December 2003 - cypherpunks-legacy

Re: POISON PILL
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

All this talk of booby-traps reminds me of this booby-trap expert who had written books and had his house set up completely. He was found dead one day when one of the traps got him... [This anecdote is vaguely remembered from a short note in Whole Earth Review. I remember seeing a review in the '70s on the book itself when it was originally reviewed.] Paul E. Baclace peb(a)procase.com

1 0

BlackNet Investigations--the Truth (fwd)
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherians, Here's a posting I sent to the "Extropians" list, which many of you are already on..sorry about getting this twice. Hit "delete" now if you are not interested in the "crypto-anarchy" side of what we are doing. I say this because when I post on these topics, which are apparently of interest to some, I often get notes or postings saying "Not all of us are anarchists, so keep this stuff off the list!" Now we are a diverse bunch. Some of us are fairly radical libertarians and see strong crypto as the technological tool to demolish governments (including the U.S. government). Others of us are anti-big business and see crypto as a means of reducing the power of large corporations over individuals. Others are socialists, acid freaks, even military cadets. Whatever. Some want to talk about using thermite bombs to melt hard disks (a current hot topic, as it were). Others are deeply into Perl scripts, MIME, and so on. For others, patent law and the ins and outs of the ECPA are the big excitement. The point is, there are a lot of loosely related items in the Cypherpunks agenda. What follows is related to _my_ main interest, the colonization of cyberspace and the institutions and methods which will arise. Don't read it if it doesn't interest you. And if you're scared that talking about using technology to bypass laws and ultimately overthrow national governments as we know them today will get you into trouble with the authorities or with your company, well, then this list is probably not for you. Me, I say what I think. Others can say what they think, too. -Tim May Forwarded message: To: Extropians(a)extropy.org Date: Fri, 1 Oct 93 14:06:16 -0700 From: tcmay(a)netcom.com (Timothy C. May) Subject: BlackNet Investigations--the Truth BlackNet Investigations Announces New Dossier Services FLASH: BlackNet Investigations is pleased to announce the immediate availability of dossiers from the former East Germany (DDR) and the former Soviet Union. We have obtained tens of millions of dossiers on activists, dissidents, extropians, and ordinary people and have meticulously scanned and digitized the essence of these files (many of these files were already in magnetic format, albeit primitive). Now you can learn what the KGB had on your business associates! Now you can discover if that little German pastry is as innocent as she seems. And you can even find out what the GRU had on you from your visit to Vienna in 1984. Contact us for details. Competitive rates, as always. And coming soon: the previously secret files of the KriminalStaatsPolizei. Plus, the now-privatized dossiers of the South American police states! Sources close to the FBI may soon make their files available as well! We are also negotiating with personnel at hospitals and insurance companies to obtain black market copies of insurance records, describing in gory detail all medical and psychiatric conditions for tens of millions of Americans. Onward and Upward! -BlackNet Investigations, a Cyberspace Entity ......... By now many of you know that BlackNet Investigations is not quite real...yet. More than just a Klaus!-style put-on, it's a basically plausible implication of current trends. Some of you requested your dossiers, others even wrote threatening notes. And a few of you even played along, saying how "shocked, simply shocked" you were to see the dossiers compiled on you. (Thanks! You know who you are.) As Dave Krieger noted in his piece on BlackNet Investigations, folks need to keep the inevitability of such dossier-based systems in mind. Others may not "advertise" the way BlackNet does, but they're just as surely keeping dossiers. I don't think it's overly paranoid to suggest that things you write on Usenet, or in mailing lists like Extropians and Cypherpunks, are being compiled by some into dossiers of sorts...call them "databases" if you like, but they're still dossiers. And in fact I do have a lot of Extropians and Cypherpunks postings tucked away in places that my Mac databases can access them easily, via keyword searches, tagged fields, etc. I'm quote sure a lot of people are doing this, quite likely some TLA agencies. All of the Extropians and Cypherpunks traffic for the past couple of years, and a lot more, fits on a single 128 MB magneto-optical cartridge...and I've got 10 or so of them. All Usenet postings are archived on CD-ROMs, available by subscription (Walnut Creek Software, or somesuch...and maybe multiple sources). Easy to obtain. Expect ftp sites to carry these back postings, if they aren't already available. In the next 10 years it'll be essentially a trivial exercise for any person--your child, your potential employer, credit agencies, etc.--to sift through the 20 or 30 gigabyes of Usenet traffic for a 10-year period and look for juicy items, for admissions of unusual sexual practices, for extreme political statements, etc. Data storage increases (CDs, DATs, MOs, new media) and processor speed increases will make searches easy and fast. Rather than having all this data on one's own machine, many people will compile it into files or dossiers, and then charge access fees. Customized searches, specialized grepping, and database "engines" optimized for search (like the Connection Machines, the Teradata hypercubes, neural net and fuzzy logic engines, etc.) will make this even easier. As jurisdictions attempt to pass laws restricting these accesses, as with the convoluted U.S. laws regarding credit, tenant (renter) credit, medical malpractice databases, etc. (the whole credit market, in other words), these databases will be moved offshore. Or the access may go offshore, and then back again! (You can set up the databases in your bedroom, then sell access through "cut-outs" that lie beyond the reach of U.S. laws.) Private investigation as we know it today will be radically changed. (Actually, much of current P.I. work is already accessing records and databases, so-called "skip-tracing" work, to see where vanished people have ended up...deadbeat dads, missing children, etc.) Entities like BlackNet will flourish in the crypto-anarchic world of cyberspace (or "cypherspace," as John Draper dubbed it). Positive reputations will be of utmost importance, as we've discussed so many times. Digital pseudonyms will of necessity become more widespread. Offshore data havens, credit agencies that aren't restricted to the "7 years" allowed by U.S. law, repositories of stolen software, all will be accessible by "BlackNet"-style "wormholes" (the public key access methods that allow entities to communicate anonymously and untraceably). Wake up and prepare for this future. Embrace it, or be left behind. Crypto-anarchy is inevitable, and changes everything. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Medium destruction
by Peter Capek (TL-863-6721) 17 Dec '03

17 Dec '03

I have no firsthand knowledge, but a friend who was into this a few years ago told me that the following is used for NSA's "best stuff" on paper... First, it is shredded. Then, it is burned. Then, the ashes are soaked in acid Then the acid is allowed to evaporate and the resulting mass is formed into bricks. The bricks are dumped at sea at a classified location which is changed weekly. Maybe he was putting me on, but... A few years ago, the American embassy in (I think) Teheran was invaded by mobs of locals. They apparently managed to get hold of a lot of classified documents which had been shredded in the minutes before they managed to break in. But a few months later, there appeared in the New York Times reconstructions of a few pages of the original material, based on a lot of tedious labor. So, maybe the procedures above aren't excessive...

1 0

FIDO, encryption
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is the companion script to the other one I posted. It takes the output of the previous script (which takes PGP encrypted ascii to a list of geopraphic name), and turns it back into a PGP file. Not really stegonography since it's really just a substitution cipher. But, with a more sophisticated output grammar, you could embed your encrypted file in a bizarre vacation itinerary :-) pgphide < file.asc | mail -s "not encryped at all" user@host and then pgpuhide < mail_file_from_sneaky_person > pgpfile.asc will allow your friend decrypt pgpfile.asc. - ---------- #!/usr/local/bin/perl #pgpunhide - converts a geographic file back to pgp #Karl L. Barrus <klbarrus(a)owlnet.rice.edu> %conversion = ( 'canada', '0', 'united states', '1', 'mexico', '2', 'pacific ocean', '3', 'atlantic ocean', '4', 'arctic ocean', '5', 'gulf of mexico', '6', 'north america', '7', 'allegheny mountains', '8', 'rocky mountains', '9', 'alabama', 'a', 'alaska', 'b', 'arizona', 'c', 'new mexico', 'd', 'arkansas', 'e', 'california', 'f', 'colorado', 'g', 'connecticut', 'h', 'rhode island','i', 'delaware', 'j', 'maryland', 'k', 'florida','l', 'georgia', 'm', 'hawaii', 'n', 'idaho','o', 'illinois', 'p', 'indiana', 'q', 'iowa','r', 'kansas', 's', 'kentucky', 't', 'louisiana','u', 'maine', 'v', 'massachusetts', 'w', 'michigan','x', 'minnesota', 'y', 'mississippi', 'z', 'missouri','A', 'montana', 'B', 'nebraska', 'C', 'nevada','D', 'utah', 'E', 'new hampshire', 'F', 'vermont','G', 'new jersey', 'H', 'new york', 'I', 'north carolina','J', 'north dakota', 'K', 'south dakota', 'L', 'ohio','M', 'oklahoma', 'N', 'oregon', 'O', 'pennsylvania', 'P', 'south carolina', 'Q', 'tennessee', 'R', 'texas','S', 'virginia', 'T', 'washington', 'U', 'west virginia','V', 'wisconsin', 'W', 'wyoming', 'X', 'washington d.c.','Y', 'bermuda', 'Z', 'guam', '+', 'puerto rico','/', 'virgin islands','=', ); print "-----BEGIN PGP MESSAGE-----\n"; print "Version: 2.3a\n\n"; while (<>) { $line = $_; chop $line; if ($line eq "") { print "\n"; } else { print $conversion{$line}; } } print "-----END PGP MESSAGE-----\n"; -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLKyz4YOA7OpLWtYzAQF3JAP9EjWnj7pix65fJLFf9mE+gLkw719nX0Xa jMgHFxmDIdeOxewi9ZnuzE99QqQHv4+TO3dO+CGg0zxGhCMO8/mu4vQtK6825kHl 9fESP/f2oSVLDPd2/Zv3c0/kMKe9UnMModNgl7tngzsMeBkFJVCnKjkQNGsJGCSz C5Z4uXaZccs= =M+N2 -----END PGP SIGNATURE-----

1 0

[Question EFF yielding of crypto authority to NIST]
by Doug Humphrey 17 Dec '03

17 Dec '03

[stuff deleted] >Actually, they have issued such legal guarantees. They're in the form of the >administration's vow to uphold the US Constitution. That document's 9th and >10th amendments preclude US Government denial or disparagement of the people's >right to use cryptography (and a whole lot of others). The fact that these >legal guarantees are being ignored simply illustrates that their tyranny is >unbridled. When I first scanned this, I saw "... illustrates that their tyranny is unbundled" And I thought, what a concept! Doug

1 0

MPJ Encryption Algorithm
by Mike Johnson 17 Dec '03

17 Dec '03

Bill Stewart writes: > Sounds interesting; do you have any comparisons between it and IDEA > about either encryption strength, speed, or design philosophy? The full design philosophy for MPJ is in my thesis. Since then, I learned about differential cryptanalysis and was relieved to see that MPJ is fairly resistant to that. Here is a short summary: Algorithm Key size Block size Rounds Strength* SW Speed HW Speed DES 56 bits 64 bits 16/2 22-55 slow fast 3DES 112 bits 64 bits (16*3)/2 24-58 slower fast IDEA 128 bits 128 bits 16 65-110 fast fast Skipjack 80 bits 128 bits 32 79 ? ? MPJ 128 bits 128 bits 10 70-120 medium very fast MPJ2 >=64 bits 128 bits >=10 50-128 <=medium <=very fast *Strength is a GUESS at log base 2 of the complexity of breaking it. Algorithm Legal status Back door? Origin DES Public Domain No IBM/NBS->NIST/NSA 3DES Public Domain No IBM IDEA Patented No Switzerland Skipjack Classified LEAF NSA MPJ Public Domain No USA - University of Colorado at Colorado Springs (UCCS) MPJ2 Not yet released No USA DES Design philosophy: (1) Fit in small chip (2) Use involution for reversibility (only half of block changes with each round) (3) Use polyalphabetic nonlinear s-boxes of limited size (requires great care to avoid differential cryptanalysis) (4) Some design criteria still classified. 3DES Design philosophy: (1) Cascade existing known algorithm (2) Avoid weak key situations (3) Try not to require too much more key than the strength of the algorithm justifies (i.e. just 2 instead of 3 keys are used). (4) Apply a bandaid. Making one compound block cipher would have been more secure, but not all the s-box design criteria are known. IDEA Design philosophy: (1) Use unrelated arithmetic operations on different fields. (2) Use only 32 bit arithmetic operations for speed on a computer. (3) Arrange the structure of the algorithm to do proper confusion/diffusion. (4) Very small code and memory space used in computer. Skipjack design philosophy (guessed): (1) Similar to DES, but with a block size of 128 bytes. (2) No attack known to the NSA will be more than a bit or two better than exhaustive key search. (3) Learn from the mistakes of DES (i.e. avoid weak keys and complementation symmetries DES suffers from). (4) Restrict knowledge of the algorithm as much as possible. MPJ Design philosopy: (1) Relax some of the size limits of DES & IDEA to gain security, but make sure it fits on a PC. (2) Avoid fragile fixed s-box & subkey design of DES, but copy its product cipher structure. (3) Change the whole block with each round instead of just half (i.e. 10 MPJ rounds is as effective as 20 DES-type rounds). (4) Make every output bit a strong function of every bit of the input and every bit of the key within 3 rounds. (5) Use such simple operations in a complex and nonlinear fashion that mathematical breakthroughs are not a threat (as with RSA). (6) Make the substitution steps reversible through a very clever construction of reversible substitution arrays directly from the key. (7) Make key scheduling slow (to discourage exhaustive search for keys), but make the algorithm very fast, especially in dedicated hardware. (8) Make creative use of nonlinearity, bit twiddling, and rounds to thwart an analytical attack using massive quantities of known or chosen plain text. MPJ2 Design philosophy: (1) Generalize the key scheduling to accommodate variable length keys. (2) Generalize to n rounds. (3) Attempt to do key scheduling on the fly in cases where the memory required for precomputed internal keys take up too much RAM. Common elements: All of these block cipher algorithms use repeating rounds of "confusion and diffusion" or "substitution and permutation" weaker ciphers to form a stronger product cipher. All of them are secure, even if the cipher becomes known. Skipjack is classified more to prevent knowledge of design criteria and cryptanalysis secrets, and to allow the forced insertion of a back door (LEAF) than for the security of the algorithm (just ask Dr. Denning). DES and 3DES can raise the price of unauthorized disclosure of secrets above the average individual's means. The others have the potential of raising the price of eavesdropping by breaking crypto algorithms to above the budgets of organized crime, hostile governments, and terrorists. None of them prevent other technological solutions to spying, such as placing bugs closer to the target individual, office, or computer system. General rules of the game in CRYPTOGRAPHY and CRYPTANALYSIS: 1. There is always a way to crack any practical cryptosystem. 2. Your opponent will not tell you if she has broken your cryptosystem and is reading your mail. 3. The longer any one cryptosystem is in use, and the more widely it is used, the more likely it is that someone has broken it, or at least discovered a weakness in it and not told anyone about it. 4. The more widely used a cryptosystem is, the more profitable it is to try to break it (for either noble or ignoble purposes). 5. Exclusive control of the ability to communicate securely is a powerful force that can easily be corrupted. 6. Putting all your eggs in one basket is unwise. Use more than one cryptosystem, and change keys regularly -- even if you don't suspect compromise. 7. Insecure cryptosystems often appear on the surface to be secure. They are often sold for good money. DISCLAIMERS: DISCUSSIONS ABOVE ARE FROM MEMORY AND MAY NOT BE ACCURATE. ALL DATA CLAIMING TO BE GUESSWORK IS. PROVING ANY CRYPTOSYSTEM SECURE IS USUALLY IMPOSSIBLE. INVENTERS OF CRYPTO ALGORITHMS ARE NOT QUALIFIED TO JUDGE THEM. Mike Johson mpj(a)csn.org This message contains writings protected under the First Amendment of the Constitution of the United States of America. Censorship is forbidden.

1 0

Re: TRAVELLER'S ADVISORY
by an36440＠anon.penet.fi 17 Dec '03

17 Dec '03

>Unfortunately, >I don't have any bullet-proof solutions. Suggestions? Yes. Seek professional help. And try Xanax. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

secretive API
by doug＠netcom.com 17 Dec '03

17 Dec '03

I don't know if this is old hat, but I was amused to see a moment ago on another mailing list the following quote from the Windows NT API: ERROR_TOO_MANY_SECRETS -The maximum number of secrets has been exceeded. -Win32 (NT) API. Doug

1 0

Re: TRAVELLER'S ADVISORY
by doug＠netcom.com 17 Dec '03

17 Dec '03

an36440(a)anon.penet.fi said: >> [ Sandy said: ] >>Unfortunately, >>I don't have any bullet-proof solutions. Suggestions? > >Yes. Seek professional help. And try Xanax. Now, now. Sandy's got a point, John could in fact get zapped by overly zealous authorities. It may be mildly paranoid to think that they'd plant evidence on him...the suits only do that if they're *REALLY* pissed at someone, and even then only sometimes...they're risking their jobs every time they do that, after all. Actual conspiracies are comparatively rare, if only because they take a lot of high level carefully planning and support to execute well. It's not like John is a key figure in South American politics or something. :-) But nonetheless, there's still the chance that they'd get a fixation on the notion that he was carrying something illicit out of the country and interfere with his travel in a very unpleasant way. It wouldn't be the first time such a thing happened purely out of misplaced zealousness. As for solutions, the age-old approach is to be a high profile philanthropic and campaign contributor and elbow-rubber, so that one has a lot of community support if one gets leaned on. This would be a private matter for John, though, and not up to us to discuss. I mention it simply because it *is* a well known partial solution. I actually don't exactly recommend it, for complicated reasons. Considering certain recent posts (and considering the Internet at large, for that matter), I'll still give you points for showing signs that you paid attention to everything Sandy said and responded to what he actually said. I wish everyone would do that. ;-) Doug

1 0

troglodyte MIND RAPIST flames, take II
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

anon.penet.fi cut my message. now I know how Infocalypse feels. send this EVERYWHERE in cyberspace it might make a difference. === Subject: STOP THE TROGLODYTE FIDONET MIND-RAPISTS *NOW*! does routine FIDOnet email INVASION by operators VIOLATE the U.S. Electronic Communications Privacy Act? EFF's lawyer M. Godwin speaks with FIDOnet operator Al Billings <mimir(a)u.washington.edu> on the cypherpunks mailing list. Resident list crank Perry Metzger offers his own whitehot flame. this forward brought to you by cypherpunks Cyberspatial Reality Advancement Movement (CRAM) Information Liberation Front (ILF) Blacknet === From: Mike Godwin <mnemonic(a)eff.org> Subject: Re: FIDOnet encryption (or lack thereof) To: cypherpunks(a)toad.com Date: Fri, 1 Oct 1993 16:40:09 -0400 (EDT) Al Billings writes: > On Thu, 30 Sep 1993, Mike Godwin wrote: > > > > My question is this: how does he know that the mail is encrypted if he's > > not examining the mail that passes through his system? If he *is* > > examining the mail that passes through his system, it seems likely that he > > is violating the Electronic Communications Privacy Act. > > Only if he has stated that he allows private mail. Most sysops have > specifically worded policy statements for their systems that say that the > sysop can read any and all messages on the system and may do so at any > time. That's all very nice, but it doesn't enable a FIDO sysop to intercept messages from people who are not users of his or her particular system. Those people did not waive their rights to privacy under the ECPA. > Bulletin boards do not normally offer truely private mail because of > some of the legal implications. This is a common myth. First of all, there are many BBSs that do offer truly private mail, or whose sysops, as a matter of policy, do not read others' private mail. Secondly, there's no legal liability associated with allowing e-mail privacy. Third, federal law (the ECPA) bars sysops from examining mail except under some very precisely defined circumstances. I suggest that you inform sysops who tell you otherwise that they can contact me at the Legal Services Department of EFF. You've got my e-mail address already--my phone number is 202-347-5400. -Mike From: Mike Godwin <mnemonic(a)eff.org> Subject: Re: FIDOnet encrypted mail issues Date: Fri, 1 Oct 1993 17:16:48 -0400 (EDT) To: cypherpunks(a)toad.com anonymous(a)extropia.wimsey.com writes: > Now, the point most internet people forget is that FIDOnet hosts are > hobbyists with 100% privately-owned machines and generally pay for the > entire participation of their userbase out of their own pockets, > excepting a few who get some dollars here and there from their generous > callers. I have never forgotten this. But their commitment and efforts do not amount to an amendment to federal law. > As a completely justified consequence, they can decide if they > allow encrypted traffic _on their individual BBSs_. Under what legal theory do they get an ECPA exemption as a "completely justified consequence"? > In that there is > considerable fear of the consequences of illegal activity being > conducted on their BBSs via encrypted mail, many sysops (such as the one > you mention, leaving aside, for now, that he apparently confused a PGP > key with an encrypted message) do not wish to take the risk and forbid > encrypted traffic. What they don't realize is that, rather than reducing the risk of legal liability, they are increasing it. > They also monitor e-mail, if only incidentally > during the course of routine system maintenance, and notices to this > effect are generally contained in log-on screens and new-user info > files. Any monitoring that results *directly* as a function of system maintenance is okay--it's sanctioned by ECPA. > In that these sysops are extremely, _personally_ vulnerable, they are > generally more cautious than those internet folks who can hide behind > institutions and businesses. If they were really cautious, they'd talk to a lawyer before setting policy based on some guess as to what their legal liabilities may be. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0