December 2003 - cypherpunks-legacy

Re: e$: Geodesic Securities Markets
by f_griffith＠ccsvax.sfasu.edu 17 Dec '03

17 Dec '03

> >> Perry Metzger says, >> >Yup. The certificate is held in street name -- the name such >certificates are held in is "Ceed & Co." for obscure reasons I've >never been able to fathom. I think it's Cede & Co. The original reason, which may not still hold, was that it was rather cumbersome to transfer securities held in the name of a corporation, much easier to transfer those in a partnership's name. Thyus, the clearing corp formed a partnership to hold the securities.

1 0

PGP is Product of the Week
by Claborne, Chris at SanDiegoCA 17 Dec '03

17 Dec '03

PGP is Product of the Week in last weeks PCMag. I will bang my drum one more time... How to beat the three letter agencies: 1. Power of the press is just one of the weapons at our disposal. Public education and continued press on privacy alternatives is important. One of the things that would help a concerted offensive against the three letter agencies that want to remove our privacy would be to send more articles to the industry rags. Hopefully better than the one published in Byte. The more exposure the better. You there! Start writing! 2. Improve the ease-of-use factor for PGP... That is, write more front ends (windowing since most of the general public uses it). Example: ViaCryptPGP for Compuserve's WINCIM and navigator. I believe in the critical mass theory... "A product becomes a defacto standard not that it is always the best product but because of sheer number of users". In this case I am pushing PGP but I think it would go for crypto products in general. 3. Drive for an independent "renegade" standard like PGP. The term renegade here meaning "having rejected tradition". Flood the net with it and the genie is truly out of the bottle. Now that PGP is "legal" in the US, and people outside the U.S. have the product spec no-one gets left out in the cold. 4. Mentioned earlier... "Attack the NSA budget". This can be a win and a loose since a smaller budget could lower our countries defenses. It is possible that an attack on the budget would get them to lay off without any real action needing to be taken. ... __o .. -\<, chris.claborne(a)sandiegoca.ncr.com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server.

3 2

New at EFF - Intell. Cmte. HR3937 crypto report, Inouye NII bill
by Stanton McCandlish 17 Dec '03

17 Dec '03

Electronic Frontier Foundation ftp site: ftp.eff.org 06/23/94 - added House Intelligence Committee's enraging report on its so-called reasons for butchering the crypto export provisions of the Export Admin. legislation (HR3937/3627): /pub/EFF/Policy/ Crypto/ITAR_export/hr3937_intell_cmte.report - added Sen. Inouye's bill for "public spaces" on the NII: /pub/EFF/Policy/OP/inouye_nii_s2195.bill -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 0

Hardware RNG's
by John A. Thomas 17 Dec '03

17 Dec '03

Roger, I would like some details about your hardware RNG, if you could, including how you were reading the random value. I had the impression you were taking one bit at a time. What did you mean when you said: "I just got a 3 standard deviation at a 1000000 sample..."? What statistical testing did you do? I used the chi-square test on 8-bit values (255 degrees of freedom), and also computed the probablility for the chi-square statistic. I programmed the runs-up and runs-down tests as suggested by Knuth, and computed the chi-square for those as well. Finally, I counted the numbers of 1 and 0 bits, and the number of times 1 followed 0, 0 followed 1, etc. I didn't do the autocorrelation test. If you have any code for that, I would appreciate having it. I'm not sure what you mean by "...the derevitives of the sequence..." What is that? I suppose these gadgets could be useful for those who want the absolute security of the one-time pad, and can exchange disks securely. With disks holding 1.44 meg now, it could be practical. John A. Thomas b858jt(a)utarlvm1.uta.edu 75236.3536(a)compuserve.com PGP public key available.

1 0

Get U.S. Representatives to use PGP?
by Jonathan Rochkind 17 Dec '03

17 Dec '03

I just saw a press release somewhere or other on the net which stated that a number of U.S. Representatives now have email addresses @hr.house.gov. Among other things, the release stated: > In addition, constituents who communicate with their > Representative by electronic mail should be aware that Members will > sometimes respond to their messages by way of the U.S. Postal Service. > This method of reply will help to ensure confidentiality, a concern > that is of upmost importance to the House of Representatives. What if we could get the Reps to use PGP to solve this problem? Sure, they _should_ be using clipper chip, to respect the Administration and all. But the fact is, they couldn't realistically use clipper now, even if they wanted to. No one else uses it. On the other hand, lots of people use PGP. PGP is fully legal now, so the Reps can use it if they want to. Maybe we should write up some form letter proseletyzing PGP and send it to all online Representatives? If we could get even one or two to use it, it would be major major pro-PGP publicity. It would also be a major embaressment to Clipper-supporters (ie. the Administration), but we definitely don't want to mention this in our form letter, as I doubt few Reps want to blatantly embaress the administration like that. But the fact is, PGP really _is_ a de facto standard, which is why teh Reps would use it instead of clipper, and furthermore if we can "trick" (maybe too harsh a word) a Rep or two into using it, it will just prove the standardness of PGP. What do you think? It looks like we'd have to snailmail the form letter to them all if we did it, as their email will only accept stuff from constituents who have pre-registered their email address by snailmail so as to prove their constituency.

1 0

Re: PGP is the product of the week!
by Jeff Gostin 17 Dec '03

17 Dec '03

"Claborne, Chris at SanDiegoCA" <claborne(a)microcosm.sandiegoca.NCR.COM> writes: > PGP is Product of the Week in last weeks PCMag. Good to hear it. Does this mean that PGP has become part of the Establishment? > 4. Mentioned earlier... "Attack the NSA budget". This can be a win and a > loose since a smaller budget could lower our countries defenses. It is > possible that an attack on the budget would get them to lay off without any > real action needing to be taken. This isn't truly an issue. The NSA had it's hey-day during the Cold War. Now that that's over, and the same level of effort can be attuned to fewer enemies, one would think that they don't NEED a bigger budget. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

WARNING!
by dcosenza＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I spoke with Phil Zimmermann today at some length, and he has informed me that users who decide to use the jumo keys generated by the hack of 2.6ui will be running a risk of incompatibility on down the line with future releases he has planned. You have been warned! Ever forward, David - -- - --------------------------------------------------------------------------- David Cosenza dcosenza(a)netcom.com PGP 2.3a Public Key available by finger _or_ ftp.netcom.com:/pub/dcosenza PGP 2.3a Key fingerprint = BF 6C AA 44 C6 CA 13 3F 4A EC 0A 90 AE F3 74 6D "When encryption is outlawed, only outlaws will have encryption." -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCzAgUBLgoyQCjdpAfJZzihAQGXhwTuO79ehD2s5q4c877Uc/+gt5ygytj2cmDD eUGhKGwqhGco9p/SC3FmtFltSvaTRuMP8GKBbQfXPnSQ4l1i2k11qvQObioKjq7p gGsb5CwyK47sVzPm/0WvAYcPc0wv1FHmZQOWLjiQEgjR9q3JHMSD0bDnV0zeoV3Q 6G02xeigDGCuGHQMBm4zT2n5ffldDTS0b2vn4AJZxNYPGoAH5nI= =G/aQ -----END PGP SIGNATURE-----

1 0

Digital Sigs?
by Cypher1＠aol.com 17 Dec '03

17 Dec '03

I read in yesterday's L.A. Times about something called CommerceNet, where sellers and buyers of workstation level equipment can meet and conduct busniess. Near the end of the article, they talked about a proposed method for exchanging "digital signatures" via Moasic (so that buyers and sellers could _know_ that they were who they said they were) and that they were going to "submit it to the Internet Standards body" Is this something new, or am I way gone on this one? Cyph1(a)aol.com

2 1

RE: Unofficial release
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

++++++++++++++++++++++++++++++++++++ > Rumor has it that certain government applications do Diffie Hellman > with 2K-bit moduli. Given the apparent connections between factoring > and discrete logarithm (the complexity formulas seem to look very much > alike), it appears that at least one user feels that keys longer than > 1K bits provide a desirable safety margin. I'm still not sure that I understand the original argument against using keys that are "too long" by someone's standards. Nor am I sure the analogy holds up. It would be the security equivalent of saying that it's "paranoid" to put strong locks on your front door because your windows are made of glass, and are thus easier to break than the door. The fact is, most burglars would rather not break a window, if possible, because it's a glaring sign of forced entry visible even while they're in the process of burgling, it's noisy, and they could get cut, leaving blood samples behind and causing themselves pain. Sure, hypothetically, it might be "easier", in a given case, to monitor RF (Tempest) leakage vs. breaking a 1K+ key. OTOH, it would also require putting monitoring equipment at every Internet user's site vs. collecting and cracking keys at a centralized location. Of course, if someone wants to leave his front door unlocked for fear of being labelled "paranoid", that's his prerogative, I suppose. Just don't ridicule others who are more security conscious! +++++++++++++++++++++

2 1

Re: PGP is Product of the
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com J >A person in the group to which I refer is ``in the US'' by the J >commonly understood geographical definition of that phrase, but has as J >a matter of conscience renounced any citizenship he may have had. He J >refuses on principle to affirm that he is a national person, and J >therefore cannot use PGP 2.6 because such affirmation is supposed to be J >required in order to obtain PGP 2.6, and may therefore be implicit in J >each use of PGP 2.6. On the other hand, if he uses PGP 2.6ui, he risks J >being accused of violating RSADSI's patent rights, because they will J >take him to be "in the US", even though he has disaffiliated himself. J >What version of PGP can such a person use? Even though your friend is no longer a U.S. Citizen he is a "legal resident of the U.S." in that he could not be deported. Residence is defined at law as equal to "domicile" and is under the legal control of the individual rather than the State. "Domicile" is defined as "Actual physical presence plus intent to make the place one's home." Once domicile is gained, it persists even if you are away until one acquires a new domicile by one's own action. So he could use the MIT version of PGP. When their lawyers came up with their spastic language about users having to be U.S. Citizens or Green Card holders they weren't trying to be exhaustive. They were clearly trying to mirror the ITAR crypto regs. Since your friend, while not a citizen, is not an alien he can possess crypto technology under ITAR and thus under the MIT license. DCF "If Nicole had had a Colt Mk IV Govt. Model, she'd be alive today." --- WinQwk 2.0b#1165

1 0