December 2003 - cypherpunks-legacy

Re: Remailer REORDER not DELAY
by fnerd＠smds.com 17 Dec '03

17 Dec '03

i wrote- > > Delay--time--isn't what matters. It's confusion about which message is > > which that matters. So if I get 10 messages in one minute, I can scramble > > the order and send them out the next minute, and I've done my job--at > > least the order-scrambling part. (You also need to pad or packetize > > messages.) > > > > So use serial numbers, not times! Send a message for every one you get, > > keep a fixed number of messages queued, and add dummies if necessary > > to keep things moving. Jim replies. > Wrongo...the random time stamp does randomly re-order then. As to bogus > messages, not on my system you won't.... Okay, first I'll go over the case where delay without dummies does NOT reorder. Then I'll go over the case where delay simply adds needless, well, delay. Then I'll talk about the cost of dummy messages. Assumption: Your remailer assigns each message a number from 0 to 59 and remails it at that minute of the hour. Whether it's hours in the day, minutes in the hour or seconds in the minute only changes which of the following two cases is more likely: Case 1: The remailer receives no messages for 61 minutes, then one message, then no messages for 61 minutes. Result: In the hour following receipt of that one message, only one message is sent. Guess which message it was. Case 2: 60 messages arrive in one minute. Result: The last one(s) go out about an hour later. They could have all been sent in the next minute with equivalent reordering. P.s., if 60 messages arrive *every* minute, under the assumption above, you have to save an average of 3600 messages. So, with this method, you can adjust the delay time down to guarantee delivery time, or up to make reordering *more likely*, but you can't guarantee reordering. If you want 1/N reordering to be likely, you need to set the response time to N times the inter-arrival time for the *quietest* traffic periods. To guarantee reordering you have to either wait indefinitely for enough messages, or after a while insert some of your own. To get over the problem of needless delay, you either need to invent some kind of tricky variable-delay scheme, or turn your attention away from clock time and focus on ordering. > I have a system which runs of a SLIP feed and bandwidth is sacrosanct. > If you would like to pay for an additional line to handle the added > load then fine but my pocket book won't support it. Say the worst turnaround you want is 24 hours, and you want to get 1-out- of-10 reordering. Then on a day where you receive only one message (for this you got a SLIP connection?) you would need to generate 9 dummies. Assuming 10Kbyte messages, the bandwidth required is... 10.4 baud. For a turnaround of 2.4 hours ... 104 baud. 15 minutes ... 1040 baud. And remember, you generate only enough dummies to keep up the minimum *total* traffic, so in reasonable-traffic periods, you generate no dummies and the amount of real traffic you can handle isn't affected. > the consideration of the future where there will be many small systems > with minimal bandwidth and monetary resources then I realy doubt they > will be interested in any system which slows down or otherwise wastes > a precious and critical resource. I guess this sentence, which you quote, wasn't clear: > > Plus, if the remailers only generate > > dummies when necessary, the total dummy traffic is self-regulating, since > > multi-hop dummies are x-lax for every remailer they pass through. In other words, in a world of communicating forwarders, a dummy message from one just looks like regular traffic to any others it goes through, and serves to keep their traffic levels up--the more remailers the fewer dummy messages each remailer has to generate. > I also oppose the implied synchronicity of your methods as well. I am > looking at a resonably secure asynchronouse method of making the > traffic analysis difficult (the real reason for all this mumbo jumbo > in the first place). Traffic analysis is difficult when the order of messages is sufficiently scrambled. If you don't reorder, then delay doesn't help. If you do reorder, then added delay doesn't help. Whether one message is "synchronized" or not with a random other message isn't useful information to an outsider. > Why should I provide a potential monitor with the > information that a certain amount of information going out will be > bogus? How might this information help analyze traffic? Also, as I mentioned, if you send your dummies to yourself indirectly, then pretty soon the level of input will match the level of output, and the ratio of bogus to real messages *won't* be visible. As far as I can see, dummy messages are simply necessary if you want to guarantee both reordering and response time. Please explain if you believe differently. > You obviously don't pay all the costs for your feed or else you are very > rich... Are you charged per byte or just a flat rate? -fnerd - - - - - - - - - - - - - - - the snack that eats like a food -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Anon posts (was irritating posts...)
by dfloyd＠runner.utsa.edu 17 Dec '03

17 Dec '03

> From owner-cypherpunks(a)toad.com Mon Jun 13 14:23 CDT 1994 > X-Sender: ben@localhost > Mime-Version: 1.0 > Date: Mon, 13 Jun 1994 12:17:00 -0700 > To: cypherpunks(a)toad.com > From: Ben.Goren(a)asu.edu > Subject: Re: (None) > Precedence: bulk > > At 12:50 PM 6/13/94 -0500, Jeff Gostin wrote: > >dfloyd(a)runner.utsa.edu (Douglas R. Floyd) writes: > > > >> How rude is it for people to post (or mail to a mailing list) anon messages > >> encrypted with someone's PGP key? It makes it easy for the receiver to > >> obtain it, but how irritating is it to people? > > Fairly. In fact, it's considered downright rude. It's like sitting > >around a table of, say, 3 people, and whispering with someone next to you. > >The first person is you -- you're sending the message. The second person > >is your friend -- he's recieving it. The third is me -- I'm just watching > >two people whispering. Further, newsgroups are a very inappropriate place > >to send private mail for propogation. > > Might it be appropriate, though, to create an alt group for that purpose? > Sort of the digital equivalent of putting "coded" messages in the personals > section of your favorite newspaper's classified section. You know--"John, > you have five days to pay up" means to meet at the Ritz for dinner next > Thursday, and "I love you, Sally" means to run for the border. > > But far, far more effective digitally. > > Could be especailly useful for people "in the field," considering how many > universities and other places permit Usenet posting without an account, so > long as your IP is considered local--easier to get access. > > > --Jeff > > b& > > -- > Ben.Goren(a)asu.edu, Arizona State University School of Music > net.proselytizing (write for info): Protect your privacy; oppose Clipper. > Voice concern over proposed Internet pricing schemes. Stamp out spamming. > Finger ben(a)tux.music.asu.edu for PGP 2.3a public key. > > That is a good idea, creating a special USENET group for coded messages. Alt.security.coded.messages would be a good moniker. Personally, I am not familar with gopherholes or message havens, so I do not know how good they are, and can log telnets in. It is harder to log nntp reads of alt.security.coded.messages or such. If an admin is very nosy, they could be snooping your terminal and packets as well, though... Another idea could be an anonymous FTP site, but someone can go and delete all the messages on there, and ftps are logged as well... Any better ideas on being able to anon-post and anon-read with as few ways for a third party to log as possible? (This is for my curiosity only, as I rarely have anything worth saying that needs this much protection.)

2 1

Economist Clipper Article
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

Lead article in the Science and Technology section of this week's Economist is about Clipper. As usual for the Economist, it is really quite good. Good description of the LEAF and Blaze's hack. Mentions the 47,000 CPSR signatures, Wired, and makes a good case for how a "voluntary" standard might not be, and the export issues. Wish all general-interest publications were so well done. The profile of Clipper is rising, and the press is not too shiny for the NSA. -kb, the Economist-reading Kent P.S. In the middle of the page is a great line-drawing of a evil-looking cloaked spy in hat and dark glasses, poised with a dagger and skeleton key at a key-hole equipped computer. Wish I had a high-res scanner, Postscript-ized those with fast RIPs could get it in its full copyright-breaking glory.

1 0

Big Brother wants the shirt off your back
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

Although not exactly crypto-related, I couldn't forego the opportunity to pass this along - From: risks(a)CSL.SRI.COM (RISKS Forum) Newsgroups: comp.risks Subject: RISKS DIGEST 16.14 Message-ID: <CMM.0.90.1.771548444.risks(a)chiron.csl.sri.com> Date: 13 Jun 94 23:00:44 GMT Sender: daemon(a)ucbvax.BERKELEY.EDU Reply-To: risks(a)csl.sri.com Distribution: world Organization: The Internet Lines: 644 Approved: risks(a)csl.sri.com ------------------------------ Date: Mon, 13 Jun 94 16:16 EDT From: Lynn R Grant <Grant(a)DOCKMASTER.NCSC.MIL> Subject: Big brother wants the shirt off your back Here's another risk on the horizon. We may have to wait a few years, though. From the June 1994 issue of Bobbin, "The premier news and information source of the global sewn products industry": Groups such as the American Textile Partnership (AMTEX), a research consortium that links the sewn products industry with the Department of Energy's national laboratories, also are looking at RF technology as a means to improve the production process. In a research project called the Embedded Electronic Fingerprint, long-term work is underway to develop a computer-type device the size of a grain of wheat that could be attached to a garment and used through the entire product life cycle. "A manufacturer could program into the device information unique to a garment, such as the size, color, style, line, or plant of manufacture, care instructions, etc.," explains Jud Early, director of research and development for the Textile/Clothing Technology Corp, [TC]**2. "There also would be a large amount of blank memory that could be used for anti-counterfeit tracking and more." Since each tag would have a unique identity, in-process inventory could be tracked easily using RF units--without ever touching garments or having to open shipping boxes. For example, a carton could be passed through a reading system, which would verify the contents against the packing list. So, all that is needed is for the clerk at the store to capture the identity of the shirt, perhaps through a barcode on the tag (so they wouldn't have to install the special shirt readers), and they already know your identity from your credit card number (unless someone else buys your shirts for you), so they can track your movements by setting up shirt readers in various places. But that might take more collusion between government and the stores than we want to speculate. So try this: a crime is committed. A few days later, you walk past a hidden shirt reader, and are immediately approached by an officer of the law, who arrests you for the crime. "But I was nowhere near the scene of the crime," you protest. "On the contrary," the officer counters, "one of our hidden shirt readers detected you shirt in the vicinity of the crime. You must be guilty." One would hope that the manufacturers of these devices don't accidentally program duplicate serial numbers in them. And you should think twice about lending your shirt to your girlfriend. Lynn Grant Grant(a)DOCKMASTER.NCSC.MIL ------------------------------

1 0

Traffic Analysis papers, where?
by peb＠netcom.com 17 Dec '03

17 Dec '03

The pointer to oml(a)eloka.demon.co.uk died due to bounced mail (bounced after 32 days!). Does anyone have other pointers to papers on traffic analysis? Paul E. Baclace peb(a)netcom.com

1 0

URGENT Action required (NJ folks only) (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message:

1 0

UPDATE 2: Crypto export campaign - more fax numbers
by Stanton McCandlish 17 Dec '03

17 Dec '03

YOUR letters, faxes and calls are needed now to ensure that the cryptography, privacy and security provisions of the Cantwell Export Administration Act are preserved in bill HR3837 - help strike a blow against Clipper and for freely distributable software like PGP and RIPEM. If you can't fax directly, you can send your message to glickman(a)eff.org. EFF will fax or hand-deliver it for you to the Committee Chair, Rep. Dan Glickman. Updates on the Fax numbers of the House Intelligence Committee. Subcommittee fax: +1 202 225 1991 Sometimes does not answer. Keep trying! it IS a working fax number. Rep phone fax D KS Glickman, Daniel +1 202 225 6216 +1 202 225 5398 Chair Rep. Glickman's staff has finally released his fax number. D TX Coleman, Ronald D. +1 202 225 4831 +1 202 225 4831 This fax number is also a voice line. Staff manually switch to fax if they hear fax tones. You may wish to call by voice to make sure they do this if your fax attempts fail. If you don't get thru, call the Committee, and ask for the voice number, it may have been changed. D AL Cramer Jr, Robert (Bud) +1 202 225 4801 +1 202 225 4392 Rep. Cramer's staff has finally released his fax number. D MO Gephardt, Richard A. +1 202 225 2671 +1 202 225 7414 Rep. Gephardt has changed his fax number. The correct one is given here. R NE Bereuter, Douglas +1 202 225 4806 +1 202 226 1148 Sometimes does not answer. This IS a valid fax #, keep trying. R CA Dornan, Robert K. +1 202 225 2965 Rep. Dornan has disconnected this fax number. His office does have a fax, but it has been made non-public. Constituents may wish to describe to Rep. Dornan how they feel about such manouvers. R IL Michel, Robert H. +1 202 225 6201 +1 202 225 9249 Try again if you don't get an answer. This is a working fax number. Many thanks to Janet E. Harrison <tat(a)well.sf.ca.us> for doing the footwork for this update. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0

Re: Anon posts (was irritating posts...)
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 2:34 PM 6/13/94 -0700, Timothy C. May wrote: >[. . .] >To see this, think of the Cypherpunks list as one large (by today's >standards) message pool [. . . .] Just out of curiousity, how large *is* Cypherpunks? I've been subscribed just about a week now, but I've been quite pleasantly shocked by the S/N ratio, after getting completely turned off by the Sternlight wars on Usenet. Ironic that a group calling themselves "punks" should be civilized, intelligent, scholarly, altruistic, and basic good 'net citizens, while sci.crypt is often little more than a bunch of people playing "did so!" games. And the PGP group! >--Tim May > > >-- >.......................................................................... >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero >408-688-5409 | knowledge, reputations, information markets, >W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. >Higher Power: 2^859433 | Public Key: PGP and MailSafe available. >"National borders are just speed bumps on the information superhighway." -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

4 3

RSADSI "Terisa" venture
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

A (very) brief blurb on the inside cover of Network Worl this week (p.2, June 13, 1994; vol. 11, number 24): "That secure feeling. RSA Data Security, Inc., which sells public-key cryptograpgy software, and Enterprise Integration Technologies Corp., product manager for a $12 million Internet marketplace, are teaming up to sell tools that build secure Internet applications. Their joint venture, Terisa Systems, will market tools for creating World-Wide Web clients and servers that incorporate cryptography and digital signatures for ensuring the privacy and validity of transactions over the Internet. Shipping is scheduled for late 1994. Terisa: (415) 617-1836" _______________________________________________________________________________ Paul Ferguson US Sprint Managed Network Engineering tel: 703.904.2437 Herndon, Virginia USA internet: paul(a)hawk.sprintmrn.com

1 0

Re: Anon posts (was irrit
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com B >Sternlight wars on Usenet. Ironic that a group calling themselves B >"punks" should be civilized, intelligent, scholarly, altruistic, and B >basic good 'net citizens, while sci.crypt is often little more than a B >bunch of people playing "did so!" games. And the PGP group! B > B >>--Tim May USENET vs mailing list. DCF --- WinQwk 2.0b#1165

1 0