December 2003 - cypherpunks-legacy

New stego prog was "A possibility"
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

Hey guys, I'm in the final throes of applying some cleaning up on a bit of code I wrote a couple of years ago. I'm wondering what would be some good sites to FTP this to? (I'd like to just post it up on here, but since there are non-USA residents on this list, I don't need the NSA to come on knocking on my door as I've bigger things to worry about (like bills, graduating, etc.) Anyhow, a bit about this code: This is a program called White Noise Storm which I wrote out of an inspiration flash (and subsequently the reason I joined this list.) I had left this project to rot until recently when my school finally offered a crypto class, and decided on making this my project. Unfortunatly disaster struck and I had lost the final version of this program a few months ago, having only a buggy, unfinished backup. Suffice to say, I spent all last night infront of my 486 and resurected WNSTORM from the dead, and in doing so added some features which make it a useful program. Someone from MicroSoft had a similar idea, so I thought I'd go public with it before WNSTORM vanished totally. :-) So Ophir Ronen (Rho) <a-ophirr(a)microsoft.com>, here it comes. :-) A brief description of this program is basically an cypher box that takes in a password, a stream of random numbers, a plaintext file, and a window size specification (more on this later.) The program takes in one byte of plaintext, several bytes of random numbers (called a window) of varying size, and then takes an encrypted copy of the plaintext byte and spreads its bits across the random number window. The actual bits and bytes that get replaced in this window depends on the passkey and the previous window. The great and obvious disadvantage to WNSTORM is that the size of the cypher text is several times larger than the plaintext. Another is that this is a private key system, but that's not quite as large a sore point. However, by replacing the random number stream with the low bits of a sound, picture, movie or other noisy data, inserting the plaintext into this noise with WNSTORM, and re-injecting the low bits back into the picture gives us the possibility of an excellent stego system! WNSTORM will also try and statistically fix the bits it changes so that the outgoing cyphertext matches the incoming random noise stream statistically, making a stego sniffer's job much harder... Anyhow since I'll need to clean up both source code and documentation, I thought I'd take this opportunity and announce the program. Oh and Tim, this is what I was talking to you about a long time ago and kept secret. :-)

1 0

Another Anti-Clipper Resolution
by Dave Banisar 17 Dec '03

17 Dec '03

I found this on the Public_Keys forum on Fidonet.. -dave Subject: Clipper/Telephony Big Bro Resolution To: All From: David Treibs Date: 3/26/94 6:07:02 PM ------------------------------------------- The following was passed as a resolution for the Republican convention in Senatorial District 19 of Uvalde county, Texas. I will attempt to get it adopted at the state level also. ENCRYPTION/GOVERNMENT MONITORING (BIG BROTHER IS WATCHING YOU) Whereas, government is increasingly intruding into the private matters of its citizens, And, an example of this intrusion is Clinton's Clipper/Skipjack encryption chip, which would allow the government easy access to all private and corporate electronic communications by telephone, computer, etc., And, a further example is the government's push to force all communications providers to leave a "back door" through which the government could easily monitor all communications, And, it is a trait only of despotic governments to scrutinize the private communications of its citizens, Resolved, we urge that the Clipper/Skipjack scheme be dropped and the Digital Telephony Act killed, that private communications and encryption be allowed to flourish without government "back doors," and we urge our government to give up the idea that we the people are guilty of something and must be monitored. --- Maximus/2 2.01wb * Origin: Frank's Station (1:19/148)

1 0

Re: identity, privacy, & anonymity in cyberspace
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

tmp(a)netcom.com writes/asks: > yes, remailers solve the problem of trying to post > messages without identity, but are we sure this is a > `problem' we want to `solve'? If this problem is not solved then all posts must contain a reference to the poster's true identity. Is that what you want, tmp(a)netcom.com? How would it be enforced? Government approved public-key pairs issued at birth? Random identity checkpoints on the Infobahn? A ban on all un-approved cryptography? Peer pressure? > hal argues below that there is `no line dividing the clean > from the unclean' (real name vs. pseudonymous vs. > anonymous etc.). to the contrary it seems to me to be the > case that either `i know who you are' or i don't. what does > it mean for me to `know who you are'? i admit there is no > basic definition, but it does seem to me that should not > prevent us from trying to find one. Instead of asking "who are you?", ask "what are you like?". I don't usually need to know who you are, but in certain contexts it is important to know what you are like. Further, I don't need to know what you are like in all contexts. Identity-based systems approach the "what are you like" question by demanding to know "who you are", and then determining "what you are like" by accessing various and sundry databases. These various and sundry databases are rapidly condensing into a few logical mega-databases. The problem with identity-based systems in which everyone has only a single identity is that it soon becomes very easy for someone to learn more about you than is necessary or desirable. Cross-referencing is the root of all evil! :-) I think much of the technology advocated on this mailing list can enable people to answer the important "what are you like" questions without creating systems that can also be used to pry into your entire life history. > the important goal is `defining what privacy really > means' I agree it is an important goal. > and cypherpunks seem to take the position, `it > means that nobody knows anything about me'. I disagree. I think cypherpunks want to retain (or re-acquire) the ability to control who knows what about them and when and under what contexts. This is a bit different from "nobody knows anything about me". However, I can't speak for all cypherpunks. > our society simply cannot function under this constraint. If by "our society" you mean the society in which we currently live, I'd have to agree. That does *not* mean I believe all possible societies become impossible under this constraint. Actually, I believe "under this constraint" is a strawman (see previous paragraph). > if you continue to insist that `nobody should know who i > am' i fear you will be bypassed by more sophisticated [?] > groups that have a less polarized view of issues of > identity and privacy. and it will ultimately be the least > controversial proposals that will shape the future we > live in. Being a pessimist, I'll have to agree with you here, although for slightly different reasons. I believe that as long as there are income and property taxes, the government will find ways to justify prying into our personal lives. Jim_Miller(a)suite.com

1 0

Re: Prime Numbers
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

Jeremy Cooper writes: > I found something interesting that I have not proven, but it has not > failed yet: > The integer N is prime if: > 2^N - 2 > --------- > N is an integer. This is fermat's little theorem. What you have written basically says 2^N - 2 = 0 (mod N) or 2^(N-1) = 1 (mod N). Note, the converse doesn't apply. If (2^N-2)/N is an integer, N isn't neccessarily prime. For example, take N=561=(3*11*37) For extra credit, prove your hypothesis. ;-) -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

3 2

Crypto, satellites, & China
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A story in the 3/14/94 issue of _Aviation Week_ reports that Hughes and Martin Marietta have satisfied the State Department and will now be able to launch the Optus B3 comsat. All the quotes below are from the article; it didn't have any detail on the cryptostuff. State had held up the launch because the Optus B3 payload included a "sensitive decryption chip". The USG made trade with China subject to the Missile Technology Control Regime (MTCR) after China was suspected of selling missiles to Pakistan. Hughes agreed to remove the chip, which "guards the satellite's steering commands"; once removed, State lifted the export restriction. "By removing the chip, authority for approving the launch was shifted to the Commerce Dept. from an interagency review commission headed by the State Dept. that had far less leeway to act." I never knew that encryption fell under MTCR in addition to ITAR. Presumably any crypto hardware or software which can be used to protect missile or satellite telemetry or commanding can be restricted. If anyone has more details on the MTCR and its application, I'd love to hear it. - -Paul Robichaux - -- Paul Robichaux, KD4JZG | Out the 10Base-T port, through the router, perobich(a)ingr.com | over the leased line, off the bridge, past Intergraph Federal Systems | the firewall... nothing but net. Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLamroCA78To+806NAQEK0wP/SD8692ZaMl71c57dSKAG7vmYVcyvIJi5 CNuWb4u3kL7WlfEtzrZ42Dfx4avgyzcjyoIyBDE5r+7n/nSMnbBGZGYR2OyTBQ5b GaK8RrrdJQoKujEvzR8i+XhtBin2doK5hzBHTY2VpYIexMH34MLZeYNST4nA7ek9 5EGWhbZ5mxw= =avDx -----END PGP SIGNATURE-----

2 2

T-Shirt Shipping Status
by Christian Void 17 Dec '03

17 Dec '03

Most of the shirts have shipped, with the exception of orders containing sizes over XXL. There was a probably with the larger sizes, which has been resolved. Those orders (the last remaining) will be shipped out sometime this week. I apologize for any delays, and the time it took to get this together. It turned out to be a bigger project than originally anticipated. It's too bad I can script a packaging algorithm to handle this, but that's real-life for you. :) If anyone has any questions, comments, gripes, flames, etc, mail me. Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

Clipper's Revenge
by Robert A. Hayden 17 Dec '03

17 Dec '03

Ok, this is a 'what if': What if: The government backs down on clipper, agreeing that there will be no escrowing of keys, but says that communications with the government must use Skipjack in order to establish a single encryption scheme for government communications. (this has the benefit of creating a huge userbase, thus establishing it as a standard.) What if: Skipjack, as designed, has a (secret) hole in it that will decrypt ANY communications using it. This means that anybody with the master skeleton key would be able to read Skipjack encrypted information. ========================= If you think about it, the above makes sense. The government wants to spy on the population, but the population can't know about the spying. Thus, they propose escrowing keys, which they know will raise public outrage. They put up a half-hearted fight and then back down, making hte public thinks they've won. In reality, though, Big Borther has won as they have put an compromised algorithm into general use that will allow them to do what they wanted to all along. Granted, they couldn't prosecute cases with evidence from taped Skipjack communications, but as we've seen, wiretaps are used so infrequently that it really isn't relevant. But, as long as they lay low, they can spy on any Skipjacked communications among business and other government agencies. Is the above feasible? ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> Political Correctness is \/ Finger for PGP 2.3a Public Key <=> P.C. for "Thought Police" -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

FW: Shot 'Round the World
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Blanc Weber writes: > On the subject of psychological warfare as a method in this privacy > effort, I was pondering: > . the effectiveness of the tactic employed > . the character of the intended recipient of the message > . how it will be interpreted by them > . predicting whether they will care, in the same way as the sender, > about the purpose & content of the message > Since the communication is mostly words framing thoughts and > philosophical arguments, the effects that one can aim for will be > either cognitive or psychological (hopefully achieving both). To aim > for a psychological effect only, is to propose that you know so much > about psychology, that you know precisely what to aim for - in the > minds of all of the recipients, and to expect predictable results. This goes too far; it's possible/reasonable to only suspect that an action will cause a certain effect in a useful segment of the target population. We don't insist on all-or-nothing accuracy in other forms of warfare, why expect it here? > In the attempt to persuade, convince, convert others from their > position which is offensive to one's own, the methods employed are > typically negative: pointing out the adverse consequences, pointing > out what is wrong with what is being done, pointing out how > bad/lousy/wrong/mistaken the offending party is, etc. This doesn't sound like psychological warfare to me - it sounds like some form of discussion. Psychological warfare is about manipulation and FUD (fear, uncertainty, doubt). (For all I know, it's about other stuff, too. Folks with actual training in the field are welcome to correct me.) > What is lacking in the mind of that type of psychological target is a > perspective on what is normal to a regular human being. So how could > positive indicators to the rest of life be given; how could a vision of > what else is true about real people be created, so that the perspective > of those targeted individuals or agencies is offered something better > to think about than the problems created by a few out-of-control types; > so that their outlook on the subjects of their attention (in this case, > the citizens of the US) is not composed only of visions of delinquency > and aberrant behavior? It sounds like your point is "if we're really good and eat our vegetables and clean our rooms, maybe Dad will let us stay up late to watch TV." Well, fuck that. The state is not our parent, and we don't need to demonstrate good behavior to convince it/them that we deserve or can be trusted with strong crypto or untapped phones. > It is a challenge to "maintain one's head while all about one, others > are losing theirs". Yet not only is that what is needed, but the > agencies supposedly charged with our welfare could also use some help > in maintaining *their* rationality. They apparently need some support > to the end of acquiring confidence in our judgement (the rest of us who > are not members of the elite, the chosen few). They are alarmed by the > potential threat of destruction of a system which they prize as the > means to social stability. What would reduce their felt need to cover > the world with wiretraps in order to make sure that they don't miss any > loose cannons out in the mists of the wild electronic atmosphere? What > could provide that sort of reassurance, that everyone is not going to > begin using their liberties in wanton, uninhibited, juvenile ways > against the system or against each other. What could provide evidence > contrary to the agencies' conclusion that non-government employees do > not have what it takes to make rational decisions about the toys & > tools and other devices which they create for their own amusement. No, they do not need our solicitude to bolster their flagging confidence, they need a good kick in the teeth. I suspect that good behavior will only convince them that we're up to something *really* evil that they need more tools/access to discover. [...] > There would be a great benefit to a psychological type of warfare, if > it could achieve points for the potential to normality which exists in > everyone; if it could present evidence to counter the argument that the > individual cannot be trusted, that we need to be saved from each other > (by the intelligence agencies). What could bolster their lack of > confidence in the judgement of the general population, such that the > conclusion made to use the services of these agencies would be proved > unnecessary? There is no rational argument that can force the non-trusting to trust. Attempts to formulate one frequently inspire further mistrust. > This would be demonstrated by the kinds of actions taken by individuals > in response to the threats against their privacy. So .. to demonstrate that we deserve privacy, we should ask politely for it? Bad little girls and boys are to get no dessert? Heck, my dog is smarter than that - she wants to see the treat before she does the trick. I don't even see the treat here (and am uninterested in letting the state teach me any new tricks). > To wage a psychological war is to assume a great responsibility for the > impressions made upon those who will be judging the behavior of their > "charges". Sometimes it's useful to drive opponents into such a frenzy that they're no loger capable of rational thought; it can be dangerous when the frenzied opponent will use the mechanisms of "public safety" to express its frustration. I agree that this sort of project must be undertaken with some care - but the point may be to create a state of irrationality, not a particular rational conclusion. The former is frequently easier and cheaper to create. > The psychological warriors would be taking part in the > creation of a picture of the population, the effects of which would be > a determining factor in the decisions made for future policies. It is > very easy to take exceptional cases and use them as examples upon which > to base techniques implemented for the cause of safety. It could > hardly be expected that a limited few would have the resources to > accomplish the goal for everyone, of saving the image of the individual > against the one-dimensional cyclops (within our own lifetime); it is > questionable whether any individual should associate themselves with > the burden of such a responsibility. Perhaps this discourse about "images" isn't useful, and it's time to talk about capabilities. Individuals have the capability to carry on private conversations whether the state likes it or not. Just as the forces of "public safety" can and will represent themselves as activists, terrorists, and saboteurs in order to infiltrate and influence dissident political groups, members of the public safety forces may be or may become disenchanted with the current regime or political climate and use inside information to embarass or injure the machinery of the state. I don't think Jeff Davis' action was an attempt at discourse but a shot fired across the bow of the ship of state. As such, it does indeed serve the purposes of rational discussion poorly; but it was meant to reach other goals. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLajOb33YhjZY3fMNAQGWMAQArmz5Ue8t8MCy09lM2q2w3QWARhzw1zHl vysopTCHhHh9CYtxJRaMPRsmCXWf4/b8ThEVE30dfVDYA1TeZktxYQCtDzRP7Xg+ wCPlxKGFCnpfaOdjkrq02sl/hMoZgBT89q8Y/rz5DLAcbKFBh/Ei5Pkyl2a5Kst3 mFnc0xpe/Bw= =JQNO -----END PGP SIGNATURE-----

1 0

ftp sites for 1984 NSA shirt
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

The NSA 1984 shirt is now available at the following ftp sites: ftp.atd.ucar.edu:/pub/Crypto ftp.wimsey.bc.ca:/pub/crypto/shirt It is still available for web surfers at: http://phoenix.aps.muohio.edu/users/jdblair/t-shirt.html Thanks to Mark Henderson and Jonathon Corbett for making the design available. Contact me at: jdblair(a)nextsrv.cas.muohio.edu if you would like the ordering information again. -john. -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 PGP public key available upon request. KILL YOUR Privacy in the information age is a right, not a privilage. TELEVISION Information = Power = Control. Fight the centralization of information.

1 0

No Subject
by Josephine Sandler 17 Dec '03

17 Dec '03

Please take me off your mailing list. Sincerely, josie(a)minverva.cis.yale.edu

4 3