December 2003 - cypherpunks-legacy

Re: Can someone verify this conjecture for me?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> From: nelson(a)crynwr.com (Russell Nelson) > > It seems like it solves two separate problems: 1) foiling traffic > > analysis, and 2) foiling a cheater remailer. The problems are > > separate, really, because if you really, really trust the remailer (as > > many people do Julf), then 2) isn't a problem. All you need to do is > > solve 1. Or, you can solve 1) by using a single remailer. A > > necessary but not sufficient step to foil traffic analysis is to strip > > headers. There are a couple of advantages of chaining multiple remailers. One is that traffic analysis is an art, rather than a science, and to really foil it, you've got to know how good it is, which is hard. Long-term patterns may show up even though the traffic mixes are pretty good in the short run, and if you can spread out the remailer use and increase the traffic load, plus constantly sending encrypted traffic between remailers, it does make the job harder. If the Bad Guys can isolate their target to a few remailer users, they can often find the real one by rubber-hose or a small number of wiretaps at the user locations instead of the remailers; that's impractical if there are thousands of potential users in multiple countries across the remailer-chain. Another is that if one good trustable remailer can foil traffic analysis, then multiple remailers increases the chance that at least one of them is good. Sure, Julf's a good guy, but what if the KGB has kidnapped his grandmother, or the CIA has planted wiretaps inside his computer - will you know if it's compromised? There's also the reliability issue - what if the Finnish Phone Company decides Julf is using too much of their resources and cuts him off, or the Mafia steals one of your police-informants' remailers, or the California Public Utilities Commission declares email to be a common carrier and insists on auditing all transactions? Multiple remailer in a strongest-link chain reduce the risks. Bill

1 0

Re: Vinge's True Email name ?
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <Pine.BSI.3.91.950109001111.9299A-100000(a)garnet.msen.com>, Lou Poppler <lwp(a)garnet.msen.com> wrote: >I knew that old compuserve account was good for something. >They list Vinge, Vernor San Diego CA 72267.2656(a)compuserve.com Sigh. Please don't use this, people. I'm sure VV has no desire to pay for oodles of mail telling him just how much people like him. Treat it like a home phone number (of course, some people abuse home phone numbers of famous folks...). - - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLxCrChNhgovrPB7dAQF7VgQAqsDQM0h7b0VDmBISGd3o0YqYg4q2HYmQ m0g7VtnX3yEU1vi9N96HPilMwe2JGs/6Frlvf9IKMmzGAIJxEQzGdMLbow54Il1/ akV9siQAH7BvKwaEWkzO8dDi6nl83ZtawVXIQNacIb5v9oEIQwK/vw4aYWitmDAv B0eJJUVT1XI= =u+fn - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxDlzSoZzwIn1bdtAQEXTwGAqVqaYnu+0yy8/d0HSZseTDuxP7BBWqGb PuzL4Xpu2HE7DDrIaALalplmGIYrHnun =zr9V -----END PGP SIGNATURE-----

2 1

Re: Vinge's True Email name ?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- NOTE: This mutation of this thread has no crypto content, but some (awfully specific) privacy relevance. Todd Masco writes: > Lou Poppler <lwp(a)garnet.msen.com> wrote: > >I knew that old compuserve account was good for something. > >They list Vinge, Vernor San Diego CA [email address omitted] > Sigh. Please don't use this, people. I'm sure VV has no desire to > pay for oodles of mail telling him just how much people like him. Treat > it like a home phone number (of course, some people abuse home phone > numbers of famous folks...). I began composing a reply precisely to this effect, but was stopped by the words "They list...". If the address appears in some standard Compu$erve email directory, then this was hardly a major transgression. Allow me to suggest a compromise. If some enterprising VV fan would volunteer to collect fan mail from c'punks, then forward it all, everyone involved might be fairly satisfied. Disclaimer: I'm not familiar with the details of CI$'s fee schedule; if one pays by sheer volume and not number of messages, then obviously this approach won't alleviate the burden. Maybe then someone could volunteer actually to ask VV whether/how he'd like to hear from fans.... - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxDr62f7YYibNzjpAQGxAwP+LloeLQS/BJcZciApmMWEvmOhSaCQJX8u uuwzprP2ZYTmbsb08lfTHnofS1TXKmoZ3BrYdiqjugaCTKFweg8BSZ2vw5i6KplV x2ArBnejYPKjtqs3C12mf8WJrgjnKdMZ9LxLgjlE1ymELG1bhH0loIyq3YX3x46G 69hvZyz/qQ8= =h05K - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxDtAyoZzwIn1bdtAQHLNAF+LEFF+UniR9jrXSZxd6Ia9L5aJIXjFFt3 J9aUAIUQKXf0o5ytM2nHYUvj7v0cWhn6 =e+gV -----END PGP SIGNATURE-----

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 9 Jan 95 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- nately remailer(a)nately.ucsd.edu ++++++++++ 1:28:30 99.99% rahul homer(a)rahul.net **#**##****# 4:31 99.99% mix mixmaster(a)nately.ucsd.edu ++-+-++-++ 48:36 99.99% penet anon(a)anon.penet.fi *+****+***** 28:32 99.99% vox remail(a)vox.xs4all.nl ----------- 14:34:13 99.99% usura usura(a)replay.com -- -+--+*** 22:31 99.44% bsu-cs nowhere(a)bsu-cs.bsu.edu +##**##***+# 23:14 99.26% ideath remailer(a)ideath.goldenbear.com * --- ----- 2:08:58 99.12% q q(a)c2.org --+--*++-- 2:33:18 98.62% soda remailer(a)csua.berkeley.edu -..-.- ... 8:10:14 98.47% alumni hal(a)alumni.caltech.edu ++ *-**+**** 7:37 97.74% portal hfinney(a)shell.portal.com ** *-#*#*#** 5:32 97.74% c2 remail(a)c2.org *--*+* *+ 1:13:45 95.50% desert remail(a)desert.xs4all.nl _.----.--- 19:54:01 94.80% extropia remail(a)extropia.wimsey.com ++__ +++++ 13:02:14 84.83% xs4all remailer(a)xs4all.nl *-- -+*** 16:29 76.54% rebma remailer(a)rebma.mn.org -*___-__- 31:31:05 70.47% flame tomaz(a)flame.sinet.org -*-*+ 29:22 37.83% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

Re: Anonymous payment scheme
by RGRIFFITH＠sfasu.edu 17 Dec '03

17 Dec '03

>At 09:45 AM 1/3/95 -0800, Hal wrote: >> ... As I wrote, banks are >>required to get SS#'s for depositers right now, and I wouldn't expect >>that to change any time soon. If anything, the trend appears to be >>towards more tightening rather than less. ... > >Isn't that only a requirement on interst-bearing, or potentially >interest-bearing, accounts? > > --Paul J. Ste. Marie > pstemari(a)well.sf.ca.us, pstemari(a)erinet.com > Yes, but the account form will have a place for it anyway and the account opening person will demand it. My experience a few years ago was that I had to go to an officer and point out that the account was not interest bearing and so the SS# was not required in order to get the account opened without it.

1 0

HUMOR:...and we thought _PRZ_ had troubles!
by ddt＠lsd.com 17 Dec '03

17 Dec '03

My apologies for this non-crypto posting, but I just _couldn't_ resist sharing. Ironically (incredulously?), paranoia does nothing to improve one's grasp of adjectives and adverbs... Anyway, please, please restrict your replies (if any) to private email amongst yourselves and don't follow my poor example and post anything more about it to the list. BTW..."Half" street?! dave ____________________________________ "Fascinating, Captain." -Mr. Spock =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Newsgroups: alt.alien.visitors Subject: Truth or Paranoia? From: doctor.doom(a)citylink.uu.holonet.net Date: Fri, 6 Jan 95 21:56:00 EST I found the following disturbing post on a BBS in the Washington DC area: Msg # 48 of 83 Date: Fri 12-03-93, 6:29 pm From: UNIT Read: 7 times [1 Reply] Forwarded From: 1900 Half Street, SW Subject: important The story I am about to relate may seem incredulous in many ways even thought it is true and I solemly attest that it is true despite the fact that it seems incredulous in many ways there is verifiable evidence and i urge you to verify the evidence on your own if you should find this incredulous which is the natural response. I am a victim of government sponsored terrorism and racism sponsored by the us government and big corporations which actually work HAND IN HAND with the us government towards these ends. This of course includes the liberal media although some cells of independence remain and not all individual journalists are accessories to the conspiracy. Suffice it to say that democracy does not in any way exist in the United States of AmeriKKKa. The government has been out to get me ever since I was born in 1966 as a result of a specific genetic coding abnormality which makes me unique among the 99.9999 th percentile of the American population and makes people like me marked for harrassment. The abnormality may have been spawned by mass CIA mind control tests conducted in 1961, which affected certain birth patterns. They actually have attempted to cause me to try to kill myself on several occasions and have attempted to drive me crazy by chemical and psychological means including retroactive radio control from the future (any scientist will tell you that radio waves which move faster than light speed are capable of moving backwards in time and thus controlling the past). The constant chemical assaults on my well being mean I cannot leave my apartment except in dire circumstances and then I must breathe through a gas mask. Not only that but people are strategically placed at all places I interact with people out of necessity (I cannot avoid such encounters entirely) to make me self aware and paranoid. These efforts are futile and I continue to defy the Amerikkkan government. On June 11 1986 they deliberately influenced me by radio to be present at the intersection of Sherman Avenue and Harvard Street NW at precisely 1:42 am and I had to cross seven blocks of territory that had been sealed by the police. This is documented. I witnessed seven police forces engaged in a shootout that lasted three hours. THe police forces were shooting at EACH OTHER and I counted at least thirty verifiable casualties. Although this has never made the newspapers due to the government/corporate conspiracy the information is readily obtainable but must be sought through FOIA requests at the FBI. The files are disguised as traffic fatalities and the true cause of death is not noted. Also documentable is my genetic trait which Johns Hopkins in Baltimore will provide upon demand. I am considered a threat to the CIA because of my superior evolutionary status and my radical thoughts. In 1971 the United States abandoned the Bretton Woods system of fixed exchange rates and secretly implemented a dual currency system along with ruling elites from other major countries including the USSR and Red China. I know this because agents have tried to buy me off with this currency which exists solely in the form of informational transactions and has no physical manifestations yet makes a mockery of the valueless Dollar. I am a man of integrity and I refused to participate in this plot. Needless to say the federal deficit is measured in dollars and is therefore nonexistent and irrelevant. The secret currency system is solvent. In 1987 the Wall Street Journal documented the cataclysmic stock market crash but made no mention of the real underlying factors behind it, which again represented a government conspiracy. After I wrote to the Wall Street Journal to point this out, attempts to kill me trebled. There are also listening devices implanted everywhere to monitor my actions and junk mail sorted with DMSO and curare arrives daily. I remove the mail with tweezers and leave it on the counter for the mailman as unreturnable. He wears gloves of course. The only reason I am still alive is because I persist in making my case public at every opportunity, which means the government does not directly try to kill me but relies on third-party means which I have so far avoided. A rental car I obtained in Sausalito in 1989 was irradiated with depleted uranium which increased the total mass of the car by 33% d would have caused me to go over a cliff were it not for the normal precaution I take of always driving 15 mph under the speed limit. But it is this kind of insidiousness which I am consdtantly faced with. I also can only cross the street in crosswalks so that any attempt to kill me with a vehicle could not be blamed on pedestrian error. The only reason I am still alive is because I persist in making my case public at every opportunity, which means the government will not try to kill me directly, since that would verify my claims instantly in the public's eyes. For that reason I urge all of you to write to the media, contact your senators, and do everything you can to let the conspirators know that my story has been heard, and that the eyes of the public are upon the conspiracy. It is only through concerted collective action that I can remain alive and the AmeriKKKan government which has been ruling illegitimately since a secret coup in 1947 (documented at the Library of Congress) can be brought down and freedom restored. -end?-

1 0

Re: Remailer Abuse
by Rich Salz 17 Dec '03

17 Dec '03

What lists did you post to?

1 0

More signal than YOU can handle.
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- For the moment, all of the archives that Eric just dropped me are on ftp://ftp.hks.net/cypherpunks/All I'll be making some primitive engines to access individual articles by various means but I thought I'd put 'em up in case anybody else with more disk space than brains would like to snarf 'em (following the Shulgin model). (By the way, Glimpse looks like it'll be ideal, since everything is already in its own file, the "since June" archive currently being our /usr/spool/news/... dir.) Look for more info in this space (that sucking sound is my copious free time). - - -- Todd. - -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBLxD1GBNhgovrPB7dAQEOQAQAuTRIVTQOzIbjqrUAFsPu3xHTJAH+3YnX ickYtw627leo3vs7wD2rxGfHNx6As7JbzSI1JwD26zsb2CMqMGgvQHNQ5eD7rW/N 3ICSWACwESWlnL/rAFvVh69mZDM/IUv5C+eSTVHKdlh3KWYbetRvCgkRNQvGVl58 S06pthGBpJ8= =f4fe - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxD1nyoZzwIn1bdtAQEv7wGAhSVywzGivjeo9fZwVrYDRaJx596TPVeJ pjutyvubg3yyKmqFD+Ele62LhiPvhxtX =pooh -----END PGP SIGNATURE-----

2 1

Data Haven problems
by dfloyd＠io.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- While programming my data haven code, I am wondering how to guard against spamming the data haven parser. It is trivial to mount a denial of service attack by repeatedly mailing large files. which will fill up the quota or filesystem of the data haven host, and if you have mail on a root partition, will cause hangs or crashes. Any ideas on how to guard against mailbombs, and to confirm to the sender that their files are stored successfully? Perhaps do a mailing with a test command that validates the existance of the file, and sends a reply back wether the file is okay or not, or would this result in a possible security hole? As to the code, this will have to be my second rewrite as I am going to do it in perl code, rather than C... last rewrite was from a daemon to a program activated by a .forward file. Lastly, instead of postage (like a remailer would get), how hard would it be to implement "rent" where if the "rent" is not paid, and a grace period has elapsed the file would be trashed. All this while preserving the anonymity of the sender and the data haven site. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLw7KpFLUeLjqSiixAQHs4wf+Mf4CVx77nXjUXug/3q1hINhCyWgWmal7 vY1WeCDXM+qrrdxUgqzIhYRYpCPKChMjeozFltn9T0CcH/YdaD5hx3dB5A0YUPWZ SpF5oCL3iZzf2veA8BBJEIrFdmts/nFUzWaqMx4+2IcufYb+0kVw/AKi2M5B0ZiT UoOFFIsySR9hIMMIfHlkGqrnoO8LhlViRBx4u1O0bb0GYAyc+Nv6HvDJOSWuVe9C g5B4GMLuW1t9e5Qw3W0Qy1VRIC4QbOrd0zbjDrQ38GUemOjALuZ2h4+tr3bR93KU ZthueqsIzGKlr90PU6AVVZd128mDHLofJO4I4IoOgSPV7XIK4tufyA== =KZk0 -----END PGP SIGNATURE-----

4 3

RC5 data, anyone?
by Andy Brown 17 Dec '03

17 Dec '03

Has anyone got any plaintext/cyphertext/key data sets that I can use to test my RC5 implementation against? +-------------------------------------------------------------------------+ | Andrew Brown Internet <asb(a)nexor.co.uk> Telephone +44 115 952 0585 | | PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A C0 1F 9F 66 64 02 4C 88 | +-------------------------------------------------------------------------+

1 0