December 2003 - cypherpunks-legacy

Possible [Best?] Scenario
by Anonymous User 17 Dec '03

17 Dec '03

Let's say I have a digital cellular phone. I also have Anonymous Remailers, PGP, and over 100 BBS numbers (structured for which day and which hour each would be used) so that I can contact and talk to my "Friend." Please tell me how the LEA's can find me and understand the transactions between us? If I have several encryption programs, can I 'layer' each document [I PGP the file, the I DES the PGP file, then IDEA for the final layer. Does the NSA have to crack it one layer at a time, or can they bombard it, crack the layers in whatever order the supercomputer finds? If I am missing something, please let me know what I have missed.

2 1

Re: RSADSI vs. Remailers (Meta Strong Crypto)
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

[Hal forwards articles mentioning that the jpunix remailer is down after complaints were made regarding the remailing of "copy-written" material. The jpunix remailer is the visible remailer used to post the RC4 source code to cypherpunks.] (Meta Strong Crypto) This points at one of the weakest links in the crypto anarchist's toolset. To the extent that the sheep^H^H^H^H^Hpublic becomes concerned with the "implications" of the tools of crypto anarchy, there will probably be attempts to outlaw or otherwise control these tools. Take the recently much discussed notion of the risk-free placement of "contracts to kill". This relies upon almost all of the major tools in the crypto anarchist's toolkit. I count four in this case: the existence of strong public key cryptography; the existence of widely read and used public bulletin boards (such as alt.test); the existence of untraceable digital cash; and the existence of secure anonymous remailers. Of these four, strong public key cryptography is here today and would be very difficult to regulate legislatively at this point. Likewise, widely visible public bulletin boards are rock solid. Untraceable digital cash is of course not really here today, and it is possible that attempts to outlaw it could be made. However, Swiss banks have specialized in anonymous accounts and similar services for a long time, and there could be significant financial gains to be made from issuing untraceable digital cash. It seems likely that there will be banks in Switzerland or elsewhere that will be more than happy to do this. Then the only impediment can be at the level of outlawing the *use* of digital cash. However, the combination of secure public key encryption and anonymous remailing would make the use of digital cash impossible to detect. This leaves anonymous remailers as the one vulnerable link in the chain. Imagine that a country (say the USA) decides to outlaw the operation of, or use of, any anonymous remailer. I don't see how any of the other tools of strong crypto could be used to circumvent such laws. The last link in an anonymous remailer chain is always visible. The operator can be prosecuted for operating an anonymous remailer, if inside the borders of the country (or even outside, given recent USA claims to be able to kidnap foreign citizens on foreign soils for prosecution within the USA). It still might be possible to have anonymous remailers operating safely outside the borders of the country -- but it would be possible to monitor for traffic *destined* for these remailers, leaving the country. Since no anonymous remailers exist within the country, the origin of this traffic can be determined, and the sources can be prosecuted for use of an anonymous remailer. (Going Out On A Limb) One possible way around this societal control of anonymous remailers might be the existence of very large DC-nets (or related technologies). The idea here would be to effectively spread the social responsibility for the operation of an anonymous remailer out over such a large segment of the population that societal (legal) pressures could not be effectively brought to bear to suppress it. This would in effect be a type of political movement... the participating members of these vast "DC-nets" would effectively be members of a kind of political group. This membership would be intrinsically visible, since it will be used to *construct* the possibility of anonymity, and cannot rely on it. In order to be immune from suppression by the rest of society, the membership rosters would have to be comparable to that of a major political party... probably on the order of millions of members (at least hundreds of thousands). Getting there would be the tricky part... during the initial formation stage, when the membership rosters are low, the group is susceptible to be legislated out of existence. Doug

2 1

(fwd) "Will You Be a Terrorist?"
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherpunks, Not all of you like posts that mention "guns" in any form, so if this the case for you, hit "D" now. I think the recently-passed Crime Act has implications for what some are calling "terrorist speech" and that Cypherpunks remailers may be construed as "PROVIDING MATERIAL SUPPORT TO TERRORISTS" in the context of being "communications equipment." Consider this "food for thought." An excerpt, and commentary by the original anonymous poster, is included below. I know that our favorite optimists, Duncan Frissell and Sandy Sandfort, are fond of saying that it's already over, that we've already won, that the state is powerless, etc., but when I read the text of the Crime Bill (available from ftp.nra.org in pub/legislation), I just can't buy that. I see a growing police force, I see U.N. blue helmets, I see many more prosecutions for a growing list of crimes, I see my gun rights being taken away, and on and on. In the section below, read carefully the sections about providing support for "terrorists." Note that belonging to a pro- or anti-abortion group in which _one_ of the members uses violence (a fistfight, a jostling of a cop, or a shooting...) makes the group a "terrorist" group, under the new language of the Crime Act. I will not be surprised to hear that the Cypherpunks group is classified as a terrorist group, for a variety of reasons (not the least of which was the "liberation" of the RC4 code, the Mykotronx-government deal info, the debates about undermining the government, the talk of assasination markets, etc.). Sorry, but I just can't "Don't worry, be happy." --Tim May Newsgroups: talk.politics.guns From: anonymous(a)extropia.wimsey.com Subject: "Will You Be a Terrorist?" Message-ID: <199409120907.AA15385@xtropia> Date: Mon, 12 Sep 1994 02:07:16 -0700 X-Mailer: mail-news 2.0.3 Remailed-By: remail(a)extropia.wimsey.com Comments: This message was anonymously remailed. Do not reply to the address in [Check it out - Cross-posted from Fidonet:] The "Crime Bill" passed by Congress recently (truename: Violent Crime Control and Law Enforcement Act of 1994) has a frightening provision that hides a boogeyman under its superficially appealing surface: *----------* *----------* *----------* SEC. 120005. PROVIDING MATERIAL SUPPORT TO TERRORISTS. (a) Offense.--Chapter 113A of title 18, United States Code, is amended by adding the following new section: ``Sec. 2339A. Providing material support to terrorists ``(a) Definition.--In this section, `material support or resources' means currency or other financial securities, financial services, lodging, training, safehouses, false documentation or identification, communications equipment, facilities, weapons, lethal substances, explosives, personnel, transportation, and other physical assets, but does not include humanitarian assistance to persons not directly involved in such violations. ``(b) Offense.--A person who, within the United States, provides material support or resources or conceals or disguises the nature, location, source, or ownership of material support or resources, knowing or intending that they are to be used in preparation for, or in carrying out, a violation of section 32, 36, 351, 844 (f) or (i), 1114, 1116, 1203, 1361, 1363, 1751, 2280, 2281, 2331, or 2339 of this title or section 46502 of title 49, or in preparation for or carrying out the concealment of an escape from the commission of any such violation, shall be fined under this title, imprisoned not more than 10 years, or both. ``(c) Investigations.-- ``(1) In general.--Within the United States, an investigation may be initiated or continued under this section only when facts reasonably indicate that-- ``(A) in the case of an individual, the individual knowingly or intentionally engages, has engaged, or is about to engage in the violation of this or any other Federal criminal law; and ``(B) in the case of a group of individuals, the group knowingly or intentionally engages, has engaged, or is about to engage in the violation of this or any other Federal criminal law. ``(2) Activities protected by the first amendment.--An investigation may not be initiated or continued under this section based on activities protected by the First Amendment to the Constitution, including expressions of support or the provision of financial support for the nonviolent political, religious, philosophical, or ideological goals or beliefs of any person or group.''. (b) Technical Amendment.--The chapter analysis for chapter 113A of title 18, United States Code, is amended by adding the following new item: ``2339A. Providing material support to terrorists.''. *----------* *----------* *----------* In the U.S. Title 18 Code, terrorism is defined as "engaging in any act or conspiring to engage in any act intended to intimidate or coerce the civilian population or the government" or close words to that effect. What does this mean? Suppose you organize a militia and some little jot or tittle is just that much off -- and the thugs at the BATF or FBI or NatPol decide that your militia is an "armed group"? They can now seize your house, your car, your bank account and anything else even remotely connected with the maintenance or support of the militia, and make *you* prove your innocence before the Federal thugs will grudgingly return your life to you. Suppose you participate in a demonstration against abortion and just one member of the peaceful demonstration gets into a fistfight with an escort. You had given a ride to this demonstrator -- is the fistfight "terrorism" and you a collaborator in this "terrorism" to be arrested and thrown in jail and your car seized until you can prove that you did not know that the other demonstrator did intend to fight with an escort? Suppose you demonstrate against national health care and you yell that Clinton should be thrown out of office and make a threatening gesture -- will the thugs treat this as an "attempt to intimidate the government" and take your car and perhaps your home if you used it to prepare materials for the demonstration? Suppose you quote Thomas Jefferson's words about a revolution being due every twenty years -- will you be thrown into jail for that? Note that the above section does not allow anything but "NON-violent" goals. This is another direct attack upon the First Amendment and deeply disturbing in its implications when considered as part of a set of other federal statutes scattered across Title 18 criminal law. ***end of quoted section*** -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay

9 19

Returned mail: Host unknown
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

----- Transcript of session follows ----- 550 3toad.com (tcp)... 550 Host unknown 554 <cypherpunks(a)3toad.com>... 550 Host unknown (Authoritative answer from name server) ----- Unsent message follows ----- Received: from hummingbird.CS.Arizona.EDU by optima.CS.Arizona.EDU (5.65c/15) via SMTP id AA23319; Sat, 17 Sep 1994 11:26:06 MST Date: Sat, 17 Sep 1994 11:26:04 MST From: "Patrick G. Bridges" <bridges> Message-Id: <199409171826.AA03054(a)hummingbird.cs.arizona.edu> Received: by hummingbird.cs.arizona.edu; Sat, 17 Sep 1994 11:26:04 MST To: cypherpunks(a)3toad.com Subject: RC4 -----BEGIN PGP SIGNED MESSAGE----- >>>>> "ritter" == ritter <ritter(a)pentagon.io.com> writes: ritter> In <CwA0Br.KH0(a)chinet.chinet.com> ritter> schneier(a)chinet.chinet.com (Bruce Schneier) writes: >> I think the smartest thing RSA Data Security, Inc could do at >> this point is to patent RC4. ritter> Sorry, but they don't have that option. ritter> When a product containing an invention is sold ritter> commercially, a one- year count-down starts on the patent ritter> application. ritter> --- Terry Ritter ritter(a)io.com So, to summarize what I've heard so far: So, unless RSADSI had already filed for a patent, they're essentially screwed. The algorithm is revealed, but they can't patent it. The source posted may or may not be copyrighted, but anyone can roll their own version which would not be copyrighted and use it freely, unless Trade Secret law say otherwise, which I've heard several people say it doesn't... What has been done may or may not be criminal... If the posted code IS RSADSI source, this is clearly a breach of copyright law...If it is a reverse engineering job, then it's illegal if the reverse engineer had a no-RE agreement w/ RSADSI, which may not be the case if she just worked back from Lotus Notes, for instance... I can't say I'm upset by the fact the algorithm itself has been made public, since IMHO a new, fast algorithm will help the state of academic research in cryptography, and I think most would agree that peer review is the best way to evaluate encryption algorithms. Still, I wonder about the effects this release will have on the net as a whole... This release could make good scare tactic ammunition for the pro-clipper/DigTel folks to use w/ corporations... It may also fuel worrisome cries for regulation of the networks... - -- *** Patrick G. Bridges bridges(a)cs.arizona.edu *** *** PGP 2.6 key available via finger * Key Fingerprint: *** *** D6 09 C7 1F 4C 18 D5 18 7E 02 50 E6 B1 AB A5 2C *** *** #include <std/disclaimer.h> *** -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLns0j0oL7Aaetl5pAQFDkwP+M2cO95+jjj7cZp/6FBmplfYM7WhndGhn AcR+NsS6UNvjU+e/q7ekRXPDAHzh4idTldrGndoUAsvVhdXJpYDOvyGyBG1e0W/c HPLQbiNcURRDkDeTIVLLAtX1ECjmfEeBPC/2iiTq1GaivbEGCL1kq+2AS1dSu31m EZOOOWJQe68= =JdAM -----END PGP SIGNATURE-----

1 0

NYT/Markoff article on RC4
by Jeff Gostin 17 Dec '03

17 Dec '03

"Brian A. LaMacchia" <bal(a)martigny.ai.mit.edu> writes: > The article does mention this list, which is called, "a specialized > computer network mailing list of computer researchers who oppose > the Government's stringent controls on data encryption technology." A tad succinct, but perhaps not too far offbase. Is it fair to say that we support the free flow of information, and place the responsibility for maintaining the privacy of that information on the party said information concerns? Now, I know that saying "we" has certain implications, mainly that of a list consensus. However, it seems that a great many people here seem to post to that regard. Am I correct in my observation? --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Re: if this is RC4
by Martin Minow 17 Dec '03

17 Dec '03

The strange line in the posted RC4 (assuming that's what it is): > xorIndex = state[x] + (state[y]) % 256; might be an intentional do-nothing statement that could be used to show that the original was stolen source code, rather than a decompilation of an executable or object module. An expert could point out that the statement cannot be derived from any distribution of RC4, but was in the source licensed to Company X, and therefore an employee of Company X violated the source code agreement. Just speculating. Martin Minow minow(a)apple.com The above does not represent the position of Apple Computer Inc.

1 0

Stealth remailers
by Hal 17 Dec '03

17 Dec '03

One "quick and dirty" way to get the effect of a stealth remailer is to have all messages leave the remailer net via one or more politically strong hosts. For a long time now I have been having my remailer on alumni.caltech.edu, which I judge to be politically weak, forward mail to shell.portal.com, which seems stronger. When people see some anonymous mail they don't like, they look at where it comes from. They seldom think to blame other remailers in the chain (partially because they can't easily find out who they are). It is the final remailer which takes the heat. If that remailer were in a jurisdiction and/or political position that would allow it to withstand the various threats we anticipate, it would provide cover for the other remailers. And by using other remailers in a chain before going through this final remailer, users don't have to trust the final remailer with any significant secrets. Some time back I proposed a variation of this idea: "second tier" remailers, which always forward their outgoing messages through one or more "first tier" remailers, which work like the current ones and take the political heat as a result. Second tier remailers would be very safe to run and it would be rare that a sysop or supervisor would get a complaint about the remailer's activity. Hal

1 0

art encryption...
by Lile Elam 17 Dec '03

17 Dec '03

Well, it looks like I have to delve into this subject as I should really know what's available for signing art. Some poeple are concerned that art via the net is going to be ripped off, abused, and any other sort of horra you can think of *if* people share digital images of their works via the Internet (WWW, ftp, newsgroups, et all). So, I have been thinking that a way an artist can insure a viewer that the art they are viewing is really that of the artist, the artist can *sign* their art with their private key and others can check it with their public key. Now, the art would be factered into the key generated that others would check with the public key. So, a image file (gif, jpeg, tiff whatever) would be run through a encryption coding that would generate a signage based on the artist's image and their private key. The image would remain unchanged. Then viewers could run the same encyription coding on the image and apply the artist's public key to see if it really *is* their work.... I don't know if this is the best way to do something like this and I sure am not much of a programmer... :) But it would be interesting to find if you think this is possible. Any other ideas on work authenticy would be appreciated. The main goal here is to let people view the work and if they *really* want to make sure the artist posted it, they could check it with PGP... or the like. Hopefully, people could catch art abuse and let the artist know about it. I myself have my art on the net as "share art" and people can do what they like with the images as long as they don't use them commercially without contacting me first. Also if they really alter an image, to say it's been manipulated and the orig can be found at say art.net. I realize that some folks may abuse these images of paintings I have done but I feel that what I gain by sharing makes up for it all. Unfortunately, this isn't the case with other artists and alot of them are not ready for this concept of sharing and letting go. They become terrified that their works might be open to the terrors I have mentioned. I want to give these artists a method that will make them feel more comfortable about sharing digital images.... Such a method will also help shoot down the marketeering, blood sucking, types of slippery jerks I run into who try and scare artists from sharing on the net. One fellow had the nerve to scare two artists away from art.net with copywrite arguments and abuse issues and then in some crazy way, he convenced them to pay him $ to provide the same service with no security messures ither. Blows my mind that they went for it... sigh..... This type of undermining will not help artists and I want to fight back. This jerk also is probably scared of art.net because we are offering to help teach artists how to put their stuff up with html, are offering a free space for them to create and share in, and are asking them to teach others the same. We are wanting to help other sites come up on the net and do the same. We're totally non-profit. This jerk couldn't understand why I would barter a painting for a years worth of Internet connection for art.net. He asked, "What do you get out of it?". I just shook my head... Sigh... thanks for your help in advance and check out "Art on the Net" if you get the chance... (http://www.art.net) -lile Lile Elam founder and one of the webmasters of "Art on the Net" lile(a)art.net

2 1

H.E.A.T. SEEKING
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Bummer! WWOR, here in the New York area, pulled a fast one on me. They rescheduled Acapulco H.E.A.T. from 18:00 to 15:00 without so much as a "by-your-leave." But as Mr. May will tell you, I'm one of the list's perennial optimist. There are no problems, only opportunities. If you saw the show in question, my loss may be your gain. That's right, I asking you to post a "guest review" of this week's episode of Acapulco H.E.A.T. to the list. If we're lucky, we may end up with "dueling reviews." What was the bikini count? How many gun battles? What was blown up? How many computer/privacy/crypto plot devices were used? And most importantly, Fabio or no Fabio?; that is the question. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Stealth remailers
by Matthew Ghio 17 Dec '03

17 Dec '03

Hal <hfinney(a)shell.portal.com> wrote: > Some time back I proposed a variation of this idea: "second tier" > remailers, which always forward their outgoing messages through > one or more "first tier" remailers, which work like the current ones > and take the political heat as a result. Second tier remailers would > be very safe to run and it would be rare that a sysop or supervisor > would get a complaint about the remailer's activity. ftp cs.cmu.edu cd /afs/andrew.cmu.edu/usr12/mg5n/public/remailer get ghio.cp-remailer.tar.gz gunzip & untar Change the following line in the readheaders.c, in the block_addr function: if (match==1) address[0]=0; to if (match!=1) address[0]=0; Your blocked.addresses file is now a pass-addresses file. Put the email addresses of other remailers in the file. You now have a stealth remailer. Now, EVERYONE should go do this RIGHT NOW! No more excuses for not running remailers... :)

1 0