December 2003 - cypherpunks-legacy

Re: Cryptosplit note
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

It uses rand() when it needs random numbers for the coefficients of the polynomial. I don't know what kind of security risk that poses, but it really should be using something better. It definitely should. It will be trivially crackable. (Well, trivally after someone writes the program I mean, which is more tedious than difficult). (Next question to determine *how* tedious... what do you do to initialise the random sequence? - oh, never mind, I should look at the code, except it's probably not worth the effort now. Just make sure people only use it for fun and not serious data hiding. Ask on sci.crypt if anyone wants to take a crack at decrypting the exored data, given the source code.) Where can I get Blum-Blum-Shub source or documentation on the algorithm? Can't help on that one, sorry. They don't tell us nasty furriners. g

1 0

Anonymous Remailer list
by Jeff Gostin 17 Dec '03

17 Dec '03

C'Punks, I'm looking for a list of Anon Remailers that hopefully have most/all of the following features, or at least get me in the ballpark. Failing that, perhaps just a list of remailers would be nice. Requested features: o I would like to be able to send a PGP [2.3-present versions!] file with commands-etc to be decoded and processed by the Anon Remailer. This allows me to not have to send my password-etc in plaintext. I realize that this will have to wait until after my first email to the remailer, as it has to get my key. o Allows embedded PGP files: One for the remailer, which contains both a second PGP message and commands for the remailer. o Allows passwording of anon accounts (I know, they probably all do this....) o Reports back errors in command syntax-etc, using a pgp encrypted file. o Uses latency and/or reordering. o Relatively quick (this might countermand latency -- I'm not sure which is more important to me) I'm just getting started with remailers, and am interested in secure, anonymous communications. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Remailer ideas (Was: Re: Latency vs. Reordering)
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

I was thinking some about remailers and means to create more effective ones. I think the idea of padding messages has been kicked around (has anyone implemented it?), but what about random compression? Some messages are compressed, others are padded, some are left alone, perhaps shooting for a median message size (everything coming from this mailer tries to be 9k, or as close as possible). Of course, this requires a standard so that other remailers downstream can make the message readable. Another thing that occured to me is the thought that if there were an organized web or remailers, remailers could bounce messages between them automatically- a header could identify the number of bounces perhaps, I haven't thought too much about the implications of doing so, but if every message through the web bounced around 30 times with reordering, padding/compression, PGP, etc. then traffic analysis would be pretty damn hard, I would think, even for someone monitoring the entire web of remailers' traffic. This all assumes that: - remailers can agree on a standard for the above needed features - a semireliable web of remailers can be maintained - some method fordealing with denial of service attacks can be found (a coredump sent to the web could play all sorts of hell, as could an 'evil' remailer that sneaks in and changes the how-many-times-through identifier). The third problem could be delat with by deciding on a size limit- if a message is over 65k (or whatever) it is bounced- if you're sending something big, split it. The first one could probably be done- if someone (grin- if I find any time soon, this is a project I'd like to do) wrote a nice package that was easy to install and use with a feature set that could be agreeable to most. The second one is the problem, but could be dealt with by the first by establishing automated communication- when someone installs the package, send a control message another remailer already part of the web which 'registers' it, and then the web consistently tries to maintain itself by checking on the others and dropping ones that go down off the list. Some sort of method would have to be found for ones that drop off then later come online again so that control messages didn't have to be manually initiated every time, but that shouldn't be that hard. What are the problems in the above? Would Perl be a good choice for doing this? I saw some code from a remailer some time ago, but lost my mailbox a while back (which could also mena that this is a dry rehash of an old discussion... apologies if I am rewriting someone elses thoughts). Anyone still have this? Am I talking out my ass? -j -- "Blah Blah Blah" ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com>

3 2

Please verify key for remailer@soda
by Jeff Gostin 17 Dec '03

17 Dec '03

Hello fellow C'punks! As my last message said (for those who read it), I'm just getting into anon remailers. I just picked up the docs and PGP key for the remailer@soda. I would appreciate it if people would send me fingerprints of the key. This is so that I know it hasn't been tampered with, or at least can be reasonably sure. Thanx, in advance! --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

2 1

RE:
by Blanc Weber 17 Dec '03

17 Dec '03

From: David K. Merriman It has been brought up on the Cypherpunks mailing list that Microsoft is proposing to include public-key escrow as a *built-in* "function" of future products - Chicago and Daytona have been specifically mentioned. ...................................................................... .......... No, this is not correct. It was speculation from Tim May on possible developments, based on his interpretation of recent events and on email which I sent to him. This email was referring to the fact that his concerns notwithstanding, it is not an easy thing to implement a privately-held key escrow system into a desktop operating system, that Microsoft is not talking about implementing a 'software Clipper', and is presently only *examining* the international ramifications of software key-escrow and non-escrowed strong encryption security. Please give it this question the benefit of the doubt and postpone your conclusions about this until I can get an official statement, thanks. Blanc

3 2

(fwd) Possible compromise of anon.penet.fi
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

Path: math.utexas.edu!news.dell.com!tadpole.com!uunet!spool.mu.edu!howland.reston.ans.net!gatech!news-feed-1.peachnet.edu!news.duke.edu!eff!news.kei.com!hermes.oc.com!convex!cnn.eng.convex.com!barnett From: barnett(a)convex.com (Paul Barnett) Newsgroups: alt.privacy Subject: Possible compromise of anon.penet.fi Date: 27 Jul 94 22:09:28 GMT Organization: CONVEX News Network, Engineering (cnn.eng), Richardson, Tx USA Lines: 29 Message-ID: <barnett.775346968(a)cnn.eng.convex.com> NNTP-Posting-Host: zeppelin.convex.com Someone has been collecting email addresses, apparently from postings to Usenet, and forging them to anonymous postings through anon.penet.fi to alt.test. The text of the posting states the REAL email address of the poster, under a posting attributed to the anonymous ID assigned to that poster. I received a notification that an anonymous ID has allocated for me, followed by a confirmation of a posting to alt.test. Looking in alt.test, you will see as many as 500 similar postings. Most of the anonymous IDs are numbered sequentially. However, there are some lower numbered anonymous IDs, presumably in previous use by the addressee named in the text of the message. These anonymous addresses are now compromised. I am posting to this newsgroup because there appears to be some correlation between the contributers to this newsgroup and the addresses that were forged to the messages. It may be coincidental, but I thought this was a fair place to post a warning anyway. My condolences to those people that have been caught in this net. This is one of the most despicable forms of net.terrorism that I have encountered. -- Paul Barnett Convex Computer Corp. MPP OS Development Richardson, TX

2 1

(fwd) WWII Enigma traffic
by Jim choate 17 Dec '03

17 Dec '03

Newsgroups: sci.military Path: bga.com!news.sprintlink.net!sundog.tiac.net!usenet.elf.com!news2.near.net!MathWorks.Com!news.duke.edu!godot.cc.duq.edu!newsfeed.pitt.edu!uunet!ncrgw2.ncr.com!ncrhub2!ranger!military From: lharnisch(a)delphi.com Subject: WWII Enigma traffic Message-ID: <CtMKns.J91(a)ranger.daytonoh.ncr.com> Sender: military(a)ranger.daytonoh.ncr.com (Sci.military Login) Organization: Delphi (info(a)delphi.com email, 800-695-4005 voice) Date: Thu, 28 Jul 1994 00:43:04 GMT Approved: military(a)ranger.daytonoh.ncr.com Lines: 13 >From lharnisch(a)delphi.com Does someone know the location of archives (or preferably microfilm) containing undeciphered German Enigma traffic? It isn't important whether it was cracked by the Allies during the war... am simply seeking some original German traffic to test computer program.... I have already gone through messages in the journal Cryptologia...... Pls E-mail me if you know of some sources... Thanks.... Larry Harnisch

1 0

RE: Questions about Microsoft and Software Key Escrow
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May My forte here on the list, I like to think, has always been to have "extremely long-range radar" that can pick up trends far in advance. Black Unicorn once told he this was my main strength, and even everybody's second-favorite nemesis, David Sternlight said much the same thing in sci.crypt. Coming from Sternlight, high praise indeed. <misc. elided> By all means, give Microsoft the benefit of the doubt. But also insist that they explain their work on SKE, and repudiate it. ......................................................... I respect your ability to think clearly and with great foresight also, Tim, but I really cannot think that Microsoft would "sell out" on this issue. There are too many in the company who would are for privacy for the individual, and remember they have their customers to think about. If SKE would constitute a problem for the individual end-user, then I can't see how the company could implement it and expect to remain a leader in the business, with all the negative publicity it would generate (conceivably most of it from cypherpunks!). These are my thoughts based on what I know about attitudes around here that I am familiar with & certain of. As I said in another post, Microsoft is an expert at arriving at a "win-win" situation, but I don't believe this includes sacrificing some of our most cherished values, like personal privacy, in exchange for a little security. If I thought this was not true, *I* would not work here. I may sound naive; hope time does not prove me wrong. Blanc

6 5

Patently Absurd?
by will＠thinkmedia.com 17 Dec '03

17 Dec '03

I realize this may seem absurd, but for the sake of humor could there be any relationship between the Dept. of Justice near pardon of Microsoft on charges of Anti-trust and the potential adoption of a software encryption standard in Chicago with the blessing of NIST and some goverment agencies. Would it be ridiculous conspirancy theorizing to think that MS and Justice made a deal? I have nothing to back this up, just reading the news and cypherpunks. ______________________________________________________________________________ Opinion is a flitting thing, Thinking Media Research But Truth, outlasts the Sun-- will(a)thinkmedia.com If then we cannot own them both-- (408) 423 3720 Possess the oldest one-- Emily Dickinson

1 0

RE: Questions about Microsoft and Software Key Escrow
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: I respect your ability to think clearly and with great foresight also, : Tim, but I really cannot think that Microsoft would "sell out" on this : issue. There are too many in the company who would are for privacy for : the individual, and remember they have their customers to think about. I think you're all forgetting something. Satellites. G

1 0