December 2003 - cypherpunks-legacy

Re: New Crypto Application
by Guillotine 17 Dec '03

17 Dec '03

The first of ten replies to my e-mail that has any decent information... >>I'm creating a new _text_ cryptography program. > >What do you mean by "text cryptography"? You'll only accept text as input, >or you'll produce your output in ASCII, or you'll produce your output >as English-like words? It's going to be a GUI program for Windows/95 (evil, I know, but where else is the money at?) written in Delphi. For a quick explanation... it has two memo-textareas for the input and output and one edit-area for the key. I called it a _text_ encryption program because it's a small application like NotePad.exe which you can just type into, encrypt, and copy the output into your e-mail or into a file... and it accepts ANY ascii characters as input. The output is as garbled as hell too, not alphanumeric. > None of the common encryption algorithms treats >text input any differently that raw bits, and it's worth taking whatever >input you have and compressing it to reduce the amount of data the >encryption and transmission phases need to handle. Producing printable >ASCII as an output format isn't a cryptography issue - it's just a >simple reversable transform from a bunch of raw bits to printable, >and there's no excuse for inventing a new format rather than using >MIME encoding, uuencode, or btoa, unless you're doing something extremely >creative with Unicode... True, it's all raw bits to this program. As an added plus, it supports pasting from clipboard of any binary format using a clipboard memory dump. Just go to your favorite graphics program and copy an entire picture, paste it, and encrypt it. I see no use for that whatsoever, but the point is that if you copy it to clipboard, it can paste and encrypt it. Since Win95 has the ability to copy and paste even FILES then I guess that those who want file encryption are in luck, I have implemented the file detection for clipboard usage and I have also implemented manual file selection and encryption. >Producing output as English-like words is more interesting. >It's a steganography issue, not a cryptography issue, since you should >be doing the secure part first anyway, but it can be useful for >obscuring the fact that you're using crypto in a message. >The canonical reference is to Peter Wayner's Mimic Functions, >which let you model an arbitrary context-free grammar for output, >but you should also look around for "texto". (The other canonical >reference is to "PHB", Dilbert's program that disguises the message >in Pointy Haired Boss jargon, but I'm not aware that anyone's written it.) >A good book to read on cryptois Bruce Schneier's "Applied Cryptography", >which discusses most of the current algorithms and how they're used. Me and a friend of mine have written some new bit switching procedures which use keys to encrypt the input in a dozen different number systems, but since that realllllllly slows it down I'm going to have to write a random number/phrase generator mainly used to hash the key and make it a couple of dozen characters long no matter how long it is. Brute force will be possible (it's unavoidable!) but just decrypting the text alone will not work. It will have to contain an ability to hash a guessed key just like this program and then try the guess, making it take much longer in general to brute force it. That doesn't apply to the governments computers, but since when does anything to do with slowing down brute forcing apply to them and their mainframe-using crypanalytic selves??? >>The encryption algorithm, >>using a symmetrical is going to be as strong as legally allowed, >There are no legal restrictions on cryptography strength in the US; >only restrictions on what's exportable, and even then you need permission. I was just implying of the possibility that the US might soon resolve some _MORE_ restrictions on cryptography, since they've already proven their capability of imposing as much on the US. Thanks for the information Bill! For who ever said that I was going to release the source to this program's copy protection... I'M NOT! I don't have to prove to you how good or bad its copy protection is!!! Someone will reverse-engineer it anyways, and it might as well take them a day or ten. Besides, this program isn't even going to cost ten bucks.... but I'll stop now before this e-mail spams any further. Guillotine

1 0

Cypherpunks Santa Cruz meeting/party, Saturday, 26 August
by tcmay＠got.net 17 Dec '03

17 Dec '03

This is the last announcement I'll make here on the general Cypherpunks list for this meeting/party at my house. I keep a mailing list for interested folks, with about 35-40 names on it (not all of them local to Santa Cruz and Monterey, needless to say). To be added, send me mail...no special format, as I keep the list manually in Eudora Pro. Here are just a few details. WHAT: Cypherpunks Santa Cruz meeting/party. A chance for locals to meet, and for others who want to vary their routine to visit this area. WHEN: Saturday, August 26th, 1995, beginning at around 6 p.m., but early arrivers can arrive as early as 5 (some are travelling from afar, so...). Several people plan to stay over until Sunday. WHERE: Tim May's house in Corralitos, between Aptos and Watsonville. 427 Allan Lane, 408-728-0152. Detailed directions available from the full announcement. WHO: Anybody who wants to attend. It will be both a meeting and a party, so children and SOs may find it boring--you have been warned. Some local people interested in crypto or related issues are on this list, even if they're not subscribers to the Cypherpunks main list. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

NEXT CHALLENGE: plan of action?
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

[First please moderate my previous couple of postings with the knowledge that they may (if they even got out) have been hanging in suspended animation for ~40 hours due to stuffed mail server, and some things have changed since then.] I've been out of things for a couple of days due to aforementioned dead mailer. All's well now (well it's croaking along passably anyway). Just posted a config file for Hals 2nd challenge, which Alex Tang <altitude(a)cic.net> has kindly checked. I read on Saturday Ian Goldbergs post about starting out on the challenge using Damiens code. It doesn't matter a great deal which code is used as such, but the main thing is to ensure that this is a coordinated effort. The aim of the challenge (which I requested and Hal kindly provided just before popping off for a week or so's holiday) was to see how fast a SSL challenge could be broken. Not how *soon*, note the distinction. That means that if for instance we count the time that Ian has been clocking up since Saturday, the real time will be slowed by approx 2 days. We really need to do this with a starting-line like affair, so that someone is running a server, and everyone gets the code compiled etc, and then the server starts offering the challenge and all the clients fire off. That way we have a less straggly start up which makes for better bruteing figures. Agreed so far? If so here's my ideas... Use Andrew Roos client & Piete's socket server / WWW client for the reason that this combination has been designed to operate both an automated sockets master / slave system and offer manual key allocation over WWW for those without direct connectivity, or behind firewalls. All of the software for this system is indexed from the URL: http://www.brute.cl.cam.ac.uk/brute/ or ftp://ftp.brute.cl.cam.ac.uk/pub/brute/ The socket server running SKSP protocol (more ont he protocol later) is at this address: sksp.brute.cl.cam.ac.uk 19957 (ie port no 19957) The clients are setup to use this address by default in any case. The WWW based key doler is indexed from the WWW page above: http://www.brute.cl.cam.ac.uk/brute/ and this (transparently) interacts with the socket server also, so WWW users can via a WWW forms interface take out keyspace to sweep, and return the keyspace after sweeping. The SKSP (Simple Key Searching Protocol) is described in an RFC like document available here: http://www.brute.cl.cam.ac.uk/ftp/pub/brute/protocol.txt for anyone wishing to write clients for other platforms, or with more advanced features, or for those simply wishing to know what language the client is talking. Where to find things... The brutessl software, the unix socket client, and the Windows NT client are on: http://www.brute.cl.cam.ac.uk/brute/ Also I have put an untarred version of the brutessl code here: http://dcs.ex.ac.uk/~aba/brutessl/ (individual files untarred). If and when people compile binaries for architectures which don't typically come with compilers by default - such as DOS, OS/2, Macs, I'll put any binaries sent to me in this directory, and / or send to Piete for a pointer to this repository, or copying to brute.cl. UNIX client. How to use the unix client... download brclient from the www page: http://www.brute.cl.cam.ac.uk/brute/ it is a perl program so you may have to edit the path to perl (the 1st line of the program should be #!/full/path/to/perl/binary), and you will have to mark it as executable. You will also need a shell script called brloop which uses brclient. It is on Piete's "sources" page, this page is indexed from the main brute page above, here it is explicitly. http://www.brute.cl.cam.ac.uk/ftp/pub/brute/README.html So get brloop. Get and compile the brutessl.tar.gz file. Run brloop. The brclient perl socket client talks to a machine with a DNS: sksp.brute.cl.cam.ac.uk on port number 19957 At the moment the server is running and will ask your client to sleep, as the challenge has not been started yet. When Piete starts it up, your client will periodically ask for work, before the start time (Tue 12:00 GMT, or later time if this time is changed) your client will just be told to sleep for a while, when it wakes up it will ask for work again. In this way the client can be left ticking over, when work does arrive it will notice, as it will actually recieve some work when it makes the request, and start doing it, and reporting back when it finishes each chunk. There is a windows NT socket client written by Andrew Brown, pointers to that also. Adam

2 1

Guns, Roses & Tobacco
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Meantime, taking their cue from the Tobacco Nazis, the city of Philadelphia is trying to figure out how to sue gun manufacturers for their crime rate -- 414 homicides last year, according to conservative gabmeister Rush Limbaugh. "Expect the arguments to focus on how unsafe guns are, the lack of warning labels, the lack of formal training programs, etc." ... rather than simply improve public safety by legalizing concealed "Vermont carry." The notion that gun manufacturers can be sued for manufacturing a faulty product is somewhat bizarre, of course, if the product (rather than blowing up in the user's hand, say) did precisely what it was intended to do. If America's socialist mayors and city councils are going to play this brand of roulette, at least the odds should be evened. Why don't the firearms manufacturers go ahead and offer to pay the municipalities, say, $500,000 for every innocent citizen killed by one of their products (except by the government's own police, of course) ... if the municipalities, in turn, will pay them $500,000 every time one of their weapons is used (by either police or commoner) to kill, wound, or drive away an intended rapist, robber, burglar or murderer ... or tax collector or other government agent acting in excess of his or her constitutionally delegated powers -- the main purpose for which the founders wanted to guarantee we had such instruments of liberty, in the first place. Vin Suprynowicz is the assistant editorial page editor of the Las Vegas Review-Journal. Readers may contact him via e-mail at vin(a)lvrj.com. *** Vin Suprynowicz, vin(a)lvrj.com Voir Dire: A French term which means "jury stacking."

2 1

Not a Logic-Newbie / Re: Queries from a Cyper-newbie?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Chris Avery wrote: > 3. I'll do the www.crypto.com thing, thanks for the pointer. This may be a critical last stand on the privacy of communications issue. What gets me is the blind arrogance with which govt "servants" assume that their (even if legitimate) pursuit of crime somehow excuses or justifies diminishing privacy rights for everyone else. There must be some kind of ratio: 1,000,000 rights diminished for 1 criminal activity detected? Doesn't make sense. Don't worry about being a "Cypher-newbie" (even if you did spell it wrong in the subject header). You can always learn the "numbers" and the "terms," but at least you don't seem to fall into the category of being a "Logic-newbie" or a "Common-sense-newbie," which is far from uncommon in new (and some of the older) list members. As a matter of fact, I don't believe I've seen a post by any of the cypherpunks list members which so simply points out that one of the major reasons for the erosion of our civil rights is usurpment of them by civil servants. In effect, the "servants" have armed themself and taken over control of the manor from its owners--their "masters." "Legitimate needs" seem to have usurped "legitimate rights." All of a sudden, we are required, at gunpoint, to eat our meals only at times which conveniently fit into the "servant's" schedule. Next, we find out that the servants "don't do windows." Then we find out that the servants need to sleep in the "big bedroom" because they work so much harder than us, and that we have to sleep in the barn because they need the servant's quarters for other "legitimate needs." The "tail" of government is wagging the "Bull Mastiff" of our Constitutional rights and freedoms. Please continue to follow the cypherpunks list, as there is a decided shortage of individuals left in society who are capable and willing to understand the importance of true privacy, rights and freedom. There is no disgrace in having been round-up and penned with the rest of the sheeple, but it is a sad day, indeed, when we fail to keep an eye open for a "gate" inadvertantly left open, so that we can graze on the open range when circumstances permit. {And if the gatekeeper happens to bend over in a position that places his/her head close to your hooves...} TruthMonger

2 1

Whither Barbados?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I've cc'd (former cypherpunk) Vince Cate on Anguilla on this for obvious reasons. I got a bit of blurbuge in the USnail from the Barbados Investment and Development Corporation (BIDC) on their 3rd Barbados Information Services Converence, (Subtitled "Surfing the Global Net from Caribbean Shores" ;-), February 26/27 1996. The headers in the blurb were: Investment Management in Emerging Markets -- Information Technology Challenges, Network Security on the Global Net, New Opportunities in Wireless Communications, Barbados -- the Carribbean hub for Internet Access. They promise a "Full Conference Programme available October 1, 1995", and they seem to have a mailbot at info_bisc(a)caribnet.net. Having inadvertantly <ahem> plugged their stuff with no idea whether it's a waste of time or not, I have a few thoughts about this and about data/banking havens in general. First, here's what I know about internet access in the Caribbean, gleaned from discussions with Vince, and by lurking on various caribbean newsgroups (see soc.culture.caribbean), web pages, and mail groups: First off, bandwidth down there sucks. This is probably because there really aren't many people there, the ones that are there are pretty poor, and they can't buy much phone time. This is compounded by monopolies, Cable and Wireless being the biggest, built on cozy relationships with government officials, if not actual creatures of those government officials themselves, amortizing their <exageration mode on> 30 year old centrex switches with 50 year schedules <e.m. off>. To be fair, they have to have long distance lines to the mainland, and those cost, whether they're copper, fiber, or satellite. All the shenanigans of third world politics apply there. Trinidad and Tabago had an attempted coup recently, Barbados, I believe, is in the throes of a constitutional crisis where the speaker of their legislature can't be impeached because she won't conviene the committee to impeach her... Not to mention hurricanes, and in Montserrat, a volcano going off at the moment... The obvious reason I'm interested in this is regulatory arbitrage, of course. If there's a government that will let internet commerce and privacy flourish there, then it flourishes everywhere on the net, national borders or no. I hear tell that Barbados is serious about converting its information technology business from data entry and forms processing to web-cluefullness. Given that their business development people don't have their own domain name, they probably have a bit to go. So, I have a little exercise... If we were to tell the government of Barbados what it had to do to promote the creation of internet commerce, what would we say? Anyone here could probably crank out a prima facie set of reccommendations, but I figure to beat this to death canonically and have a little fun at the same time. So, here a few categories to get started. I'm trying to keep it relevant to this group's charter. Infrastructure Power Long distance Local wire Local wireless Regulatory Financial Privacy Laws Telecommunications Competition Civil/Human Rights Privacy Business Deregulation Government intervention in the economy Culture Religeous/Cultural tolerance (the Netherlands are tolerant, for instance) Education (talent pool) Well, that's a place to start. I'll try to plug in my 2 cents in another posting... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

NYTimes: Disappearing Cryptography
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- _________________________________________________________ Forwarded to you by Attila T. Hun <attila(a)hun.attila.org> July 29, 1997 Giving Away Secrets By PETER WAYNER NYTimes OpEd BALTIMORE -- Internet hype can turn age-old problems into new grave threats. The biggest tempest may be the concern over the use of encryption, or secret codes, to scramble information sent over the Internet and other computer networks. The use of codes may thrill people who want to protect the business plans on their office computers and the love letters they send by E-mail. But it worries the Director of the Federal Bureau of Investigation, Louis J. Freeh, and other law-enforcement officials. Mr. Freeh is right to be concerned that encryption can limit the ability of law enforcement to gather electronic evidence from wiretaps and court-ordered searches. But he was wrong when he recently told the Senate Judiciary Committee that "technology and telecommunications well beyond the contemplation of the Framers" will bring "a terrible upset of the balance so wisely set forth in the Fourth Amendment." In other words, he envisions the balance tipping against the police, because they will have more difficulty conducting reasonable searches if more of the information they are seeking is encrypted. Yet cryptography wasn't beyond the contemplation of the Framers, because many of them were skilled code makers and code breakers themselves. David Kahn's book "The Codebreakers" tells how codes have affected history for more than 3,000 years. According to Mr. Kahn, George Washington had to deal with the problem when a coded message was intercepted in August 1775 from Benjamin Church, a member of the Massachusetts Congress who was a spy for the British. The message, which was finally deciphered, told the English details of American troop movements. As Mr. Kahn reveals, both sides in the Revolutionary War made extensive use of encryption. Benedict Arnold designed the complex code that he used to sell out his country. James Lovell of the Continental Congress helped win the war by breaking the codes used by General Cornwallis. After the war, Thomas Jefferson and James Madison communicated in their own private code. And Benjamin Franklin devised his own cipher for sending dispatches from Europe. Yet in writing the Bill of Rights, the Founders did not forbid cryptography, even though they knew how powerful a tool it could be. Nor did they suggest that the police be able to obtain the plain text of a coded message. But that could happen under a measure sponsored by Senator Bob Kerrey of Nebraska, a Democrat, and Senator John McCain of Arizona, a Republican. Under their bill, the key to any code used to scramble information sent on the Internet would have to be given to the proper authorities. The Clinton Administration supports similar measures. James Bamford, in "The Puzzle Palace," describes how the F.B.I. broke the case of the gangsters who were communicating without phone calls or letters. Agents discovered that the gangsters sent their shirts to Las Vegas to be dry cleaned -- and that the number of shirts held the coded message. No ban on cryptography on the Internet will be able to thwart creative crooks like these, but diligent police work can find cracks in the armor. This is why the National Research Council has recommended that Congress invest in research to help the F.B.I. better understand computers and codes. The F.B.I. faces a daunting task. Encryption makes it impossible for agents to gather all the evidence they would like. But the answer is not to regulate, and in effect destroy, the use of coded messages. Criminals would probably find a way around the rules, and the rest of us could lose a powerful tool for protecting our privacy. Peter Wayner is the author of "Disappearing Cryptography." _____________________ End forwarded message ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM92xDL04kQrCC2kFAQE+qQP/WIO0Mj/GX5ANiyq2ekCbOiN1lfYKl/MN H6/X0TdHIEpcmZipTzxuC4UOQ4rR7XUOXRneDSiLBS+OEFCRGlm85/o8/dTWgRsG lMVF0SDR44GwONBik2sH1rV4b3m+GUzvTGvPIBkybjU2wSfZUrwSQALeRuvxkABq 8C5sJ6waEV4= =SLL5 -----END PGP SIGNATURE-----

1 0

Re: NSA leak (fwd)
by Secret Squirrel 17 Dec '03

17 Dec '03

Subject: Re: NSA leak (fwd) From: h_tuttle(a)rigel.cyberpass.net > Terawatts for a few microseconds is fairly standard technology, I > believe. Femtosecond laser pulses driven by *very* large capacitor > banks... I'm talking continuous generation - sustained for half an hour... > > Terrestrial fusion is not a serious contender yet, and I doubt > > it will be for a long time. > > It's easy to generate lots of power through fusion. The problem is > confinement. I'm still talking continuous generation - we'll leave out the H-bombs. And of course I agree confinement is a major problem. Last I heard from the cutting edge (early '90s) you could get 2MW out of a fusion reactor, but that was less than you put in to start it up. That was using Deuterium, being gentle in order to preserve the reactor. Predictions were that using D-T would break even. Even that isn't anywhere near a commercial scale generator. You know of better results ? There certainly are a number of approaches, but I think I'd know if commercial fusion reactors were working. Are you ready to take this off-list ?

1 0

Re: CPAC, XtatiX, and the Censor-State
by Mike Duvos 17 Dec '03

17 Dec '03

In alt.cypherpunks, Censorship Suck <FBI(a)Sucks.NSA> writes: > That's pretty bad, when there's not even any sex. Yes. Most of these Web pages are not even political or sexual in nature, but cute boys anywhere on the Net these days cause the Fundies to have Grand Mal seizures. > My previous suggestion was to create "virtual" WWW sites > (when necessary, possibly as a stop-gap measure when there > is a censorship attack). I read your earlier post, and find the notion of hosting Web sites on Usenet intriguing. Tim has always pointed out that Usenet already exists as a persistent uncensorable repository of virtually everything, and that applications (eg BlackNet) needing such a facility should simply use the existing one. > By virtual, I mean by posting to USENET, probably encrypted, > with the decryption key following a couple days later. > It involves considerable development for either a newsreader > or preprocessor, but then, the work is implied. A > "gathering" design is necessary. Conceptually, seamlessly extending the Web over Usenet is not complicated. Each document could be posted as a single PGP conventionally encrypted article, with some reasonable convention for encryption keys and message ids that would enable links to be followed. Browsers could be modified to maintain a open connection to an NNTP server, and to fetch and decrypt articles specified by an nntp:<message-id> link in lieu of using http. Suppose I post my favorite banned Web pages to alt.anonymous.messages on a weekly basis, and distribute browser plug-ins and patches to enable Usenet to host Web content. I forsee the following glitches. First, as anyone who has posted a large number of articles to Usenet knows, many servers will only get a subset of them. Second, policy for article expiration is site-specific, and can be made to depend on a number of parameters. Posting once a week may be fine for some servers, and not for others. Third, it is only practical to employ Usenet to host static Web content. This rules out Web-based chat boards, and other such politically interesting content, as well as anything that is cgi-bin based. Fourth, Web content on Usenet will be in an easily identified format and trivial to filter out at local sites. > Because you are exactly right: the ISPs can be attacked, > regardless of the fault-tolerant design of the Internet. > Some version of the above tool WILL route around "damage" > attempts. > Interesting, that this would in part require cryptography. > Would the government go so far as to try and outlaw crypto > posts to USENET? Good luck. Odder things have happened. > Someone should make a complete list of all the > contacts/emails involved in contacting ISPs to get them to > censor. There may be something to learn. (sort of a traffic > analysis deal) It's the "usual suspects." We know who they are, and they are making no attempt to keep their activities secret. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

2 3

Re: Liability for Key Cracking in Idle Hours?
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>Damien may be able to tell us if Ecole Polytechnique has raised any >questions about his highly-publicized attack on the SSL Challenge key. Well, I asked for permission before I used the machines, so I don't expect any problem. (Actually, I asked for the permission, then launched the processes, then got the permission, but it doesn't make any difference, does it ? I should have also asked permission for putting their name in my announce, though.) It seems that the Herald Tribune called them about a cracker, and they refused to comment. They must have gone in paranoid mode, because they've had lots of trouble with student crackers in the past, and there is currently not even one student on the campus. But now, the situation seems to be in control, although I had no official contact from Ecole Polytechnique. Ecole Normale Superieure did not react at all. They're all on vacation anyway. By the way, "cypherpunks" keep getting mentioned in interviews with the press. I hope that's OK with you all. -- Damien

1 0