December 2003 - cypherpunks-legacy

Infomercial
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

Most people couldn't care less. They don't encrypt data, and will never use a clipperphone. The FBI can *already* listen to all their phone calls and see all their medical records. Why should people do anything to protect something they don't have anyway?

2 1

Rising dishonesty level
by Brad Dolan 17 Dec '03

17 Dec '03

jimn8(a)netcom.com remarks about the rising level of dishonesty in (presumably) media/political circles: *It's bad* I once had a faint hope that a change in administrations would reverse the tide. I'm over that now. People from eastern Europe recognize a lot of what they see developing here, as a recent poster noted. jimn8 further wonders if anybody knows a better country to live in: I know of several that are less intrusive in your private affairs. Unfortunately, it's hard for an American to find work in most of them. I've made up a list of decision rules about when it's time to flee to the first place I can find "three hots and a cot" (Places like Belize, for instance). Try compiling your own list, it's an interesting exercise. My rules: It's time to leave when... ... I can't say what I want. ... I can't own a gun. ... I can't use good crypto. ... I can't leave and enter the U.S. freely. Brad bdolan(a)well.sf.ca.us Somewhat related: Does anybody find it interesting that no one noted for over a decade that Ames had (1) a lavish lifestyle and (2) a foreign-born (Colombian!) wife. Normally, spooks aren't allowed either. A cynic might say that the lavish lifestyle was overlooked because it was attributed to the Colombian connection, and not to the other extracurricular activities. -bd

4 3

Viacrypt at NCSC ?
by an69654＠anon.penet.fi 17 Dec '03

17 Dec '03

Why does at least one person from Viacrypt have an e-mail address at dockmaster.ncsc.mil ? Is there an association between Viacrypt and the NCSC, or does the NCSC give out accounts to those in the business ? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

InfoMercials / Getting the word out
by Robert A. Hayden 17 Dec '03

17 Dec '03

I cannot see how an 'infomercial' would be effective at all. The audience of people that commonly watch those things are apathetic about politics. Face it, the only way to get the word out is to get the industries of power against clipper, then the popular support falls into line. The industries include (but are not limited to): Really Rich People Really Rich Corporations The Media Non-US Governments Coalitions need to be built. Face it, the government IS NOT going to listen to the people. The people are the ones that the government is violating. And the commone people have no REAL power, and even shorter memories of those violations. Make the governemtn afraid of those with power, and we can have our way. ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Re: story on digital telephony from today's Washington Post (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>From: Mike Godwin <mnemonic(a)eff.org> >Message-Id: <199402250044.TAA04129(a)eff.org> >Subject: story on digital telephony from today's Washington Post (fwd) >To: eniac(a)prudence.fof.org (eniac(a)prudence.fof.org) > cypherpunks(a)toad.com (cypherpunks) >Date: Thu, 24 Feb 1994 19:44:42 -0500 (EST) >The FBI and the Justice Department say the initiative would not expand >their power, but would ensure access to the type of communications they >have been entitled to tap for years. This is totally bogus. The FBI has never had the right to watch computer programs execute. Now that computer programs are being written as distributed systems, what was originally written to be an internal subroutine call can look like a message over the phone system. The FBI never had the right to bug corporate conference rooms. Now that companies are using videoconferencing, a private corporate conference could look like a phone call. Etc. This needs to be fought. - Carl P.S. Even though the FBI has had the wiretap law of 196?, we need to keep reminding them that this law wasn't a constitutional amendment. It's entirely possible for a new routine law to invalidate their law -- or for technology to invalidate their preferred M.O. It might even be reasonable to pass a law prohibiting all wiretaps. That is, now that the FBI has shown that it intends to act like an Iron Curtain surveillance agency, perhaps it should be treated like one and shut down.

1 0

Re: Omnibus Crime Control Act of 1968
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sorry, my fingers are all thumbs: the issue of Time is July 25, 1969. faust's dog -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBpAgUBLW2jPop26HwU0zr9AQGC/wKaAx5+2y0N1/jlGFnJ3Nv9ZY9S4STt09oJ lBA8eeOcf/dXQk7dvmsUY/X17FRyAYujqwI7PCG5Vhjxl/GN1vlwSShZ4Ozd1KCM mAkLWORloypkmJ5i =rFMU -----END PGP SIGNATURE-----

1 0

VOUCH program encrypts with DSS keys
by Mike Ingle 17 Dec '03

17 Dec '03

There is a program called VOUCH which implements the Digital Signature Standard. In addition to signing, it has the interesting ability to do public-key encryption with the DSS keys! The manual describes this as Diffie-Hellman key exchange. As I understand DH exchange, it is an online negotiation protocol. Can DH be combined with DSS to use the DSS keys for public-key encryption? How? If His Excellency decides we should all have DSS keys tattooed on our asses, the ability to encrypt with them could be very useful. Vouch is available by ftp from garbo.uwasa.fi in /pc/crypt/vouch10.zip It's about 90K. The author is in Pakistan and gives only a snail address. --- Mike Here's my key and a test file if you want to play with it. section 1 of uuencode 4.13 of file VOUCHKEY.ZIP by R.E.M. begin 644 VOUCHKEY.ZIP M4$L#!!0``@`(`.<#61PE%-J7)P$``-$!```,````35E054),24,N2T59%9`[@ MCA4P#$5[)/9`,37RWW$W<6Q+%*P"GF#$\%E_1Y[<7<4WQP?MT]>W7X\O?WZ\A M/UZ_/][__7S[_.WO[X\?7GRDJ707%\H`U"$==(8YYLVD8K97C3E`]F8*EEXGV MNX9X`''5`4JS*EA[JL8%C=I9)=-NZ0[=M-1,77(/J!T("F"2//ER&7)5+8[$? M::^Y<X-3O"<&3>.LG1"AY_E6&&L;GDV%?/^*WGLA1HNZRM;+MW&2H/BNBVIX' M)@`T=HCX7F'1;HWAY;@(<A]@C5PY-H1\J9=1`<^%A[,+-&H1JH1/R).A;K<PC M\0VIK?-<17'LGHZAA"&&N0.+#T8P.NH\218:&/?QZXEF`UCSW.91D5E.A.EVO MFOU*]>O@VF,G;2=L(T>R;/%.N`S_`5!+`P04``(`"`!V!%D<[NQ;R\<```#0Z M````"````%1%4U0N4T=.*TO.4##4,U"P2LE,SRQ)S%$HSDS/2RPI+4I5R"U.O M5XC.RRPNB56P,C13L#)5L%+PS<Q.]<Q+STEU2$G-*<C(U$O.SU6PXN52<35VS M,S$W,'5R-;$P,S1T=#$S,G2R,'-R=76Q<'-R,G%VMC"S<'*Q,%`!JC4V=W9S+ M,7(U,W9R,C4Q<34W=75U<G8S,S0R-#`P-C9V=;(T=#-S<[$`J@W)R"Q6`*)$S M!9?@8%V0VU)3%')3BXL3TU,5THJ`EH-<I`!VDAXO%R\7`%!+`0(4`!0``@`(6 M`.<#61PE%-J7)P$``-$!```,``````````$`(`````````!-65!50DQ)0RY+F M15E02P$"%``4``(`"`!V!%D<[NQ;R\<```#0````"``````````!`"````!1L A`0``5$535"Y31TY02P4&``````(``@!P````/@(`````N `` end sum -r/size 15963/1022 section (from "begin" to "end") sum -r/size 40836/708 entire input file

1 0

Re: "self decrypto" and Steg
by Seth Morris 17 Dec '03

17 Dec '03

First, re: "self decrypting" binaries. > An interesting idea, although highly unpracticable. Sending a binary > is nearly impossible. As an example, I have at my disposal (and I log > into regularly) at least 6 different platforms. All Unix, but each > one would require its own binary! > Also, there is no way to meet your goal of "no external binary > needed." There may be a few things you can do in lieu of this, but > all of them require some knowledge of the recipient hardware system. > But in a case such as mine, even that wouldn't help (do you send it > for an RT, Vax, Decmips, RS6000, Alpha, Linux, Sun386i, Next, ...?) Sounds more like a general utility for conventional key crypto with versions ported to other platforms. Like pkzip's "crypto" options, but hopefully without publicly posted programs to crack it! Imagine a program built with lharc, zip, arj, tar, uuxfer, md5, and idea. A general file cruncher. Then you send a binary .whatever file with a special header that has the passphrase prompts you've decided on. Not "self-decrypting" by any means, but more likely to be run and accepted by a user unwilling to install pgp. Also, very easy to write. Hork gzip, maybe info-zip, pgptools, maybe some lharc code, etc from publicly visible locations and snap them together. I have to agree with the statement that I'm NOT going to run a random binary dropped in my mbox! Even if someone I'd like to communicate securely with had said it'd be dropping by. I think with all the talk about steg lately we might want to recall an idea posted a few months (several?) ago.... Create and widely distribute a program to take a "stealth" crypto file (of course, the util might also do the stealthing.... details) and perform a large number of manipulations on it. Something like a command blend -"Hello, world!" file.bin would do something like use the "H" option (of MANY) with an argument of 5 (or of 101 or whatever the ascii value of 'e' is... I'm tired), then the "l" manipulation twice ("l" might not take an argument), then "o", skip the comma and whitespace (or maybe not), etc. No way to gaurantee that some operations don't undo one another, but you'd still have a good chance that the resulting file would be VERY difficult to cryptanalyse, I think (and I *know* I'll be told if I'm wrong... I'm repeating what seemed like a good idea). At the very least, it wouldn't decrypt into anything useful. This way, one utility can provide man avenues to help steg (if the file cannot be determined to be encrypted by a particular program/with a particular method, it may be easier to hide in a practicable way (which may be less secure than a more theorhetically sound method)). Again, I'm in favor of having the program also provide a non-crypto related service to the user. Encourage people to have it and know how to use it, and provide a cover to explain it's presence. Just a couple-a comments on current threads. Seth Morris (Seth.Morris(a)LaUNChpad.unc.edu)

1 0

Re: WE WANT SELF DECRYPTING STENOGRAPHY NOW!
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

Any software for hiding data in fractals would have the problem that people would eventually learn to recognize the type of fractal. Thus when the FBI digs through your PC, they'd find the fractals, and recognize them as data carriers. Hiding data in arbitrary .jpg files would solve this problem, but even so, if the FBI knows there is software for hiding data in the low bits of .jpg files, they'd run it on all your pictures as a matter of course. Naturally you'll have encrypted your file, but you may as well have left it on the disk as is. a) What's stenography? b) What's stegography? c) There's nothing self-decrypting about a .jpg file.

4 4

No Subject
by cort＠ecn.purdue.edu 17 Dec '03

17 Dec '03

Kinda-Fair-Secret Message Passing -OR- Self-Decrypting Messages I have an IDEA. It may have already been thought of.... Problem: - PGP is great, but like so many infant technologies, encryption programs are not quite "turnkey". - Many people do not have PGP installed. I want to send messages to some of these people. (Oh, I know, a true geek doesn't bother to communicate with PlaintextPunks!) Solution: - Securely encrypted messages with programmable "key question" and "response key" for self-decryption. Scenario: Fred wants to send a message to Ida. Fred is a cypherpunk and is quite proficient with PGP. However, Ida is not set up with PGP and does not desire to learn PK cryptography. Fred and Ida know each other (or something about each other). Fred sends a self-decrypting message to Ida in an executable file. Ida simply receives the file and executes it. (This is analogous to self-extracting zip files.) When the file is executed, it will ask Ida a question that Fred has set up (with her in mind). This question will ideally be answerable only by Ida. If Ida answers correctly, her response will form a key to decrypt the message. I have thought a bit about the implementation. It seems that it may be pretty simple to do using PGP Tools. The passphrase recognition could use a one-way function (MD5?). IDEA could be the encryption algorithm. RSA is not needed. The tricky part is providing an executable file while providing a little bit of instruction at the front of this file (to instruct the recipient to down-load and execute). Also, it seems that an assumption of recipient platform (e.g. DOS, Unix, etc.) may be necessary. Uuencoding or similar ASCII/binary conversion may be required. Comments? Would someone do this? Does it already exist? It would be a nice augmentation to the PGP package! Cort. -- cort(a)cc.purdue.edu

5 7