December 2003 - cypherpunks-legacy

Looking for a paper...
by Jim McCoy 17 Dec '03

17 Dec '03

I am trying to hunt up a copy of: The Dining Cryptographers in the Disco: Unconditional Sender and Recipient Untracability with Computationally Secure Serviceability by Michael Waidner and Birgit Pfitzmann So far the only ref I have found is the abstract in Eurocrypt '89, but I can't seem to locate a copy of the entire paper. If anyone knows of where I might find a copy I would appreciate it... jim

1 0

Minor edit to the PGP 2.6 distribution
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

About one half hour ago I replaced the PGP 2.6 distribution files with a newer version. The change represents a new mitlicen.txt file (minor wording correction, no big deal) and a corrected UNIX makefile. The source itself and the executables were not changed. -Jeff

1 0

PGP 2.6 is dangerous in the long term ?
by mgream＠acacia.itd.uts.edu.au 17 Dec '03

17 Dec '03

Personally, I happen to dislike the PGP 2.6 saga; I think it's effectively turning the wheel back viz. "US only software" as well as confusing the issue ("oh, which PGP do you have ?"). Some say that it's not a problem in the sense that PGP 2.3a will be upgraded to "support" PGP 2.6. Even this situation is clearly undesirable as PGP itself becomes a fragmented product -- esp. as I think "new users" will opt for PGP 2.6, and others will change too because of the purported "legitimacy". The result is that PGP 2.6 _will_ become heavily adopted in the US. This it not the point, however. As the RSA patent is expected to expire in the coming years, one would expect the liberation of PGP, at least in terms of the RSA algorithm (negating the export control issues). The sinister fact of PGP 2.6, and other derived RSAREF product is that even as the patent itself expires, RSADSI still exerts control over PGP by way of RSAREF. Being Australian, I've not read the RSAREF conditions, but there is at the point that commercial use will still not be possible (at it would be under non-RSAREF 2.3a) when the RSA patent expires. So quite possibly, PGP 2.6 is doing a great deal more longer term damage to the viablity of PGP than is immediately obvious. Is this a valid viewpoint ? Matthew. -- Matthew Gream Consent Technologies Sydney, (02) 821-2043 M.Gream(a)uts.edu.au

9 12

RE: Bruce Sterling's talk at CFP
by Blanc Weber 17 Dec '03

17 Dec '03

I'm glad that Bruce Sterling made the comments which he did, in that gathering of the right people to hear these statements. Although he sounds as though he thinks that everyone ought to be their brother's keeper, I think the paragraphs below do point out the hypocrisy in worrying about the gravity of what could be communicated in a telephone conversation or over the net that might result in advancing a criminal act, when "People stumble through the streets of every city in this country absolutely wrapped in the grip of demons, groping at passersby for a moment's attention and pity and not getting it." The contrast between cries for safety legislation and the abhorent conditions under which many live, do not demonstrate a delicate sensitivity towards higher standards of functioning which could make one sympathize with the alarms about opening up a pandora's box of crime, in such a climate of seeming disconcern for the sufferings of the individual. Who is being saved from what, and who really cares? If the answers to these questions are not resolved, then what sense does it make to put such alarms into a non-existent context. "There may be securicams running 24 hours a day all around us, but mechanical surveillance is not the same as people actually getting attention or care." And it's not the same as actually knowing what is important to an individual, and it does not convince that, although truly important values which could build up a society are being neglected, attending to these exceptional threats to safety will keep everyone from total disaster. "You want to impress me with your deep concern for children? This is Chicago! Go down to the Projects and rescue some children from being terrorized and recruited by crack gangs who wouldn't know a modem if it bit them on the ass!" Another convincing demonstration of efficacy in responding in a coordinated fashion to the safety requirements of a great society, protecting the sacredness of vulnerable littel children, the purity of the moral atmosphere, and being of practical use to all. Maybe I could appreciate someone's deep concern for my safety, but yet be unconvinced of the consequential benefit of their ministrations when there is so much evidence to the contrary. I wouldn't make the points which B. Sterling made in quite the same way, but he did present the message to our "guardians" that they are not pulling the wool over *every*one's eyes, that their hypocricy is patent, and that their motives are ridiculous about their proposed goodwill to mankind. Blanc

1 0

PGP 2.6 uses RSAREF version 1
by Hal Abelson 17 Dec '03

17 Dec '03

MIT's release of PGP 2.6 uses RSAREF version 1, under the RSAREF license of January 5, 1993. Some people have wondered whether including RSAREF 1, rather than RSAREF version 2, is an oversight in the PGP 2.6 distribution. It is not an oversight. Version 1 is what we intended. The change from RSAREF 2.0 (in PGP 2.5) to RSAREF version 1 (in PGP 2.6) was done on the advice of RSA Data Security, which has granted MIT permission to access non-published routines in all RSAREF versions 1.nn, and rights in accordance with the version 1 license. -- Hal Abelson Dept. of Elect. Eng. and Comp. Sci. MIT

1 0

(fwd) FBI infiltrates Connected.com
by Jim choate 17 Dec '03

17 Dec '03

Path: bga.com!news.sprintlink.net!connected.com!connected.com!not-for-mail From: turmoil(a)hebron.connected.com (Turmoil) Newsgroups: seattle.general,alt.activism,alt.2600,alt.drugs Subject: FBI infiltrates Connected.com Date: 21 May 1994 11:48:31 -0700 Organization: Connected INC -- Internet Services Lines: 22 Message-ID: <2rll1v$jmb(a)hebron.connected.com> NNTP-Posting-Host: hebron.connected.com X-Newsreader: TIN [version 1.2 PL2] Xref: bga.com seattle.general:3840 alt.activism:10793 alt.2600:9216 alt.drugs:20914 Recently the staff at connected. has admitted that they have "invited" two FBI agents to roan that system. According to connected.staff these FBI agents are looking for "hackers phreaks" and people having copywritten programs. I am pretty peaved about this, we don't know how long thev'e been here, what rights they have on the system, or much else. Just that they are here. Watching us. Of course, I never use my account for illegal activities. Shit, I don't even do much illegal (except smoke a bit of pot) But I do not like the idea of giving up my rights against undue searches. This seems a reflection on the state of America today. This used to be a free country, but now there is a pig or FBI agent watching EVERYTHING you do. This is NOT the America described in the constitution. It's not a society of free, independent people. It is a dictatorship that must spy on it's own people in order to survive. I am anxious to here what others that read these groups think about this. Have A Nice Day turmoil(a)hebron.connected.com The FBI have infiltrated this site, I am activly searching for a new site

1 0

Email firewall etc
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Vincent.Cate(a)FURMINT.NECTAR.CS.CMU.EDU: > Companies like the idea of firewall machines to protect the security of > their internal nets. I bet they would also like something called an > "email-firewall". Names are important. :-) I think of the > email-firewall as a slightly modified anonymous-remailer. I haven't delved into the wide world of remailers out there, but I'd like a remailer that encrypted, though did not necessarily anonymize, incoming mail. I'm not really bothered about the NSA reading my mail. In fact, I'm not usually concerned whether someone in New York, for instance read my mail. But I might not want people closer to home (local sysadmins, etc) to read it. I'm sure many others share this position. The problem is that I can't ensure that people encrypt their mail to me. They may not bother, or be unable. An alternative would be for them to send it to a remailer, which, knowing my public key, would encrypt and forward it to me. Comments? -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! --------------------------------------------------------------------------

1 0

Re: PGP 2.6 uses RSAREF version 1
by joshua geller 17 Dec '03

17 Dec '03

>Some people have wondered whether including RSAREF 1, rather than >RSAREF version 2, is an oversight in the PGP 2.6 distribution. It is >not an oversight. Version 1 is what we intended. uh huh.... >The change from RSAREF 2.0 (in PGP 2.5) to RSAREF version 1 (in PGP >2.6) was done on the advice of RSA Data Security, which has granted >MIT permission to access non-published routines in all RSAREF versions >1.nn, what the FUCK? what mean non-published routines? > and rights in accordance with the version 1 license. something smells here. josh

1 0

Re: Graph isomorphism based PK cryptosystems?
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: Graph isomorphism based PK cryptosystems? > Interesting. Have you tested it against the known methods for the > isomorphism problem? Van Leeuwen* references an O(n log n) > average-case algorithm, and ones that are pseudopolynomial w.r.t. > degree, genus, and treewidth. Luks did the trivalent case and then later the bounded valence case. bounded genus is due to Miller. Also bounded eigenvalue multiplicity due to Babai and others. There are also a number of related problems which are believed to be difficult. Finding a small generating set for the automorphism group of a graph is polynomial time equivalent. The graph isomorphism problem also reduces to several of computational problems in permutation groups where these groups are given by small generating sets (e.g. calculation of the centraliser of a permutation, group intersection, double coset membership, subset stabiliser, normaliser) This is one of those problems where the "average" case is relatively easy. Take a random graph (with a reasonable definition), finding the automorphism group is usually relatively easy by backtracking. The hard cases are ones which superficially look like they have lots of symmetry but really have small non-trivial automorphism groups. Similarly for graph isomorphism, i.e. take two random graphs (again one needs to define this), it is usually pretty easy to determine whether they are isomorphic (just look at the degree sequence and work from there). Approaches involving backtracking to find isomorphisms can be effective in more subtle cases. So you need to be careful to avoid the easy cases. I remember some really hard (practically) cases for the usual backtracking approaches to determining automorphism groups came from graphs derived from certain designs. I'd sure like to see more details about a public key system based on Graph Isomorphism. (For a book on graph isomorphism and related computational problems take a look at C.M. Hoffmann, Group-Theoretic Algorithms and Graph Isomorphism, Lecture Notes in Computer Science #136, Springer-Verlag, 1982. A little old but it covers a fair bit). There is a point to this, I remember some papers by Magliveras (sp?) on cryptosystems from problems in permutation groups. Anyone have copies or remember any details? -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLeLV9WrJdmD9QWqxAQHKYAH9EuLksdWKLvnhr6FIRjBZO6O2eyKCY6rI MsDvo2V8QJTLdXDHR/rDuChdOQRIQtsa7H1k3/ZEZnP331Roeg3/3w== =yJZr -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

SRA telnet and ftp (FYI)
by Richard Johnson 17 Dec '03

17 Dec '03

A note about a package that uses D-H to generate a key for telnet and ftp authentication. Has anyone here played with it? Richard ------- Forwarded Message Subject: SRA telnet and ftp Date: Tue, 24 May 1994 08:57:40 -0400 To: Firewalls(a)GreatCircle.COM From: bukys(a)cs.rochester.edu After hearing about David Safford's SRA telnet/ftp package from numerous sources, I finally went and got a copy (from ftp://net.tamu.edu/pub/security/TA MU). It's nice work. I would like to clarify one point, though: This package uses the Diffie-Hellman code from the Secure RPC implementation, to securely compute a session key which the SRA code uses to encrypt an authentication transaction. The code does NOT use the session key to encrypt the whole session. It would probably be relatively easy to add, but it's not in there in the current code. This is from my perusal of the code, and correspondence with the author. FYI ------- End of Forwarded Message

1 0