December 2003 - cypherpunks-legacy

Re: rng, anyone?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> need good RNG WHile Blum-Blum-Shub is probably the cool way to go, RSAREF uses repeated iterations of MD5 to generate its pseudo-randoms, which can be reasonably secure and use code you've probably already got hooks from perl for.

3 3

Re: Key Eater Needed
by Matthew J Ghio 17 Dec '03

17 Dec '03

Mike Ingle <MIKEINGLE(a)delphi.com> wrote: > There is no way to know now when a key was sent to a server, so it is hard > to know when to delete it. One way would be to keep track of when new > keys are sent or updated, and delete any key which has not been updated > within a certain time, such as one year. All existing keys could be given > six months to live. Those who wanted to keep their present keys could > send them again, and others could create new ones. > > The web of trust model does not lend itself easily to key expirations, > because this requires you to frequently get people to re-sign your key, > and to re-sign the keys of others. This creates the opportunity for the > "here's my new key, and I haven't got it resigned yet" attack. There > would have to be a fairly long overlap period between new and old keys, > during which time the old key signed the new key. Expirations would > complicate the system considerably. How about people just keep their keys, and the signatures, but they re-sign their own keys every six months or so? In order to keep their keys on the keyserver, they must submit a PGP signed message to prove that they still have that key. If they don't, the key is assumed to be lost, and it is deleted.

1 0

Key Eater Needed. NOT!
by Pat Farrell 17 Dec '03

17 Dec '03

Matthew J Ghio <mg5n+(a)andrew.cmu.edu> writes: > How about people just keep their keys, and the signatures, but they > re-sign their own keys every six months or so? In order to keep their > keys on the keyserver, they must submit a PGP signed message to prove > that they still have that key. If they don't, the key is assumed to be > lost, and it is deleted. I have no problem with periodic deletion of keys from keyservers. They are interesting, but not a very important part of strong crypto (IMHO). My objection is to anything that makes the key itself invalid over a period that I don't chose. I'm not sure what problem you are trying to solve. Loading the whole public ring from the servers exceeds my definition of reasonable procesing now. Since the number of keys keeps growing, I expect that it will never be SOP to munge all of them. You will get keys directly, or get a few specific ones on demand. If you're just trying to save disk space on the keyservers, I'm not all that sure it is worth the effort. Disks are cheap, and getting cheaper. But your approach is as good as any. I know there are lots of keys on the servers that are no longer active -- I collected a few hundred that I exchanged with Phil K two years ago, and know many are unused starting with strnlght, the folks at CERT, and Brad Cox's key of that vintage. Even if a fair percentage, say 25% are dead, the savings are pretty trivial. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: Key Eater Needed
by Black Unicorn 17 Dec '03

17 Dec '03

Mike Ingle says: There is no way to know now when a key was sent to a server, so it is hard to know when to delete it. One way would be to keep track of when new keys are sent or updated, and delete any key which has not been updated within a certain time, such as one year. All existing keys could be given six months to live. Those who wanted to keep their present keys could send them again, and others could create new ones. <- Why not a note sent from the server to the key address to the effect: Your key has been deleted.... etc. Not only will this fish out some of the changed addresses and thus non- updated keys, but also remind the legitimate user who just hasn't gotten or looked to get a new signature in 6mos - Years to think about a new key and a revocation. I assume revocations will be kept for good?

1 0

Re: Laundering money through commodity futures
by Peter Wayner 17 Dec '03

17 Dec '03

>>[then is described the double-up strategy] >>Ideally, you play this game with two players with relatively deep >>pockets. This means that A can cover the short term loses. >Here's the flaw, in full glory. This scheme is the classic >double-or-nothing martingale. It doesn't work. The "relatively deep >pockets" of A have to be infinite, because that's the expected value >of the amount of A's intermediate loss in the random walk to the >completion of the transaction. >The example is ludicrous, but the conclusion is valid. More >transactions means more interactions between them and more possibility >to hide something inside the ever-increasing flux. There is a major difference between playing this game with commodities and trying to win with a double or nothing Martingale scheme in a casino. The casino always takes their cut. The transaction costs in the futures market are often much smaller if you're dealing with significant amounts of money. Many of the people who experiment with these schemes have very large pools of money to move. You must realize that laundering money was usually done through much more inefficient ways. Some typical techniques involve double billing and inflated construction costs. If Entity A wants to move money to Entity B then, Entity A contracts with B for a big new building. B charges too much for the building and A pays up. This can be done with supplies or other commodities. The problem is that you've got a brand new building that you've got to sell/lease or whatever. So, are there problems? Yes. But it can be much more efficient and much more transparent than almost other scheme. Remember that the flux between the two entities in the commodities market is not immediately apparent. You don't need to use the same broker. One could use a broker in Hong Kong and the other could use one in Chicago. You don't even need to trade the same contracts. One side of the deal could buy gold futures market marked in pounds sold in London and the other side could sell gold futures marked in dollars in Chicago. The thousands of arbitrageurs out there will make sure that the markets move together. (You can also hedge your deal against the currency risk.) Who is going to piece these two together?

5 4

RE: Warrantless searches -- A sign of things to come?
by GERSTEIN＠SCSUD.CTSTATEU.EDU 17 Dec '03

17 Dec '03

On Sun, 17 Apr 94 13:39:39 paul(a)hawksbill.sprintmrn.com (Paul Ferguson) wrote: >A Page 1 story in The Washington Post Sunday (94.04.17) reads, >"Clinton Lets Police Raid Projects," "Warrantless Searches Said to Be >Needed For Tenants Safety." > >For those who haven't been following this ludicrous story, the USG has >now decided that Chicago Housing Authority-sponsored, and warrantless, >searches of dwellings within the CHA, is "A Good Thing" (tm) and >specifically geared towards uncovering weapons of criminals (or >would-be criminals) for the safety of law-abiding Housing tenants. > >Personally, I find this mentality alarming and indicative of a growing >trend within the government. "Big Brother knows best." > >Vile and Nauseating. > >This is another absurdity in the "War on Drugs" and "War on Crime." >More government-sponsored "wars" are undoubtedly on the horizon, >perhaps even a war on non-escrowed crypto. > >I suppose things will get worse before they get better. ======== While I don't agree with these searches either, you have to understand the situation that the people in the CHA buildings are in. Did you see the show that was done on it? (I think it was Nightline, they did a whole hour on it) Anyway, the point is, these people aren't safe in their own homes. The parents keep their children home from school because they are afraid that they will either get shot (which happens quite a lot, one child was shot by a "gangsta" with a sniper rifle while his mother was walking him to school- the kid was about 5 years old) or that the kids will get involved in the gangs. For a while, the Chicago PD were unwilling to enter the buildings until after the shooting had stopped, and would then go in to tag and bag the bodies. IT WAS BAD!!! The landlord of the little kid who got shot decided he wasn't going to put up with that, and started the CHA PD, and they were kicking ass until the ACLU got involved. Slightly related is the fact that I live on my school's campus in the residence halls. If the resident advisors feel there is probable cause for something and decides to do a room search, I can do nothing about it but hope they don't find what ever it is their looking for (usually because I don't do anything bad >:)). Anyway, if they find something (drugs, beer in excess of the 6 can limit, firearms, PGP, etc.) they can call the campus police (real, live, actual cops) in to bust my ass and nail it to the wall. BUT NO WARRANT WAS SERVED! Does that mean I can get the ACLU up the school's ass? If the school says they can do that because I pay to live on their property, then why can't the CHA do what they want? Just my 0.02¢..... adam "After this, nothing will shock me." ---------- "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 4, 1994

4 3

Re: 'Nother MIT talk on crypto...
by Peter Wayner 17 Dec '03

17 Dec '03

I saw the talk Micali gave on his Fair Crypto systems at Crypto 92. Someone asked him about governmental abuse and he said (I approximate), "Well, you have to trust them. That's why they're called trustees."

2 1

RE: Warrantless searches -- A sign of things to come?
by Black Unicorn 17 Dec '03

17 Dec '03

On Sun, 17 Apr 94 13:39:39 paul(a)hawksbill.sprintmrn.com (Paul Ferguson) wrote: >A Page 1 story in The Washington Post Sunday (94.04.17) reads, >"Clinton Lets Police Raid Projects," "Warrantless Searches Said to Be >Needed For Tenants Safety." > [Deletions] What really gets me here is the alienability of the rights in question. One of the prevailing arguements seems to be "the tenants are willing to sacrifice their rights for more safety." This of course misreads the question. If it were only a questions of relinquishing your own rights then there are procedures for the waiver and consent to search. What drives me up the wall is some tenants saying they are willing to waive their own rights for safety when what they are really doing is waiving EVERYONES rights for their safety. This is merely another load of whiskey for the toothache. Bust down some doors and we will solve the nations problem of violence. I have to hand it to the administration, they managed to divert the attention of the media from the other major screw-ups and cast a "fight the violence" spotlight on it. At least this cluster-fuck is (in the current atmosphere) defendable. What a crock. The ease with which this nation disregards its own fundamental principles disturbs me. -uni- (Dark)

3 2

RE: Warrantless searches -- A sign of things to come?
by Black Unicorn 17 Dec '03

17 Dec '03

> The ease with which this nation disregards its own fundamental principles > disturbs me. A government official was quoted in today's LA Times as saying approximately, "I'm sure we can square this with the Fourth Amendment... this is an emergency situation." Eli ebrandt(a)hmc.edu To which I reply: Then declare a national emergency and suspend the constitution. Any emergency not sufficent enough to do this isn't a national emergency. The only thing that bothers me more than the use of rhetoric like "The War on Drugs" or "The War on Crime" or "The Health Care CRISIS" to cover up the fact that rights are being circumvented or outright eliminated is the willingness of the population to buy into the game. -uni- (Dark)

1 0

MS Word - don't email documents
by Mike Ingle 17 Dec '03

17 Dec '03

>From Apr 11 Computer Currents: Windows Magazine Uncovers Word "Time Bomb" Ever wonder if someone could read your mind? Well, if you use any Microsoft Word version 2.0 through 6.0 you may have unwittingly provided someone with your thought processes. If you ever create documents which are sent digitally, be aware that your client might be able to read your earlier drafts. This is due to the fact that in Word's default mode, with options Prompt for Summary Info off and Allow Fast Saves on, deleted text portions are retained in the internal document structure. This enables anyone with a file viewer to check your earlier passages -- such as a lower price you were originally going to quote. (Incidentally, you can do the same thing with the Macintosh version and a utility like CanOpener. -- Ed.) By turning Prompt for Summary Info on and Allow Fast Saves off, you can prevent a potential disaster. Since this is not a bug, Microsoft says there is no fix.

1 0