December 2003 - cypherpunks-legacy

anti-clipper autobomber
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

I found this on comp-privacy. Maybe we can use a scheme like this one to send anti-clipper information over the net... Does toad.com have a usenet news feed? If so, maybe we can have a program written that scans for keywords and mails the author of the message some info about cypherpunks and clipper and digital telespying 2. I do however strongly suggest that the automail bomber keep records of who it sent a particular anti-clipper message to. We don't want to actually mailbomb people with 500 copies of the same message. Just one article would do. We could also have this program autobomb different articles based on different keywords. It would be a good idea to also keep a list of names of those who complained so we don't send'em anything again, and separate "already-sent-to" lists for different articles with a central universal "no-send" list. I would guess that this could be done with a daemon and a couple of scripts, or perhaps some atrun'ed program. The 1st program would scan all the articles for the keywords and useraddresses. It would then append any usernames it finds that have sent messages with keywords that may indicate a favorable response to the article to the article's mail list. The second program would then take the mail list for each article and remove any names found in the universal "send-no-mail-to-me" list, and in the "already-sent-to" list. The resulting list could be fed to perhaps majordomo(?) or just passed to a mailer along with the text of each article. The name would then be thrown in the "already-sent-to" list after the message completed. Perhaps at the bottom of the mailed article we can have some instructions on subscribing to cypherpunks, or telling this autobomber to put the name into the "no-send" list. Perhaps a message to majordomo with "remove autobomber" or something... I'd imagine that this would create quite a lot of traffic for toad.com, not to mention the requirements of huge names lists... Maybe if the articles are periodic and are no longer sent after a month, it can help keep the storage and traffic in check??? Anyway, here's the article: Article 1117 of comp.society.privacy: Path: prism.poly.edu!cmcl2!yale.edu!yale!gumby!newsxfer.itd.umich.edu!gatech!howland.reston.ans.net!vixen.cso.uiuc.edu!uwm.edu!computer-privacy-request From: "Paul W. Robinson" <PAULW(a)TDR.COM> Newsgroups: comp.society.privacy Subject: Every Move You Make...I'll Be Watching You Date: 14 Apr 1994 23:41:27 GMT Organization: Computer Privacy Digest Lines: 39 Sender: comp-privacy(a)uwm.edu Approved: comp-privacy(a)uwm.edu Message-ID: <comp-privacy4.52.5(a)cs.uwm.edu> NNTP-Posting-Host: 129.89.2.6 X-Original-Submission-Date: 14 Apr 1994 02:43:17 -0400 (EDT) X-Submissions-To: comp-privacy(a)uwm.edu X-Administrivia-To: comp-privacy-request(a)uwm.edu X-Computer-Privacy-Digest: Volume 4, Issue 052, Message 5 of 19 Originator: levine(a)blatz.cs.uwm.edu "Paul W. Robinson" <PAULW(a)TDR.COM> stated: Here's something which might be of interest to you. A large Educational Instuitution's computer is watching everything sent in newsgroups and possibly in some mailing lists. I am using a modified address of PAULW(a)TDR.COM instead of PAUL because that computer has already sent me a message to PAUL(a)TDR.COM. I want to try to see what it does this time. In one list I mentioned that the Massachusetts Institute of Technology (you know what the 3 letter abbreviation is) has a system that collects E-Mail addresses of people who post to newsgroups. That site used to be called "pit-manager". I am writing this message in this way to see what happens. Apparently, any time one of the Institute's computers sees a reference to "pit-manager" it mails a message to the sender telling them that the site was changed to the address "rtfm". I am not referencing the internet address that ends in .EDU here for that educational Institution because I want to see if the Massachusetts Institute of Technology's computer is checking based upon someone using the name "pit-manager" or is it because of reference to the Institute's domain name with that term used within the message? I don't know if a program that is sending out messages based on it scanning the contents of messages that it saw is a good idea. Consider a program that checked for spelling errors and criticized people who misspelled words by telling them of all the words they misspelled. (Considering how bad some people's writing is, that might not be a bad idea.) This sort of practice could be prostituted into to all sorts of interesting political correctness tactics by having automated programs that watch for comments someone doesn't like and mailing the writer complaints. --- Paul Robinson - Paul(a)TDR.COM

2 1

Blind signature cash patents
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

A little while ago someone posted about a new company that would do patent searches via email requests. For another week they are doing free searches as an introductory offer. I did a search on blind-signature based cash systems, and these are the patents it found. This might be useful for those considering implementing electronic cash. Full text of patents are available for $4.95. The kind of search I did for free will cost $149 after another week. People are allowed 3 searches per day for free until then. For more info send a message with just "help" in the body to spo_patent(a)spo.eds.com. Hal 2 04977595 19901211 380/24 Method and apparatus for implementing ++electronic++ ++cash++ Inventor: Ohta; Kazuo Assignee: Nippon Telegraph and Telephone Corporation Abstract: In an ++electronic++ ++cash++ implementing method, a user makes a ++bank++ apply a ++blind++ signature to user information Vi produced, by a one-way function, from secret information Si containing identification information, thereby obtaining signed user information. Further, the user makes the ++bank++ apply a ++blind++ signature to information containing authentication information Xi produced, by a one-way function, from random information Ri, thereby obtaining signed authentication information. The user uses an information group containing the signed user information, the signed authentication information, the user information and the authentication information, as ++electronic++ ++cash++ for payment to a ++shop++. The ++shop++ verifies the validity of the signed user information and the signed authentication information, and produces and sends to the user an inquiry. In response to the inquiry the user produces a response Yi by using secret information and random information and sends it to the ++shop++. Having verified the validity of the response the ++shop++ accepts the ++electronic++ ++cash++. 3 05224162 19930629 380/24 ++Electronic++ ++cash++ system Inventor: Okamoto; Tatsuaki Assignee: Nippon Telegraph and Telephone Corporation Abstract: In an ++electronic++ ++cash++ system, K sets of ++blind++ signature information are derived from secret information containing identification information of a user, K/2 sets of them are opened and a ++bank++ attaches a ++blind++ signature to the remaining K/2 sets of information. The user obtains a signed license from the ++blind++ signature. The user generates ++blind++ signature information from the license and a desired amount of money and gets a ++blind++ signature of the ++bank++ to the ++blind++ signature information and obtains ++electronic++ ++cash++ signed by the ++bank++ from the ++blind++ signature. The user presents to a ++shop++ a residue power root of a node in a money hierarchial structure and the ++electronic++ ++cash++, corresponding to the amount of money to be used, and the ++shop++ verifies their validity and, if they are valid, offers inquiry information to the user. The user offers, as response information, a residue power root of the node corresponding to the amount of money to be used to the ++shop++. The ++shop++ verifies the validity of the response information and, if it is valid, acknowledges the payment with ++electronic++ ++cash++ of the amount of money to be used. 4 04759063 19880719 380/30 ++Blind++ signature systems Inventor: Chaum; David L. Abstract: A cryptographic system allows, in one exemplary use, a supplier to cryptographically transform a plurality of messages responsive to secret keys; the transformed messages to be digitally signed by a signer; and the signed transformed messages returned to the supplier to be transformed by the supplier, responsive to the same secret keys, in such a way that a ++digital++ signature related to each original message is developed by the supplier. One important property of these systems is that the signer cannot determine which transformed message received for signing corresponds with which ++digital++ signature-even though the signer knows that such a correspondence must exist. 6 04914698 19900403 380/30 One-show ++blind++ signature systems Inventor: Chaum; David Abstract: Numbers standing for ++cash++ money can be ++spent++ only one time each, otherwise the --account-- from which they were ++withdrawn++ would be revealed. More generally, a technique for issuing and showing ++blind++ ++digital++ signatures ensures that if they are shown responsive to different challanges, then certain information their signer ensures they contain will be revealed and can be recovered efficiently. Some embodiments allow the signatures to be unconditionally untraceable if shown no more than once. Extensions allow values to be encoded in the signatures when they are shown, and for change on unshown value to be obtained in a form that is aggregated and untraceable. 11 04949380 19900814 380/30 Returned-value ++blind++ signature systems Inventor: Chaum; David Abstract: A payer party obtains from a signer party by a ++blind++ signature system a first public key ++digital++ signature having a first value in a withdrawal transaction; the payer reduces the value of the first signature obtained from the first value to a second value and provides this reduced-value form of the signature to the signer in a payment transaction; the signer returns a second ++digital++ signature to the payer by a ++blind++ signature system in online consummation of the payment transaction; the --paper-- derives from the first and the second signature a third signature having a value increased corresponding to the magnitude of the difference between the first and the second values. Furthermore, the following additional features are provided: payments are unlinkable to withdrawals; a ++shop++ between the payer and signer can be kept from obtaining more value than desired by the payer; the first value need not be revealed to the signer or intermediary in the payment transaction; the returned difference can be accumulated across multiple payment transactions; and the returned difference can be divided between a plurality of payment transactions. 19 04759064 19880719 380/30 ++Blind++ unanticipated signature systems Inventor: Chaum; David L. Abstract: An improved ++blind++ signature system not requiring computation during ++blinding++ for anticipating which of a plurality of possible signatures will be made during signing, while still allowing the ++blinding++ party to unblind and recover the unanticipated kind of signature on what was ++blinded++. An exemplary embodiment ++blinds++ by forming a product including a plurality of generators raised to powers normally secret from the signing party, and unblinds by forming a product with the multiplicative inverse of a signed form of the generators raised to the original powers. Re-blinding allows a signature on a value to be transformed into a signature on a particular ++blinded++ form of the value. 23 04206315 19800603 380/23 ++Digital++ signature system and apparatus Inventor: Matyas; Stephen M. Assignee: International Business Machines Corporation Abstract: A ++digital++ signature machine provides a simplified method of forming and verifying a signature that is appended to a ++digital++ message. A sender transmits a signature with the usual signature keys and with validation table entries that correspond to the unsent keys and with the compressed encoding of the next validation table. The receiver uses the compressed encoding of the next validation table to form validation table entries from the signature keys so that the receiver has a full validation table. This validation table is compressed and compared with the compressed encoding which was received from the sender in a preceding message.

1 0

Media Mass Mailers
by Jeff Davis 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Llywelyn <samman(a)CS.YALE.EDU> Subject: Re: anti-clipper autobomber On Sat, 16 Apr 1994, Arsen Ray Arachelian wrote: > I do however strongly suggest that the automail bomber keep records of who > it sent a particular anti-clipper message to. We don't want to actually > mailbomb people with 500 copies of the same message. Just one article ::Sounds a bit like Serdar's scheme. ::Ben. Having had some experimental success with mass mailing the media, I've already considered the concept. Pertinent adresses would include major newspaper, TV and periodicals. Items would have to be newsworthy, not just informational. Personal attention would be paramount. A live person would have to monitor the responses, personally appologizing for the inconvienience to those requesting deletion, with assurances that the matter will taken care of to their satisfaction immediately. Out of the God knows how many media adresses Adam Gaffin provided me, I had two deletion requests. One from an IL local, and the other from the Pheonix Gazzette. Notable persons requesting to be kept informed of newsworthy developments on the electronic frontier include Adam Kaul of NBC News. IMHO, we need to use our technological resources to their greatest tactical and operational advantage. Albeit, ladies and gentlemen, we must consider it of paramount importance to preserve a strategy of befriending the media, avoiding at ALL COST a technological alienation of them. Serdar's roboposts are the classic example of what not to do. I'm sure if this ever gets out of the intellectual stage and into the operational, sufficient safeguards for our integrity will have been established. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLbBfmV/ScHuGXWgVAQHxpAQAtDl2gXZbKD621n+UNvzTtylxifqpx6ry wk4o/ZdGaA+jfJbeVnTdd/+Borq1VdgIGAyJEwBCoDft/qbuMoKrhhNAHzWcLy9T 96mNmgFzGZw0OKgniDbVkBLcL3g9uCtvce1E+XFFZeHUeXwHL3NWqOH2oiG3ti+d uk04h1SLUBI= =oPEx -----END PGP SIGNATURE----- -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

1 0

Sgt Russell
by Wayne Q Jones 17 Dec '03

17 Dec '03

Sorry for pounding this to the list but I cant get through to the Sgt Russel on my system. Q: I did not know sea06 funded the USMC . Is this some special unit or just the way it is? Q: SInce when did the Fallbrook Weapons Station need to use PGP for its security? Sounds a little black to me especially when you can get RSA for free. Wayne **************************************************************************** Qjones(a)infi.net She kissed me- I felt the hot blush * * Qjones(a)larry.wyvern.com Of raging passion incinerate my heart * ****************************************************************************

1 0

'Nother MIT talk on crypto...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

> Thursday, April 21, 1994 > Refreshments at 4:00pm, Talk at 4:15pm in NE43-518 > > ``WHICH KEY ESCROW, IF ANY?'' > or > ``Fair Cryptosystems vs. The Clipper Chip'' > by > Silvio Micali > MIT > >Wide-spread use of cryptography will greatly enhance our privacy, but >will also make court-authorized line-tapping impossible. In an effort >to make cryptography ``compatible'' with law enforcement, the Clinton >Administration has been advocating the use of a new encryption >technology: the Clipper Chip. > >Whether cryptography should be regulated at all is an important >question, one that should be debated at all possible levels of our >society. This talk, however, focuses primarily on TECHNICAL points >that are crucial to make an informed decision. In particular, we >address the following questions: > >* Does Clipper Chip really make cryptography and law enforcement > compatible? > >* Does Clipper Chip introduce unwanted and/or unforseen dangers? > >* Are there better alternatives to making encryption and law > enforcement compatible, if this is what we want?

2 1

Table of Key Lengths and Brute Force Cracking Times
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Here are some numbers from Bruce Schneier's article in the April 1994 "Dr. Dobb's." The article is a review of the "Cambridge Algorithms Workshop," where Bruce also presented a paper on Blowfish. These estimates are in a slightly different form than what "Applied Cryptography" has (on pp. 130-135), and incorporate (apparently) the Michael Wiener DES-busting estimates from last summer. First, some typical key lengths for block ciphers, as reported by Schneier: Algorithm Key Block Problems/Comments DES 56 64 key too small Triple DES (3DES) 112 64 slow Khufu (Merkle/Xerox) 64 64 patented, key too small FEAL 32 64 64 patented, key too small LOKI-91 64 64 weaknesses, key too small REDOC II 160 80 patented REDOC III variab. 64 patented IDEA (Europe) 128 64 patented RC2 (RSADSI) variab. 64 proprietary Skipjack (NIST/NSA) 80 64 secret algorithm GOST (FSU, Russia) 256 64 not completely specified MMB 128 128 insecure The "problems" reported are exactly as reported by Schneier. No mention of RC4, which may in "exportable" versions may be as short as 40-45 bits. Second, some estimates of brute-force cracking time: Key Length Time for a $1M Time for a $1B ($1000M) Machine to Break Machine to Break 40 0.2 second 0.0002 sec 56 3.5 hours (Wiener) 13 sec 64 37 days 54 minutes 80 2000 years 6.7 years (2 years?) 100 7 billion years 7 million years 128 10^18 10^15 years 192 10^37 years 10^34 years 256 10^56 years 10^53 years Note that a billion dollar cipher-busting machine is not out of the question. Norm Hardy once described to us the $100M "Harvest" machine (also described by Bamford). NSA has its won on-site wafer fab facility (built by National Semiconductor several years back). A single Space Shuttle launch costs around a billion dollars (NASA says $0.6B, GAO says $1.5B), and many of the launches are just put up reconnaisance and SIGINT satellites, so spending $500M to $1B on special computers to crunch the data seems plausible. (However, it's hard for NSA to make plans for what key length they'll have to target. It's also not clear that enough non-financial users have been using DES to make it "necessary" for such large expenditures....a single machine that can crack a DES-encrypted message in, say, 1-10 hours may be enough for their current needs. All of this is just speculation.) For logistical and other reasons, I would expect they may have _several_ smaller machines. Just as effective, of course, cumulatively. Obviously a billion dollars worth of hardware will not be dedicated for a couple of years to crack a single 80-bit cipher. Anyway, you all can fool with these numbers and draw your own conclusions. Ron Rivest did some similar calculations for RSA modulus sizes and came to similar conclusions (e.g., 1200-bit modulus will withstand even attacks by billion-dollar machines for several more decades). --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Dolphin Encryption Tutorial
by Anonymous 17 Dec '03

17 Dec '03

I just received this encryption "tutorial", which is really a thinly disguised sales pitch for Dolphin Encryption software. The sales pitch seems aimed toward less knowledgable users of PGP. >Some have claimed that PGP is the most secure encryption program >available for PCs, a claim that does not withstand critical >examination. What PGP is built on (IDEA, MD5, RSA) are all available for public inspection. Same for RIPEM. Available for free. Are you somehow implying the Dolphin Encrypt withstands critical examination? Be real. >Generally public key systems, such as PGP, are much slower than >secret key systems, and so ?? PGP uses MD5 to hash the passphrase to create a session key. It uses the session key to encrypt data, and uses RSA to encrypt the session key. It does not perform full blown RSA encryption on the data. What follows is a wondrous statistical analysis designed to frighten. A "weak" system is used to encrypt 2048 bytes, showing statiscal skewing. Fortunately, Dolphin Encrypt produces a flat distrubution when encrypting a 60201 byte file. Dolphin encrypt versus a 60201 byte file is superior to another system versus a 2048 file. Thank god. I just wonder what kind of data these two files are: 2048 bytes of ascii text versus 60201 bytes of a jpeg, zip archive, random noise? The comparison, fairly useless as it is, is even more useless without this further information.

2 1

Cypherpunks Quick Code
by Bill Garland 17 Dec '03

17 Dec '03

Cypherpunks Quick Code V 1.00 ====================== 1. Cypherpunks, QUICK! CODE! 2. Cypherpunks write code. 3. Cypherpunks, WRITE CODE! 4. Cypherpunks, right. Code? 5. Cryptography is all Economics. 6. There is no cypherpunks agenda. 7. According to something tossed around over on the Extropians list, .... 8. i am NOT Detweiller. 9. As long as you use the MD5 hash of the 3DES session keys in the remailer header and PGP in the digital postage stamps, the NSA can't de-cripple your whiffie, er, de-clipple your Hell, man, - the money will still be safe with aunt bessie. 10. DISSEMINATION of this IMPORTANT INFORMATION in UnAltered Format is .... 11. ag588 is rejecting mail from you. Wendell Noseworthy =========== Just so as not to generate any more wasted bandwidth here, or is that waste more generated bandwidth, whatever, I will forward any suggested changes to the Cypherpunks Quick Code to Wendell Noseworthy for insertion into the next offically cypherpunk-agenda-approved release of the Cypherpunks Quick Code. Send them to me... Bill Garland, whose .sig does channeling for a small fee

1 0

RE: Laundering money through commodity futures
by Pat Farrell 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes) posts to C'punks: >> This zero sum nature is the key to laundering the money. Person A and >> Person B get together and guess that the price for a commodity is going >> to go up. > > Guess. Read that word again; it's important. > >[stuff elided] > The example is ludicrous, but the conclusion is valid. More > transactions means more interactions between them and more possibility > to hide something inside the ever-increasing flux. On the OP-Ed page of the WSJ a week ago thursday (page A14) is an article that describes a way to make a $100,000 bribe look like extrodinary luck in the cattle futures market. The trick that both the initial poster and Eric missed is that you don't guess. You need a shady broker who makes a saddle - both side of the trade - and doesn't register either. Once the market has moved, one will post a gain, and the other a loss. So you could, hypothetically of course, post the loser to a huge poultry conglmerate, and the winner to a successful laywer's account. The Poultry firm would write it off as a normal market loss that was protecting their operations. The laywer would claim that she read the WSJ and was lucky. But untracable electronic markets will have lots of transactions, so there will be lots of ways to play these games. This is what drives the taxman crazy. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Warrantless searches -- A sign of things to come?
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

A Page 1 story in The Washington Post Sunday (94.04.17) reads, "Clinton Lets Police Raid Projects," "Warrantless Searches Said to Be Needed For Tenants Safety." For those who haven't been following this ludicrous story, the USG has now decided that Chicago Housing Authority-sponsored, and warrantless, searches of dwellings within the CHA, is "A Good Thing" (tm) and specifically geared towards uncovering weapons of criminals (or would-be criminals) for the safety of law-abiding Housing tenants. Personally, I find this mentality alarming and indicative of a growing trend within the government. "Big Brother knows best." Vile and Nauseating. This is another absurdity in the "War on Drugs" and "War on Crime." More government-sponsored "wars" are undoubtedly on the horizon, perhaps even a war on non-escrowed crypto. I suppose things will get worse before they get better. _______________________________________________________________________________ Paul Ferguson US Sprint Enterprise Internet Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com

3 2