December 2003 - cypherpunks-legacy

Opinions of a book requested...
by Jim choate 17 Dec '03

17 Dec '03

Hi all, Does anyone have any hands-on experience with: Contemporary Cryptology: The Science of Information Integrity Gustavus J. Simmons 656pp., 1992 ISBN 0-87942-277-7 It is listed in a catalog of books carried by Omega. I was wondering if anyone has read it (or even looked it over peripheraly for that matter)? Thanks.

2 1

Re: ANI 800 number
by peb＠netcom.com 17 Dec '03

17 Dec '03

The number I have no longer works. Too bad, since I found it useful to find out what number I'm dialing out on (rarely needed, but handy when necessary). Paul E. Baclace peb(a)netcom.com

1 0

Where is SecureDevice? wuarchive directory missing..
by Philippe Nave 17 Dec '03

17 Dec '03

Hello, all! I have just changed jobs within the company, and now I find that my PC is not as secure as I'd like. (Long story.) I'm looking for SecureDevice, hoping that it will let me create a secure area on my hard drive. I ftp'ed to wuarchive.wustl.edu, changed directory to /pub/msdos_uploads, then tried to change directory to cryptography only to find that the directory does not exist! Pointers? Suggestions? Thanks for your time! Philippe Nave P.S. Does anybody have a FAQ or something about how to integrate PGP with Microsoft Mail? (Note the lack of a PGP signature while I'm getting my act together..)

5 4

Re: Chained Remailing Strategy and Tactics
by fnerd＠smds.com 17 Dec '03

17 Dec '03

anonymous says- > In order to preserve anonymity and thwart traffic analysis in > chained remailings, it would seem useful to include a very BUSY > remailer in the chain, and try to ensure that the message arrives > at the busiest time of the day for that remailer, from a traffic > standpoint. Hitting a remailer at a slack time when, let's say, > only one message arrives over a period of several hours would > seem most unwise. The problem for someone trying to trace a message is, which of some set of outgoing messages matches this incoming message? (Or vice-versa.) The size of the set of possibilities determines how much uncertainty is introduced. If the remailer works by delaying messages a random amount of time up to a maximum, then the number of possibilities varies with the traffic. But if the remailer works in terms of sequence instead of time, it can hold the size of the set of possibilities constant (which makes the maximum delay time vary as a side effect). So, sequence, not clock time, is what matters (or ought to), all other things being equal, and there's no reason a remailer should be any less effective in low traffic periods. -fnerd - - - - - - - - - - - - - - - the liquidy snack that drinks like a beverage! -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

Detweiler clone at WSJ
by Brad Dolan 17 Dec '03

17 Dec '03

The drumbeat against all those anonymous pedophiles continues.... _Wall Street Journal_, 6/30/94 PERSONAL TECHNOLOGY by Walter S. Mossberg "Keeping Your Kids Away From Creeps As They Play Online" (...Talk about striking up electronic friendships online ...) But there's a dark side to this exciting phenomenon, one that's too rarely understood by computer novices. Because they offer instant access to others, and considerable anonymity to participants, the services make it possible for people - especially computer-literate kids - to find themselves in unpleasant, sexually explicit social situations (Sex-ed sessions led by Joycelyn Elders?) The online services all have rules banning bad conduct and, fearing possible government-imposed restrictions, have stepped up the policing of online abuse. But parents could do more to protect kids from these disturbing situations. And I've gradually come to adopt the view, which will be controversial among many online users (!), that the use of nicknames and other forms of anonymity must be eliminated or severly curbed to force people online into at least as much accountability for their words and actions as exists in real social encounters. (.. More talk about how your kid might [gasp!] download a "hardcore pornographic photo" [This guy should see the stuff on the newstands in Amsterdam!]...) Beyond that, I think it's time now for the services to jettison the long tradition of allowing members to hide behind "handles" or nicknames. In general people should conduct themselves online under their real names, or not at all. IN THE SAME VEIN, I THINK THE SERVICES SHOULD DELAY GRANTING NEW MEMBERS ACCESS FOR 24 OR 48 HOURS ...WHILE THEY VERIFY THAT THE APPLICANTS ARE REALLY WHO THEY SAY THEY ARE ... (emphasis mine). (And some folks thought that Brady-style fascism would only be applied to "gun-nuts"! Won't be long before you have to have a license to drive on the information superhighway.) (Article continues with more of same. Lambasts AOL. Talks about "the most dangerous forms of communication," etc.) ------------------------------------------------------------------- I didn't comment on NSA threatening Bidzos because dog bites man is not news. If you annoy the Nazis in power and they can get away with it they will kill you. BTW: The current _New Republic_ contains a story about an Oxford student being threatened by the Secret Service over a much more trivial matter.

6 5

Copyright
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

From: Robert Lau <rslau(a)skat.usc.edu> does anybody want a 26Mb .au file (uncompressed)? WHAT'S the copyright laws on this stuff anyway? Not very different from those for all the articles that keep appearing on the net, reproduced without permission from Time etc... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: PC Expo summary!!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

rarachel(a)photon.poly.edu (Arsen Ray Arachelian): > FEB 17 CYPHERPUNKS TRANSCRIPT > Copyright (C) 1994, cypherpunks(a)toad.com All Rights Reserved. ^^^^^^^^^^^^^^^^^^^^ I wonder how the courts will interpret that ;) Pats on the back to you for going ahead with the distribution of disks. It would be a good idea to put up the contents of the disk at some FTP site, maybe soda. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

4 5

NSA
by root%pig.jjm.com%jjmhome.jjm.com＠jjmhome 17 Dec '03

17 Dec '03

Just two small points. First NSA's two missions are protecting classifed US communications and penetrating those of everyone else. Neither is aided at all by publication of NSA developed cipher technology. Seems particularly silly to assume that no matter how much NSA mathematicians and engineers might like to publish that the agency would let them if by so doing they made their job harder in either the short or long term. And certainly it is not in the agencies interest to publish much of anything ex-officio either. So it is really kind of stupid to complain that they must not be any good because they have not contributed to the published body of work that constitutes the infant modern science of mathematical cryptography when the existance of and quality of that body of knowlage is their greatest long term challenge. NSA's mission depends critically on others underestimating NSAs capability and overestimating their own skills at making and breaking codes. If those whose codes NSA has cracked thought they could be cracked they would not have used them (would have used one time pads or some other technology that is truly secure instead). It is thus obviously not in NSAs interest to allow the world to know just what they have developed and when, especially if by so doing they frighten the codemakers in the rest of the world into using more secure technology, and certainly so if by thus admitting they can be seen to be endorsing a particular technology that they have in fact been using in US codes because they think it secure. This brings up the second point. IS NSA really presuring RSA because they fear the security of the RSA exponentiation algorithms or because they can break them and hope to induce people to use use them by seeming afraid of them ? What would be a better endorsement of a security product than that the NSA wanted it banned because it was too good ? Or would it ? I personally find it extremely hard to believe that Clipper/Skipjack is not riddled with holes and backdoors since it seems inconceivable that NSA would allow a NSA technology that could be used effectively against them to be circulated world wide. They can't really believe that the anti-reverse engineering stuff will protect them against foreign goverments and other well funded research organizations for long, and they admit to having known of Blaze's checksum hack so it seems likely that anything one could extract from reverse engineering the chip and algorithm is flawed in some more subtle way. Weak Keys ? Or do they have a general method of solving DES like ciphers ? Dave Emery N1PRE die(a)pig.jjm.com

2 1

MAIL: chained remailing strategy
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Can some of the major remailer operators make available some > "sanitized" traffic stats of average traffic by hour and day of the > week? Well, I don't run a remailer at the moment, but I can about ones I used to run. One I ran (elee9sf(a)menudo.uh.edu) batched all incoming messages and remailed them randomly at midnight. So in some sense it didn't matter when during the day mail arrived. During its operation, the remailer averaged about 15-20 messages a week, or about 2-3 a day (I don't remember which days of the week if any were more popular). Sometimes there were severe usage "spikes", when the remailer would handle several times its average (once nearly 100 messages in a week, and 20 in one day). However, I feel that this was due to users repeatedly submitting messages - perhaps testing the remailer - without realizing the remailer only resent at midnight. I don't know what loads remailers operated with, but more messages circulating via anonymous remailer would definitely help. > Can someone familiar with remailer software answer something? When > a message is encrypted, using the "Encrypted: PGP" header, will > everything after the end of the encrypted message itself be ignored? > I ask, because this seems like a good place to introduce "padding" > into the message length to thwart detection of identical messages, > assuming that such extraneous material wouldn't screw something up. Yes, the extra text is ignored. In fact, the remailer implemented this form of padding (however, it only padded messages shorter than 2K out to 2K). This isn't the best way to do padding since it is quite obvious that it is in fact padding. Hal Finney wrote some perl scripts which pad inside the pgp message (add random text without likewise updating the message length field; upon decryption the extra text is throw away) and this is a better approach. I think one thing that screws things up (Bill O'Hanlon pointed this out months ago) is if somebody encrypts a message with the -m option (for eyes only) - this causes the remailer to hang, waiting for keyboard input. I'm not sure if this problem is easily fixable on the remailer side. > What's the best strategy for utilizing a given group of remailers > in a chain? Which ones would be most advantageous as the FIRST Run your own and use that one as the first link ;) > How would "someone", hypothetically, follow the chain backwards? Hm... I guess exactly the way you describe, by going to each machine and trying to piece together the remailing path, possibly with help from the syslog file. > What, if anything, would prevent that? By disabling sendmail logging, if the remailer operator is able to. (I wasn't able to on any of the remailers I ran). Of course, other forms of logging would need to be disabled as well. > For the sake of argument, let's assume a worst-case scenario: a > chained message to "president(a)whitehouse.gov" containing a Well, I'm not sure. A few months ago, there was only one remailer outside of the U.S. (in Canada, @extropia.wimsey.com). However, now there are several, in the Netherlands, and one in Italy (?). I guess it would depend on whether the chain includes out of the country remailers, if each remailer keeps logs (including syslog which may or may not be in control of the remailer operator). All the same, I would recommend remailers block @whitehouse.gov. :) Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLhJHbcSF/V8IjI8hAQEGswP+LmW+DqIOr7UZS82/EVINGn57e+LtBzlJ 0HOonCMuId7DmC7OiqbRyHD2TSHNZB5KrPOVGg7N4QXtuzioJ55e/S9mdMxsSy0G 9oan4UGzMZEyw9rD09KIu5MqG4vt/KVQqpNhy7F8XMZwt9wwlbupeQv1v/92VdRU rDOlw9pCnZE= =A4af -----END PGP SIGNATURE-----

3 2

Re: ANI 800 number
by Matthew Ghio 17 Dec '03

17 Dec '03

shamrock(a)netcom.com (Lucky Green) wrote: | About 1.5 years ago, Sandy posted an 800 number that would give you the | | number of the phone you are calling from. Does anyone still have that? | No, but you can use AT&T's test number - 1073214049889664 (you won't be charged for the call) If you're interested in that type of thing, you might want to read alt.2600

2 1