December 2003 - cypherpunks-legacy

Re: Jude Milhon in WIRED
by Hal 17 Dec '03

17 Dec '03

From: tcmay(a)netcom.com (Timothy C. May) > General insults, or political statements, are of course kosher, but > making any kind of snide remarks about Joe Foobar, for example, will > often result in these comments being fed to the at person. (I recently > made some comments here on this list about a public Net person, whom I > do not believe is or was subscribed...a few days later I got a > note from this person objecting to my characterization of his views! I > am assuming someone forwarded the traffic to him.) I felt the same way recently. I had commented here about elec cash prodigy Stefan Brands being among those not getting into the DigiCash demo, it got cross-posted to www-buyinfo (which is read by DigiCash people) and led to a big political stink that may have set back relations between Brands and Chaum and therefore the prospects for high-quality digital cash. I really regretted my words as it was certainly not my intention to stir up bad blood. I still tend to think of this list as a relatively private place to make comments "just among friends", unlike more public venues which feed into a wider cross-section of views and where I try to be much more circumspect. Hal

1 0

request for factorising code
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have had a look at the exported version of Netscape's WWW browser which has support for secure transfer of info, and it says it uses RSA keys limited to 40 (not sure whether this is decimal digits or bits). This is the broken version for export, I am not sure what the non-crippled version uses. I would like to have a go at factorising a number of 40 digits to get a feel for how secure this system is. I suspect not very secure even 40 digits is pretty pitiful for an RSA key size 40 bits would be a joke. I would like to get a feel for how long it takes to factorise a 40 digit number. Does anyone have source code for factorising large numbers. I have code to generate the RSA key pairs and modulus, what I am looking for is code to factorise a number using one of the better algorithms (quadratic sieve, etc.). Adam -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAiwUXUEAAAEEAJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GWe4g4PLrSbJZPBFIezd8xddnx5+5hbRk1K6UpfReQuOynIuJ1VakpnAAUT tB9BZGFtIEJhY2sgPEEuQmFja0BleGV0ZXIuYWMudWs+ =pRe7 -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUALxrGhSnIuJ1VakpnAQHzbAP/Q00RZan2rdMrIYzM3Dp4+620DFGoe0zi bRMvLUlKUuPPfdc5PYh/l7cxXwnj6/ARP6QUCyxlHwS/vKxHNJyhIcgna2yIBQGA NtCKZjZNdEYII9/taC4BXc7nTIvJKuz0EgXVSJwbUXgBjuMFA/ZGOrKr1SFcyLbP qMER2rgg5VM= =AJwi -----END PGP SIGNATURE-----

4 3

Known data havens for pirates? Doubtful
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

I forget who wrote: > blame them. Copyrighted data on a server in a jurisdiction that > doesn't acknowledege the copyrights - a prime use for Data Havens > when they come of age. I suppose you _are_ aware that the US has threatened China with punitive duties on $100 BILLION dollars worth of trade, and that China has started holding some show trials (without shutting down its state-owned CD-piracy factories). It's not going to be easy to find a country more willing and able to ignore international copyright law (Berne Convention etc) than China; however, despite howls of protest even China is likely to knuckle down eventually. What may be likely is distributed piracy markets, such as described in Tim's BlackNet spoof. Read my earlier post on what Lance Rose thinks. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

6 5

Re: How do I know if its encrypted?
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I think we're pretty well agreed that Dave's DataHaven can't ensure that files are encrypted without looking inside them at some point. It's a dilemma: Dave wants to be sure he can't read something, but the only way he can be sure is by reading it. But suppose that Dave's good friend Ender Trent decides to set up a new service, Ender Trent's Trusted Encryption. It's a simple job: people send files to Ender and he returns them encrypted and signed. Now, all Dave needs do is check Ender's signature before accepting a file. At no point does Dave ever decrypt or attempt to decrypt such a file. Ender offers encryption in many different forms. In the simplest, Alice sends the file to Ender, Ender generates a random key, encrypts the file, and sends both back to Alice. Almost as simple, Ender uses the hash of the original file as the key. Presumably, Alice already knows the hash and so Ender doesn't send that back. Alice could supply a public PGP (or other asymmetrical algorithm) key with the file and Ender uses that. If Alice is a frequent customer and likes this method, she might register the key with Ender. Lastly, Alice might want to supply a symmetric key of her own. Because Ender wants to protect people like Dave, he can either print a warning that the key used for encryption might not be secure, or run a password-cracking algorithm on it, or both. Because of the extra effort and reduced security, Ender might not want to offer this, or charge an arm and a leg for it. And Dave might not be willing to accept such files, anyway. How is it better to have Ender do all this rather than Dave? Essentially, it splits the risk. Dave never sees the files, and therefore can't be responsible for their contents. Nor could he make sense out of them, even if he tried really, really hard. He could operate his data haven in all but the most repressive parts of the world. Ender's risk is slim to none. Were he to be held accountable for files he encrypts, public notaries would likewise have to be held accountable for everything they notarize. I don't see that as a problem. Dave might wish to offer an encryption service, as Ender might want to offer a data haven, but, if they're smart, they won't accept files that they themselves encrypted. Ender's encryption need not only be for data havens, of course. Nervous remailer operators might want proof of encryption. Escrow services will likely like Ender. And probably more. If there is a demand for a trusted encryption service, I'll create one after the second trumpet audition for the Oregon Symphony on the first of the month. That's the main reason I'm signing this--to hold myself to it. b& -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBLxrj5a7gd9aHWwWVAQH2Hgf0CF+0CIMWiK7d52Gaa8fPpMQy+qAYOBj+ MxJPZJpwxLEzmdT8n+dWjz2+0uPbIXXYa8yEM86UeV9++BzNM7WkOr5tezUuUrYa aM+I4yWJEz/oUpURxi4tt1Jmxn4F0IGQENBweIw+lsgU/TyNweCerKoShLpP4zca iZr1HtkK/7KdEi/wmADtfI6aUHytRyMXYvwKhKiy23eAFyNtZgAz4i77p2Kw6iM6 aTGsQQVjda6AYcVlIcLAJN8v+pQV+RGKA4FGACsxEGHDCQvFd3/WvCD4pupPm80E 9QLhQ2zLIjAkSmkO9flndXq6TOcCtMd3f6u/oGCx1EHKUTdP8nbg =svFy -----END PGP SIGNATURE----- -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

1 0

Re: REQUEST: Privacy/Free Speech URLs
by jml＠wizard.synapse.net 17 Dec '03

17 Dec '03

>On the request of a few law-related professors and other faculty, I'm >trying to put together a web page that brings together resources from all >over the net that are related to issues of free speech, privacy, libel, >censorship, etc. > >If you have a few URLS with materials related to the above, I'd >appreciate it if you could drop them in an emailee to me. Basically, any >URL that ends up pointing to issues of rights and rules on the net, and >possibly related software (such as PGP and the like). > >Thanks much :-) Check out Vince Cate's Cryptorebel/Cypherpunk Page at: ftp://furmint.nectar.cs.cmu.edu/security/README.html It has just about everything with links to other sites that have links to other sites that have links to.... it's a web thing. :-) *********************************************** jml(a)wizard.synapse.net PGP encrypted mail preferred. I might disagree totally with what you say but I'll defend your right to say it to the death. ***********************************************

1 0

US News on Policing Cyberspace
by John Young 17 Dec '03

17 Dec '03

US News of January 23 has a cover story on "policing cybersapce", another drumbeat about "the growing threats to your privacy and property in the information age." Not much new for this group except to enjoy another Spielberg gremlin of Jekyll and Hyde cryptography, fearful remailers, slippery digicash, stolen services and personal data, smuggling, terrorism, child pornography, Tennessee BBS, "cybercops" and such. Featuring the FBI's Kallstrom and Tafoya and FLETC and Financial Fraud Institute and Clipper and protective wiretaps, with supporting roles for Kevin Mitnick, Bruce Schneier, Mike Godwin, Marc Rotenberg, John Perry Barlow, Esther Dyson, Robert Corn-Revere. And, a cartoon on how to teach parents fear of the Net for their children. Cypherpunk is not sited, I think, or is it steganoed?.

1 0

Longer than 1048 bit keys
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm using MacPGP 2.6(ui) and noticed that the limit for a key size is the 1048 bit ("military grade" (right)). Is there anyway to circumvent this to make larger, harder-to-break-type keys? TIA, - -J -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLxr4xEiLvmPjc4XdAQFVZgP/UsykAUkO18IFddV+QTOkEK4wwipljb/F U1zkrh3IlUUHg82OVhS7tAtEn68d2NyNvbv5k+00CY+DYv9eSLgSbgTeMyyspFTf ZmQtjQZu0Qe6NVWOVMXAFzfUDhmAAytfssvMHqSEMyxaHdyNNFoK9csSg39VchfF s/VBsHv9sZ4= =JQbl -----END PGP SIGNATURE----- (-: aka: :-) (-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-) (-: www server: http://josaiah.sewanee.edu/ :-) (-: It's January 29th! IT'S TIME!!! Ask me for details!:-) (-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-) (-: PGP block. :-)

1 0

Another internet story: INFO: NBC Nightly News Tonight (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 16 Jan 1995 16:44:07 -0500 From: Craig Peterson <craig(a)Mainstream.com> To: Multiple recipients of list <rkba-alert(a)gatekeeper.nra.org> Subject: INFO: NBC Nightly News Tonight A story regarding the Internet, with some sort of mention of NRA.org, should be on the NBC Nightly News with Tom Brokaw tonight. Craig.

1 0

Announce: ChainMail 0.6b applescript for using anon remailers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

I've written an applescript for using the cypherpunks-style anon remailers with Eudora for the macintosh. It will take a message in Eudora, and construct a chain with MacPGP for encryption, through remailers you've specified, and then deposit it back in Eudora for sending. There are still several features I'd like to add to it, but it's quite useable in it's present incarnation. You need a scriptable version of MacPGP, scriptable version of Eudora, and some sundry scripting additions which are listed (with URLs) in the docs. Send email if you'd like a copy, and I'll mail you a binhex'd copy. I don't want it on any archive sites yet, because it's not really done, or fully beta tested for bugs. (so let that be a warning to you, too.)

1 0

Abuse Complaint out of homer@rahul.net
by Homer Wilson Smith 17 Dec '03

17 Dec '03

Oh, Goody. I get to deal with my first abuse complaint for my remailer. Seems to me that letting others decide what is or is not abuse without at least being able to see the abuse myself would be wrong, that opens the door to just anyone claiming they were abused and my taking action against the alleged abuser. Clearly though if some admin of a system considers something an abuse, one can not just blow them off, we are all responsible for responsible use of the net. Even if this posting came through a chain, this admin is going to try to trace back the chain through the other remailers. So if I give him the remailer it came from, he is going to pester that remailer operator who won't appreciate it. I will soon be able to install blocking on the To: or From: lines. Blocking the From lines is hard, because usually abuse comes through other remailers, so I can't just block that. I can however block To: lines if the person is abusing one particular usenet newsgroup or end receiver. It would seem that if I am going to take action against someone with blocking of some sort, then I have at least a right to see the full posting that is claimed to be abusive. By the way, rahul.net keeps syslog files world readable which I find to be a security leak, as anyone (specifically the Church of Scientology) could find out who is in communication with me and start to harrass them too. Comments on ethics and diplomatic handling of this would be appreciated. Homer

2 1