December 2003 - cypherpunks-legacy

Re: Pseudonyms and Reputations
by Hal 17 Dec '03

17 Dec '03

Nathan Loofbourrow writes, regarding the on-line game: > > You could impose an annoyance factor on the distribution of initial > resources (a week's wait, perhaps), or on unlikely transfers (you > can't give away the resource except in exchange for some other form of > goods... an Objectivist's paradise, perhaps?) Some kinds of play-by-mail games have had a similar situation, but they have generally not faced the problem in this form because they charge money to enter. This puts a cap on how many entries a person is willing to make. With a large number of participants, controlling two or three players instead of one does not increase the average person's chance of winning enough to make it worthwhile. This does suggest an alternative form of "is-a-person" credentialling, though. Rather than trying to verify identity at a distance, one could simply have a "he paid me $10" credential. You would give these out (probably just one per customer rather than multiple ones) as blinded signatures for anybody who sent you the cash. These could be substitute is-probably-a-person credentials on the theory that most people wouldn't be able to waste a lot of money purchasing a great many of these. OTOH, it's not clear that anyone would be willing to pay this much for a credential unless it had some real, tangible benefit (otherwise it serves as an "I'm a sucker" credential), and if the benefits are great enough perhaps it would be worthwhile to buy multiples. Hal

1 0

MIT sysop faces piracy charges.
by Alexander Chislenko 17 Dec '03

17 Dec '03

Today's Boston Globe has an article on a 20yo MIT student David LaMacchia who 'enabled Internet users around the globe to pirate more than a million dollars worth of copyrigthed software'. David 'faces a possible jail term and fines of up to $250,000'. David's scheme involved usage of anonymous remailers [?] in Finland. The article starts on the front page with a big color picture of David in his computer room. Here's a repsonse to the case I found oncomp.org.eff.talk:

2 1

remailers GONE!
by Black Unicorn 17 Dec '03

17 Dec '03

------------------------------------------------------------------------------ List of Running Remailers Last Response ------------------------------------------------------------------------------ 0 remailers listed. <- OH NO!

4 4

Data Lock 271.82 dollar contest
by Michael Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- __ / \ New Cryptographic Freeware Available: Data Lock /____\ \ / * Uses the Diamond Encryption Algorithm (slight variation on MPJ2) \ / * Includes complete source code \/ * No patent infringement problems * Includes source code library for Diamond & Diamond Lite * Can be strong enough to protect very valuable data (see below) * Can be weakened enough to be exportable in executable form only * Ciphertext doesn't advertise its algorithm or key (stealth) Documentation only (exportable): ftp:csn.org//mpj/public/dlockdoc.zip or dlockdoc.tar.gz ftp:ftp.netcom.com//pub/mpj/public/dlockdoc.zip or dlockdoc.tar.gz Full package (including all source code & executable file): ftp:csn.org//mpj/I_will_not_export/crypto_???????/mpj/dlock.zip or dlock.tar.gz ?????? and anti-export warning given in ftp:csn.org//mpj/README.MPJ ftp:ftp.netcom.com//pub/mpj/I_will_not_export/crypto_???????/mpj/dlock.zip or dlock.tar.gz ?????? and anti-export plea given in ftp:ftp.netcom.com//pub/mpj/README.MPJ Colorado Catacombs BBS 303-938-9654 DLOCK.ZIP Data Lock itself may be useful, but its greater value lies in the fact that it is written more to be used as a function library for people who want to incorporate encryption into other applications. The only change from MPJ2 to the Diamond Encryption Algorithm is that the key expansion mechanism now distinguishes between keys of different lengths. For example, the keys "aaaaaaaa" and "aaaaaaaaaaaa" would have been equivalent in MPJ2, but are not in Diamond. Diamond Lite is just the logical contraction of Diamond from a 16 byte (128 bit) block to an 8 byte (64 bit) block. Even though "Lite" is in the name, it yields better security for small numbers of rounds because of the faster avalanche effect (1 bit to 64 in just 2 rounds instead of 1 bit to 128 in 5 rounds). MPJ2 and Diamond are derived from the MPJ encryption algorithm, invented in 1989, but use an improved key scheduling algorithm that eliminates the slight bias in the way the substitution arrays were filled. The following is a comparison of some of the symmetrical key ciphers available to the general public today. Included is a (somewhat subjective) strength comparison to give a general idea of how Diamond and Diamond Lite compare: ALGORITHM BLOCK KEY ROYALTY ECB RELATIVE APPROXIMATE WORK FACTOR NAME SIZE SIZE FREE? MODE SPEED TO BREAK log base 2 of BITS BITS OK? number of operations DES 64 56 YES YES MEDIUM 43 3DES 64 112-168 YES YES SLOW 64-168 DIAMOND 128 variable YES YES MEDIUM 128-key size DIAMOND LITE 64 variable YES YES VERY FAST 64-key size BLOWFISH 64 variable YES YES VERY FAST 64-key size? SHA-CFB 160 variable YES NO VERY FAST 80-160 MD5-CFB 128 variable YES NO VERY FAST 64-128 REDOC II 80 160 NO YES FAST 80-key size REDOC III 64 variable NO YES VERY FAST 64-key size KHUFU 64 512 NO YES ? 64-512 IDEA 64 128 NO YES FAST 64-128 MMB 128 128 ? YES FAST 128? The "work factor to break" column is somewhat subjective, and is based on the best attacks that I have knowledge of (hardly an exhaustive list), combined with a GUESS at what attacks might succeed. They also assume that the key length is at least as long as the numbers indicated when the key length is variable. You should decide for yourself what you will believe. Don't put all your eggs in one basket. Besides those things listed above, some distinguishing characteristics of Diamond and Diamond Lite include: * They can easily and securely take a pass phrase directly as a key. * They can be extremely fast when implemented in hardware. * They allow you to perform some security vs. speed and size tradeoffs. * Key setup is designed to make brute force attacks very costly. OK, this is where I put my money where my keyboard is. If you are the first one to correctly decipher my challenge text (CHALLENG.ENC in DLOCK.ZIP), enciphered with DLOCK.EXE, before midnight UTC, 29 April 1997, and follow the redemption instructions contained within the challenge text, then I will send you US$271.82 of my hard-earned money. You must (1) reveal to me how you did this, and (2) not break any laws in the process to collect the prize. I know that this isn't enough to justify much serious cryptanalysis, but it should demonstrate that such a challenge is beyond the reach of the average hacker. ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-938-9654 | | | | / _ | mpj(a)csn.org ftp:csn.org//mpj/README.MPJ for crypto stuff | | |||/ /_\ | aka mpj(a)netcom.com mpjohnson(a)ieee.org mikej(a)exabyte.com | | |||\ ( | m.p.johnso(a)nyx.cs.du.edu CIS 71331,2332 PGP key by finger | | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLaDz1j9nBjyFM+vFAQHJ8QP/UgnrRX0u5AAnEoOIuNPi1Y8yRPrY7U3R BWTb04eyi1hqSuWnVQaAkINp84R5d/PhyS7wa5xEEoq+UmhISEoGHoSVc6e2QWr+ xsSR5vjvUQpc5zkPIdkFOpVb94aCUCDHh5Zv4bU6WsVoKI+zAXSrRDL7o4zhwfxp +H6ov+NPI1M= =9Ul1 -----END PGP SIGNATURE-----

1 0

bumpersticker source
by nates＠netcom.com 17 Dec '03

17 Dec '03

Lots of people have been asking about where to get the sticker paper, so I'll just tell everyone. I think it may be easier to just let everyone make their own instead of bothering with making them myself. Here's the info: The stuff is called "stickyback" Saga Division of DADE, Inc. Interchange Office Park 400 Highway 169 South Minneapolis, MN 55426-1199 Pricing: Size: Qty 1-3 4-11 12+ --------------------------------------- 8.5" x 11.0" 10 7.35 6.60 5.95 8.5" x 11.0" 50 31.50 28.50 25.60 11" x 17" 50 63.00 57.00 51.20 It's available in either white (opaque) or clear. -nate -- +--------- | Nate Sammons <nates(a)netcom.com> PGP Key and fingerprint via finger. | Clipper == Big Brother Inside. Question Authority. Encrypt everything. +---------

1 1

Re: Today cryptography, tomorrow ??
by joshua geller 17 Dec '03

17 Dec '03

> > Many of the Cynosure users hid their identities by using an > > Internet address in Finland that provided an anonymous forwarding > > service for the pirated programs, according to the indictment. > Does this mean we will soon be seeing Julf in chains on the evening news > with his coat over his head? > After all, the United States long ago awarded itself kidnapping > priveleges against anyone it claims has violated US law, with no concern > for the laws of the country in which the person resides. Just ask Manuel > Noriega. or timothy leary. josh

2 1

MIT Student Indicted on Piracy Charges
by Anonymous 17 Dec '03

17 Dec '03

http://the-tech.mit.edu/V114/N19/piracy.19n.html Student Indicted on Piracy Charges By Josh Hartmann Contributing Editor A federal grand jury charged an MIT student yesterday on a felony charge for allegedly allowing the piracy of over $1 million in business and entertainment software using Athena workstations. David M. LaMacchia '95 was indicted on one count of conspiring to commit wire fraud, according to a statement from the U.S. Attorney's office in Boston. LaMacchia allegedly allowed the duplication of hundreds of copyrighted software packages between Nov. 21, 1993, and Jan. 5, 1994, using workstations on the Athena Computing Environment. "We became aware sometime in December that a computer was being used to distribute software," said Kenneth D. Campbell, director of the news office. "That information was turned over to Campus Police and the FBI. MIT personnel cooperated with the FBI in the investigation." The incident was discovered when an Athena-user in the Student Center cluster noticed that an unattended workstation next to him was behaving abnormally, making frequent disk accesses, according to James D. Bruce ScD '60, vice president for Information Systems. The user apparently reported the abnormal behavior to members of the Student Information Processing Board, who then proceeded to investigate the matter, according to a source familiar with the investigation. The SIPB members saw the status of the workstation and reported the incident to the Information Systems staff, the source said. SIPB itself was not part of the investigation, according to Jessie Stickgold-Sarah '96, the SIPB chairman. Attorneys for LaMacchia issued a swift denial of the charges late yesterday, saying LaMacchia was merely the provider of a service which others used to place and remove files. The statement called the indictment a test case to "decide whether current criminal law would penalize a [systems operator] who neither controls what is placed on the system nor profits one cent from any copyrighted software that others upload to and download from the system that he and others create and operate." Many of the people who accessed the pirated files over the Internet concealed their location by using an anonymous service in Finland, Bruce said. The Associated Press reported yesterday that LaMacchia advertised the server strictly by word-of-mouth to avoid detection. The AP quoted the indictment as saying that as many as 180 users accessed the server in one 16-hour period. Disciplinary process underway Within MIT, "there was a disciplinary action filed against [LaMacchia] sometime in January," Bruce said. These proceedings have been halted, he added. Another anonymous source said that the Office of the Dean for Undergraduate Education and Student Affairs had received a complaint in January, but had not decided whether the disciplinary action would be forwarded to the Committee on Discipline, handled by the Dean's Office, or dismissed outright. Dean for Undergraduate Education and Student Affairs Arthur C. Smith said last night that Institute disciplinary procedures are usually suspended when a student is charged with such a crime. However, Smith would not comment on the status of any disciplinary case underway. If LaMacchia were convicted, he would still be subject to the normal disciplinary measures within the Institute, Smith said. Losses over $1 million Losses from the illegal software duplication are expected to surpass $1 million, according to the statement from the U.S. Attorney's office. "The pirating of business and entertainment software through clandestine computer bulletin boards is tremendously costly to software companies, and by extension to their employees and to the economy," said U.S. Attorney Donald K. Stern. "We need to respond to the culture that no one is hurt by these thefts and that there is nothing wrong with pirating software." A list obtained by The Tech revealed that MS-DOS games dominated the server. Among the business software, however, were Aldus Pagemaker 5.0 for Windows, Microsoft Word for Windows 6.0, a beta (pre-release) copy of a forthcoming operating system by Microsoft code-named Chicago, WordPerfect 6.0 for both DOS and Windows, a beta copy of Microsoft 5.0, and Aldus PhotoStyler 2.0. If found guilty LaMacchia could conceivably be the subject of a civil suit by the software vendors, Bruce said. "It would be entirely possible for a vendor to make a case that it suffered monetary damages," he said. "I would think there is some reason [LaMacchia] could be sued." Bruce said he thought the Institute's liability would be limited because of Athena rules prohibiting duplication of copyrighted software. LaMacchia did not return telephone calls last night. Copyright 1994 by The Tech. All rights reserved. This story was published on Friday, April 8, 1994. Volume 114, Number 19 The story began on page 1 and jumped to page 13. This article may be freely distributed electronically, provided it is distributed in its entirety and includes this notice, but may not be reprinted without the express written permission of The Tech. Write to archive(a)the-tech.mit.edu for additional details.

1 0

Today cryptography, tomorrow ??
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

AP 4/8/94: A federal grand jury indicted an MIT student Thursday on charges he ran a computer bulletin board that allowed people to copy more than $1 million worth of copyrighted software for free. [...] The bulletin board, named Cynosure, allowed people on MIT's computer network to copy business and entertainment software, the indictment said. [...] Internet users also were able to illegally copy the software, Stern said.[..] Many of the Cynosure users hid their identities by using an Internet address in Finland that provided an anonymous forwarding service for the pirated programs, according to the indictment. .... Like to include more but ..uh.. "fair use" and all that .... Wonder how come he didn't encrypt?

3 2

THE ANTI-CLIPper
by Gary Jeffers 17 Dec '03

17 Dec '03

An excerpt from the THE SPOTLIGHT newspaper April 11, 1994 from its TECHNOLOGY & LIBERTY column. "TV THAT WATCHES YOU" "In a little-noticed agreement reported in Washington Technology Week Bell Atlantic, General Instruments Corporation, & the National Institute of Science & Technology(NIST) have agree to build Clipper chips into future General Instruments cable-TV boxes." "It's a landmark agreement, & the mainstream media has been virtually silent on the subject. But what does the agreement mean?" "For starters, it means your high-tech cable box of the future will have all the "privacy protection" of your Clinton Clipper telephone. It is designed to snitch on you." "For example, you'll soon be able to order merchandise through your high-tech cable TV. And the Clipper chip implanted in your cable box wil flag every purchase as yours. Maybe you contribute to church causes? Use your cable box for tithes & it could be "profiled". Do you watch pay- per-view movies? Big Brother could soon be critiquing your viewing habits." "Starting to get the picture? The Clipper chip is designed to auto- matically identify every cable TV transaction you make. It can report your favorite programs & films. It can mark your buying habits." "And since Clipper's actual capabilities are still top-secret, it could theoretically be even more sinister. It could even contain logic to encrypt signals from monitoring equipment built into your cable box, such as a miniature video camera or infrared sensor (like the cameras & sensors already built into experimental cable boxes used by the Arbitron & Nielson rating services to monitor who is in the room with the TV on)." "General Instruments Corporation (GI) has a near-monopoly on the production of home cable-TV receivers. As a result, the "quiet" Clipper agreement virtually assures that Clipper chips will be insin- uated into the cable boxes of almost 90% of American's cable sub- scribers, all of whom have GI's cable equipment." This looks like really bad news to me! Maybe the free market could help? How about "CLIPPER FREE" labels on small companies cable_TV receivers. If the company could get away with it, it might really help their sales. Maybe foreign companies could come in with Clipper-frees? They could scream trade- war if the feds tried to stop them. American companies could then claim unfair restrictions were keeping them from being competitive. An even better possibility presents itself! How about the poss- ibility of a pirate cottage industry in disabling Clipper chips. Would the TV work with a broken Clipper. How about jumping around the Clipper chip? If that doesn't work, then an anti-clipper chip that goes in parallel or in series with the Clipper or replaces it? I don't know much about electronics. There has been for years a small in- dustry in producing "pirate" cable boxes. Imagine the possibilities with the anti-chip business. Electronic hackers working their way though college by installing off-shore produced anti-Clipper chips. Also individuals making a living from this or a good moonlighting job. If the feds outlaw this - THEN EVEN BETTER! An off the books, non-taxed business employing skilled technical people & habituating the population to engaging in federally unlawful activities! I predict that in coming years, the productive general population is going to become boldly contemptful of the big state. In this atmosphere, anti-Clipper activity will be well received & popularly endorsed. We will see a booming underground electronic privacy industry. What would the new chip's name be? THE ANTI-CLIPper? THE FREEDOM CHIP? THE WACO? THE WEAVER FAMILY? THE ANARCHIST CHIP? THE EQUALIZER CHIP? THE CYPHERPUNK CHIP? THE PRIVACY CHIP? THE YOU'LL-MIND-YOUR-OWN-DAM'D-BUSINESS CHIP? THE NEUROMANCER CHIP? THE ANTI-STATE CHIP? THE REVOLT CHIP? THE CLIP CLIPPER CHIP? THE NO-FEDS CHIP? THE CLIPPER CLIPPER CHIP? Yours Truly, Gary Jeffers PUSH EM BACK! PUSH EM BACK! WWWWAAAYYYY BBAAACCCKKK! BBBEEEAAATTTT STATE!

1 0

Re: Shot 'Round the World
by Black Unicorn 17 Dec '03

17 Dec '03

Mr Davis: >You may authenicate the NSA manual via confirmation by the phone numbers >listed in it. Consider this the shot heard round the world in the >Electronic Revolution. Well, this certainly helped the "cause." If I were a media person recieving this mail, I'd get a good laugh, then hit delete. I don't see anything nifty, wonderful, or unusual in the manual. I've held a Secret clearance doing work as a Defense contractor, and the requirements aren't abnormal. They're stricter, but given that the clearance level is higher and it's in the intelligence community, it's not unusual. I would seriously doubt the manual is of much interest to the media. If you want to help, mail the media about privacy, and what Clipper is going to do to it. This kind of mail just makes the online community look like fanatical crackpots. Bob (I'm an EFF member as well. What does that have to do with your message?) -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl. <- I tend to side with Mr. Snyder here. I would add that Mr. Davis has probably attracted a good deal of attention to himself for little gain. Distributing the manual anonymously would have made more sense, and in the event that the manual becomes an issue of contention or a torch for a witchhunt, Mr. Davis would be an interesting martyr in the quest to test the security of remailers and anonymous distribution. I fail to see how this is an important step for the cause. The manual was already in active distribution, the media will probably be the first to jump on the "electronic risks" bandwagon by noting how easy it would have been for an individual to spread a much more damning document. This brings up a curious point. If the cause is thawarting intelligence agencies, the next Clipper will be much less open, perhaps even black. My take on the point of cyberpunks was to make the technology available, organize the positive societal impacts, and prevent the government regulation of information and technology. How can the reckless distribution of (admittedly moderate) intelligence information serve these goals? As much of an anti-estlablishment movement as cypherpunks might associate themselves with, since when has treason been on the agenda? (Obviously I don't label Mr. Davis a traitor, but I'm not in authority in this matter.) Even Mr. May, who I most respectfully place on the heavy side of anti- estlablishment, has often noted that the goal is to allow society to evolve into the technology that is available. Freedom of information, and nil transaction cost in anonymous settings is key in empowering the individual and securing individual rights. Obviously the goal will conflict with modern intelligence agencies that seek to attempt domestic monitoring, but I think everyone here needs to address the role of such agencies in the grand scheme of things. Is the cypherpunk position a lawless one, or one promoting the evolution of law? I will be the first to assert that the manual was basically non-damning, I did in fact assert so some days ago. But consider, what if it had indeed been a revelation in the security methods and practices of the intelligence agency? That would be a significant compromise, and cost mass sums of money in modified security efforts by the agency. Not to mention the fact that it stands to endanger lives. Consider the recent attack on the CIA. I doubt that even this would have prevented the wild distribution of the manual however, prompting me to wonder about the place of responsibility and restraint in the realm of freedom of information. Who would be the bidders on BlackNet for such information? No one who wanted to know simply for academic purposes I'll wager. Issues like this seem to add to the Pro-Clipper arguements. The current pathalogical obsession with anti-crime measures can only be fueled with incidents like this and the MIT piracy case. If anon.penet.fi was not really used in this case, we see how the media will capitolize on these events to feed the headlines, and in this case that means anti-crime positions. Most media people will pass up the manual, just as someone suggested they might. What concerns me is the radical right reporter who asks, "Just who is this guy and why does he have this manual?" -uni- (Dark)

1 0