December 2003 - cypherpunks-legacy

No Subject
by smb＠research.att.com 17 Dec '03

17 Dec '03

And there's also the question of whether or not I'm going to execute a random program that you've sent me, allegedly to do a decryption....

2 1

Infomercials, FUD... time?
by Kragen J. Sittler 17 Dec '03

17 Dec '03

Despite all our word-of-mouth and -of-net efforts, the general public knows little or nothing about the Clipper issue. Perhaps it's time to let them know what's going on... not in an article buried on the third page (?) of the New York Times, not in an article on page 30 of Time Magazine, but in some way which lets them know the real facts. I suggest that we air an infomercial, or series thereof, urging the citizens of the US to protest. Phone calls to religious groups, special-interest newsletters, and even mainstream newscasters would also be a help. Most of us cypherpunks have little income. A few, such as Winston Timothy C. May, have enough for an infomercial or two. But there is supposedly an industry coalition headed by Novell to oppose Clipper. Is there anyone here who can successfully solicit these companies for money? I don't know enough details to do this. I don't know the cost of a half-hour infomercial on a national network at 11:00 at night. But I know it can be bought. I don't know which companies are involved in the coalition. Nor do I know how committed they are. But I suspect we could raise enough money... and we do have a number of experienced public speakers and broadcasters among us. If the public knows the facts, just the known, confirmed facts, many of them will be outraged. The response that a single half-hour infomercial could produce in a nation of 260 million would make the puny tens of thousands of votes on the CPSR petition look insignificant... as indeed they are. C'mon folks... what's stopping us? Kragen

2 1

Sending encrypted stuff to non-PGP users.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

PGP already lets you do almost what you want. The pgp -c option does conventional crypto, using IDEA, and prompts you for a passphrase to encrypt it with. (You can look at the code to see if it crunches it with MD5 or just uses the first 16 bytes / 128 bits.) To decrypt, you just do pgp -d filename. This lets anybody who has the PGP binaries on their machine decrypt it, even if they haven't bothered setting up public and private keys. If they use DOS, and either you're located in an encryption-tolerant country or they're located in your country, you can send them the binary if they want. If this is too big, you can shred apart the PGP source and do a version with just the IDEA decryption stuff, leaving out the patent-sensitive RSA code and most of the fancy help and file-handling stuff. Of course, if you *still* really want something that's widely executable for people who don't want to install crypto code on their machines, you could write yourself an IDEA-decryptor in PostScript (tm) and let them print the file on their laser printer. A tad slow, but...... (Yes, they'll need some way to input the passphrase; editing the file works but leaves traces around. You'll think of something user-friendly if you're that perverse :-) Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: WE WANT SELF DECRYPTING STENOGRAPHY NOW!
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

Any software for hiding data in fractals would have the problem that people would eventually learn to recognize the type of fractal. Thus when the FBI digs through your PC, they'd find the fractals, and recognize them as data carriers. Hiding data in arbitrary .jpg files would solve this problem, but even so, if the FBI knows there is software for hiding data in the low bits of .jpg files, they'd run it on all your pictures as a matter of course. Naturally you'll have encrypted your file, but you may as well have left it on the disk as is. a) What's stenography? b) What's stegography? c) There's nothing self-decrypting about a .jpg file.

4 4

Infomercial
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

Most people couldn't care less. They don't encrypt data, and will never use a clipperphone. The FBI can *already* listen to all their phone calls and see all their medical records. Why should people do anything to protect something they don't have anyway?

2 1

InfoMercials / Getting the word out
by Robert A. Hayden 17 Dec '03

17 Dec '03

I cannot see how an 'infomercial' would be effective at all. The audience of people that commonly watch those things are apathetic about politics. Face it, the only way to get the word out is to get the industries of power against clipper, then the popular support falls into line. The industries include (but are not limited to): Really Rich People Really Rich Corporations The Media Non-US Governments Coalitions need to be built. Face it, the government IS NOT going to listen to the people. The people are the ones that the government is violating. And the commone people have no REAL power, and even shorter memories of those violations. Make the governemtn afraid of those with power, and we can have our way. ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Re: story on digital telephony from today's Washington Post (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>From: Mike Godwin <mnemonic(a)eff.org> >Message-Id: <199402250044.TAA04129(a)eff.org> >Subject: story on digital telephony from today's Washington Post (fwd) >To: eniac(a)prudence.fof.org (eniac(a)prudence.fof.org) > cypherpunks(a)toad.com (cypherpunks) >Date: Thu, 24 Feb 1994 19:44:42 -0500 (EST) >The FBI and the Justice Department say the initiative would not expand >their power, but would ensure access to the type of communications they >have been entitled to tap for years. This is totally bogus. The FBI has never had the right to watch computer programs execute. Now that computer programs are being written as distributed systems, what was originally written to be an internal subroutine call can look like a message over the phone system. The FBI never had the right to bug corporate conference rooms. Now that companies are using videoconferencing, a private corporate conference could look like a phone call. Etc. This needs to be fought. - Carl P.S. Even though the FBI has had the wiretap law of 196?, we need to keep reminding them that this law wasn't a constitutional amendment. It's entirely possible for a new routine law to invalidate their law -- or for technology to invalidate their preferred M.O. It might even be reasonable to pass a law prohibiting all wiretaps. That is, now that the FBI has shown that it intends to act like an Iron Curtain surveillance agency, perhaps it should be treated like one and shut down.

1 0

Re: Omnibus Crime Control Act of 1968
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sorry, my fingers are all thumbs: the issue of Time is July 25, 1969. faust's dog -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBpAgUBLW2jPop26HwU0zr9AQGC/wKaAx5+2y0N1/jlGFnJ3Nv9ZY9S4STt09oJ lBA8eeOcf/dXQk7dvmsUY/X17FRyAYujqwI7PCG5Vhjxl/GN1vlwSShZ4Ozd1KCM mAkLWORloypkmJ5i =rFMU -----END PGP SIGNATURE-----

1 0

VOUCH program encrypts with DSS keys
by Mike Ingle 17 Dec '03

17 Dec '03

There is a program called VOUCH which implements the Digital Signature Standard. In addition to signing, it has the interesting ability to do public-key encryption with the DSS keys! The manual describes this as Diffie-Hellman key exchange. As I understand DH exchange, it is an online negotiation protocol. Can DH be combined with DSS to use the DSS keys for public-key encryption? How? If His Excellency decides we should all have DSS keys tattooed on our asses, the ability to encrypt with them could be very useful. Vouch is available by ftp from garbo.uwasa.fi in /pc/crypt/vouch10.zip It's about 90K. The author is in Pakistan and gives only a snail address. --- Mike Here's my key and a test file if you want to play with it. section 1 of uuencode 4.13 of file VOUCHKEY.ZIP by R.E.M. begin 644 VOUCHKEY.ZIP M4$L#!!0``@`(`.<#61PE%-J7)P$``-$!```,````35E054),24,N2T59%9`[@ MCA4P#$5[)/9`,37RWW$W<6Q+%*P"GF#$\%E_1Y[<7<4WQP?MT]>W7X\O?WZ\A M/UZ_/][__7S[_.WO[X\?7GRDJ707%\H`U"$==(8YYLVD8K97C3E`]F8*EEXGV MNX9X`''5`4JS*EA[JL8%C=I9)=-NZ0[=M-1,77(/J!T("F"2//ER&7)5+8[$? M::^Y<X-3O"<&3>.LG1"AY_E6&&L;GDV%?/^*WGLA1HNZRM;+MW&2H/BNBVIX' M)@`T=HCX7F'1;HWAY;@(<A]@C5PY-H1\J9=1`<^%A[,+-&H1JH1/R).A;K<PC M\0VIK?-<17'LGHZAA"&&N0.+#T8P.NH\218:&/?QZXEF`UCSW.91D5E.A.EVO MFOU*]>O@VF,G;2=L(T>R;/%.N`S_`5!+`P04``(`"`!V!%D<[NQ;R\<```#0Z M````"````%1%4U0N4T=.*TO.4##4,U"P2LE,SRQ)S%$HSDS/2RPI+4I5R"U.O M5XC.RRPNB56P,C13L#)5L%+PS<Q.]<Q+STEU2$G-*<C(U$O.SU6PXN52<35VS M,S$W,'5R-;$P,S1T=#$S,G2R,'-R=76Q<'-R,G%VMC"S<'*Q,%`!JC4V=W9S+ M,7(U,W9R,C4Q<34W=75U<G8S,S0R-#`P-C9V=;(T=#-S<[$`J@W)R"Q6`*)$S M!9?@8%V0VU)3%')3BXL3TU,5THJ`EH-<I`!VDAXO%R\7`%!+`0(4`!0``@`(6 M`.<#61PE%-J7)P$``-$!```,``````````$`(`````````!-65!50DQ)0RY+F M15E02P$"%``4``(`"`!V!%D<[NQ;R\<```#0````"``````````!`"````!1L A`0``5$535"Y31TY02P4&``````(``@!P````/@(`````N `` end sum -r/size 15963/1022 section (from "begin" to "end") sum -r/size 40836/708 entire input file

1 0

Re: "self decrypto" and Steg
by Seth Morris 17 Dec '03

17 Dec '03

First, re: "self decrypting" binaries. > An interesting idea, although highly unpracticable. Sending a binary > is nearly impossible. As an example, I have at my disposal (and I log > into regularly) at least 6 different platforms. All Unix, but each > one would require its own binary! > Also, there is no way to meet your goal of "no external binary > needed." There may be a few things you can do in lieu of this, but > all of them require some knowledge of the recipient hardware system. > But in a case such as mine, even that wouldn't help (do you send it > for an RT, Vax, Decmips, RS6000, Alpha, Linux, Sun386i, Next, ...?) Sounds more like a general utility for conventional key crypto with versions ported to other platforms. Like pkzip's "crypto" options, but hopefully without publicly posted programs to crack it! Imagine a program built with lharc, zip, arj, tar, uuxfer, md5, and idea. A general file cruncher. Then you send a binary .whatever file with a special header that has the passphrase prompts you've decided on. Not "self-decrypting" by any means, but more likely to be run and accepted by a user unwilling to install pgp. Also, very easy to write. Hork gzip, maybe info-zip, pgptools, maybe some lharc code, etc from publicly visible locations and snap them together. I have to agree with the statement that I'm NOT going to run a random binary dropped in my mbox! Even if someone I'd like to communicate securely with had said it'd be dropping by. I think with all the talk about steg lately we might want to recall an idea posted a few months (several?) ago.... Create and widely distribute a program to take a "stealth" crypto file (of course, the util might also do the stealthing.... details) and perform a large number of manipulations on it. Something like a command blend -"Hello, world!" file.bin would do something like use the "H" option (of MANY) with an argument of 5 (or of 101 or whatever the ascii value of 'e' is... I'm tired), then the "l" manipulation twice ("l" might not take an argument), then "o", skip the comma and whitespace (or maybe not), etc. No way to gaurantee that some operations don't undo one another, but you'd still have a good chance that the resulting file would be VERY difficult to cryptanalyse, I think (and I *know* I'll be told if I'm wrong... I'm repeating what seemed like a good idea). At the very least, it wouldn't decrypt into anything useful. This way, one utility can provide man avenues to help steg (if the file cannot be determined to be encrypted by a particular program/with a particular method, it may be easier to hide in a practicable way (which may be less secure than a more theorhetically sound method)). Again, I'm in favor of having the program also provide a non-crypto related service to the user. Encourage people to have it and know how to use it, and provide a cover to explain it's presence. Just a couple-a comments on current threads. Seth Morris (Seth.Morris(a)LaUNChpad.unc.edu)

1 0