December 2003 - cypherpunks-legacy

radio program - Los Angeles area only
by Robert Lau 17 Dec '03

17 Dec '03

today's topic on Which Way LA (KCRW 89.9FM, Los Angeles) was on phone, computer, etc. privacy, and how the government is doing everything it can to take it away from us. at least that's what the spots have said. presumably about clipper, FBI wiretap laws, etc. first broadcast was at 13:00 but i missed it, being rebroadcast at 19:00. i don't have a tape deck in my office, but i guess i could digitize it. sorry for all of you outside LA, which is probably 99.3598% of you... :) Robert Lau - Systems Programmer, Unix Systems 213-740-2866 -- University Computing Services Internet: rslau(a)usc.edu -- University of Southern California Bitnet: rslau@uscvm -- 1020 W Jefferson, LA, CA USA, 90089-0251 UUCP: ...!uunet!usc!rslau

2 1

Sternlight and Stokes
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

> Has anyone else noticed that David Sternlight has been quiet for the past > two weeks or so? > I hope he's not like you-know-who in that mentioning his name summons the > fiend. Coincidentally, or maybe not, a fellow named Ralph Stokes (Ralph.Stokes(a)f1611.n375.z1.fidonet.org) has been mentioning "you-know-who" by name all over the net in his now infamous "Beware of Roman Catholic Corruption" spam, and accusing all matter of people of being in league with him. You don't suppose that, with Sternlight's disappearance and Stokes' appearance that ... nah, forget it...

1 0

"military" one-time-pad generation
by fasttech!zeke＠uu4.psi.com 17 Dec '03

17 Dec '03

While we're on the topic of random numbers, etc., this is what I was told a long time ago about military OTPs. I don't know if this OTP generation was by NSA or by one of the military forces itself. And, as this information is at least 10 years old, who knows if this is how it's still done. And maybe it was disinformation, and never done this way. Anyway, there was supposedly a heavily shielded room which had equipment that used radioactive decay to generate random numbers. Apparently it was pretty automated and the thing basically spit out pairs of paper OTP pads that were already prewrapped in tamperproof packaging. To me, this makes more sense than Clancy's "atmospheric noise" hypothesis. But then, Clancy was generating entire CD's worth of bits, which would certainly need orders of magnitude more bits than actual paper pads.

1 0

Regional Lists
by Robert A. Hayden 17 Dec '03

17 Dec '03

A month or so back, there was a brief discussion talking about the production of a cypherpunks net.book. Out of that discussion I talked about the fact that I (would) have a workstation available to provide a platform for various mailing lists if they were needed. On of the suggestions that was made by Eric was that it might be a 'good thing'{tm} to creat some regional cypherpunk lists to facilitate the planning of physical meetings, to make announcements about speakers, or whatever. In any case, I have the computer up and running, and am now in a position to create whatever cypherpunk mailing lists might be wanted or needed. So, does anyone have anything they'd want a mailing list for? ____ Robert A. Hayden <=> hayden(a)vorlon.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> I do not necessarily speak for the \/ Finger for PGP Public Key <=> City of Mankato or Blue Earth County -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

3 4

Use of large Keys
by edgar＠spectrx.sbay.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Roger Bryner said, ...You should always take some reasonable ammount of time(say 5 min) to encrypt your most sensitive messages, even if you have a 12 crays and a connection machene. The algorithim can be viewed as giving you an economic advantage, and worying over spending $.01 vs $.0001 is not just stingy, it is dangerous. I disagree. The problem is not time to ENcrypt, which is not much greater for large keys than small ones. This is because the ENcryption exponent is usually a small number, like 17. The problem is the time for your recipient to DEcrypt. On my 386/SX 16mz, DEcrypting a msg with a 4096-bit key takes 5-10 minutes. I have a report that a Pentium takes about 1.5 minutes. During that 5-10 minutes, many recipients will not sit there watching grass grow, but will leave the PC unattended to do something else. If during that time Janet Reno's storm troopers break through the front door, your recipient may not have time to power-off the PC and PGP will deliver your plaintext message right into JR's hands! Thus in some cases use of a large key can -reduce- security of your msg. I haven't worked out the math, but I suspect that an 8000-bit key is completely impractical for use on any desktop machine. At this time, open use of a large key marks you as not using an MIT version of PGP, thus making you a target of RSA. This is easily avoided by exchanging large keys and messages encrypted with large keys "inside an envelope" of 1024-bit key encryption. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLg6Mjd4nNf3ah8DHAQErZwP/RiKYC+iTX61iuNV/a8Ga1H3Cz1M/r1iL 0gYiHId1QckiKcWMt1f9XwbT4TpY9OWrVKb7wK1N94nKQq7T56eg/fuoEC4e2TlL j5WXHX8S5SEUPWpTeU0V2XsnYeojsyBCHh8keVcDROr6nBZmxACmSxWEFMTjYfUf 3x8YdS2ThoE= =0CI+ -----END PGP SIGNATURE----- -- edgar(a)spectrx.sbay.org (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

NSA Agents Threaten to Kill Bidzos of RSA? (fwd)
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

Another interesting part of this article (Monday San Jose Mercury News) quotes Lynn McNulty of NIST saying that they explicitly chose DSS as the FIPS digital signature standard in order to discourage use of RSA. It looks like Bidzos has a clear case for a restraint of trade lawsuit. Bidzos would also be well advised to tape record any future conversations he has with NSA officials.

1 0

Brits propose internet voting
by rah＠shipwright.com 17 Dec '03

17 Dec '03

The brits have the "american" disease, only they've done us one better. I just got through listening to the BBC World Service. It seems that some official commission or other over there proposed the Information Infrastructure thang with a couple of twists: polling and elections. They said that they could save mucho dinero by having people vote from home. Looks like someone over there did their crypto homework... Even cited Mr. Bill's (Clinton, not Gates) email address as a Good Thing. What's next, er(a)bpalace.gov, gov? <hyuk> Seriously, they couldn't be talking about this election thing unless they knew it was possible (no star wars flames, please). I wonder who put the bug in their ear? If anyone finds a copy of this report online (fat chance, I bet) let me know. Cheers, Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: Sternlight
by tim werner 17 Dec '03

17 Dec '03

>Date: Mon, 27 Jun 1994 17:03:59 -0500 >From: "Bill O'Hanlon" <wmo(a)digibd.com> >Content-Length: 308 >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk > >Has anyone else noticed that David Sternlight has been quiet for the past >two weeks or so? Sternlight does not belong to this list. Why are you looking for him here? tw

1 0

Re: NSA and competence
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

>Do not, however, assume that they do not know and perform their job to the best >of their abilities, or you will be in the position of the mark talking to a >cardsharp: 'I'm not any good at cards, but I sure do like to play for money.' OTOH, one need not assume that everyone at NSA is a rocket scientist and that they are miles ahead of us in this game. The long undistinguished history of federal agencies shows them to be full of incompetence, waste and usually gross fraud as well. Considering the huge budget and lack of accountability, NSA seems an unusual place to look for an exception. A truly competent and efficient government agency that can hold its own against competition from the private sector is a rarity indeed. Granted, NSA had a head start of a few decades, yet it would be surprising if their lead at this point is more than negligible. Yes, I have read Bamford (though - sorry - not Kahn): remember that Bamford's book is already 12 years old and was probably out-of-date WRT the technology when it was published. <not the same anonymous author>

2 1

NSA Agents Threaten to Kill Bidzos of RSA?
by John Young 17 Dec '03

17 Dec '03

There is a lead article in the New York Times Business Section today on Bidzos and RSA. It reviews current crypto, RSA, NSA and others. If there is interest I will transcribe the article for this forum. John

1 0