December 2003 - cypherpunks-legacy

Privacy with clipper
by Mikolaj Habryn 17 Dec '03

17 Dec '03

I seem to remember someone once writing that with the proposed clipper laws, you are allowed to encrypt messages before piping them through the clip chip, but the output must be left unaltered. The problem to this is that then whoever does the audits knows who's being sneaky. (Or something like that - i don't remember precisely.) Seems to me, if one is talking about videophone type devices, they are transmitting quite a great deal of info, and stegging in a message is quite feasible, is it not? You don't even have to do much of a hardware modification. Do something like having an HF carrier tone in the background, that anyone listening to it can't detect without the knowing what they're listenong for. Or insert a microburst transmission - it'll look like static. This is not to say, that the clip chip isn't worth fighting against, just that, as always, someone's going to come with a way around it. It's human nature, really. * * Mikolaj J. Habryn dichro(a)tartarus.uwa.edu.au * "Life begins at '040." PGP Public key available by finger * "Spaghetti code means job security!"

1 0

Clipper in Sunday Times
by Duncan Frissell 17 Dec '03

17 Dec '03

Page 5 of the Business section of the Sunday New York Times has a Clipper article by Peter H. Lewis. All the usual suspects. DCF "They are planning to smuggle automatic weapons a... move the plastic explosives in boxes disguised as in... keep secret from the authorities the identity of the p..." -- Either 1) The cleartext of the decrypted message in the "box" showing how Clipper works in the above article or 2) Governor Clinton personally directing weapons shipments to the Contras from the hidden CIA airfield near Mena Arkansas in 1986. --- WinQwk 2.0b#1165

1 0

Crypto toolkit
by Hal 17 Dec '03

17 Dec '03

From: Peter Murphy <pkm(a)maths.uq.oz.au> > I was most > taken by the idea of a "Crypto Toolkit". I think it would be understand- > able to write the code in plain, vanilla C (as opposed to C++). One > good reason is the widespread availability of C compilers, especially > with UNIX. Additionally, C++ compilers do take up more space (although > this would be more of an issue with PCs. I think Tim had in mind something that was accessible more from a higher- level language than C or C++; ideally, something interpreted so you could sit down and type in a few commands to get something useful. Perl and TCL are two languages which Tim mentioned and which have been discussed here in the past. Smalltalk might do, although it is not as "freely" avail- able. If you want a C toolkit, a good example already exists: the PGPTOOLS package by Pr0duct Cypher. It is available by ftp from csn.org in /pub/mpj to US citizens, and probably from some European crypto sites as well. This has a bignum package as well as interfaces to IDEA and RSA encryption. It also supports processing of PGP message formats and key rings. The latest version has code for Diffie-Hellman key exchange. Hal

3 2

RE: Warrantless searches -- Sorry to start this again....
by GERSTEIN＠SCSUD.CTSTATEU.EDU 17 Dec '03

17 Dec '03

You guys just keep saying the right things... My comments are below... -------------- Jim Sewell (jims(a)Central.KeyWest.MPGN.COM) said : >Subject: Re: Warrantless searches -- A sign of things to come? >To: cypherpunks(a)toad.com >Date: Mon, 18 Apr 1994 10:30:25 -0400 (EDT) >From: "Jim Sewell - KD4CKQ" <jims(a)Central.KeyWest.MPGN.COM> > >Slightly reformatted, but the content is faithfully reproduced: > ><My computer told me that GERSTEIN(a)SCSUD.CTSTATEU.EDU said:> >> >> On Sun, 17 Apr 94 13:39:39 >> paul(a)hawksbill.sprintmrn.com (Paul Ferguson) wrote: >> >> >A Page 1 story in The Washington Post Sunday (94.04.17) reads, >... [warrantless searches of housing project] ... >> Anyway, the point is, these people aren't safe in their own homes. > > Then the cops need to sting/watch these guys until they catch them > committing these felonies and throw them in jail, not invade the > privacy of a citizen cuz they think it's right. If the cops were > watching that neighborhood then the child couldn't have been sniped > without the shooter getting bagged. It is a poorly chosen solution to > the police force's inability to do their job well due to fear and/or > underfunding. You see, Jim, the drug deals go on inside the apartment buildings. How easy is it to do surveilance (sp?) on an apartment that is run by gangs, surrounded by their other apartments, on floors that are run by the gangs? Sure, you can do a phone tap. But that doesn't work on cellular phones.... You could also take over an apartment in another building and bounce lasers off the windows, but their damn music is too loud, or they change the rooms they do business in daily (the gangs aren't stupid, you know). And if you did find some way to bust them, how are you going to do it? Fire-fight your way through 3-4 floors of crack-crazed junkies with Uzi's? I don't think so. As far as the sniper killing that little kid, think about what you said. You really think the sniper didn't hang around on the roof-top, waiting for that first cop car to roll up? He's not dumb. They have to get to the building, and he can "reach" them a hell of a lot better than they can fire at him. And once they get inside, it's the same thing. The cops have to fight their way to the roof, at which point the gun and sniper are both inside the building somewhere, safe and cozy. In many ways, the situation has gotten better since the searches started. I AM NOT SAYING I AM FOR THE SEARCHES, I am merely saying that they are being productive. I challenge you C'punks to come up with a better solution. Given the circumstances that those involved are dealing with, it's pretty good for now. Adam Gerstein Comments to: GERSTEIN(a)SCSU.CTSTATEU.EDU Flames to: /dev/null -=-=-=-=-=-=-=- -=-=-=-=-

2 1

Re: Crypto toolkit
by Hal 17 Dec '03

17 Dec '03

> I went to this site to pick up PGPTOOLS but apparently it's moved > or something, since the pub/mpj directory doesnt exist and when I scanned > some other directories I didnt find it. Does anyone know another pointer > to this package? Sorry, my mistake: the directory is /mpj, not /pub/mpj. Again, the site is csn.org. You will have to read the file README.MPJ which tells the name of a "secret" directory to cd to (which changes every time). Then look at pgp_tools/pgptl*. Hal

1 0

licence plates seen
by mdbomber＠w6yx.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I saw a couple interesting licence plates on cars at work. One was 2PGP386 Now, that's a valid ordinary sequentially issued plate. But I'd still say the owner of that one has the right idea. :-) Another one on a car I've seen many times is 68 ASCII I don't have an ASCII chart available. What does this one mean? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLbq3bTSSmvXojb+5AQHFngIAnS/cs41ZKXf0kdtPBDmtZ5dgLov5OZ5O VmGg8S65xjZh8xNAOgvbgMOVDhefT0Vig8KlLRlGJG0WRRGkpbPt7A== =WIur -----END PGP SIGNATURE----- Internet: mdbomber(a)w6yx.stanford.edu Matt Bartley GPS: 33 49' 117 48' PGP keys on finger and servers

4 3

Today's Dumb Question?
by David Merriman 17 Dec '03

17 Dec '03

I've got what may turn out to be Today's Dumb Question.... What Happens If, instead of using prime numbers or logarithms for the basis for a public-key crypto system, we instead generated out public key thus: 1> pick an arbitrary bit stream (large [pseudo?]random number, binary representation of selected chunk of text or data file, etc). 1024 bits or more (in 256 bit chunks?) 2> enter a passphrase 3> XOR the bit stream with the binary representation of the passphrase, cycling the passphrase as necessary. This makes the 'large' component of our public key. 4> hash the passphrase to 128 or more (in blocks of 64?) bits. This makes the 'small' component of the public key. 5> We then use these components as in normal public-key algorithms. Conceptually (to me), this would seem to work, and have the advantage of not being dependent on the factorability of any number; that is, the numbers could be extended as necessary fairly simply. It would also seem to depend on the entry of a passphrase that would be securely 'locked' inside someone's mind :-) Too, it wouldn't seem to be subject to any kind of patents. Finally, if the arbitrary bit stream were taken from something like a section of text in a file, a sequence of bytes in a data file, or even absolute track/sector reads from a floppy/hard disk, the entire thing could be rendered useless by the user by simply erasing/wiping a single file or track/sector. Would something like this work, or am I missing one of the trees because of the forest? Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 'That's odd.... the computer model didn't do that....'

1 0

"Information-Hiding" in Crypto Programs
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

The challenge I mentioned in my last message can be summarized as follows: - hide the complexity of implementation in the code, so that other programmers, and especially end-users, don't have to worry about it. - to pick a simplest example, a random number generator needs to generated a good random number without the user having to worry about a zillion related issues (this may get flames....I'm not saying users should be blissfully ignorant of some of the assumptions that went into the RNG, only that most users want an RNG that operates consistently, has been tested by others, etc. This is the Mathematica function method: have experts devise the best factoring or primality testing approach, implement it efficiently (usually in C or even machine language), and then give it to the user as "FactorInteger[3858783237285638838513] for him to incorporate as a canned functon.) - "information hiding," or modularization, means hiding the implementation details from the user and providing regularized calling conventions to make the code behave almost like a "thing" (internal consistency, reproducible behavior, etc.) - "crypto objects" (or instances of classes) would presumably know how to handle the usual crypto messages. - "digital cash objects" would help with the extraordinarily confusing protocols for multi-party transactions I'm not saying _how_ they would help, just that my intuition is that the crypto community could make new strides if the imperative style of programming ("do this," "now do this," etc.) were to be supplemented with the descriptive style ("this is a digital cash object and these are the messages it understands") and even the logical style (of Prolog, for example). Two years ago, Eric Hughes and I spent a few intense days debating these sorts of issues, including discussions of "program correctness" and protocol generation. For digital money to succeed, there had better not be flaws and loopholes that allow attackers to drain your money away or to cause confusion and doubt amongst your customers! Automatic theorem-proving methods, so often the topic of dusty old Ph.D theses, may come to the fore to handle these extremely complex (and attackable by spoofers, eavesdroppers, forgers, etc) protocols. This stuff goes beyond what I was talking about with objects, classes, and libraries, but may be needed sooner than we think. I promise to shut up for a while. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 3

your Clipper video testimony wanted
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message: From: blogan(a)crash.cts.com (Barry Logan) Subject: Re: vid testimony Date: Thu, 21 Apr 1994 11:51:17 -0800 ****** P A P E R T I G E R T V S O U T H W E S T ******* For Immediate Release 4.20.94 *Distrubute Widely* This is a request for submissions of video testimony regarding Clipper. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The public is increasingly becoming aware of the Clipper. Hearings are scheduled to held on April 27 and May 3, 1994 by Sen. Patrick Leahy's (D-VT), of the Senate Judiciary's Technology and the Law Subcommittee, the subject of which will be the Clipper initiative and the FBI's draft Digital Telephony surveillance bill. Momentum is building, get involved. Unless the conquest of cyberspace goes unchallenged by the public-at-large, First and Fourth Amendment rights will be abrogated in a "fait accompli" out-of-sight of democratic processes. This is a battle that cannot be won if fought solely in cyberspace. The implementation of draconian measures calls for innovative counter measures. We propose to take arguments against the Clipper proposal to the public with a video. Fighting with the traditional weapons of mass media will get the attention of the wider net-disinterested audience (most of whom will intersect with the net in the future), than relying on the net alone to conjure the necessary outcry to make Clipper an issue of public scrutiny. We need your collected clips to put together a composite argument. It will be distributed to public access television stations, key legislators, and also be made available to the general public. Submission guidelines: - DEADLINE MAY 8TH ~~~~~~~~~~~~~~~~~~~~~ -Send us a video of you containing your most cogent thoughts and passionate statement regarding Clipper. -Please limit your comments to privacy issues in general and Clipper in particular. -Send original tapes (we'll return them) in any format, 8mm, Hi8, VHS. ~~~~~~~~ Hi8 is the best. -Because of both the nature of video and the nature Clipper, guerrilla theater is encouraged. -Submissions of arguments in favor of Clipper will also be considered for inclusion. -Contributions from outside the U.S. are welcome. -Suggestions about content and/or format welcome. -Please send your video as soon as possible, but no later than May 8th for consideration. Information about Paper Tiger: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Paper Tiger TV is a non-profit volunteer collective based in Manhattan, with working groups in San Diego (PTTV Tiger South West) and San Francisco (PTTV West). Paper Tiger TV produces 30 minute programs shown weekly on public access cable TV and distributed to cable stations, colleges and libraries across the country. The collective has been working for nine years with critical readings on many areas of cultural production including advertisement, TV, films, mainstream publications and cultural events. Although there is no confirmation, it is likely that the finished tape will be uplinked by Deep Dish TV: an association of community and independent producers, public access and cable programmers; a national, alternative satellite network with multi-racial, multi-regional representation producing and distributing television that has a point of view. FEARLESS TV!! We hope that our shows will inspire, educate and empower the political movements that we are a part of. Mail your tapes to: VIEWING HABITS 3270 MT.AACHEN AVE. SAN DIEGO, CA 92111 We are including Herb Sciller's "Plunge into cyberspace". Well known lefty media critic and guru of our collective. This is a historic moment, don't blow it. Make history, make video.

1 0

Re: The un-BBS
by sdw＠meaddata.com 17 Dec '03

17 Dec '03

> > Mike Ingle writes: > > > There are occasional waves of actions against BBSes. The most recent ones > > are for porn. Before that it was pirate software and phone codes. The next > ... > > > What we need is a totally decentralized BBS. It would be something like > > running Usenet over UUCP. There would be newsgroups or SIGs or whatever > > you want to call them. Anyone could leave their computer and modem on, > > and anyone else could call them and get an update. There would be no BBS > > to call and log into. You'd just call your friend's computer and update > > your newsgroups, and someone would call yours and update his. The network > > would grow outward, with no organization or structure. Anyone could create > > a new newsgroup, and if his friends chose to take it, it would spread. > ... I'm pretty perplexed: What's wrong with the current Netnews (Usenet...), Email, etc. setup? It's very flexible and you can get access for very reasonable amounts of money (even for a server). The software's free, the net is huge, etc... I dislike BBS's alot compared to standard Internet services. It's only expensive if you want online, realtime access, gigabytes/mo. of traffic, etc. > This is FIDONet (or FidoNet). In most essential features, this is what > FidoNet has been doing for the past half dozen years. Distributed, > decentralized, dial-up lines, banyan-type architecture (sort of), etc. > > Tom Jennings, one of the main architects of FidoNet, was once on our > list, as were a couple of others, but they don't seem to be any > longer. > > There are some interesting issues here, which I'll just list: > > * since the FidoNet is not subsidized by others the way the Internet > is, operators of FidoNet nodes (I don't know the exact term) often end > up subsidizing the costs themselves. Most systems/people on the Internet are not subsidized. This is well known. The critical mass of users has obviated the need for it. I've been grappling with what features I'd like in the perfect communications / BBS / Internet / online system. Does anyone have strong opinions about which features are important? For instance: I find that my Unix Internet mail/news tools are an order of magnitude more efficient than any BBS message base reader I've ever encountered. sdw -- Stephen D. Williams Local Internet Gateway Co.; SDW Systems 513 496-5223APager LIG dev./sales Internet: sdw(a)lig.net OO R&D Source Dist. By Horse: 2464 Rosina Dr., Miamisburg, OH 45342-6430 Comm. Consulting ICBM: 39 34N 85 15W I love it when a plan comes together Newbie Notice: (Surfer's know the score...) I speak for LIGCo., CCI, myself, and no one else, regardless of where it is convenient to post from or thru.

3 5