December 2003 - cypherpunks-legacy

Re: current remailer list?
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

Before my mailbox is filled with answers, thanks to Karl Lui Barrus for answering my request for a remailer list. -john. -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 http://phoenix.aps.muohio.edu/users/jdblair/home.html KILL YOUR PGP public key available upon request. TELEVISION

1 0

Clipper LEAF Holes?
by Mike Ingle 17 Dec '03

17 Dec '03

As I understand the Clipper/Capstone LEAF, it works like this: Take 80-bit session key. Encrypt with device-unique key. Add 32-bit serial number and 16-bit checksum. Encrypt resulting 128-bit packet with family key. One of the EES chips, the type designed for cellular and other phones, operates in "1-bit CFB mode". This would seem to indicate that it is a straight-thru device - that the data input and output rates are the same. So the LEAF is only sent once; it is not repeated throughout the output. The user is forced to send a valid LEAF because the receiving chip will not set up without receiving a LEAF. But how does the receiving chip check to see if the LEAF is valid? The obvious way is to decrypt it with the family key, and then verify the checksum. But EES chips for different countries will have different family keys. So if an American EES chip sends a LEAF to a foreign one, how does the foreign one verify the LEAF? Even if the receiver can decrypt the first level of the LEAF and examine the checksum, it doesn't have your device-unique key, so it cannot check to see if the session key in the LEAF is the same session key that you sent to it. So it would seem that any valid LEAF would work, even if it is not the one for the current session key. Am I missing something in the Clipper design which prevents this? --- Mike

1 0

The un-BBS
by Mike Ingle 17 Dec '03

17 Dec '03

There are occasional waves of actions against BBSes. The most recent onFrom owner-cypherpunks Sun Apr 24 05:14:11 1994 Return-Path: <owner-cypherpunks> Received: by toad.com id AA22474; Sun, 24 Apr 94 05:14:11 PDT Received: from cap.gwu.edu by toad.com id AA22467; Sun, 24 Apr 94 05:14:06 PDT Received: by cap.gwu.edu (4.1/SMI-4.1) id AA27650; Sun, 24 Apr 94 08:14:43 EDT Date: Sun, 24 Apr 94 08:14:43 EDT Message-Id: <9404241214.AA27650(a)cap.gwu.edu> From: sniles(a)cap.gwu.edu (Sabastian Niles) To: cypherpunks(a)toad.com Subject: FTP sites Reply-To: sniles(a)cap.gwu.edu Sender: owner-cypherpunks(a)toad.com Precedence: bulk Does anyone here know any good FTP sites for text files relating to programming/privacy issue/computer underground/or the like? If so, please e-mail me at sniles(a)cap.gwu.edu. Any sites that carry zipped files of the same subject matter would be welcome as well. Thanks.

1 0

Privacy with clipper
by Mikolaj Habryn 17 Dec '03

17 Dec '03

I seem to remember someone once writing that with the proposed clipper laws, you are allowed to encrypt messages before piping them through the clip chip, but the output must be left unaltered. The problem to this is that then whoever does the audits knows who's being sneaky. (Or something like that - i don't remember precisely.) Seems to me, if one is talking about videophone type devices, they are transmitting quite a great deal of info, and stegging in a message is quite feasible, is it not? You don't even have to do much of a hardware modification. Do something like having an HF carrier tone in the background, that anyone listening to it can't detect without the knowing what they're listenong for. Or insert a microburst transmission - it'll look like static. This is not to say, that the clip chip isn't worth fighting against, just that, as always, someone's going to come with a way around it. It's human nature, really. * * Mikolaj J. Habryn dichro(a)tartarus.uwa.edu.au * "Life begins at '040." PGP Public key available by finger * "Spaghetti code means job security!"

1 0

Clipper in Sunday Times
by Duncan Frissell 17 Dec '03

17 Dec '03

Page 5 of the Business section of the Sunday New York Times has a Clipper article by Peter H. Lewis. All the usual suspects. DCF "They are planning to smuggle automatic weapons a... move the plastic explosives in boxes disguised as in... keep secret from the authorities the identity of the p..." -- Either 1) The cleartext of the decrypted message in the "box" showing how Clipper works in the above article or 2) Governor Clinton personally directing weapons shipments to the Contras from the hidden CIA airfield near Mena Arkansas in 1986. --- WinQwk 2.0b#1165

1 0

Crypto toolkit
by Hal 17 Dec '03

17 Dec '03

From: Peter Murphy <pkm(a)maths.uq.oz.au> > I was most > taken by the idea of a "Crypto Toolkit". I think it would be understand- > able to write the code in plain, vanilla C (as opposed to C++). One > good reason is the widespread availability of C compilers, especially > with UNIX. Additionally, C++ compilers do take up more space (although > this would be more of an issue with PCs. I think Tim had in mind something that was accessible more from a higher- level language than C or C++; ideally, something interpreted so you could sit down and type in a few commands to get something useful. Perl and TCL are two languages which Tim mentioned and which have been discussed here in the past. Smalltalk might do, although it is not as "freely" avail- able. If you want a C toolkit, a good example already exists: the PGPTOOLS package by Pr0duct Cypher. It is available by ftp from csn.org in /pub/mpj to US citizens, and probably from some European crypto sites as well. This has a bignum package as well as interfaces to IDEA and RSA encryption. It also supports processing of PGP message formats and key rings. The latest version has code for Diffie-Hellman key exchange. Hal

3 2

RE: Warrantless searches -- Sorry to start this again....
by GERSTEIN＠SCSUD.CTSTATEU.EDU 17 Dec '03

17 Dec '03

You guys just keep saying the right things... My comments are below... -------------- Jim Sewell (jims(a)Central.KeyWest.MPGN.COM) said : >Subject: Re: Warrantless searches -- A sign of things to come? >To: cypherpunks(a)toad.com >Date: Mon, 18 Apr 1994 10:30:25 -0400 (EDT) >From: "Jim Sewell - KD4CKQ" <jims(a)Central.KeyWest.MPGN.COM> > >Slightly reformatted, but the content is faithfully reproduced: > ><My computer told me that GERSTEIN(a)SCSUD.CTSTATEU.EDU said:> >> >> On Sun, 17 Apr 94 13:39:39 >> paul(a)hawksbill.sprintmrn.com (Paul Ferguson) wrote: >> >> >A Page 1 story in The Washington Post Sunday (94.04.17) reads, >... [warrantless searches of housing project] ... >> Anyway, the point is, these people aren't safe in their own homes. > > Then the cops need to sting/watch these guys until they catch them > committing these felonies and throw them in jail, not invade the > privacy of a citizen cuz they think it's right. If the cops were > watching that neighborhood then the child couldn't have been sniped > without the shooter getting bagged. It is a poorly chosen solution to > the police force's inability to do their job well due to fear and/or > underfunding. You see, Jim, the drug deals go on inside the apartment buildings. How easy is it to do surveilance (sp?) on an apartment that is run by gangs, surrounded by their other apartments, on floors that are run by the gangs? Sure, you can do a phone tap. But that doesn't work on cellular phones.... You could also take over an apartment in another building and bounce lasers off the windows, but their damn music is too loud, or they change the rooms they do business in daily (the gangs aren't stupid, you know). And if you did find some way to bust them, how are you going to do it? Fire-fight your way through 3-4 floors of crack-crazed junkies with Uzi's? I don't think so. As far as the sniper killing that little kid, think about what you said. You really think the sniper didn't hang around on the roof-top, waiting for that first cop car to roll up? He's not dumb. They have to get to the building, and he can "reach" them a hell of a lot better than they can fire at him. And once they get inside, it's the same thing. The cops have to fight their way to the roof, at which point the gun and sniper are both inside the building somewhere, safe and cozy. In many ways, the situation has gotten better since the searches started. I AM NOT SAYING I AM FOR THE SEARCHES, I am merely saying that they are being productive. I challenge you C'punks to come up with a better solution. Given the circumstances that those involved are dealing with, it's pretty good for now. Adam Gerstein Comments to: GERSTEIN(a)SCSU.CTSTATEU.EDU Flames to: /dev/null -=-=-=-=-=-=-=- -=-=-=-=-

2 1

Re: Crypto toolkit
by Hal 17 Dec '03

17 Dec '03

> I went to this site to pick up PGPTOOLS but apparently it's moved > or something, since the pub/mpj directory doesnt exist and when I scanned > some other directories I didnt find it. Does anyone know another pointer > to this package? Sorry, my mistake: the directory is /mpj, not /pub/mpj. Again, the site is csn.org. You will have to read the file README.MPJ which tells the name of a "secret" directory to cd to (which changes every time). Then look at pgp_tools/pgptl*. Hal

1 0

licence plates seen
by mdbomber＠w6yx.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I saw a couple interesting licence plates on cars at work. One was 2PGP386 Now, that's a valid ordinary sequentially issued plate. But I'd still say the owner of that one has the right idea. :-) Another one on a car I've seen many times is 68 ASCII I don't have an ASCII chart available. What does this one mean? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLbq3bTSSmvXojb+5AQHFngIAnS/cs41ZKXf0kdtPBDmtZ5dgLov5OZ5O VmGg8S65xjZh8xNAOgvbgMOVDhefT0Vig8KlLRlGJG0WRRGkpbPt7A== =WIur -----END PGP SIGNATURE----- Internet: mdbomber(a)w6yx.stanford.edu Matt Bartley GPS: 33 49' 117 48' PGP keys on finger and servers

4 3

Today's Dumb Question?
by David Merriman 17 Dec '03

17 Dec '03

I've got what may turn out to be Today's Dumb Question.... What Happens If, instead of using prime numbers or logarithms for the basis for a public-key crypto system, we instead generated out public key thus: 1> pick an arbitrary bit stream (large [pseudo?]random number, binary representation of selected chunk of text or data file, etc). 1024 bits or more (in 256 bit chunks?) 2> enter a passphrase 3> XOR the bit stream with the binary representation of the passphrase, cycling the passphrase as necessary. This makes the 'large' component of our public key. 4> hash the passphrase to 128 or more (in blocks of 64?) bits. This makes the 'small' component of the public key. 5> We then use these components as in normal public-key algorithms. Conceptually (to me), this would seem to work, and have the advantage of not being dependent on the factorability of any number; that is, the numbers could be extended as necessary fairly simply. It would also seem to depend on the entry of a passphrase that would be securely 'locked' inside someone's mind :-) Too, it wouldn't seem to be subject to any kind of patents. Finally, if the arbitrary bit stream were taken from something like a section of text in a file, a sequence of bytes in a data file, or even absolute track/sector reads from a floppy/hard disk, the entire thing could be rendered useless by the user by simply erasing/wiping a single file or track/sector. Would something like this work, or am I missing one of the trees because of the forest? Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 'That's odd.... the computer model didn't do that....'

1 0