December 2003 - cypherpunks-legacy

Applied Cryptography Disk via FTP?
by jkyser＠netcom.com 17 Dec '03

17 Dec '03

I just purchased a copy of Schneier's Applied Cryptography, and am interested in obtaining the source code disk set that accompanies the book. Does anyone know if these disks are available via FTP? Any pointers would be appreciated. Thanks, Jeff -- Jeff Kyser PGP 2.3 public key available via finger jkyser(a)netcom.com

1 0

Re: a modest proposal
by Nikolaos Daniel Willmore 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greg Broiles <greg(a)goldenbear.com> offered, "I suggest that remailer operators might find it useful to redirect remailing requests originating from Detweiler directly to postmaster(a)lance.colostate.edu." Here are results of a somewhat unfair but curiosity driven experiment. I have got to admit I agree with the postmaster, but I figured it was worth a try. They are reproduced without permission. - From steved(a)longs.lance.colostate.edu Sat Jan 15 00:31:44 1994 To: Nikolaos Daniel Willmore <ndw1(a)columbia.edu> Subject: Re: Detweiler fan mail. Reply-To: postmaster(a)longs.lance.colostate.edu Date: Fri, 14 Jan 94 22:31:40 -0700 Sender: steved(a)longs.lance.colostate.edu >Hi, coming from your site are the worst abuses in rants and rave I have ever >seen on Usenet. Like it or not, this is a free country where the right to free speech is highly valued and protected. I will neither endorse nor censor anything posted to a public forum by any user from this site. Unless some law is being broken or some other user's individual rights are being violated, I don't want to hear about it. >I will help you keep informed by mailing to you each and >every one of these to you until you tell me to stop. You may stop now. >Lance Detweiler is >talking to himself over and over again all day long. I believe the best way to deal with net.pests is to ignore them. When they realize they are talking only to themselves, they will go away. BTW, his name is not Lance. ==================================== Engineering Network Services Steve Dempsey Colorado State University postmaster(a)longs.lance.colostate.edu Fort Collins, CO 80523 ==================================== +1 303 491 0630 - -Nik -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLTnVomQa8GyiAZrpAQHQWQQAqljWmUyMkgShJWvnBHAo4Y/dbvTIBzds O/PG70FxEMTTYMvz+m0zDXh5ipJzCiFQPEkGaw8+nLkBWgRDYaJ02FNojm9el5X0 /JtjjEvgutKpukV7w/aP8+QDQHLNCKoE8KEV9OrMvglAWwHm+muJYoF1nhUi1RTx Wi0oB155A80= =avk4 -----END PGP SIGNATURE-----

1 0

Re: PGP's e exponent too small? Not!
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matthew J Ghio, <mg5n+(a)andrew.cmu.edu>, argues that low public exponents such as are used by PGP are unsafe in the RSA public-key cryptosystem. I think his analysis is mistaken, although there were a fair number of typing errors which make it hard to be sure I am understanding him correctly. > Here's why > you shouldn't use low powers of d: The issue is not whether the d power should be low; of course it should not be, since that is the secret exponent, and choosing a small one will make it easier to guess. The question is whether small e values are unsafe. I think this is just a typographical mistake. > Remember that d and e are factors of (p-1)(q-1)+1. This is the fundamental error in his analysis. The correct equation is d*e = 1 mod (p-1)(q-1) or, in other words: d*e = k(p-1)(q-1) + 1 All of Matthew's reasoning about putting bounds on d*e (he often writes of bounding p*q, but I'm pretty sure he means d*e) is based on this false assumption that d*e is a factor of (p-1)(q-1)+1. Actually, the true relation is that (p-1)(q-1) is a factor of d*e-1. The concern about low values of e in the Schneier book relates to the issue of RSA-encrypting the same value with the same low e value and different RSA moduli. This might be done if you were using "pure" RSA (which PGP and PEM do not) and encrypting the same message for multiple recipients. Kaliski is right that adding random padding to what is encrypted will eliminate this attack. PGP and PEM do add such random padding, following RSA's Public Key Crypto System standard. Hal -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLTnW4agTA69YIUw3AQFPOAP9Hk+bwFCgF6F16Cl+WUh0ZfoUvHXLQGuV +pGVySmTe1yftSUq4NQTVMFmzHXc16MvxJjMBYgH445qpwn9EgHVHISG/YdaDsFs 9AA7c5lcgLxUPwzwkOLlUhICXyFLy+Hz9kWqE90ypd+7RFk0UiCwtIT9EsVywC0c 3GM8BKtJNJI= =/BA8 -----END PGP SIGNATURE-----

2 1

TC May, Taxes and Colored People
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Graham Toal <gtoal(a)pizzabox.demon.co.uk> writes: gt: >Subject: Re: neo-nazis "supported" by NETCOM gt: >Newsgroups: netcom.general gt: gt: In article <tcmayCJMv4q.3wq(a)netcom.com> tcmay(a)netcom.com writes: gt: > gt: >And I appreciate that Netcom has never once warned my for what many of gt: >my critics have called seditious postings. It is true that I look gt: >forward to seeing the collapse of the U.S. governement and the end to gt: >the taxation that steals from me to give to so-called "people of gt: >color." gt: > gt: >Some call me a Nazi, which is wrong. I use Netcom to spread strong gt: >cryptography, the tool which will help overthrow the corrupt U.S. gt: >government and usher in anarcho-capitalism. gt: > gt: >If this view interests you, contact me about joining the "Cypherpunks" gt: >mailing list. gt: > gt: >--Tim May As a tax-paying colored person I share Tim's concerns about the disposition of my tax money by the U.S. government. My parents, who are also colored, and many of my colored friends, relatives and acquaintances also pay taxes. However, given all of the questionable governmental expenditures (clipper, et. al) that are usually talked about, singling out "so-called 'people of color'" seems a bit peculiar; especially as part of a recruitment drive for a cryptography list. Surely, there are more interesting reasons to join the list. (And, as we celebrate his birthday this weekend, let's not forget that Martin Luther King, Jr. was a victim of FBI wiretapping). HasnUt the U.S. government done worse than give TimUs money to colored folk? Just as Tim anxiously awaits the "collapse of the U.S. government," many colored people in our fair land once awaited an end to slavery (a wait that ran around 300 years or more - Patience Tim). Colored people have thought about the U.S. government quite a bit over the years. Well...we'll see if strong cryptography is indeed Tim's "underground railroad" to the "promised land" of anarcho-capitalism. <Rodney King> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLTmkTrcOmH2KTo5BAQGVygP/SM/8nvOWzHgWj1ogSGPgofwG3DaRD3so pir+i4qAsRvmj/LaankoH4T6dL7HQoqqhLcmK1A44Ni6w08Vr/Zxme5lsv8AL207 Ye/HgtxUlecraE2ULScR3S+7WIdJN7+ljLnyemdHyMGzc1d+r2xh+UxHtvazncfK QDuWPUL7eVg= =xupK -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi05oMkAAAEEAMeHmva0y3bqUVFlrRLto4UIrLtwK58TVOKNrPRMn/SMD7qs ei083E8ftwy4L0xRw9QDGJwVRoAcfSEeCEa4seWWnDLV+NptzSMnUm5FiqUuZ5i3 Dr0fQzc6oI2e6gxwXo1TgmcocTv8cQwFNA8M6oJL0KCC/0v3frcOmH2KTo5BABEB AAG0C1JvZG5leSBLaW5niQCVAgUQLTmh6rcOmH2KTo5BAQF9qAP/Vfrmvohhuwtp ODfsmnw6S2hOZCYx5dlwJYELuT4RD+a5xKjGllHADfKhPSryqk3dQdDqtU2w2IEv U6RMkyHIdBNcGGoZO3Wc4yfCz3UArdW8wFD6b+UWyDHl+1PCVGi2Z5q4frwlQCQr le9H7XqSszYoIAvGTaDSXgcQUmUW144= =P0PB -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: PGP posting validation
by drzaphod＠brewmeister.xstablu.com 17 Dec '03

17 Dec '03

Robert A. Hayden [hayden(a)krypton.mankato.msus.edu] wrote: > > Here's my two cents' worth- how about a filter on incoming mail to the list > > that performs these functions: > > 1) check the incoming post for a PGP signature > > 2) If a sig is found, check it against the list's public keyring Hmm.. this would allow us to prove that THE LIST thinks he's who he says he is.. or who THE LIST tells us he is.. Now, I am not paranoid against THE LIST, but I suggest that THE PEOPLE should not filter THEIR thoughts. What of censorship [on an aside, is there a censor apprenticeship? Why the 'ship?']!? If you must censor.. censor your own messages with filters running on your own machine.. maybe even publish your filter list to the net so we can all understand each other. Remember that there will always be a percentage of noise in any public forum.. there is no average without these outliers. For a group SO interested in RANDOM numbers, some people sure do want to organize everything. TTFN. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)brewmeister.xstablu.com] [MindPolice Censored This Bit] - - 50 19 1C F3 5F 34 53 B7 B9 BB 7A 40 37 67 09 5B - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

3 4

Re: MEDUSA *LIVES* IN CYBERSPACE!! (fwd)
by Peter shipley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just got this emailed to me at the technical and administrative contact for the dis.org (where a remailer is mainiained). Since cypherpunks is given credit for the contence I figgured I would forward the complaint... -Pete Shipley - ------- Forwarded Message Return-Path: lwright(a)cac.washington.edu Return-Path: <lwright(a)cac.washington.edu> Received: from remarque.berkeley.edu by merde.dis.org (4.1/SMI-4.2) id AA19742; Sun, 16 Jan 94 13:49:07 PST Received: from ucbvax.Berkeley.EDU by remarque.berkeley.edu (8.6.4/1.31) id NAA02945; Sun, 16 Jan 1994 13:49:02 -0800 Received: from shiva2.cac.washington.edu by ucbvax.Berkeley.EDU (5.63/1.43) id AA27381; Sun, 16 Jan 94 13:47:01 -0800 Received: by shiva2.cac.washington.edu (5.65/UW-NDC Revision: 2.29 ) id AA22478; Sun, 16 Jan 94 13:48:54 -0800 Date: Sun, 16 Jan 1994 13:48:54 -0800 (PST) From: Linda Wright <lwright(a)cac.washington.edu> Subject: MEDUSA *LIVES* IN CYBERSPACE!! (fwd) To: shipley(a)ucbvax.Berkeley.EDU Message-Id: <Pine.3.89.9401161301.C22450-0100000(a)shiva2.cac.washington.edu> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII You are listed at the technical and administrative contact for the dis.org domain. I would appreciate it if you would let "remailer" know that this announcement was completely unappreciated by the 730 members of the CLASSICS list and that we do not want this to happen again. Thank you. - - -Linda Wright University of Washington CLASSICS Listowner - - ---------- Forwarded message ---------- Date: Sat, 15 Jan 1994 21:14:40 PST From: remailer bogus account <remailer(a)DIS.ORG> To: Multiple recipients of list CLASSICS <CLASSICS%UWAVM.BITNET(a)uwavm.u.washington.edu> Subject: MEDUSA *LIVES* IN CYBERSPACE!! INTRODUCING === ##### #### ## ## #### ##### ## ## ### ## ## ## ## ## ### ## ## #### ## ## ## ## ## #### ###### ### ## ## ## ## ## ### ## ## ##### ###\\ #### #### ##### ## ## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Introducing the SECRETLY QUIZZICAL UNIFIED INTERNET SNAKE HUNT! * THOUSANDS OF CONTESTANTS * HUGE CASH PRIZES * * FASCINATING DISCOVERIES * HEDONISTIC DELIGHTS * * FANTASTIC FUN FOR EVERYONE * ENDLESS ENTERTAINMENT * CONTENTS ======== - - - INTRODUCTION - - - UPDATES - - - DEADLINE - - - THE CASH PRIZE - - - MORE ABOUT `SQUISH' & `FACE' - - - QUESTIONS === The recent WHITE HOT interest by multiple groups and individuals in the CYBERANARCHIST TENTACLE INFILTRATIONS into the Internet have inspired an EXCITING NEW CONTEST and COMPETITION! we, the Federation of Associations of Cyberspace Everywhere (FACE), announce the SUPREMELY QUACKY UNIFIED INTERNET SNAKE HUNT! (SQUISH) * THOUSANDS OF CONTESTANTS * HUGE CASH PRIZES * * FASCINATING DISCOVERIES * HEDONISTIC DELIGHTS * * FANTASTIC FUN FOR EVERYONE * FAMOUS PARTICIPANTS * UPDATES === updates on the SQUISH contest will be posted regularly. Send in notice of the more spectacular point accumulations with proof for verifications immediately and the Halls of Fame and Shame. Unverified points are not valid toward the cash prize. DEADLINE === TIME IS RUNNING OUT! AVOID INQUIRING FURTHER OR WAITING FOR FURTHER INSTRUCTIONS. START IMMEDIATELY! MONTHS OF PARTICIPATION ARE REQUIRED TO ACCUMULATE COMPETITIVE STANDING. SOME PARTICIPANTS ALREADY HAVE A HEAD START. THE CASH PRIZE WILL BE AWARDED APRIL 1, 1994. FURTHER INCREMENTS WILL BE AWARDED AT YEARLY INTERVALS THEREAFTER. MORE ABOUT `SQUISH' AND `FACE' === The Federation of Associations of Cyberspace, Everywhere was founded in 1994 as a group that coordinates the activities among the many different online organizations. We have played a very low-profile role to date, and wanted to find some way of promoting our newfound alliance. We have groups combined from BBSes, local area networks, the Internet, and other global and local networks around the world (see below). We have built up some membership funds from the contributing organizations and private contributions to provide the prize money for SQUISH, and some private individuals have donated significant amounts. The contest was inspired by S.Boxx, who was the architect of point classifications and the current opponent lists. S.Boxx has also promised to provide any funds necessary for the successful completion of the contest. We hope that recent interest into snakes and tentacles by many on the Internet will make the contest spirited entertainment and a strong success. We encourage reporters and the media to use this announcement as our official press release. Feel free to redistribute or comment on this announcement in any forum. QUESTIONS === Address further questions to cypherpunks(a)toad.com, gnu(a)toad.com, tcmay(a)netcom.com, or hughes(a)ah.com. Some additional information is available in RISKS 15.25, 15.27, 15.28x: ftp CRVAX.SRI.COM, login anonymous, directory RISKS: (include the colon), file RISKS-i.j === ///// //// // // //// ///// // // /// // // // // // /// // // //// // // // // // //// ////// /// // // // // // /// // // ///// ///\\ //// //// ///// // // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Introducing the STELLARLY QUOTABLE INTERNET SNAKE HUNT! === Brought to you as a coordinated effort between the individuals * S.BOXX * MEDUSA * INFOCALYPSE * THE EXECUTIONER * PABLO ESCOBAR * DEADBEAT and the Federation of Associations of Cyberspace Everywhere (FACE) * ILF (INFORMATION LIBERATION FRONT) * BLACKNET (INTERNET ESPIONAGE COORDINATION HEADQUARTERS) * BLOODNET (CYBERSPATIAL BLACK MARKETEERING AND LIQUIDATION SQUAD) * CRAM (CYBERSPATIAL REALITY ADVANCEMENT MOVEMENT) * CRaP (CYBERANARCHIST REPRESSION AND POISON) * CY{B,PH}ER{PU,WO}NKS === * THOUSANDS OF CONTESTANTS * HUGE CASH PRIZES * * FASCINATING DISCOVERIES * HEDONISTIC DELIGHTS * * FANTASTIC FUN FOR EVERYONE * CRIMINAL CONVICTIONS * * GRISLY DEATH TORTURE * JUDGEMENT DAY * APOCALYPSE NOW * - ------- End of Forwarded Message -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLTof3XynuL1gkffFAQE21wH+JYX/bsJvaIpTApsOjNqaeQFBAdkeCpOZ kXYx4yabmOPSDaUoUBTXV3t45GYGFfadILaT/IX8SMjOcJbqW+RXwA== =AhwP -----END PGP SIGNATURE-----

2 1

Crypto and Taxes
by Duncan Frissell 17 Dec '03

17 Dec '03

H>I agree with the last point about legality helping, but I don't H>understand why most transactions will become legal in the future. I H>thought we were talking about ways to evade laws via cryptography. Legality is a matter of time and place. The nets let us pick our time and place. A non-economic example: It is a crime for someone in Germany to produce, possess, or transfer "Nazi Material." It is legal for someone in the US to produce, possess, or transfer "Nazi Material" (substitute other jurisdictions and other "material" to taste). If I am in Germany and I download "Nazi Material" from the US, no crime has occurred in the US. A crime may have occurred in Germany but discovery and proof will be very difficult. Encryption will help here. Info contraband (which also include things like "unregistered securities" or "American Movies in France") can be produced and accumulated where legal and acquired anywhere else. Production and distribution remain legal. In some cases the possession may be illegal but in others (unregistered securities) it won't. H>My assumption is that governments would actually crack down when faced H>with lost revenue, similar to what was described as happening in Italy: If 90% of GWP is on the nets, cracking down will be difficult because there is nothing to seize. What is happening of economic value on a private, encrypted net? Who knows or can know? Enterprise networks (properly designed) will only respond to their owners. No one else can have a say. Governments will be reduced to taxing the remaining physical parts of the economy. Meanwhile, people will be learning what it's like to live in a free society for part of the time (on the nets). They will not put up with restrictions in their physical life. They will have assets and attitudes that they can apply to freeing the rest of their lives. When people turn away from obedience, governments disappear (see the DDR) or at least weaken. God fights on the side with the heaviest artillery. Unless you can suggest some sort of artillery that governments could use over fiber optic cable, they will be disarmed in that environment. In the early 80's when Continental Illinois Bank was going bankrupt, these fun telexes used to arrive every day from Tokyo. "CANCEL OUR OVERNIGHT DEPOSIT OF $10,000,000.00 EFFECTIVE TODAY". Suppose that the Feds had sought to seize this money (as governments have in the past). How do you seize an overnight deposit? It is gone when cancelled. Simple bookkeeping entry in Tokyo. Similar problems everywhere in cyberspace. H>Is this the key, people working for virtual businesses? No one knows H>the true name of anybody else, so no one is afraid of being caught? I H>am still skeptical. A whole nation of people tele-commutes to work for H>companies whose name they don't know, with co-workers protected by H>aliases, all so they can be paid in cash for their services. I find H>this notion implausible in the extreme. Joe and Jane Sixpack aren't H>going to want to work for a boss who wears a mask. They can know each other. They can be paid in digital drafts (checks) drawn on the First Internet Bank. Cash not needed. Their *nationality* need not be known and will be irrelevent. Taxation is geographically based. H>Duncan> What if the MUD/MOO exists as a set of cooperative processes H>Duncan> spread around the globe. H>This may be uncertain now, but I don't see why it would always remain H>that way. There is nothing to stop governments from declaring, say, H>that residents in their boundaries are subject to their taxation, or H>that their citizens are subject to their taxes regardless of where they H>do business. Try to enforce this requirement. In any case, foreigners will not be covered which will give them a real competitive advantage if residents of the high tax nations don't "cheat." In practice even in our current physical world, small businesses only report 48% of their revenue, the self employed have the lowest rates of individual tax compliance, and 61% of expat Americans do not file US tax returns. When almost everyone is self-employed or a small business and when regulators can be excluded from transactions by the simple application of crypto technology, compliance will suffer. H>More interesting from the crypto perspective would be the case where H>the business in the MUD refuses to disclose its true nationality or H>location. There again, though, I think running an anonymous corporation H>will pose many practical problems. It can admit that its location is Grand Cayman. After a short period of social development time, it will be able to admit that its location is on a street in a MUD commercial center. Virtual communities can be as real as a skyscraper (an artificial environment.) H>To sum up, I am willing to accept that people will be eager to avoid H>paying taxes, but I still doubt that cryptography will bring down the H>United States government. Particularly when we consider the lack of H>sophistication (both financial and technical) of the vast middle class H>who provide the bulk of tax receipts, I think that virtual H>corporations and offshore tax havens are not likely to become widespread H>enough to seriously endanger the government. Once we get a better interface... People will be drawn to the nets for the games and the thrills (no censorship). They will start by buying legal and forbidden items there. Some entrepreneurs will locate there. Any government restrictions on info will be market opportunities. Porno almost everywhere, the Asian WSJ in Singapore, non-government TV in India, US movies in France, etc. The last vestiges of control over money and investments will die. These sorts of restrictions create market opportunities that traders can arbitrage. The nets almost eliminate transaction costs. Government regs on banks, stock markets, telecoms companies, etc. will end. Once restrictions on types of info or types of money are smashed, the now flush markets on the nets will start to arbitrage the tax structures of nations. If a transaction costs more because it occurs in a particular jurisdiction and is taxed, people will be able to make money by transferring the transaction (or part of it) to a non-taxed area (the nets). Why hasn't this been done as much before? Transaction/transportation costs. Duncan Frissell "Good will and artillery will get you more than good will alone, anytime." -- Artillery officer's saying --- WinQwk 2.0b#1165

1 0

Re: MEDUSA *LIVES* IN CYBERSPACE!! (fwd)
by jdwilson＠gold.chem.hawaii.edu 17 Dec '03

17 Dec '03

Should you tell her? I don't know. This whole subject is a lose/lose issue. If you react to it you may be feeding the need for attention, and if you don't you might be tacitly allowing it to continue. It's a shame that the list is equated with the message. -Jim

1 0

Re: MEDUSA *LIVES* IN CYBERSPACE!! (fwd)
by Matt Thomlinson 17 Dec '03

17 Dec '03

since she's in my domain (.washington.edu) I sent her a note explaining the detweiler affair and asking her to please respond to the postmaster, etc. I'll try and take care of this. matt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: Using the tools we have
by Halvor Kise jr. 17 Dec '03

17 Dec '03

> For added security you could do something even better. The list > server only posts messages that are "trusted" at a specified level, or it > adds a trust factor to the message. If the list maintainer has met you > and has signed his key, the list server will believe you are real. With > the web of trust and introducers, the list server will quickly be able to > identify most of the people on the list as being real or "pseudo". In > particular this will cut down on the number of forgeries posted to the list. > So the maintainer would do a hole lot of traveling then? Who would come here to Norway to see and sign my key? The real world is still a little larger than the cyber-world. Halvor Kise jr. * MEMENTO MORI * __________________________________________________ | Halvor Kise jr. * Username: halvork | | * Server: sofus | | Ostfold * Site name: dhhalden.no | | Regional College * Student at | | N-1757 Halden * Computer Science | --------------------------------------------------

1 0