December 2003 - cypherpunks-legacy

Re: MacPGP and AOL
by tim werner 17 Dec '03

17 Dec '03

>From: mpj(a)netcom.com (Michael Paul Johnson) >Date: Mon, 11 Apr 1994 08:07:48 -0700 (PDT) >> On Mon, 11 Apr 1994, tim werner wrote: >> > Late last year, in response to a "bulletin" from eff, I sent money to some >> > lawyer (in Colorado, I think) for the Phil Zimmerman defense fund. Was >> > I defrauded? How embarrassing. > >Not to worry, if the check was made to Philip Dubois and marked as going >to Philip Zimmermann's legal defense fund, it will be used as >advertised. I have personally met both of these people, and trust them >to do what they promised. Phil Zimmermann is still a free man (last I >checked), but being the target of a grand jury investigation has already >cost Phil more than sleep and peace of mind. He has had his lawyer >interceding on his behalf as much as possible to prevent an actual >indictment, and this does cost money. Thanks! I remember now, it was Philip Dubois. I feel much better. :-) tw

1 0

Re: (n!+1)^(1/2)
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>For any number n, if the square root of (n!)+1 is an integer, it is also >prime. (This is interesting, but rather useless in practice) For any number a, 1<a<=n, n! mod a == 0; therefore, n!+1 mod a == 1. n!+1 is prime. Prime numbers don't have integral square roots. Scott Collins | "That's not fair!" -- Sarah | "You say that so often. I wonder what your basis 408.862.0540 | for comparison is." -- Goblin King ................|.................................................... BUSINESS. fax:974.6094 R254(IL5-2N) collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2D Cupertino, CA 95014 ..................................................................... PERSONAL. 408.257.1746 1024:669687 catalyst(a)netcom.com

3 2

new PGP tool - your opinion on ITAR regs?
by Stanton McCandlish 17 Dec '03

17 Dec '03

Someone just sent me this, encrypted, via anon remailer yet asking for it to be distributed. Go figure. Anyway, the author thinks it may be ITAR controlled, but from the looks of it it's not crypto at all but simply an incidental utility that contains no crypto code. I'll leave it up to y'all to figure that out though. Here's the doc, and I'll pass on the binary to any US or Canada folks that want it to examine it. Don't just ask for it because you want it, wait till it shows up for ftp somewhere, eh. I have to manually send it to you, and am severely limited time-wise. Thx. _______ begin _________ This is a hack to the pgp source files random.h and random.c to support a hardware random number generator. Please distribute these file as widely as possible in the U.S. But be aware of the following problem. The U.S. governmemt is trying to say that the export of files relating to cryptography is illegal. In spite of the first ammentment to the U.S. constitution and the inalienable rights of all peoples. They might say that ranodm.h and random.c are subject to export controls in spite of the fact that they have non-croptographic applications. So be aware that if you export these file from the U.S. the govnmnt may try to prosecute, persecute or otherwise screw you! I am sure that you are aware of this problem. As a result I can not recommend that you export this file out of the U.S. The hacked files are under the GNU public licence same as the original unhacked files. This allows a program using random.h random.c to use a hardware random number generator. Thus one need not type in all those stupid keyboard timing strokes. The source files from 2.3a have been hacked. The hack has been "ifdef"ed so that the hacked files compile the same as the unhacked files unless certain "DEFINE"s have been defined. I have tested this hack under MSDOS and OS/2. I do not know about other machines compilers. RANDDRIVER This hack supports the following combinations: A hardware RNG supported by a OS drive. It is assumed that the driver can be opened as a character oriented device. Each byte read is a random byte. (Tested under OS/2) RANDHARDPORT This hack attempts to directly read random bytes directly from a bus hardware RNG. It is assumed that for each inb instruction that you do on the port you get one random byte. If necessary a spin wait can be done that enough time has passed to insure random indpandance. (RANDHARDWAIT) This has been tested under the MS-DOS program loader. RANDHARDPORT and TESTCFG same as above except that OS/2's IO driver TESTCFG$ is used to get random bytes from the port. (Tested under OS/2) HARDRANDOM is defined if you have a hardware RNG. RANDDRIVER is defined to be the filespec of the random number generator if you have a software driver. RANDHARDPORT is defined to be the port number of the random number generator if random.c is to directly access the random number generator. RANDHARDWAIT is the number of timer0 clicks that must be waited for to assure that the next random byte will be independant from the last. TESTCFG is defined is you want to use OS/2's TESTCFG driver to read a bus RNG with the port address spedified by RANDHARDPORT. UUENCODE ZIP file follows which contains the source! table !"#$%&'()*+,-./0123456789:;<=>? @ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_ begin 666 0.zip [...] _________ end ___________ -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

No Subject
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

Reprinted from the Mercury News, 4/10/94 GROUP AIMS TO INTRODUCE BUSINESS TO THE INTERNET By DAVID BANK Mercury News Staff Writer FOR entrepreneurs who are seeking to create an electronic marketplace for Silicon Valley businesses to buy, sell and pursue profits, the creators of CommerceNet have a distinctly un-capitalist marketing plan for their key technology. They're giving it away. When CommerceNet, the first large-scale trial of electronic commerce over the Internet, goes on-line Tuesday, computer users finally will have a secure way to make payments, send confidential documents and verify the identity of the person or company at the other end of the e-mail message. That security system is the key to unlocking the commercial potential of the Internet, the network of computer networks that connects more than 20 million users, said Jay Tenenbaum, chairman of Enterprise Integration Technologies in Palo Alto, which is leading the CommerceNet effort. CommerceNet is working to overcome the other obstacles that have prevented the Internet from becoming an accessible, full-service network for business and the general public. These include the lack of an easy-to-use interface, high prices for the high-speed telephone lines needed, and widely varying standards and systems that make true collaboration difficult. As solutions to those problems are found, Tenenbaum predicts, CommerceNet will revolutionize the way business is done. CommerceNet's promotional literature blithely lists as one long-term impact the disintegration of vertical companies. ''This is monopoly busting,'' Tenenbaum said. ''We think there will be an immediate, demonstrable edge in competitiveness for the companies that are participating.'' In Tenenbaum's vision, large manufacturers will be able to quickly put their orders out to bid, driving down costs. Small businesses that develop a needed new service will be able to compete with industry powerhouses, because the cost of distributing their products electronically will be, essentially, zero. Participating companies, initially, include Lockheed Missiles and Space Co., Hewlett-Packard Co., Digital Equipment Corp. and National Semiconductor Corp. One new business already has been created on CommerceNet: the Internet Shopping Network, a computer buying club based in Menlo Park that will be launched at the same time CommerceNet is introduced at Santa Clara's Techmart. ''We couldn't do it without CommerceNet,'' said Randy Adams, president of the Internet Shopping Network, who estimated the cost for each sales transaction over CommerceNet at 20 cents, compared to $5 for an 800-number telephone order. ''Our costs are the lowest anywhere because of the way we leverage the Internet.'' Many companies already use private electronic networks to communicate with their suppliers or collaborate with strategic partners. But such networks are expensive, exclusive and require prior arrangements to ensure smooth interconnections. For example, Ford Motor Co. requires its suppliers to use a particular computer-aided design program for the transfer of specifications and blueprints. If the supplier also wants to sell to General Motors Corp., it may need a different system. CommerceNet's goal is to bring the capabilities of the private networks into a public network, so that any business or individual can participate in the competitive marketplace spontaneously, without prior arrangements. Unlike commercial on-line services such as America Online or Prodigy, CommerceNet is an open marketplace. Anybody with a computer ''server'' can create an electronic storefront, or ''home page,'' which will be included in CommerceNet's directory. At first the home page will be little more than an electronic brochure of a company's products or services. Then, catalogs will be added. With the ability to send and receive electronic payments, orders can be placed and filled. Soon, bids will be requested and received electronically. Services will develop to search for and compare prices in various catalogs. The need for other services, such as banking, brokerages and specialized directories will create opportunities for new businesses. But to create these opportunities, CommerceNet decided it had to seed the marketplace. Some of the work already had been done by others. For example, CommerceNet will rely on free software known as Mosaic, which gives Internet users a relatively simple ''point-and-click'' way to navigate among thousands of information providers. With its ''hypertext'' functions, Mosaic allows browsers to click on key words to receive more information. To make Mosaic secure, CommerceNet struck a deal with RSA Data Security Inc. in Redwood City for the use of RSA's ''public key'' encryption technology. In simple terms, the technology enables a sender to encode a message in a way that allows only the intended recipient to decode it. At the same time, the recipient of a message is able to verify the identity of the sender. In addition to payment, the security system enables companies to enter into legal contracts with ''digital signatures,'' to control who sees proprietary trade documents, and to use electronic letters of credit for financing purchases. ''Everybody's worried about whether the Internet can be made as secure as the phone system,'' said Allen Schiffman, the principal architect of CommerceNet. ''Well, with this, we can do much better than the telephone system.'' CommerceNet is able to give away the security system in part because it has already been paid by the government, in the form of a three-year, $6 million matching grant from the Technology Reinvestment Program, which supports projects that aid in the transition from a defense-based to a civilian economy. CommerceNet will share its lessons and technologies with other communities that are planning similar efforts, including Boston, Austin, Texas, and Champaign-Urbana, Ill. The CommerceNet team also includes BARRNet, a regional Internet provider, and Stanford's Center for Information Technology. The project is sponsored by the non-profit Smart Valley Inc., which is pushing high-speed communications networks as the way to revitalize the local economy. The state of California put in $500,000, and companies that want to participate in the governance of CommerceNet are expected to contribute $25,000 eachin cash or services. But companies that want to enter the CommerceNet marketplace need not pay anything beyond the cost of their own hardware. CommerceNet will provide starter software and technical assistance for free to those who want to engage in electronic commerce. IF YOU'RE INTERESTED For information about CommerceNet, call (415) 617-8790, or send e-mail to info(a)commerce.net

2 1

Re: (n!+1)^(1/2) Oops! I'm wrong.
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>For any number a, 1<a<=n, n! mod a == 0; therefore, n!+1 mod a == 1. n!+1 >is prime. Prime numbers don't have integral square roots. >For example : > >(4!+1)^(1/2)=5 >(5!+1)^(1/2)=11 >(7!+1)^(1/2)=71 I am completely wrong. I replied too hastily. Please accept my apologies. In fact, n!+1 is relatively prime to any a, 1<a<=n, however plainly it is much larger than n itself and when n>3, (n!+1)>(n^2) and may have factors (including an integral square root) larger than n. Oops :-) Scott Collins | "That's not fair!" -- Sarah | "You say that so often. I wonder what your basis 408.862.0540 | for comparison is." -- Goblin King ................|.................................................... BUSINESS. fax:974.6094 R254(IL5-2N) collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2D Cupertino, CA 95014 ..................................................................... PERSONAL. 408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

RE: Code review is requested
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

>> 3) There may be other RNG's in existence which are accessed in a >> different way, or have different IO drivers. If you have knowledge of >> such RNG's please post the info to the cypherpunks mailing list. > >In Cryptosystems Journal, published by Tony S Patti, Volume 2 Number 2 >is a description, circuit board layouts, parts list, etc. for Ranger >hardware RNG. It produced 6,750 bits per second into the parallel port of a >standard PC. The author says that you can build a Ranger for less than $40 >worth of parts. > >Cryptosystyems Journal >P.O. Box 188 >Newtown PA 18940-0188 > >I have not seen any reviews of this device, but it has been arround for a >while, and may have been covered before I got interested in the field. > Could not the operating systems' IO driver be used for the interface to the parallel port be used as the interface to the RNG? The hack has support for a device which can be accessed thru an IO driver that returns one random byte for each byte read. (RANDDRIVER). Would this be adequate for such a device, or would special code be required? Is the IO driver for the parallel port that comes with MS-DOS OK for this purpose? Has anyone out there built such a device? Yours in anonymity XXX

1 0

New anon mailer idea?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

*** This message is not from the person in the headers above. *** Reply to this message as normal, but be sure to include the *** following three lines in the mail when you do: *** Remailer-Reply-To: fdwgfjghfsdvkglhfslkjghfdkjhgkjfhgkfhg *** ljdfhkjhgfkjhfgkvjhfklvgkfjhvbgjkfhgjkhfgfkjhgjkfhgjf *** jkfdhkjfhgk;hfdgklhfdlgfldjkglkjfhg;hfgkjhfhgfghfkdhg *** Your reply mail will be anonymised. :From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> :> How about generating a secure hash and using that as an index :> into a table? If there's an address already there, use that - :> otherwise, generate one. :> :> Generate the hash from the incoming address, of course. That way, :> you don't need to keep track of anon-id-to-real-id mappings, yet :> guarantee that each user has one and only one anon address. Of :> course, folks coming in from different hosts will have different :> anon ID's. :> :> Or have I missed some blindingly obvious technical point thaqt :> would make this impossible? :I don't see how this would prevent me from having to keep track of :anon-id-to-real-id mappings. It could work for sending mail, but I'd :still have to have some way of keeping track of the real ids for the :replies. Excuse me butting in to a discussion I haven't really been following (I don't have a lot of interest in remailers); I'm wondering if everyone is missing some terribly obvious point here. Without knowing too much about how the current anon/remail stuff works, tell me what you think of this way of doing things (apologies if it's what someone already does or has been discussed recently). I want to mail fred@somesite anonymously. I know fred@somesite's public key. I encrypt my message for fred, then send it to a remailer address with instructions to pass it on to fred. For a little eavesdropping security, I include an anonymous pgp key of mine in the mail to fred so that he can reply to me without the remailer operators reading his mail. You can choose your favourite syntax for how I ask the remailer to send this mail to fred - I don't care what it is. The remailer then encrypts *my reply mail address* with the remailers own key, and inserts this as a header in the mail which only it can read. It attaches a little message to this header saying 'when you reply to this message, be sure to include this opaque header I'm giving you here...' The recipient gets the mail, decodes it, reads it, and replies. (Maybe encrypted with an anonymous public key I included in the mail, maybe in cleartext - doesn't matter for the scheme) When he replies, he included the small encrypted block that the remailer gave him at the top of his message, as he was asked to do by the remailer. The reply goes to the anonymous remailer. The anonymous remailer decrypts the header block that it searches the mail for, and extracts my email address from it again. The remailer then passes the mail back to me - this time including an encrypted block with the fred@somesite's address in it. (Or some other address if fred replied from another account; or perhaps I mailed a mail to news gateway - well, my encrypted address will still work even if a dozen people reply to the news article by mailing via the remailer, and now I *don't* know who the encrypted sender is) In this way, once a conversation has been established, replies can keep going backwards and forwards without much fancy protocol at all - all you ever do is remember not to delete the encrypted block that the remailer keeps inserting at the top of your mail. And with this scheme, the remailer does not need to remember the addresses of either the initial poster or the recipient, and hence can't divulge them if the machine is hacked. So it gives you a combination of the penet-style mailer with return address, and the cypherpunk-style mailer of throw-away anonymity -- as long as you trust the remailer operator not to cheat and log stuff anyway. Of course, you then extend the scheme by the same mechanisms that the cpunk remailers already use - chaining from one remailer to the next... if done properly, the return addresses should chain too, transparently, and the whole scheme will remain easy to use. Clearly this scheme is succeptible to mass logging of comms links followed by a bust to grab the remailer's secret key, but that's about par for the current remailers anyway. This scheme is no worse, and possibly quite a bit better. So, have I just stated the obvious or is this a new idea to anyone? Regards G PS Note this scheme doesn't need Matthew's hack for "+" in usernames, which not everyone wanting to run a remailer in say a private account on netcom etc would be able to install... PPS I thought for fun I'd put a header of the kind I'm talking about on this mail. Anyone replying should note it really *will* go to me, and you *won't* be anonymized ;-)

1 0

Re: your mail
by Graham Toal 17 Dec '03

17 Dec '03

From: Chris Knight <cknight(a)crl.com> So much for an Ivy-League education... Please send mailing list requests to owner-cypherpunks(a)toad.com Actually I think that should be majordomo(a)toad.com, and if it isn't, then cypherpunks-request(a)toad.com owner-* addresses are intended for mail bounces and stuff like that. G

1 0

Re: A confused quotation ?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: Is this not strange ? :Date: Sun, 10 Apr 1994 20:26:23 -0400 :From: E-D-U-P-A-G-E <info(a)ivory.educom.edu> : ... : :OPEN SECRET : Instead of using mathematical codes to scramble and unscramble :messages, Georgia Tech physicists are devising a way of sending a message :with electronic noise generated by a flickering laser. By connecting :identical lasers over fiber optics, the same random pattern of noise is :generated at both the sending and receiving end, and the receiving simply :subtracts the noise to uncover the message. (Atlanta Journal-Constitution :4/7/94 E2) It is as you say a confused quotation. My guess is it's that synchronised chaos crap again, badly reported. G

1 0

RE: Shot 'Round the World
by Blanc Weber 17 Dec '03

17 Dec '03

From: Greg Broiles "We don't insist on all-or-nothing accuracy in other forms of warfare, why expect it here?" Because you want to succeed? "Psychological warfare is about manipulation and FUD (fear, uncertainty, doubt)." All's fair in love and war. What makes it psychological is the faculty & type of effect aimed for, and FUD isn't the only thing possible, or desireable. "... we don't need to demonstrate good behavior to convince it/them that we deserve or can be trusted......" ". . . to bolster their flagging confidence, they need a good kick in the teeth." "There is no rational argument that can force the non-trusting to trust." ". . . the point may be to create a state of irrationality, not a particular rational conclusion." . What you would be aiming for here, apparently, is neither their psychology nor their intellect. But actually if you are not intending to communicate at all, then all of things which I mentioned are irrelevant. I would leave you to your own devices. "Perhaps this discourse about "images" isn't useful, and it's time to talk about capabilities." . What image do you get of the engagement of your capabilities under normal circumstances vs under a totalitarian regime? What sort of picture is created in your mind by the statements about human nature, "endowed ...with inalienable rights", among which are included "Life, liberty, Pursuit of Happiness", and what do you suppose George thought about that? Some questions I would ask in regard to this warfare business: What sort of a win would you be aiming for, which served the purposes of rational discussion poorly? For how long would you be expecting to live in the company of those whom you drove to irrationality? And how would you go about the business of returning everything back to a viable, liveable state, supposing you achieved victory? Blanc

1 0