December 2003 - cypherpunks-legacy

fake pgp messages
by hh＠xcf.Berkeley.EDU 17 Dec '03

17 Dec '03

in the process of doing stuff to fight traffic analysis, i need to generate a bunch of fake pgp messages. it is possible to asciiarmor random bits, but this is pretty easy to spot. does anyone know a good way to generate a large amount of bogus pgp messages? e

4 3

Re: fake pgp messages
by Jeff Davis 17 Dec '03

17 Dec '03

Eric Hollander asked about faking pgp messages. How much disk space do you have? I have a couple of megs of active files of text I could email you and you could just send them out as ascii.armored real messages. -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

rng, anyone?
by Erich von Hollander 17 Dec '03

17 Dec '03

i'm doing some stuff on this remailer which requires a good rng. perl's rng just calls c's rng, which totally sucks. does anyone know of a cryptographically sound rng i can use? i could just call it from perl or something. thanks, e

2 1

Re: fake pgp messages
by cort 17 Dec '03

17 Dec '03

> > in the process of doing stuff to fight traffic analysis, i need to generate > > a bunch of fake pgp messages. it is possible to asciiarmor random > > bits, but this is pretty easy to spot. does anyone know a good > > way to generate a large amount of bogus pgp messages? > > What better way than to generate real pgp messages that encrypt noise files? > Just generate pseudorandom binary data of pseudorandom length (biased > toward the length of real messages), and encrypt with pgp, using the > public key of some person's key from a public server, selected at > random. If you want to be able to spend less cpu time, you could hack a > copy of pgp to simulate doing this, of course, using the symmetric key > cipher (idea) in a stream cipher mode. > Better "noise" might be _real_ words, paragraphs, etc. It occurred to me once that some of the remailer operators could bounce the cypherpunks mailing list around through their remailers to get more traffic/noise. Cort.

1 0

Press Release on Secure NCSA Mosiac
by Dave Banisar 17 Dec '03

17 Dec '03

Secure NCSA Mosaic establishes necessary framework for electronic commerce onthe Internet PALO ALTO, CALIF. (APRIL 12) BUSINESS WIRE - April 12, 1994-- Enterprise Integration Technologies (EIT), the National Center for Supercomputing Applications (NCSA) at the University of Illinois and RSA Data Security Tuesday announced agreements to jointly develop and distribute a secure version of NCSA Mosaic, the popular point-and-click interface that enables easy access to thousands of multimedia information services on the Internet. The announcement was made in conjunction with the launch of CommerceNet, a large-scale market trial of electronic commerce on the Internet. Under the agreements, EIT will integrate its Secure-HTTP software with public key cryptography from RSA into NCSA Mosaic Clients and World Wide Web (WWW) servers. WWW is a general-purpose architecture for information retrieval comprised of thousands of computers and servers that is available to anyone on Internet. The enhancements will then be made available to NCSA for widespread public distribution and commercial licensing. Jay M. Tenenbaum, chief executive officer of EIT, believes secure NCSA Mosaic will help unleash the commercial potential of the Internet by enabling buyers and sellers to meet spontaneously and transact business. "While NCSA Mosaic makes it possible to browse multimedia catalogs, view product videos, and fill out order forms, there is currently no commercially safe way to consummate a sale," said Tenenbaum. "With public key cryptography, however, one can authenticate the identity of trading partners so that access to sensitive information can be properly accounted for." This secure version of NCSA Mosaic allows users to affix digital signatures which cannot be repudiated and time stamps to contracts so that they become legally binding and auditable. In addition, sensitive information such as credit card numbers and bid amounts can be securely exchanged under encryption. Together, these capabilities provide the foundation for a broad range of financial services, including the network equivalents of credit and debit cards, letters of credit and checks. In short, such secure WWW software enables all users to safely transact day-to-day business involving even their most valuable information on the Internet. According to Joseph Hardin, director of the NCSA group that developed NCSA Mosaic, over 50,000 copies of the interface software are being downloaded monthly from NCSA's public server - with over 300,000 copies to date. Moreover, five companies have signed license agreements with NCSA and announced plans to release commercial products based on NCSA Mosaic. "This large and rapidly growing installed base represents a vast, untapped marketplace," said Hardin. "The availability of a secure version of NCSA Mosaic establishes a valid framework for companies to immediately begin large- scale commerce on the Internet." Jim Bidzos, president of RSA, sees the agreement as the beginning of a new era in electronic commerce, where companies routinely transact business over public networks. "RSA is proud to provide the enabling public key software technology and will make it available on a royalty-free basis for inclusion in NCSA's public distribution of NCSA Mosaic," said Bidzos. "RSA and EIT will work together to develop attractive licensing programs for commercial use of public key technology in WWW servers." At the CommerceNet launch, Allan M. Schiffman, chief technical officer of EIT, demonstrated a working prototype of secure NCSA Mosaic, along with a companion product that provides for a secure WWW server. The prototype was implemented using RSA's TIPEM toolkit. "In integrating public key cryptography into NCSA Mosaic, we took great pains to hide the intricacies and preserve the simplicity and intuitive nature of NCSA Mosaic," explained Schiffman. Any user that is familiar with NCSA Mosaic should be able to understand and use the software's new security features. Immediately to the left of NCSA's familiar spinning globe icon, a second icon has been inserted that is designed to resemble a piece of yellow paper. When a document is signed, a red seal appears at the bottom of the paper, which the user can click on to see the public key certificates of the signer and issuing agencies. When an arriving document is encrypted, the paper folds into a closed envelope, signifying that its formation is hidden from prying eyes. When the user fills out a form containing sensitive information, there is a "secure send" button that will encrypt it prior to transmission. To effectively employ public-key cryptography, an infrastructure must be created to certify and standardize the usage of public key certificates. CommerceNet will certify public keys on behalf of member companies, and will also authorize third parties such as banks, public agencies and industry consortia to issue keys. Such keys will often serve as credentials, for example, identifying someone as a customer of a bank, with a guaranteed credit line. Significantly, all of the transactions involved in doing routine purchases from a catalog can be accomplished without requiring buyers to obtain public keys. Using only the server's public key, the buyer can authenticate the identity of the seller, and transmit credit card information securely by encrypting it under the seller's public key. Because there are fewer servers than clients, public key administration issues are greatly simplified. To successfully combine simplicity of operation and key administration functions with a high level of security that can be accessible to even non- sophisticated users, significant changes were necessary for existing WWW security protocols. EIT developed a new protocol called Secure-HTTP for dealing with a full range of modern cryptographic algorithms and systems in the Web. Secure-HTTP enables incorporation of a variety of cryptographic standards, including, but not limited to, RSA's PKCS-7, and Internet Privacy Enhanced Mail (PEM), and supports maximal interoperation between clients and servers using different cryptographic algorithms. Cryptosystem and signature system interoperation is particularly useful between U.S. residents and non-U.S. residents, where the non-U.S. residents may have to use weaker 40-bit keys in conjunction with RSA's RC2 and RC4 variable keysize ciphers. EIT intends to publish Secure-HTTP as an Internet standard, and work with others in the WWW community to create a standard that will encourage using the Web for a wide variety of commercial transactions. EIT will make Secure NCSA Mosaic software available at no charge to CommerceNet members in September and NCSA will incorporate these secure features in future NCSA Mosaic releases. Enterprise Integration Technologies Corp., of Palo Alto, (EIT), is an R&D and consulting organization, developing software and services that help companies do business on the Internet. EIT is also project manager of CommerceNet. The National Center for Supercomputing Applications (NCSA), developer of the Mosaic hypermedia browser based at the University of Illinois in Champaign, Ill., is pursuing a wide variety of software projects aimed at making the Internet more useful and easier to use. RSA Data Security Inc., Redwood City, Calif., invented Public Key Cryptography and performs basic research and development in the cryptographic sciences. RSA markets software that facilitates the integration of their technology into applications. Information on Secure NCSA Mosaic can be obtained by sending e-mail to shttp- infoeit.com. --30--pc/sf CONTACT: Hamilton Communications Nancy Teater, 415/321-0252 KEYWORD: CALIFORNIA ILLINOIS INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED Z REPEATS: New York 212-575-8822 or 800-221-2462; Boston 617-330-5311 or 800- 225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 Transmitted: 94-04-12 12:08:00 EDT

1 0

Re: Quants vs Congress
by Mike Markley 17 Dec '03

17 Dec '03

---------- | From: Timothy C. May <netmail!tcmay(a)netcom.com> | To: John E. Kreznar <jkreznar(a)ininx.com> | Cc: <cypherpunks(a)toad.com> | Subject: Re: Quants vs Congress | Date: Wednesday, April 13, 1994 8:13PM | | Received: from relay2.UU.NET by netmail.microsoft.com with SMTP (5.65/25-eef) | id AA14155; Wed, 13 Apr 94 19:20:40 -0700 | Received: from toad.com by relay2.UU.NET with SMTP | (5.61/UUNET-internet-primary) id AAwlnp10043; Wed, 13 Apr 94 23:21:22 -0400 | Received: by toad.com id AA17257; Wed, 13 Apr 94 20:13:54 PDT | Received: from mail.netcom.com (netcom5.netcom.com) by | toad.com id AA17248; Wed, 13 Apr 94 20:13:47 PDT | Received: from localhost by mail.netcom.com (8.6.4/SMI-4.1/Netcom) | id UAA15518; Wed, 13 Apr 1994 20:13:38 -0700 | Message-Id: <199404140313.UAA15518(a)mail.netcom.com> | In-Reply-To: <9404140219.AA09878@ininx> from "John E. Kreznar" | at Apr 13, 94 07:19:36 pm | X-Mailer: ELM [version 2.4 PL23] | Mime-Version: 1.0 | Content-Type: text/plain; charset=US-ASCII | Content-Transfer-Encoding: 7bit | Content-Length: 1913 | Sender: netmail!owner-cypherpunks(a)toad.com | Precedence: bulk | | John Krexnar writes: | | (Duncan Frissell's section elided) | | > Aw c'mon Duncan. Derivative of what? What's a quant? Where was the | > term ``intermediation of political risk'' used? | > | > I love your postings when I can make sense of them. This one is so well | > encrypted I can't. | | "Derivatives" mean secondary financial instruments, based on ("derived | from") things like stocks, bonds, and real estate. Things like futures | markets, "baskets" of other instruments, etc. These started, it may be | argued, in the trading pits of Chicago, but have now spread around the | world. I think I recall reading (in "Time"'s cover story last week on | derivatives and quants, ironically enough--the Wall Street nerd with | the "messy room" has replaced the hacker as the Number One Threat to | Civilization) that $ 4 Trillion in derivatives trades _daily_. | | "Quants," closely related to "rocket scientists," are those who use | math and statistics for investment purposes. Short for "quantitative." | | I urge all Cypherpunks who can afford to do so to subscribe to "The | Economist." It's filled with good, incisive articles, including the | best treatments of breaking science and technology stories in any | general magazine. Shoot your t.v., maybe, but don't let your | subsription lapse. Available also on newstands, whence information on | subscribing may be found (read the mag long enough, and you too will | speak in terms of "whence"). | | --Tim May | | | -- | .......................................................................... | Timothy C. May | Crypto Anarchy: encryption, digital money, | tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero | 408-688-5409 | knowledge, reputations, information markets, | W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. | Higher Power: 2^859433 | Public Key: PGP and MailSafe available. | "National borders are just speed bumps on the information superhighway." | The derivatives market is a very dangerous place also. In yesterdays financial section here in Seattle there was an article about how Proctor and Gamble is reporting a loss of over $100 million in the mortgage derivative market. Also in RISKS Digest 15.75 there is an article with the subject ' God Grants Granite Gift to RISKS Punsters' that talks about a company losing $600 million over the period of several weeks in the deriviative market. Mike. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Mike Markley || The opinions here do not represent the mmarkley(a)microsoft.com || opinions of my employer. Attempts to || associate the two are pointless. "I want to look at life, In the available light" - Neil Peart -

2 1

Re: Soldier of Fortune
by Duncan Frissell 17 Dec '03

17 Dec '03

M > M >This seems counterproductive. PGP should not be portrayed as a tool M >for those that most Americans consider antisocial. M > M >M Carling M > A quote from pgpdoc1.doc: "If privacy is outlawed, only outlaws will have privacy. Intelligence agencies have access to good cryptographic technology. So do the big arms and drug traffickers. So do defense contractors, oil companies, and other corporate giants. But ordinary people and grassroots political organizations mostly have not had access to affordable "military grade" public-key cryptographic technology. Until now." Now Phil wrote PGP in part so that "grassroots" political organizations could have strong crypto. SOF is a "grassroots political organization." It happens that some people don't like SOF. It happens that some other people think that the organizations that Phil was thinking of when he wrote PGP are unamerican communist front organizations who should be on the Attorney General's List (if we still had an Attorney General's List)(if we still had an Attorney General). Tastes differ. The point of cypherpunks is that everyone (even FBI agents) should have strong crypto if they want it. I know that Phil feels a personal sense of embarrassment at being adopted by all sorts of nut groups (including ourselves) and he has pleaded for stories of "worthy PGP use." Standards of worthiness will vary. DCF Who, as it happens, *is* a member of an organization on the Attorney General's list. --- WinQwk 2.0b#1165

2 1

Re: fake pgp messages
by Ian Turton 17 Dec '03

17 Dec '03

> > > in the process of doing stuff to fight traffic analysis, i need to generate > > > a bunch of fake pgp messages. it is possible to asciiarmor random > > > bits, but this is pretty easy to spot. does anyone know a good > > > way to generate a large amount of bogus pgp messages? > > > > What better way than to generate real pgp messages that encrypt noise files? > > Just generate pseudorandom binary data of pseudorandom length (biased > > toward the length of real messages), and encrypt with pgp, using the > > public key of some person's key from a public server, selected at > > random. If you want to be able to spend less cpu time, you could hack a > > copy of pgp to simulate doing this, of course, using the symmetric key > > cipher (idea) in a stream cipher mode. > > > > Better "noise" might be _real_ words, paragraphs, etc. > > It occurred to me once that some of the remailer operators could > bounce the cypherpunks mailing list around through their remailers > to get more traffic/noise. why not take a random news group comp.talk.eff seems like a good one and encrypt that and mail out one article whenever you need or whenever your news server recieves one. You could then tailor the frequency by choosing high or low volume news groups. > > Cort. > > > Ian Turton - School of Geography, Leeds University 0532 -333309

1 0

Code review is requested.
by kafka＠desert.hacktic.nl 17 Dec '03

17 Dec '03

In article <199404110553.AA00997@xtropia>, you write the following: AN> Cypherpunks review code! AN> AN> I have written a hack to allow pgp's random.h and random.c to be used AN> with a hardware random number generator. I have mailed this to a AN> number of U.S. cypherpunks with the request that the hack be AN> distributed widely in the U.S. test --- "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 4 1994 == To get PGP, FTP /pub/unix/security/crypt/pgp23A.zip from ftp.funet.fi ==

1 0

NBC's Kaul
by Jeff Davis 17 Dec '03

17 Dec '03

Well, NBC's Alan Kaul and I had a discussion a few moments ago. Apparantly a helicopter crashed and this is old news. He has been instructed by NBC superiors to move on. The downplaying by the NSA was key. It wasn't another "Pentagon Papers" leak. He's got my unlisted number and asked if he could call from time to time to use me as an informed source, and asked to be kept on my mailing list. I guess I'll scrounge up that abitrary finger data from the AmEmbMoscow.gov deal and send that to him as an item of interest. Perhaps a CIA hand was logged on when that stuff popped up on the screen... This is not a topic for discussion. I know some of you have grown to care about me, and some rip me routinely. I am responsible and accountable for my own actions. "Those who risk nothing, are nothing, do nothing, and become nothing." By the time you rebut, that finger information will be gone. -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0