December 2003 - cypherpunks-legacy

Re: HoHoCon key exchanges
by Joe Thomas 17 Dec '03

17 Dec '03

In my experience, mass key-signing on a few laptops is a waste of time. It might be a fun waste of time at a convention, but it made the one Washington Cypherpunk meeting to date kind of a drag. Far more efficient is to print up a paper certificate with your key and its fingerprint, run off a bunch of copies, and sign them. Pass them out and let people verify your credentials; everyone does a batch signing when they get some free time. Then everyone mails their key ring to a server, waits a few days, and collects all their new signatures off the same server. But, again, maybe that takes the fun out of it. To each his own... Joe

1 0

RE: hohocon
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

> From: Timothy Newsham <newsham(a)wiliki.eng.hawaii.edu> > > hmm.. looks like the ideal for someone to test out a dos virus that > looks for the PGP passphrase and for secret key rings and tries to > "get out alive" with them. > > Tim N. > > Coders start your engines. > Don't type your PGP passphrase on a PC owned by someone else! You don't have to use your passphrase to exchange keys. Keys can be extracted, added, etc. without the passphrase being entered. I don't see any way a virus could be spread via PGP key exchange. At best (worst) a virus could somehow attach itself to the PGP key file but it would be just passive data. It wouldn't do anything. Hal

1 0

Duress Passwords/PINs/Combinations
by baldwin＠LAT.COM 17 Dec '03

17 Dec '03

Having a separate authentication mechanism that is used under duress is a very good idea that some existing systems already employ. I'll pass along the ones I have had contact with. From a systems point of view, it is hard to figure out exactly how the system should respond when it recognizes a duress authentication. There are competing interests as I'll explain after some examples. The safe inside the ATM machines used by BayBanks (Boston Mass) can be opened with two combinations. One combination sends an alarm to the bank via a separate phone line (not the one used to perform the ATM transaction). The alarm phone line is also connected to a conventional panic switch. A fellow I know has a central-office alarm in his home. When the alarm goes off, the office calls his house to ask if it was a false alarm. They ask for a password to verify, and no matter what password you give they say "OK, I'll log it as a false alarm." If you gave the wrong password, they call the police and notify them of a crime in progress with hostages. If no one answers the phone, they send one of their patrol cars. The challenge-response token that Attalla sells (which is a repackaging of someone else's token) supports a fixed or variable duress pin. In the fixed duress pin mode, a special PIN, usually "1111", causes the device to use a fixed different key to compute the response to the challenge. The code that authenticates the response checks for a use of the duress key if the response does not correspond to the value expected for the user's key. The variable duress PIN approach is a feature of the card where the user can set which PIN value causes the card to use the alternate key. From a software point of view, the authentication procedure returns Yes/No/Duress. Note it is possible to have a collision between a duress response and a regular response. The competing interest problem is illustrated by the following possibility: A criminal makes an ATM money-filler open the safe at gun point (the ATM repair people do not know the safe combination). The criminal says that she knows about the duress combination and threatens to shoot the kneecaps off the person if they use the duress combination. The criminal will take the money-filler hostage for a few minutes to guarantee a clean get-away. So what does the money-filler do? To use the duress combination requires faith that the bank will handle the situation in a subtle way and thus avoid major knee surgery. For the bank, why risk loosing any money or loosing the criminal. In fact, why not just refuse to open the safe in the first place? What is the right balance between these interests? How does each party trust that the other will behave as expected? What is the benefit of this approach when the criminals already know about it? It works well against criminals that don't know about it, but is that enough to justify the overhead? These questions are not show stoppers. Individual organizations can and do answer them in order to make rational choices about duress authentication. In the cases of communicating cells, the key benefit is giving the adjacent nodes time to cleanup their surroundings of evidence or to totally "leave town". --Bob

2 1

Sorry...
by --spin＠iastate.edu-- 17 Dec '03

17 Dec '03

I am terribly sorry about the last message. The Cc: escaped my attention. I shall be more careful in the future.

1 0

souls and Multiple Personality Disorder
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <m0ozdjZ-000HXQC@khijol> erc(a)wetware.com "Ed Carp" writes: > I thought this was rather tasteless. MP is real. My SO is MP. It's not > very funny. Do you know what causes MP? Childhood sexual abuse. Possibly, but more often overzealous psychiatrists with an axe to grind. (Let me guess, she had no history at all of MPD before she went to a psychiatrist for some unrelated problem, right?) G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

4 3

Signal to noise/real issues
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9311181959.AA12707(a)anon.penet.fi> an41418(a)anon.penet.fi "wonderer" writes: > those, then maybe I'm in the wrong mailing list. I think I'll post > a copy of that message to sci.crypt where people are interested in > real crypto issues. Try talk.politics.crypto and avoid pissing off everyone on sci.crypt too :-) G

1 0

Forwarded mail from S.Boxx
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <199311181642.IAA26892(a)soda.berkeley.edu> hughes(a)soda.berkeley.edu "Eric Hughes" writes: > This one was just too good to resist. > From: an12070(a)anon.penet.fi (S.Boxx) > > I've finally figured out your intense loyalty, sensitivity, and > secrecy. You're homosexual lovers. > > Quite a complex and secretive culture, these cypherpunks. ITS NOT FAIR! He doesn't accuse me of being a tentacle and I don't get any interesting love-life assigned to me either :-( Can't I have one too, pretty please Lance? ___ G \X/ (The main reason I don't use these things in my sig is coz I never could draw ascii art worth a damn...)

1 0

ytalk help
by erc＠khijol.yggdrasil.com 17 Dec '03

17 Dec '03

Help! I got ytalk from soda.berkeley.edu and compiled it. Now it complains it can't find the ytalk daemon! There's a ytalkd.c, but it won't compile, and there's no target in the Makefile for ytalkd. Help!!! The documentation is a big lose, and the author doesn't answer his email :( :( -- Ed Carp, N7EKG erc(a)wetware.com 510/659-9560 an38299(a)anon.penet.fi, anon-1157(a)twwells.com If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever"

1 0

CryptoCards
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Could someone send me either a vendor of SecureIds (or a similar challenge/response card) or a Spec sheet, parts list and approximate cost of manufacture of one of these monsters? I've got some ideas for Telco security schemes but Id like to see what sort of Margin Im looking at first. Thanx ahead of time. --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

2 1

Re: Guerilla Cells
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> From: Matthew J Miszewski <MJMISKI(a)macc.wisc.edu> > > The sendero luminoso in Peru also works this way...Of course if you break their > rules, they break your neck! > > For security reasons each 'member' of the Shining Path is only allowed > to know of two other persons in the heirarchy. This makes for good > plausible deniability as well as qwik and efficient dissolution. In Light of my posting regarding The A./. A./. ( oh.. my use of the "./." glyph is s'posed to be an ascii representation of a glyph comprised of three dots in an equalateral traingular shape, that is when its not signifying the everlasting secret family connections of the CP's -ie:cum pigs- and stands for the erect phallus and testacles :-) it should be noted that *Sendero Luminoso - shining path* is a blatant reference to Masonic/hermetic practice. It should also be noted that Masons have been (succesfully) using graphic key based encryption of their secrets for as long as they have been around, that passwords are another key element of their craft, and that every president of the united states except one has been a mason. ( can we guess which one? :-) LUX ./. owen this message needs no NSA fodder, it is subversive enough in its directness.

1 0