December 2003 - cypherpunks-legacy

PGP 2.5 available from Electronic Frontier Foundation ftp site
by Stanton McCandlish 17 Dec '03

17 Dec '03

With the early May announcement of the availability of the new version of PGP (Pretty Good Privacy) a free encryption program for email and other files, EFF has decided to provide PGP and other cryptographic material to users of the Internet. EFF applauds and congratulates the PGP development team, MIT (who initially made PGP 2.5 available), and RSA Data Security (patent holders of the RSA and RSAREF encryption code) for coming to an agreement and providing this new version of the most popular email encryption program in the world - a free version that is finally legal in the US. Previous versions of PGP arguably violated US patent law, with the exception of ViaCrypt's commercial PGP 2.4, but the new 2.5 is built upon the free RSAREF encryption functions, rather than the previous RSA functions which required a special licensing arrangement for use in applications like PGP. Despite the patent & licensing issues being resolved, PGP is still not legally exportable from the United States (except to Canada), due to ITAR export restrictions which categorize cryptographic materials as weapons of war. Thus, EFF can only make PGP and other crypto tools and source code available to US and Canadian nationals currently residing in the US or Canada and connecting to EFF's site from a US or Canadian site. PGP and similar material is available from EFF's ftp site in a hidden directory, and only to Americans and Canadians. Access to this directory can be obtained by reading and following the instructions in the README.Dist file at: ftp.eff.org, /pub/Net_info/Tools/Crypto/ gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ PGP can only be obtained from EFF via ftp currently. Gopher and WWW access to the material itself is not supported at this time. Only the DOS and Unix versions of PGP 2.5 have been released so far. The Unix version is in source code form, and so can be readily ported to VMS, NeXT and many other operating systems. A Macintosh version has yet to be released. If you would like to see US export restrictions on cryptography removed, please send a message supporting Rep. Cantwell's export reform act (bill HR3627) to cantwell(a)eff.org, ask your Representatives to co-sponsor this bill, and ask your Senators to co-sponsor Sen. Murray's companion bill (S1846) in the US Senate. Congress contact information is available from ftp.eff.org, /pub/EFF/Issues/Activism/govt_contact.list -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994 -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Re: Here they come...
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>From: mpd(a)netcom.com (Mike Duvos) >Date: Wed, 11 May 1994 10:33:33 -0700 (PDT) >> At my company, it is considered to be sexual harrassment if a female finds >> out that I have a pornographic gif on my computer, even if I never display >> it. Apparently, just the knowledge that this material exists creates a >> "hostile" environment. > >Does the GIF have to portray a person of the female persuasion in order >for the "hostile" environment to be created, or will any sexually >oriented image suffice? Anything that suggests that anyone could be naked and having fun at the same time, I think. tw

1 0

Re: Patents on RSA will expire soon....
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> The algorithm that factored RSA129 takes about exp(sqrt((log n)(log log > n))) steps. > Indeed 10^17 instructions is just about how much work was required to > factor RSA129--. > That formula gives about 10^29 for a 1024 bit number. If computers double > in speed every 18 months then they will be only 32 times as fast when the > patents expire. If that rate of speedup held long term, and no significantly better factoring algorithms showed up, it would be 60 years until a 1024 bit number were as easy to factor as RSA129 was this year. -fnerd - - - - - - - - - - - - - - - and i dreamed i was flying high up above my eyes could clearly see the statue of liberty sailing away to sea --Paul Simon -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

2 1

NIST Good Intentions
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> [Clipper] is not intended to be mandated in the future, a [NIST] > official said today in congressional testimony. Paving the superhighway to Hell, of course. -fnerd quote me - - - - - - - - - - - - - - - and i dreamed i was flying high up above my eyes could clearly see the statue of liberty sailing away to sea --Paul Simon -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

MBone map - updated...
by lile＠netcom.com 17 Dec '03

17 Dec '03

The last version has been updated and can be found in ftp://ftp.isi.edu/mbone/mbone-topology.ps -lile

1 0

Estimating Population Summary
by ritter＠io.com 17 Dec '03

17 Dec '03

Summary of: Estimating Population from Repetitions in Accumulated Random Samples In the latest (April 1994) issue of Cryptologia, I describe the development of a new technique for the statistical estimation of population. An example of such a problem would be estimating the number of different values or codes produced by a physically- random number generator. Background This work is an outgrowth of a sci.crypt discussion in early 1992 in which Nico de Vries promoted as "physically-random" a computer program which made use of variations between software and "IBM PC" hardware timing. It was difficult to know how one could determine the amount of "state" (and, thus, the limit of "randomness") in such a mechanism. Ross Anderson suggested measurement using the "birthday paradox." The Experimental Procedure The experimenter will obtain a value from the RNG and save it, repeating this for some fixed number of random samples, a "trial." Each new sample must be compared to all previous samples to see if there is a match or "exact double." (The birthday paradox does not apply to those statistical RNG's which are designed to produce a sequence without value repetition.) A trial contains enough samples if, on average, it produces a few doubles. About 2.5 or 3 Sqrt(N) samples will be needed, given population N, but N is the value we wish to measure. Producing and saving N samples may not be trivial. Exact Repetitions In a single trial, if we find two occurrences of some value, we have a single level-two "repetition"; this is an "exact" repetition count. But if we then find another occurrence of the same value, we have a level-three repetition and no level-two repetitions. Note how increased information (another occurrence) results in reduced effectiveness in the level-two measurement statistic. Expectations Classical binomial equations can predict the number of expected exact repetitions for a given population and number of samples. But these equations are extremely difficult to reverse for use in predicting population. Trying to use these equations with numerical root-finding techniques produces ambiguous results, as there are generally multiple roots. Equations which _estimate_ the probability of repetitions are well known, but it was not previously clear how accurate these would be, how they could be used effectively, what they would mean in random sampling distribution, or how they could be generalized to higher repetition levels. Augmented Repetitions I have found a new, simple, exact, and easily-reversed combinatoric relationship between population and a value which I call "augmented repetitions." An "augmented double" consists of the number of exact doubles (exactly two samples which have the same value), _plus_ contributions from exact triples, exact quads, etc. An exact triple may be seen as three doubles: There are three ways in which an exact triple may produce exact doubles. Therefore, for augmentation purposes, a triple should count as three augmented doubles. Similarly, a quad or exact 4-rep may be 4 seen as ( ) or 6 doubles, the number of combinations of four 2 things taken two at a time. When we do this, we find that simple equations predict the result _exactly_. Thus, the number of augmented repetitions at the kth level (k = 2 means doubles), given r exact repetitions at level i is: i n i ar = SUM ( ) r . k i=1 k i (This is equation 2.3 which very unfortunately was printed incorrectly in the article.) That is, we multiply the number of exact matches at each level by the effective number of matches each could produce at the lower level, and accumulate an overall sum. Augmented Doubles and Population Given population N, the expected number of augmented doubles Ead found in s samples is _exactly_: s (s - 1) Ead(N,s) = --------- . 2 N Given population N = 10,000 (so Sqrt(N) = 100), we can show the expected number of augmented doubles for various numbers of samples: s Ead ----------- 100 0.495 150 1.118 200 1.990 250 3.113 300 4.485 400 7.980 The formula implies, of course, that the population N is related to augmented doubles ad and samples s as: s (s - 1) Nad(s,ad) = --------- 2 ad which is the desired simple form for estimating population. Distribution A major issue in population measurement is the fact that the number of augmented doubles varies greatly over similar trials on the exact same population. Thus, a single trial is essentially meaningless for estimating population. Experiments indicate that various numbers of augmented doubles occur in Poisson distribution over different trials, a result which also has theoretical support. Therefore, we should develop an arithmetic mean or expected value which is the Poisson parameter. The Poisson distribution is asymmetric, and changes radically for different expected values. In general it will be necessary to perform tens or hundreds of separate trials to develop an accurate mean for population estimation. It is worthwhile to accumulate the entire distribution (rather than just a simple mean), and compare that shape with the ideal shape of the Poisson distribution for the given mean. The Poisson distribution also gives us a way to talk about the probability of finding augmented doubles Ead: -Ead Pd(N,s) = 1 - e . So, for population N = 10,000: s Ead Pd ------------------ 100 0.495 0.39 150 1.118 0.67 200 1.990 0.86 250 3.113 0.96 300 4.485 0.99 400 7.980 0.9997 It is often stated that the birthday paradox predicts a match with the sample size s = Sqrt(N), but this value is actually a little small; the expected number of augmented doubles for s = Sqrt(N) is 0.5 (and there are at least as many augmented doubles as exact doubles). Thus, if we want one augmented double on average, we need something like s = 1.5 Sqrt(N) samples. But it is beneficial to move the Poisson distribution toward a symmetric Normal curve, so 2.5 Sqrt(N) or 3 Sqrt(N) are reasonable experimental minimums. The Advance A new statistically-exact combinatoric relationship has been found between population and value repetition in random trials. Since previous well-known estimates could be used for rough estimates, it is not clear that this is a breakthrough in practice. However, the identification of an applicable _exact_ relationship, and its expected distribution in random trials, is important in that it clarifies what we can expect to see in actual use. The paper starts with simple probability, limits itself to algebra and statistics, discusses the existing techniques for exact and other repetitions, and develops general expressions for augmented repetitions. It also has tables of all possible trials for some tiny populations, whose resulting repetition values correspond to predictions exactly. The paper also has some nice graphs of experimental results on larger populations, which show a real Poisson distribution in action, and tables show the effect of estimating population from the experimental results. --- Terry Ritter ritter(a)io.com

1 0

Enhanced One-time pad
by Duncan Frissell 17 Dec '03

17 Dec '03

What I love about the nets.... Part 1073 <New one time pad software announcement elided.> J > J >Thanks, Jim Pinson -Galapagos ^^^^^^^^^<--------------------------- J > jpinson(a)fcdarwin.org.ec J > J > J > DCF "Ergonomics is an important part of interface design" Proposed HyperForm "Document" standard: "The Ruger Mini-14 was based on the US Army's M-14 battle rifle. Make sure your Molecular Deposition Desktop Fabricator is turned on and click the buttons to produce some samples. ---------- ---------- ---------- l Mini l l 100 l l 2,000 l l 14 l l Round l l Rounds l l l l Drum l l .223 l ---------- ---------- ---------- --- WinQwk 2.0b#1165

1 0

*Here they come
by Gary Jeffers 17 Dec '03

17 Dec '03

Lefty reports some really nasty political facts in *Here they come about what constitutes sexual harassment. Would it be sexual harasse- ment to put up signs saying "DEATH TO THE POLITICALLY CORRECT" OR "DEATH TO STATISTS". Or, you could wear buttons or drop the phrases casually in conversations. It would surely be protected speech by the 1st Amendment. In case pressure was brought against you, you could just say "hey, I was only kidding." I think that we should think past behavior that bothers us in certain cases &, instead, think about the kinds of people who constantly sanction this behavior. When these people realized that we morally sanctioned their deaths, they would be less pushy. Or, at least, we could help redefine "hostile environment" for them. hey, its just a goof, Gary Jeffers

1 0

Re: *Here they come
by lefty＠apple.com 17 Dec '03

17 Dec '03

> Lefty reports some really nasty political facts in *Here they come >about what constitutes sexual harassment. Would it be sexual harasse- >ment to put up signs saying "DEATH TO THE POLITICALLY CORRECT" OR >"DEATH TO STATISTS". Or, you could wear buttons or drop the phrases >casually in conversations. It would surely be protected speech by the >1st Amendment. In case pressure was brought against you, you could just >say "hey, I was only kidding." > I think that we should think past behavior that bothers us in certain >cases &, instead, think about the kinds of people who constantly >sanction this behavior. When these people realized that we morally >sanctioned their deaths, they would be less pushy. Or, at least, we >could help redefine "hostile environment" for them. I doubt that there's a court in the land, not even in California, that would view the phrases "DEATH TO THE POLITICALLY CORRECT" or "DEATH TO STATISTS" as being sexual in nature. Beyond that, and I feel certain this will disappoint you, I haven't a clue as to what you're talking about. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Phantom Exchange public client list -------------------------------------------- aa <bb@cc> ... etc. Is there someone out there who would like to act as a broker (for a small fee, natch), so that I can maintain rigorous anonymity while trading? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCcAgUBLdFfwLhnz857T+PFAQGKiQQ49PT6XiiXCjcIt4TRRApXdom4iaKBYnTs hPbdYSm7Yo3tBbzluZwBH2zX3k2P48yO2Z3nSoMzQvtI7AW9761xzInDl7mvyTlu QBIT5glBrbFGFkUl5HFfAV4mpOnNoXRHRsxp7QvIZTT3vG9YrzH5FAi/7gjBQvyE h+V7MSBrF7vuhpAHs+5/ =SRWU -----END PGP SIGNATURE-----

1 0