December 2003 - cypherpunks-legacy

safety in Numbers ?
by Ed Switalski 17 Dec '03

17 Dec '03

Hi, a recent c-punx posting raised an implicit question about the amount of RSA in use already. Obviously the larger and more international the user base is less likely that Uncle Sam & sidekicks etc can palm off compromised crypto and signature schemes on the rest of us. Two quotes below from the pem-dev (PEM developers) list at tis.com give grounds for optimism. I have blinded the names, as a first line of defence, (those already subscribed to the list can find the original postings by date. Note that: The Public Key scheme mentioned in message 2 may not be full RSA, but indicates the possibilities if slot-in crypto modules were available for interface to standard PC/Mac office software packages PGP has a high profile right now, but needs more users to really damange Clipper. --- Quote 1 --- Date: Thu, 31 Mar 1994 02:43:27 EST Just a data point. There are currently roughly 3,620 PGP keys on the PGP key servers --- despite the fact that use of PGP generally entails violation of RSA DSI's patents. (Note that this number only includes those people who have published their keys; others, due to the patent issue, may not have published their keys on the key servers, and so would not be counted in this figure.) There are also people using RIPEM as well. Meanwhile, we haven't even been able to get our act together to generate a PEM root key; my understanding is that this at least partially related to the liability involved in running a root which *everyone* has to trust, although there may be other show stoppers as well. So there definitely is at least some amount of demand for secure electronic mail using RSA. It's just that by and large, people just aren't using PEM to satisfy their needs. --- end of Quote 1 --- *** Come on PEM-people get yourself a root key ! Then organizations *** ill send more RSA-authenticated mail. --- Quote 2 --- Date: Thu, 17 Mar 1994 12:20:22 EST Recent discussions with a very large software company that I won't name at this time indicates that they have on the order of 750,000 users that are already using an older form of public key cryptography. They are preparing their next release, currently plan to make it PEM compatible (although they are also looking carefully at the Apple AOCE varient), and expect that as many as 1.5 million users might be on this system within a year. This system includes a proprietary directory, and they are also planning to interface that directory to X.500. --- end of Quote 2 --- *** Thinks: the number of retrievals to date of PD crypto would be . useful to know For we are many and our name is Legion .... Regards, Ed Switalski

1 0

RMorality and Ethics (was Pseudonym's and Reputation)
by Jeff Davis 17 Dec '03

17 Dec '03

From: Blanc Weber <blancw(a)microsoft.com> To: cypherpunks(a)toad.com Subject: Re: Pseudonyms and Reputations Quoting Detwieler(?) " ideally we can develop moral codes where our algorithms fail us. " >Ideally, you would be able to enforce these moral codes. >Ideally, they would reflect not only what is possible in reality, but >what is truly desireable. --------- McCandlish and I discussed morality and ethics early during our initial "handshake". Stanton said there is no morality, only ethics- what do you think? (substantial paraphrase I think serves the purpose of discussion) Here's my reply, and agree that the difference is semantic: *** Morality is the ablility to differentiate between right and wrong, without denotation. Thus, each situation defines an eidetic decision and implementation which would be the application of an ethical standard based on past experience. Therefore, endogenous morality is quite tangible, while exogenous morality is most likely unethical, and detrimental to the purity of being. *** Jeff Leroy Davis <eagle> -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

NSA security manual
by Jeff Davis 17 Dec '03

17 Dec '03

Well Grady, You already know it's authentic. I'd love to call some of those secure phone #'s and see if my voice print still works. It would be a scream if it did >;) If any of you have tried one of the secure numbers out of curiosity, (and I've been out of the loop since 18 February 1983), you'll get a ring and a pause, then a rapid busy signal. This also lends credibility to my Psychological Warfare Primer, albeit subtely. I stated that the heavyweights in intelligence were the DIA, NSA, and the CIA, in that order. If *green* clearances are mere TS/IS, the DIA feeds them as well on a need-to-know basis. My analysis of the NSA mission is cryptography, (thanks for the hot tip, eh?), and interception. When AT&T broke up, it became possible to intercept transmissions that were previously protected by the monopoly. NSA is privy to all sorts of stuff, open long distance phone calls they can snag off the satellites without a warrent. They're pretty much public domain if one has the technology. Another thing I noticed was the Drug Policy. You note that they leave "authorized" drug use open. Amphetimines are SOP in some combat and combat simulation exercises. Christ, you want to laugh til tears roll down your cheeks, read the FOIA stuff released on the CIA's human experimentation with LSD. True keystone cop stuff. John Barlow and I were drinking some cokes and shooting the breeze here in Laramie a little over a year ago. He predicted an "opening" of the intelligence agencies after Clinton was elected- (This was the second to last weekend in October to be precise). NOW I see what he means. Thanks Grady! So THAT'S what the DoD pogues do. Can't wait to see a Field Manual for DIA intelligence officers. -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

Re: possible FTP site volunteer?
by Tomaz Borstnar 17 Dec '03

17 Dec '03

In-reply-to: Your message dated: Fri, 08 Apr 1994 01:33:56 EDT > This may be a lot to ask, would anyone be willing to volunteer a little > space on an ftp site for the 1984 NSA t-shirt gifs? While its easy for Me, me, me! :) > me to mail it out. You'd get a complimentary shirt out of the deal :) Great! ;) I'm taking care of ftp.arnes.si.

1 0

Grady's NSA Manual
by Jeff Davis 17 Dec '03

17 Dec '03

I don't know about you guys, but if the FBI comes through the front door over this NSA manual, this piece of shit I use for a UNIX terminal goes out the back door and off the roof into the alley >;) We're stripped down to the bare minimum for combat here at Outlaws on the Electronic Frontier. My personal secretary has full run of my accounts- (he writes the shell scripts), but he doesn't know my private key pass phrase. I guess that makes me impossible to impersonate, eh? -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

2 1

Re: NSA Security Manual
by Graham Toal 17 Dec '03

17 Dec '03

The information itself is not damning but law enforcement tends to frown on the CONCEPT of such releases. If it were seeded, Grady never would have been called. What I found interesting was that it was published in Phrack about a week ago, and nothing happened, but when Grady reposted it, suddenly phone-calls come aflying. Either this means that the NSA read Grady's posts more diligently than everyone else's, or Grady went out of his way to tell them that he'd posted it, which wouldn't surprise me... G

1 0

request
by satan 17 Dec '03

17 Dec '03

satan(a)ccwf.cc.utexas.edu request for mailing list

1 0

Re: tmp@netcom.com
by Hal 17 Dec '03

17 Dec '03

> Mr. TMP: > > You can easily settle this by attending or meeting with a CP in your area > who can sign your public key based on your Drivers License etc. > > While it might not be fair, it would put an end to the debate... Another way would be for people to get a *blind* signature from someone else saying "I am not Detweiler" (if that is all people care about). Sup- pose some nym were able to exhibit such a signature from a respected list member, ideally one who has given out a great many such signatures. No one would be able to link the nym to his True Name; all anyone would know is that at one time the True Name corresponding to this nym received a blinded signature making this assertion. This allows a nym to keep his anonymity while still responding to accusations like these, if he wishes. Hal

1 0

Re: Pseudonyms and Reputations
by Hal 17 Dec '03

17 Dec '03

From: greg(a)ideath.goldenbear.com (Greg Broiles) > Hal Finney writes: > > > The simple blinded signature model provides a pretty simple way to allow > > only one pseudonym per True Name in a given forum, if you assume there is > > some way to distinguish people in the real world. > [...] > Real-world application of this protocol still depends on folks not > using the credentials of friends/family/dead people, especially where > "real name" <-> credential mapping isn't available. This is true, but the main purpose of this technology is to prevent users from creating large numbers of pseudonymous accounts. No technology can stop people from cooperating in an on-line forum, and the use of friends' or family members' accounts is also very hard to prevent. So collusion at some limited level will always be possible. But at least it should be possible to prevent the massive use of nyms. Hal

1 0

No Subject
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

Subject: NSA Security Manual You realize, of course, that by posting the manual verbatim you have allowed them to discover where the leak was. They have the ability to change the wording slightly on every document, so that when you quote the document they can discover who gave it to you. That is why newspapers no longer report quotes from documents that they have, or never show pictures of secret documents. Then again, for something as simple as a manual, they may not bother to change each one. But the capability exists. user(a)host.domain.site

3 2