December 2003 - cypherpunks-legacy

Re: Multiple symetric cyphers
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <199501120502.VAA29808(a)largo.remailer.net>, Eric Hughes <eric(a)remailer.net> wrote: > From: cactus(a)seabsd.hks.net (L. Todd Masco) > > I'm wondering: would the strength be increased by using a randomly selected > symetric cypher? > >Strength is not right aspect. Global risk is reduced, simply because >the aggregate cost of a breach is reduced. Isn't it? If an attacker does not know what cipher is used and breaking each is computationally expensive (though not prohibitively so) doesn't that add extra complexity? IE, if cipher A, B, and C are attackable in large but not prohibitive time, wouldn't an attacker have to spend more cycles to break something that was randomly one of those? I agree that it's not a significantly large jump, but if an attacker has to go through all the possibilities for A, B, before breaking something in C, it seems that there's a small increase in strength (Not being argumentative, really... I understand that this increase in strength isn't enough to warrant any significant effort. Just want to clarify the answer in my mind). >But selecting a single cipher is just as much a fixed policy as a >randomly selected one is. Far better to let the user pick a policy, >both about sent and accepted ciphers. Sure. Ideally, a user could say "use A" or "use randomly A, C, or D" or even "use A_x(C_x) or B_x(D_y)". I'm not certain the "accept" is a great idea, but what the hell... any theoretical general system should have support for such a decision to be made, right? As failure modes multiply... > I guess this reduces to: do strong cyphers have "signatures" of some sort, > by which the type of encryption can be derived? > >If they do, they're likely not _strong_ ciphers. Great... that's the answer I was looking for, and what my gut feeling was. I'm trying to determine how much rope is too much for a first pass. Related: is there, in general or in any known specific cases, any loss of security in using sym. cipher A on ciphertext B (of another sym. cipher) with the same key? With different keys (I would think not, but I vaguely remember mention of something here long ago)? - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxSMSBNhgovrPB7dAQECKQP/fqXwOcRmH6Z5dm8fsDnFzkCNyy5bc7Os +/hWmyjlk6/qx2Ym0gvlIZaxMSVR68E1qQUaoiAaWY7SatskU8o6dZRI+SmON4NV qSZnBh/+TnQwcTK0c0N+4m3Y8GhIk0ERX9modZfadv15Q07yfP7MXEj4yRQOse6e WHmUg0WOhW4= =GedZ - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxTHISoZzwIn1bdtAQEUbAGAuX+ALOTHZkUd8vqsWzVZWKSKwnJ+03yW alp18VGBGaM4PLQWU0OAFmbBP8wUxBEz =U5tO -----END PGP SIGNATURE-----

3 2

Remailing pricing and cover traffic
by Pierre Uszynski 17 Dec '03

17 Dec '03

We have been debating payment systems for remailers under the following assumptions: a) Reliable remailers will have to justify professional management by making money for their owners. b) End-of-chain remailers will need to make money to cover for their legal expenses. c) Payment would limit abuse. I already countered the last point. Let me try to deal with the first two to conclude that many professionally run remailers may very well stay free or close to that for a long time: Remailers are only one of many kinds of businesses that have been described on this list. Others will include reputation markets, near-traditional banking systems, stamp issuers, certification agencies, data havens etc... But we have also seen that nearly all other forms of businesses already now cannot but run afoul of a tentacular law at some time or other. We have concluded that many of these businesses would migrate to cypherspace, hiding their locations, owners, books, assets and other information too dangerous to keep in the open. Each such organisation will generate lots of traffic, in part under control of whoever is trying to do business with it. So they are potentially easily traceable and subject to legal or violent consequences. A possible solution is of course for their sites to be remailers too. Lots of non-descript remailers, trading lots of encrypted traffic, a lot of it remailer management info and bogus filler traffic. When you are one of many, and people correspond with you only through limited traffic anonymous response blocks, then the remailers help you stay hidden by providing cover traffic. But for this to work you must consistently attract a lot of cover traffic through your remailer(s). If others undercut your stamp price, or best your reliability status, you are in trouble because traffic will migrate to other more competitive remailers, and you will be left dry on the sand with the task to generate believable cover traffic yourself. You are also competing with the cypherspace customers hiding their own personal traffic under cover of "everyone-a-remailer" remailers. It may well be much simpler for cypherbusinesses to stay competitive on the "middle" remailer market, even at a loss, and to transmit volumes of believable (because real) cover traffic. End-of-chain (or more precisely "clear-text") remailers can be expected to be a minority as, after all, they are only needed to post to public forums. Maybe these will charge a fee. For the others, the most and biggest "porn GIFs" go through (even for free), the better... However, large free remailers may then arise suspicion: There is little reason to run a heavy traffic remailer for free, apart from getting cover traffic. Competition may then settle at a small price, far from enough to keep the remailer running, but enough to not be too conspicuous. Or better, non-profit remailers may become ubiquitous, being used in part to provide cover traffic and in part to transfer money from the cypherspace businesses to cover for the cost of the computers and obvious living expenses. Between cypherbusinesses, everyone-a-remailer operations, and a few real non-profits, most remailing may stay close to free for a long time. Untraceable money will be useful for all kinds of things, but maybe not so much for remailing. Pierre. pierre(a)shell.portal.com

2 1

Re: Getting on the list
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 11:55 AM 1/11/95 -0800, John Draper wrote: > ... I tried the usual request to cypherpunks-request(a)toad.com, but haven't >been sucessful. > >Who is maintaining the list these days? Does it still exist? And >why haven't any of my requests been hohored? Cypherpunks uses the majordomo software. Try sending a message to majordomo(a)toad.com containing the following two lines: help subscribe cypherpunks --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Re: Pornography, What is it?
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 11:33 PM 1/10/95, Timothy C. May wrote: > ... I'm not a lawyer, and it's been 25 years since I was in a "civics" >class, so I'm sorry to not recall the precise language by which >"Congress shall make no law" also is taken to apply to Sacramento, >Albany, Austin, and so forth. The 14th Amendment extended the restrictions that the Bill of Rights place on the Federal Gov't to the state gov'ts. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1

How do I know if its encrypted?
by marko＠millcomm.com 17 Dec '03

17 Dec '03

I keep seeing the idea that to keep out of trouble remailers and Data Havens should require that data be encrypted before it is accecpted. My question is how do I know it is encrypted? If I say that anyone sending me data to be massaged by my system must first encrypt it, how do I know they are in fact complying with that request? After all this is the area for the paranoid's to hang out in. I see some possible options. Most don't seem to workable. I could ... (1) Look at the incomming data, which of course would be impractical and defeat the whole idea. (2) Force them to pgp it, but that could be defeated by having enough of a pgp sig. that my system is fooled. Not to mention they must use *MY* idea of what good encryption is. After all I could say you must use my encryption software that has a backdoor I know of, i.e. clipper, or that costs money and can only be bought from me. This last point would be one way of making sure you made some money, but does seem impractial. (3) Peform a histogram analysis on it, if it doesn't pass a certain threshold reject the whole thing. Although cute, I don't like this one. (4) Encrypt it with my own key and decrypt it before squirting it back out. This doesn't seem to gain me anything though since it could be said that I still have the ability to look at the data. (5) Only acecpt data from a remailer or other service that would be guranteed to be encrypted. This seems like it would lead to a 'good ole boy' network that could exclude service providers it doesn't like. etc. etc. Whos to say that the data isn't encrypted? I could be hidding a real message in that eagale spread of a porn picture. 'Simple, don't allow porn but only accecpted images.' Well that certainly sounds like a can of worms waiting to squirm around your toes. Is the question of what is encrypted data similar to what material is porn or some other 'evil' data? Am I missing something in this simple requirment of only dealing with encrypted data? Or am I simply blowing something way out of proportion? -Mark ---------- Mark Oeltjenbruns marko(a)Millcomm.com N0CCQ SnipIt Research Finger for PGP key. 'My other key is 2048 bits.'

5 4

Finally got on
by John Draper 17 Dec '03

17 Dec '03

I finally got on... I actually didn't get that swamped, but certainly I couldn't be expected to know that cypherpunks-request was defunkt. Oh well. Now that I'm on, I was wondering if anyone would let me know the status of Phil Zimmerman's case, and where I can xtract any info. I've heard reports that the Govt. was planning to press charges. Just getting back on here again, I'm not in the know of these things, but can now handle large amounts of mail. I'm also interested in knowing how I can help in Phil's defence case. Where do people mail checks to Phil's defence fund? Anyway, glad to be back up here again.... And a big fat HAPPY NEW YEAR to all of you Cypherpunk folks!! And Oh Yea!! Hi Brad, glad to make your acquaintence... Yup! The WELL was sure hosed today.... I'm just now getting mail thats backed up now for the 4 days I've been without power. There is ONE disadvantage of living out in the country.... Power can be a tad flakey. We've just got our power turned on today.... Yay!!! When I returned from MacWorld, things were really dark up here. :-) Cheers C. Crunch PS = Scuse the formatting, I STILL cannot get Microphone to not automatically word wrap.

2 1

Re: Microsoft TrueName (tm)
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Praise Bob! The Rev. Ivan Stang's been preaching that for years! Long live the Slackmaster! Registered<BETSI>BEllcore Trusted Software Integrity system programmer *********************************************************************** Carol Anne Braddock "Give me your Tired, your Poor, your old PC's..." The TS NET REVOKED PGP KEY NO.0C91594D carolb(a)spring.com carolann(a)mm.com ************************************************************************ COMING SOON TO AN INTERNET NEWSGROUP NEAR YOU...............CENSORED.COM

1 0

Re: Storm Signals
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Frankly, I'm quite puzzled by these signs. I can't think of any country that > seems due for a quick invasion by the USG, but the increase in granularity of > the GPS information suggests an operation of greater magnitude than just a > strike against terrorists, drug cartels etc. The normal clear transmission mode of GPS is intentionally "granulated." It was during ODS that the "granularity" was turned off rather than on. This was to allow them to purchase commercial GPS equipment for use in the Gulf theater. It could simply be a return to that standard mode. - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxS1iSoZzwIn1bdtAQHrdQGA4SP5Eawy54J11nCmwI2WzbYPojKeM8S+ gE1DtpEO025SZ7JsBcgoXFBdllLHclvZ =Nl9j -----END PGP SIGNATURE-----

1 0

Re: Microsoft TrueName (tm) (fwd)
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >From: Censored Girls Anonymous <carolb(a)barton.spring.com> >To: cypherpunks(a)toad.com >Subject: Re: Microsoft TrueName (tm) >Praise Bob! The Rev. Ivan Stang's been preaching that for years! >Long live the Slackmaster! I wondered why one of the few registered hosts for Microsoft were called "Bob" - now it makes sense. (But they've got a good sized chunk of netblks registered...) - -NetSurfer #include <standard.disclaimer> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.7: 512/E12FCD 1994/03/17 > " " o " |P. O. Box 15432 | finger for full PGP key > " " / \ " |Honolulu, HI 96830 |====================================> \" "/ G \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxVXWioZzwIn1bdtAQFrygF+LKX95qYx46I4dr7TL5WBZd3brfu8VqcE BDR+o9c/Vqu1XTGTNiS2Ij4JCEm/R4Dw =CMgM -----END PGP SIGNATURE-----

1 0

Re: Getting on the list
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 06:57 PM 1/11/95 EST, Paul J. Ste. Marie wrote: (something I didn't mean to send out to cypherpunks) Sorry. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0