December 2003 - cypherpunks-legacy

GILMORE ON TV
by Sandy Sandfort 17 Dec '03

17 Dec '03

Hey C'punks, Was everyone too busy arguing about "freedom of the press" to note a real act of Cypherpunk stealth? While some of you were rehashing WWII, Cypherpunk co-founder, John Gilmore, was slipping cryptography between the lines in a news item about the "information superhighway." The item was about a "new" way to protect against (dare I say it?) pseudospoofing. Perhaps John will honor us with an official description of Cygnus Support's new software. S a n d y

1 0

OS2 IO driver for RNG-810 random number generator is released.
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have released an OS/2 device driver for the CALNET/NEWBRIDGE RNG-810 random number generator. The file rng-810.zip has been uploaded to ftp-os2.cdrom.com. It has been placed in the directory /pub/os2/incoming. I have recommended that this file find its ultimate home in: /pub/os2/2_x/drivers. It has also been made available in compu$erve forum: OS2USER LIB:3 as the file rng810.zip Sources are included in the file, and its is released under the GNU Public Licence. It is written in Borland C++ 3.0 and TASM(IDEAL MODE). The Borland C++ runtime source is needed to compile it. - - From the software point of view, the RNG-810 is a very simple device. Simply do a "in" instruction on the port (300h 302h 304h or 306h) depending on its jumpers and you receive a random byte. The IO driver can probably be used with any random number generator that is accessed in the same way. - ------------------------------------------------------------------------------ Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVqS2fBUQYbUhJh5AQGc/QP/aGuUJ1vluEi83/5miDc2RR+IKeqwbzBy wdLP4YxTptTLaBaJvAUdBZhjX70SFUt8l5i25pEvs6nvHMjzNp0Q+w0e55E9jfkW alvvo+R5n6+l6NjuFvESmQy+6U6zvQalGwVxY+VosiSDfXNy6PJhMYbmWSN8t0h9 +C4zXAWvM8w= =KEkC -----END PGP SIGNATURE-----

1 0

MOO: on the virtual meeting
by hughes＠ah.com 17 Dec '03

17 Dec '03

I didn't get a chance to get to the virtual meeting proper last night, but I did stop by afterwards for a while. This morning I got a chance to see some what was on the videotape which was left in the camera in the meeting hall. My praise to Arthur Chandler for setting this up. Definitely a worthwhile experience, expecially given the topic of the Bay Area meeting this weekend. I've a few comments for now, though. -- Client software. A must-use. telnet is really annoying. I point this out because unimportant technical considerations make huge differences in usability. -- Speech. A lot more people talk in the MOO than on the mailing list. And you thought the mailing list was loud. People get up to speed much more quickly on overall structure, but it's still not very good for quickly explaining detail. -- Time Zones. One never forgets that real people are behind the pseudonyms because the entering and exiting is based upon clock of bodily origin. A surprising intrusion into the abstract environment. Might I suggest that some future v-meetings happen at morning hours Pacific time, in order to allow those to the east of the Atlantic to participate? I heard from a dear old friend who's living in Cambridge that he was thinking about showing up, but it was 4am local time. A noon Pacific time meeting is 8 p.m. London time, for example. -- Names. A number of people were logged on, as guests, with their real names, including me. The authentication of guest names here, though, was even lower than email addresses. I was logged on as Eric_Hughes, but anybody else could have done so as well. A small proposal. It would be convenient for meetings in the future, which might be held at different locations, to have persistent identity across MOO's. A cryptographic identification scheme seems appropriate. We can't use a global naming space, since that doesn't scale. We can, however, nicely use a hierarchical naming space since MOO names are assigned on a per-MOO basis. So, for example, we could have Haakon of Lambda or Blast of Bay. We can also resolve conflicting common names by the old custom of place-naming as differentiation. Each MOO would have an identity-signing key, which would be use to attest that a particular key was the possession of a name on that MOO. The MOO's could distribute keys amongst themselves or use a central signature source to sign MOO keys. This technique would allow characters to visit other MOO's, even as guests, and retain their identity. These pseudonyms need not even be issued only by MOO's. IRC seems another source of pseudonyms, as does the cypherpunks list. Xenon of Cypherpunks, for example. This same segmentation could be used to determine the origin of objects, as in, "This vcr is of bay-arean make." Finally, this hierarchy could be distributed with DNS, e.g. bay.moo MOO <MOO public key> bay.moo ADDRESS mud.crl.com 8888 blast.bay.moo PERSON <public key, signed> DESCRIPTION "He's bald. Very bald." (Acknowledgements to Carl Ellison. Here the identity is the key, and enforced by software.) Eric

6 6

Port Watson
by Greg - Kucharo 17 Dec '03

17 Dec '03

Anyone who is intrested in T.A.Z should also check out a short story from the Science Fiction anthology Semiotext SF,"Visit Port Watson".It's wierd how much the story resembles T.A.Z.The mythical Port Watson is located on the real islandof Sonsorol in the South China Sea,about 400 miles from The Philippines.The Portis a free enclave,a enclave with no laws of any kind.The inhabitants of the island recieve dividends from a bank who has only virtual money.Each citizen recieves and equal share of the dividends which is calculated by computer based on money made by investors.The Bankers are "libertarian computer hacks and anarcho-capitilists".Sounds like CypherPunk Nation to me.Here's the bibiliography info; Semiotext(E) SF Copyright 1989 Autonomedia,New York.Ed.Peter Lamborn Wilson andRudy Rucker.

1 0

message pools revisited - CORRECTION
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I realized only after posting that "routing" messages through a remailer that is a member of the message pool you belong to is a risk. Keep in mind that I'm still speaking within the context of "all remailers and message pool servers are colluding". Jim_Miller(a)suite.com

1 0

message pools revisited
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Someone once said that a system of remailers is as strong as its STRONGEST link. "As long as even ONE remailer in the chain is trustworthy, hiding the connection between incoming and outgoing messages, your anonymity is preserved." While I agree with this in principal, I'm still not satisfied. I want a remailer system that is secure from eavesdropping and traffic analysis even if ALL remailers are untrustworthy. You might ask why I am not satisfied with current remailer designs. My unease stems mostly from irrational fears and distrust of the people running the remailers. I don't personally know any of the people who are running remailers. How can I be sure they are not colluding? How can I be sure their machines haven't been penetrated by the Bad Guys? It may be true that the remailer system is as strong as its STRONGEST link, but how do I know where that strongest link is? As long as there is any doubt, I'm not satisfied. Others may feel the same, and refrain from using remailers. With sufficient traffic, messages exchanged via a message pool are secure from eavesdropping and traffic analysis, even if the message pool is untrustworthy. The problem is, the message pool schemes I'm familiar with (admittedly, not that many) don't scale up well. One kind of message pool works like a mailing list. People subscribe to the message pool by sending the message pool server their e-mail address (and perhaps also a public-key). A member of the message pool sends an anonymous message by encrypting it with the recipient's public key and sending it to the message pool server. The message pool server sends a copy of the encrypted message to every member of the message pool service. Only the person who has the corresponding private key will be able to decrypt the message. All other members of the pool will get garbage. One benefit of this type of message pool is that the messages come to you. You don't have to go and get them. Also, if an encrypting remailer is a member of the message pool service, then members can "route" messages through it to non-members. Another kind of message pool works like a BBS system. A person sends a message by encrypting it with the recipient's public key and sending it to the message pool server. The message pool server adds the message to a pool of messages it maintains. Messages stay in the pool for a finite time, and then are deleted. People periodically downlaod the current set of unexpired messages from the pool and see if they can decrypt any of them. If they find a message they can decrypt, then the message was meant for them. The advantage to this scheme is that there is no concept of a "member". Some time last year, before I joined the cypherpunks mailing list, I posted a message to sci.crypt suggesting that people create a news group called "alt.crypt.messages" so people could exchange messages anonymously. Some people said this was a good idea. Others said that it was suggested before by others (it had). Still others said it wouldn't work because people wouldn't carry the news group because they wouldn't be able to know what kind of stuff was being sent through it. I think it is time to ask again. Do people think it would be a good idea to create a news group for exchanging anonymous messages? Alternatively, perhaps some cypherpunks with free time would like to code up a simplified distributed message pool service modeled after USENET. You would need servers to distribute the messages and front-end "reader" apps to simplify searching for messages destined for you. Any takers? Jim_Miller(a)suite.com

2 1

FLASH: Vice President Gore Questions Current Key Escrow Policy!
by Stanton McCandlish 17 Dec '03

17 Dec '03

National Information Infrastructure Advisory Committee met today in Washington at the Old Executive Office Building. In comments made after a question and answer period, Vice President Al Gore said that key escrow policy announced last Friday (2/4/94) had serious flaws and that he hope the issue of who holds the keys and under what terms would be given more serious, careful consideration. Gore made it clear that some amount of control of cryptography technology was necessary for national security. However, the key escrow policies announced by the Departments of Justice, Commerce & State, and the NSA, were "low level decisions" that got out before thorough analysis. In a conversation with Mitchell Kapor, Esther Dyson, and Mike Nelson (of the White House Staff), Gore said that he would prefer that the keys be held by some part of the Judiciary branch, or perhaps even by trusted, private escrow agents. He made it clear that he believed that the escrow agents named in last Friday's announcement (National Institute of Standards & Technology and the Treasure Department) were no appropriate key holders. Mike Nelson also indicated that there was real interest in a software-based escrow system instead of the hardware-based SKIPJACK standard Those of us who heard Gore were quite surprised. His remarks suggest that the key escrow policies to date do not have full support of the White House. Still, Gore was quite firm in asserting that some control of encryption technology is essential to national security. "Encryption and codebreaking have determined the outcome of world wars. He stated (incorrectly) that most our industrialized allies place must stricter controls in encryption that the US does. In fact, almost all COCOM countries allow the export of DES-based products, though some do not allow DES to be imported. The whole question of encryption was raised when Mitchell Kapor told the Vice President that over half of the Advisory Council members had serious reservations about the current Clipper/Skipjack policies. Gore and Kapor agreed that the Advisory Council should be used to have a serious dialogue about encryption policy. Given Gore's departure from the current Clipper proposals, there might actually be something to talk about. ========== NOTE: This DOES NOT mean that Clipper is going away. Part of stopping Clipper is to lift export controls on encryption and enable US companies to start producing products that enable all of us to protect our privacy with strong encryption. I urge you to write to Rep. Cantwell today at cantwell(a)eff.org. In the Subject header of your message, type "I support HR 3627." In the body of your message, express your reasons for supporting the bill. EFF will deliver printouts of all letters to Rep. Cantwell. With a strong showing of support from the Net community, Rep. Cantwell can tell her colleagues on Capitol Hill that encryption is not only an industry concern, but also a grassroots issue. *Again: remember to put "I support HR 3627" in your Subject header.* P.S. If you want additional information about the Cantwell bill, send e-mail to cantwell-info(a)eff.org. To join EFF, write membership(a)eff.org. For introductory info about EFF, send any message to info(a)eff.org. The text of the Cantwell bill can be found on the Internet with the any of the following URLs (Universal Resource Locaters): ftp://ftp.eff.org/pub/Policy/Legislation/cantwell.bill http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill ************************************************************************** Relying on the government to protect your privacy is like asking a peeping tom to install your window blinds. - John Perry Barlow, EFF co-founder The Electronic Frontier Foundation is working to protect your privacy. To help stop Clipper and eliminate export controls on cryptography, support a bill introduced in the House of Representatives, HR 3627. To support the bill, send email to <cantwell(a)eff.org>. ...................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 202-347-5400 (v) 1001 G St, NW Suite 950 East 202-393-5509 (f) Washington, DC 20001 *** Join EFF!!! Send mail to membership(a)eff.org for information *** -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

3 2

Magic money not working bigendian
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

I have not been able to get Magic Money to work right in big-endian mode using pgptl10c.zip and mgmny10d.zip. It does not work with either -DHIGHFIRST or -DHIGHFIRST plus -DHIGH_KLUDGE. The key generation seems to go OK, but then when I "mint" a coins.dat file with 6 coins in the server and try reading it in the client, all coins after the first are said to have bad signature. I have tried it with both 512 and 1024 bit keys and both fail. The previous version of magicmny.zip worked OK.

4 3

Re: Oh No! Nazis on the Nets
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> I will note, however, that the U.S. has far better press freedoms than > almost any other country on earth, and that Germany is pretty damn bad > about freedom of the press. I can walk into any book store in America > and buy a copy of Mein Kampf -- and although I hate Adolf Hitler's > works, I am happy that I can read them if I so choose. I cannot do > things like that in Germany. I don't know at the moment whether it is allowed to sell "Mein Kampf", but what is the question: One says that in Germany nobody cares about the right-wing, the other says that you can't buy such books. What do you expect? Shall we care or not? We can't fight again right-wing people and sell such books! I'm sure that american press freedom is not better than german ones. Seen from Germany, american presidents elections look like a mixture of a football game and a tv show. Is is possible that we have different oppinions about 'democracy' ? (I'm sure german elections don't look better for americans...) And there is another difference: In Germany I can get my Cryptosoftware from whereever I want, I can give my software to whereever I want and I can write a PhotoCD decoder. [ ;-) ] In Germany it is always surprising what american people don't know about Germany. How many of you think that we wear trousers of leather, eat Sauerkraut and have women with blond plaits and name "Gretchen" all the time, not without a "Kuckucksuhr" at the wall? Hadmut

4 5

Re: Oh No! Nazis on the Nets
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Mike McNally writes: > Really? So your only defense against ideas you don't like is to make > the dissemination of the ideas illegal? Clearly there are values you > rate higher than press freedom. (That's not necessarily bad, though I > personally don't like it.) I never said this. Why do you think it is the only defense? Why do you all mix ideas with calls for killing people? Isn't it a difference whether I publish an idea or whether I pray killing people? Is this allowed in your country? You all seem to have a nice patent for defense against Nazis. Why don't you tell/sell us this patent? It could be very helpfull. Don't you believe that we are interested in a free press? Don't you believe that we want to fight against Naziism? How do you fight against your Nazis? > Sorry, but if you have to go to some office and ensure them you're > following the "rules of newspapers" or whatever, then that statement > is incorrect. Arrrrrghl! Stop this stupid tale! Do you want to play silly games with me? Who did you tell that you have to go to any office in germany? > I can this instant decide to print out thousands of > copies of whatever I want, drive down to some public area, and start > handing out my documents (or charging for them), all without a visit > to a government office. That's not illegal. Only "pornographic" > material is inherently illegal to distribute . Exactly the same as in Germany! Many people do this! We printed papers at the school, we print papers at the university, we do it everywhere. Print anything with your computer, go to the next copy-machine. Print as much as you can pay and carry and give it to everyone you want. It happens nearly every day. When I began to study at this university I got my half bag full of papers in the mensa every day. Meanwhile they are printing less because noone reads them all, you can't read them all, they are too many. At the first day at this university I got invitations from two groups of homosexual groups, one invitiation of the lesbians group, about 20 invitations of political groups and a lot of paper I didn't even look at. > > Seen from Germany, american presidents elections look like a mixture > > of a football game and a tv show. > > What does that have to do with press freedoms? What is the use of press freedom if the press doesn't use it? > Actually, we don't see much about German elections; there's not enough > airtime between the football games and TV shows. I'm sure you don't see much about Germany at all. Where did you get all those stories? > So can I in the US---today. The problems spring up when I try to > export what I write. Is this what you call press freedom? Hadmut

6 5