December 2003 - cypherpunks-legacy

Re: I have FOIA'd the Clipper Key Escrow databases
by smb＠research.att.com 17 Dec '03

17 Dec '03

I confess -- I expect one of two outcomes. First, they may say that the database is classified, if only at the level of ``For Official Use Only''. Second, maybe they will release it -- but remember that the keys are stored encrypted. Can you file an FOIA request for the key, too?

2 1

using mediamoo - correction
by David Galiel 17 Dec '03

17 Dec '03

re:previous message about possible use of mediamoo for mtg. Ooops - the ultimate NetSin - mispelled my address. It's galiel(a)world.std.com (sheepish grin) Flout 'em and scout 'em -- and scout 'em and flout 'em; Thought is free. -- Shakespeare

1 0

Cryptography, fascism; Perot
by Brad Dolan 17 Dec '03

17 Dec '03

There has been a lot of discussion of cryptography/communications issues on the UWSA reflector (uwsa(a)shell.portal.com) This list is monitored by people who work for Perot, so post there and it might get his attention. You can be added to the reflector by e-mailing to: telcon(a)shell.portal.com [I think that's right - I believe it used to be telconsort(a)shell.portal.com] Brad bdolan(a)well.sf.ca.us

1 0

Re standard for stegonography?
by Derek Upham 17 Dec '03

17 Dec '03

> Is there a standard for stego yet? I just added stego and de-stego > filters to my pbmplus image toolkit, using a simple protocol I made > up on the spot. Now I'm wondering if I should make them compatible > with existing stego tools. There appear to be two existing steganography packages for images. One is "jsteg", a Unix-based system which stores data in JFIF- compliant JPEG images; it is based on version 4 of the cjpeg/djpeg package. The other is "Stego", a Mac-based system which stores data in Mac PICT files (I think---I don't have a Mac to examine it). "jsteg" is available in the Cypherpunks FTP archive in the applications subdirectory as the original jpegsrc package, plus the patches, plus a README file. However, you might be better off tracking down the "Stego" sources since "jsteg" stores its data in a rather odd way (see the docs for more information). Derek Derek Lynn Upham University of British Columbia upham(a)cs.ubc.ca Computer Science Department ============================================================================= "Ha! Your Leaping Tiger Kung Fu is no match for my Frightened Piglet Style!"

1 0

Valente clarifies on Telescript
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[This was posted to RISKS in response to objections raised by several readers. Note that he says they are using "RSA" encryption; one wonders where their public keys are? --AW] From: "Luis Valente" <luis_valente(a)genmagic.genmagic.com> Subject: Safety in Telescript, Part Deux Following my posting to RISKS on January 17 entitled "Safety in Telescript" a number of readers have strongly questioned some of the statements I made in that posting. Two of those statements, in which I used casual or imprecise language, were particularly criticized: 1- "Telescript is interpreted and, thus, is safer than compiled languages." As pointed out by many readers, an interpreted language is not intrinsically safer than a compiled language. It is the Telescript language definition that provides that protection. Within the abstraction created by Telescript, programs lack operations for directly manipulating the physical resources of the "real" computer(s) on which they execute. That doesn't mean that Telescript programs cannot interact with applications (e.g., databases) outside the Telescript abstraction. However, that interaction can only take place via Telescript objects that act as proxies for the "external" applications. Each such proxy object defines the features of the corresponding external application that are to be made available to Telescript agents and places. It may also define and enforce a security policy for controlling access to those features (e.g., based on an agent's credentials and permit). Furthermore, the administrative authority for a given Telescript engine is capable of controlling (by means of mechanisms built into the language) who can and cannot create these proxy objects. 2- "Authority names are cryptographically generated and cannot be forged." Obviously, that statement is not true in an absolute sense since the "unforgeability" of the authority name is directly related to the cryptographic mechanism used to generate it. We currently use RSA-based public key cryptography for generating authority names. Entitlement to use a particular authority name can be linked to the secret key used to generate it. Aside from the criticism leveled against my poor choice of words in the aforementioned statements, several readers complained about the lack of more detailed information on the security technology used by Telescript, namely, what cryptographic algorithms are used, key sizes, key distribution and management issues, exportability issues, etc. Let me start by saying that my posting was not meant as a treatise on Telescript Technology but merely a brief description of some of the features of Telescript that can be used effectively against misprogrammed or ill-intentioned telescripts. General Magic has already published a white paper entitled "Telescript Technology: The Foundation of the Electronic Marketplace." This paper provides a high-level description of Telescript and is intended for the layman, not the techno-savvy reader. It can be requested directly from General Magic by calling (415) 965-0400. In the coming months we will publish additional information on many different aspects of Telescript Technology (including security). Let me further say that the point of my original posting was not that Telescripted networks are intrinsically secure (i.e., the "it won't happen here" syndrome). It was simply to let RISKS readers know that we have put a lot of thought into the security aspects of Telescript. In fact, when General Magic started developing Telescript, security was at the top of our list of concerns. As a result, we have built into the fabric of the language a number of features that, we believe, will enable application developers to write safe Telescript programs and network operators to run highly secure Telescripted networks. Heretofore, the discussions on RISKS have only covered a few of the many security issues faced by a dynamic, interpreted, communication-centric language like Telescript. As more detailed information on Telescript becomes widely available, I am certain it will generate heated debates on this and other forums. I look forward to them! -Luis Valente, General Magic, Inc. ------------------------------

1 0

VIRTUAL meeting needed
by Robert A. Hayden 17 Dec '03

17 Dec '03

All this talk about needing a CP meeting is well and good, but it doesn't do any good for those of us that are not in physical distances of the meeting place. Instead, perhaps we need to organize for another virtual meeting again. With a little more organizing, it would go smoother. ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

8 12

Re: Infomercials, FUD... time?
by Anthony D Ortenzi 17 Dec '03

17 Dec '03

Excerpts from internet.cypherpunks: 24-Feb-94 Re: Infomercials, FUD... time? by Timothy C. May(a)netcom.co > However, a few minor problems with the infomercial idea: > > 1. The incredible cost. Ross Perot could afford to blow $5 million per > show, not many others can. Anyone know where ol' Ross stands on this issue? He could communicate the dangers to a large sector of the population... if he believes in our cause. It's hard to imagine him not, being a little on the paranoid side about the Republicans tapping his communications, and all that jazz... and he's got to have an internet e-mail address somewhere, although it is probably under a pseudonym or something to keep him from being inundated by the masses. Someone who uses whois with Perot finds lots of Perot Computer Systems or whatever the damn name of the company is. It can't be that hard to get in touch with him via e-mail. Someone has got to be able to get through to him to check. Even though he is now not as highly regarded because of the NAFTA fiasco, he's still got some pull. Go to it, 'punks... ()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()() ()/----------------------------------------------------------------------\() ()| Anthony Dante Ortenzi () ao27(a)andrew.cmu.edu () feynman+(a)cmu.edu |() ()| -------------------------------------------------------------------- |() ()| adortenz(a)suvm.acs.syr.edu () ortenzi(a)chaos.bsu.edu |() ()\----------------------------------------------------------------------/() ()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

2 1

Security of andrew.cmu.edu anon-server?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

What kind of encryption is the anonymous contact system at andrew using? I think someone said that it used a home-brew cipher. How secure might such a system be against cryptanalysis (or just brute force key searches?) Or has it been changed to use something like DES or IDEA? (In the former case, DES, it might not be completely secure, unless you used 3DES or something.) If someone could break the code, they could find out _EVERYONE'S_ mail address that ever posted using an anon address from that remailer...

2 1

Capone's Cojones in loan Zones?
by Gary Jeffers 17 Dec '03

17 Dec '03

Tim May writes: >Regarding "Nobody"'s forwarding of the FBI's plans to move into <Russia, this is also similar to the rationale used by the German BND >(Bundesnachrichtendienst, if I rememer the spelling correctly) to move >into Eastern Europe in various overt and covert ways. >Expect Germany and the U.S. to lock horns soon. The real intelligence >war is just beginning, with Gehlen's boys battling their former >OSS/CIA cronies for world fascist domination. >"Nuclear terrorism" is indeed a threat, especially when practiced by >fascist nations--fill in the blanks with who you think I mean. >Those who thought "history ended" when the Cold War ended, now face >the prospects of Goldfingers proliferating. Exciting times indeed. >Bid deal, a few cities get nuked. The greater danger is that of the >control freaks like Denning clipping and skipjacking our remaining >freedoms and ushering in the thousand-year Reich of Kaiser Willy. Good point & good attitude Tim. While having a few big cities nuked is a truly horrible thing, its evil is completely dwarfed by the possibility of a world of billions of people crushed down by a long lived state using uncountable lies & computer monitoring to maintain control. That state evil would not have the flashiness & fear of a nuke. Its evil would be boring. Its horror would be in the hopelessness & lack of freedom of the people & in their lives being made up of lies. In the face of that threat, the idea of some ""terrorists"" or ""criminal"" gangs throwing around a few nukes on a wild Saturday night merely gives one cause for hope. Maybe a nuke would land on an oppressor & free us. Incidentally, what is this fear of ""criminals"" & ""terrorists"". I have never had a ""criminal"" extortionist take 40% of my income over a long period of time. I have never had a ""terrorist"" draft me into a war with people I don't know in a foreign country. Also, I don't know of any ""terrorists"" who occasionally murder millions of people. I think we have a problem with words. A ""terrorist"" is a soldier without a uniform. A soldier who ""failed to dress for success"". A ""criminal"" is a thug without proper papers & badges. WACO & the Weaver family were lessons for those who could set aside their prejudices for awhile. I am quite happy to share the internet with ""terrorists"" & ""criminals"" - if it gives me & my friends a chance for happiness & freedom! Anarchy is simply the absence of a monopoly on weapons & force. If anarchy gives me a chance for freedom & happiness I'll take my chances. Death before dishonor? How about an even better deal - a risk of death before a life of no honor & no hope! This is the offer of liberty. So, mr or ms State, please don't bother me. I'll take my chances with a few stray ""criminals"" & ""terrorists"". >War is Piece. No Gnus is Bad Gnus. Surveillance is Security. >--Winston May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

anonymous mail
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I assume from this statement that you haven't looked at my code. >Send me email and I'll give you a copy... or maybe someone that I >gave it to could put it up on an FTP site, so you can get it >anonymously. Hey Matt, I'd be interested in a copy of your code! >Yes, the cipher is of my own design. First off, I can assure you >that a brute-force keysearch will not work. The cipher employs three >36 element substitution arrays, which gives a total of 3x36! possible >keys, or over 10^42. DES has about 7.2 x 10^16 possible keys and IDEA >about 10^38. Well, you do have to be careful: a large number of keys doesn't mean a cipher is hard to break, there may be a faster method than brute force. For instance, those cryptograms some papers print in the puzzle section are a simple substition cipher, with 26! keys... yet they are also pretty much trivially breakable with enough input. Karl Barrus <klbarrus(a)owlnet.rice.edu> -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLXD7gIOA7OpLWtYzAQG6wQP/Qcim32WFYHrjZ53bIHJ2CSjmoRSmh5XI Gcm9LbvvwPOywAzEzWaTw0g31c6rz9xor/g8EYX25lyMsYSX36LpyrZRO77XeJI4 sEitU9S8Dp0GWIVgXT6a2reLkUwbIuTU5Y4KFpRvbvTKN33GU+GKFgPAxV6/+FLr d+rC3w2F/ms= =U9gg -----END PGP SIGNATURE-----

3 3