December 2003 - cypherpunks-legacy

Stego in Jazz?...The Miles Files
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Straightahead jazz fans take note! More significant bits follow: * Critics who claim jazz = noise now will understand that jazz evolved in the 1940s as a stego method for communicating with agents in the field. * Hitler was right in suspecting "that Negro music." * Agent Parker developed method of putting signals in Bird calls, with great sax appeal. * Unveiling below of "crypto-jazz" movement. Cryptids are spreading the PGP word. Jazz raves to be the Next Big Thing. From: esharp(a)panix.com (Elliot Sharp) Newsgroups: rec.music.bluenote Subject: crypto-jazz Date: 3 Mar 1994 12:10:51 -0500 Organization: PANIX Public Access Internet and Unix, NYC Message-ID: <2l55mr$b5s(a)panix.com> Summary: a night of Keywords: Sharp,Ribot,Berne on Tuesday, March 15, the Cooler (416 W. 14, NYC) will present a night of crypto-jazz with: 10 pm Elliott Sharp's THE CRYPTIDS (Sharp-reeds, guitar w/ Reuben Radding-bass, David Gould-drums) 11 pm Marc Ribot - solo guitar 12 am Tim Berne's BLOODCOUNT (Berne-reeds with quartet)

1 0

Update on user-level hack to do telnet encryption posted recently
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

OK folks, I've started tidying up that hack code I posted recently which outlined a method for rolling your own telnet-style encryption. In particular, I've done the hard bit of making it work with an arbitrary binary 1:1 stream cypher, rather than the original hack which *had* to encrypt printable text as printable text (to get it through 7 bit terminal links). [Note, anyone who didn't look at it too closely because they thought it was only for telnet - look again: it's useful for *any* local to remote connection, even kermit down a serial line, as long as you're calling between unixes.] Now, what I need are volunteers - preferably outside the US and any other country where any relevant patents are valid - to work on a suitable stream cypher. Note you don't have to use any patented technology, as long as whatever you come up with is sufficiently secure for your needs - this will eventually be issued as a modular system, with the default encryption module being rot13. If you don't really care much about the strength of encryption (assuming your only opponents are kids who sniff packets who won't have enough crypto experience to decode even an trivial cypher) then there's a lot to be said for everyone implementing their own variation... just for the amusement of tying up the time of all those more competant people who feel they have to know everything that's going on everywhere in the world. Machine cycles they can afford aplenty; man years are a different question... Anyway, back to the project: Currently there's a trivial interface that you can work to - I suggest for demo purposes just using a hard-coded known key at each end, and we'll do the key exchange stuff after we've got the stream cypher working. Here's the header file: /* Placeholder module for arbitrary stream encryption */ #define STATE_SIZE 128 typedef struct cypherstate { char *unique_tag; char whatever[STATE_SIZE]; long int byteno; /* Add useful stuff here as need be... */ } CYPHER_STATE; void new_cypher(CYPHER_STATE *s, char *unique_tag); char stream_cypher(CYPHER_STATE *s, char byte); Put any state you need in the struct, initialise it (with a known secret key for now) in new_cypher; and supply a function that does a 1:1 encoding of a byte in stream_cypher. Make the function stateless apart from the CYPHER_STATE parameter so that it can be used to encode multiple streams without interference. With a bit of help from you guys, this project shouldn't take more than a week to get a prototype running... When I have a feel for what sort of encryption methods people want, and how precisely they're implemented, I'll know better how to generically code the key-exchange part too. I don't think it's appropriate for me to post any more source over the net. Anyone who wants to discuss this in public rather than by mail, I suggest we stick to alt.sources.d Anyone wants the current sources, send mail to gtoal(a)an-teallach.com Thanks G PS The sources I have probably won't work anywhere except on BSD systems. If you want to make the framework bit work on other versions of unix, drop me a line about that too. Your programming will have to be up to the level of writing a clone of the unix 'script' command, which is all this program is really. PPS Americans: please don't get either you or me in trouble by mailing me unsolicited gifts of crypto code. I don't want it. The crypto part of this project is for those people in countries where there's no legal barrier to them participating.

2 1

Seattle Times, 3/6/94
by Matt Thomlinson 17 Dec '03

17 Dec '03

The Seattle Times' front page story (1984 + 10 years) leads into a few articles on pg 18 that deal with encryption/clipper/privacy. Paul Andrews seems to have a _few_ misconceptions about exactly what the clipper chip will do, but all in all it seems like a good wake-up call. This article is the first in a series in privacy, it says. I'm glad something like this made the front page. mt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

Looking for listserver
by Syl Miniter 803-768-3759 17 Dec '03

17 Dec '03

i am interested in setting up a listserver and I would appreciate it if someone can point at a source of some basics on the Internet thanks Syl

2 1

RSAREF help requested
by Eric Conrad 17 Dec '03

17 Dec '03

I need to use RSAREF to do 3 simple things: generate a keypair, encrypt a file, and decrypt a file. This is so that I can safely encrypt online information with the public key, while keeping the private key offline. PGP does what I want, but I can't use it due to legal reasons. Ripem does too much (all the mail and key management stuff), and is too complex for my purposes. I've begun writing the C code using the RSAREF libraries to do what I want, but I'd rather not recreate the wheel. Has anyone written the simple tools I described? ...Eric

1 0

Re: Update on user-level hack to do telnet encryption posted recently
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

> OK folks, I've started tidying up that hack code I posted recently which > outlined a method for rolling your own telnet-style encryption. I really think this project is a serious mistake. People should, if they insist, produce software compatible with the draft RFCs on telnet encryption and authentication -- although such code has already been written. The notion of putting in all this effort just to avoid having to deal with your system administrator, especially when he should be happy to install such code given the recent rash of internet breakins, seems misplaced to me. Perry, I'm no longer interested in what you have to say. You've been a wet blanket and have pooh-poohed every practical suggestion I've ever seen anyone making - weren't you one of the first people to post to the netphone project telling us we were all wasting our time? Cypherpunks write code, except when asked not to by Perry Metzger. The point of this code, in case you missed it, is so that people can take responsibility for their own encryption and not have to trust software installed by someone else, just like we all use pgp rather than Clipper. Now, if you don't have anything useful to contribute, shut up and stop trying to discourage those who do. G

3 4

Re: Truly Stealthy PGP
by Hal 17 Dec '03

17 Dec '03

From: hughes(a)ah.com (Eric Hughes) > What I suggest is making the exponent (the encrypted session key) > completely random over the length assigned to it, since that's > visible, and just live with a slightly non-flat distribution of > exponents mod n. It turns out that this can be made to work just > fine. > > n is the modulus. Divide L by n to get L = t * n + s, s in [0,n). > Assume x is random in [0,L). The entropy of x mod n is > E = log L/t - s(t+1)/L log( 1 + 1/t ) > > What is the smallest value of E? In other words, what's the upper > bound of the randomness we can lose? It happens when when t = 1 and > when n = L/2+1. This maximize the expression in t and maximizes s at > n-2. This minimum value of E is > > E_min = log L - ( ln 2 - 2/L ln 2 ) > > In other words, the most entropy we can lose is two bits. That's > right, only two bits. Since the entropy of the session key is the > length of the modulus, for a 1000 bit key the entropy loss is > negligible. I'm not sure the point of this entropy calculation. For the case n = L/2+1, t=1, it seems to me that the RSA-encrypted session key (sk^e mod n) is never going to have the high bit set, so with K such messages it should be possible to tell that something is going on with probability 1 - 2^-K. > Therefore, my recommendation is that the session key representation be > chosen randomly over [0,2^k) and to use as an actual session key this > value mod n. The effective entropy loss is small enough not to worry > about. > > Eric > If the session key is chosen from [0,L), still the encrypted session key m = sd^e mod n will be uniform in [0,n). I don't quite follow here how exactly we go from something uniform in [0,n) to something uniform in [0,L), if that is what Eric is proposing. Hal

2 1

delete from list
by leonar716＠aol.com 17 Dec '03

17 Dec '03

delete my name from cypherpunks BBS

1 0

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

about joe6pack>>> though joe 6-pack might not vote, and likely won't even understand about the crypto of it all. he would understand the police listening in on his conversations with jill 6-pack. and not like it to well. i do think though that the ge that the general public should know, what the congress is getting itself into other topics before congress get aired why not this one. making it simple for simple minds, might be beyond some folks though there has been talk here about how to go about the process. which on the surface looks so easy. but the general populace of the US of A has a bit of problem with concepts at times. big bangs and lots of noise and death, that sure does catch attention, for about 20 seconds. the computer folks are going to be fighting with the gov't types til the end of time and the joe 6-packs are going to be stuck in the middle. but we need them more than we need to alienate them. they do pay taxes, some of them do vote, and some of them are the rich and famous we want to get our point across to. not every rich man knows about computers. we as a group or as individuals should at least try to let the joe 6-packs that we know in on the secrets the gov't and the FBI and the NSA are trying to hide from him. maybe that is the point of a so called free nation. and sure we might not run this country, but public outcry most times turns heads in congress. charles the monster maker

1 0

RE: New mailing list?
by Blanc Weber 17 Dec '03

17 Dec '03

"I want each reader of these words to reflect on the phrase "implementing culture". If you do not realize the magnitude of this principle and have some respect for its enormity, I would sincerely suggest that your time would be better spent reading some political philosophy and some technological history and pondering over your desires, to make sure that you know them." Okay, Teach. :>) Thanks for the clarification, Eric. I remember some critical statements made about your attitude toward modifications to list and the suggestions which you apparently shot down. I remained silent but wondering. "Cypherpunks is where the politics meets the code. .... Policy separated from development lags the reality of deployment, and necessarily. " These are some things I have thought about, upon reading complaints against the tangential discussions which come up on the list: It is not unimportant to engage in these conversations as they develop, to allow for the associated efforts to achieve precision on attitudes/expectations which counter the rest of the intellectual atmosphere of acceptance, especially when one might be required to produce just cause why things should go in one direction (yours) rather than another (theirs); when you might have to answer to 'authorities' for non-complicity to collectivist programs. Some people do (and some should) struggle for better justification in their own mind, of their position relating to what they themselves do (writing & distributing code which permits alternatives to government-supplied arrangements), of what they advocate to others that they ought to do (positive or negative support for a method/plan of action), or would prevent (as in thwart the progress/implementation of Clipper). It is not unimportant to be clear about the propriety of the motives behind an argument, to be satisfied that one is correct - that it isn't merely 'whining' because one is not getting one's way, or because the government & its advisors are not sufficiently lenient in their outlook; that there is philosophical, logically consistency in the actions/solutions proposed. It is not unproductive to maintain a general awareness among all those who would deem to be of the same "attitudinal alignment". Else how could such a group survive as advocates of ideas promoting complete independence & total autonomy. (euphemism) I myself would welcome the existence of a more thorough elaboration on this subject, from yourself and the others who founded the list: an explanatory FAQ for reference, especially on the matter of "implementing culture", since this implies more than simply effects dealing with government. Blanc

1 0