing the key (which is a^XA^XB mod p) from (a^XA mod p) and\n"; cout << "(a^XB mod p) is equivalent to performing two discrete log calculations;\n"; cout << "the number of steps to perform discrete logs grows exponentially\n"; cout << "in proportion to the # of bits in the field. For a 'p' of 644 bits,\n"; cout << "Denning estimates 1.2 x 10^23 steps.\n"; } // Calculate a^z mod n // // Based on the fact that (a^3 mod n) is the same thing // as: (((a * a) mod n) * a) mod n // // Gets its speed from the fact that, for example, n^18 is the // same as (n^2)^9 Integer& FastExp(Integer& a, Integer& z, Integer& n) { Integer a1, z1, two; static Integer x; a1 = a; z1 = z; x = 1; two = 2; while(z1 != 0) { while((z1 % 2) == 0) { div(z1, two, z1); a1 = (a1 * a1) % n; } z1 = z1 - 1; x = (x * a1) % n; } return x; } // Yes, I know the random stuff is lame. This is a demo. Integer& RandBigInt(int bits) { int i; int randval; static Integer retval; retval = 0; for(i = 0; i<bits; i++) { retval |= (random()&01); lshift(retval, 1, retval); } return retval; }

3 4