December 2003 - cypherpunks-legacy

Public Key Confusion
by jfmesq＠ibm.net 17 Dec '03

17 Dec '03

I am a very confused over my PGP public key(s). I have signed my public key and this is shown in a verbose listing of my public keyring. The same date appears in my public keyring for my public key as in my secret keyring for my secret key. The .asc file for my public key has the same file date (per a file-manager program). SOURCE OF CONFUSION: when I extract my public key from my public keyring and insert the extracted public key into a message, the public key that is inserted is bigger than and different from the public key in the .asc file. Am I correct to assume that the .asc version is a good public key but *unsigned*, and that the larger public key extracted from my public keyring is the same public key but has the additional component of my signature built into the body of, or seemlessly incorporated into, or otherwise coupled with, my public key? People to whom I have sent the smaller .asc version of my public key have sent me messages encrypted with that key, and I have been able to decrypt them with no apparent problem. My confusion arose when someone suggested that I sign my own public key, I clearsigned it (I know, duh!), and PGP and a public key server could not find a key block in the clearsigned message because the clearsigning put "- " at the start of both PGP block delimiters. Should I just stop distributing the .asc version and only let people have the longer version extracted from my public keyring? Is that the properly signed copy? Tampering can be ruled out as a practical matter. -- Best Regards, Jim

2 1

Re: Sex & Crime TV filter
by nobody＠replay.com 17 Dec '03

17 Dec '03

> Yesterday I heard in the radio that someone in America has developed > some device which darkens the TV screen if there is sex or crime on TV. > Does anyone know whether this is true and how it works? It's called the 'Off' switch...

1 0

Re: Sex & Crime TV filter
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>Yesterday I heard in the radio that someone in America has developed >some device which darkens the TV screen if there is sex or crime on TV. It's the "V-Chip" for blocking television programs marked as "Violent" by the broadcasters, which some politicians are proposing to require that all TV makers install in new TVs and all broadcasters label all programs. The descriptions in the press have made it sound like there's one bit of control info, which would be very stupid; multiple bits would at least allow parents to block programs separately for violence/sex/nudity/nasty-words/political-correctness. That would also be offensive, and more likely to be used. Unlike VCR-plus, which is a complex hash of the time and channel for a given program (complexity included so you have to buy TV Guide magazine), any V-chip codes could be handled automatically. (Also, V-chip is designed to turn the TV off, while VCR-plus is designed to turn the recorder on. If the designers were clever, the V-chip mechanism can probably also block video-tapes with V-chip codes?) If somebody wanted to develop a free-market rating service, the most convenient mechanism would probably be to broadcast VCR-plus codes with detailed information about programs to a set-top box, so you could sell features like - block speeches by annoying politicians - record all football matches but not other sports events - record the closed captioning from infomercials and parse for telephone numbers so you can order things automatically! - turn on the Nintendo whenever Barney the Dinosaur is on. Blocking commercials would be fun, but would probably be illegal :-), or at least stations that supported it would have trouble getting advertisers. (It would almost certainly be illegal to block the "Enhanced Underwriting" on public broadcasting, since otherwise you wouldn't get to hear "The Environmental Correctness Show has been brought to you by a grant from BigOil corporation, lubricating the Alaskan shoreline for 15 years!".) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

2 1

Commercial killers
by rah＠shipwright.com 17 Dec '03

17 Dec '03

God help me, all of this reminds me of a Carl Sagan book, of all things. One of his science fiction characters was said to have made his first fortune by building a commercial zapping chip for VCRs. Butthead Astronomer, indeed... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: a hole in PGP
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:49 PM 7/31/95, Dr. Fred said: >You might be, but even if you are not, that doesn't mean there are no >back doors. Well, we all knew it would happen, didn't we. I feel like I'm about to shoot Ol' Yeller, but... PLONK! See ya on the other side, Fred. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

The Two Threads of Dr. Cohen
by cman＠communities.com 17 Dec '03

17 Dec '03

There are two threads to Dr. Cohen's arguments which bear separation. One thread, with the implications of deliberate wrongdoing on the part of Derek Atkins or others unnamed should be dismissed out of hand. His comments regarding the fundamental security properties of PGP and the burden of proof for software security are right on target. One has to draw the line somewhere with regard to what "they" are out to do. PGP may have had weaknesses from the beginning, but to suggest a deliberate change so subtle to escape PGP's original authors is to descend into the realm of paranoia. In addition, such allegations are extremely rude, and I think Dr. Cohen owes Derek an apology. At the same time, I think some apologies are in order with respect to some very good points raised by Dr. Cohen about software security. There is a whole sub-discipline of CS devoted to the construction of trusted computer systems, which if practiced can result in much greater assurances about the reliability and security of the resultant software. This is (I believe) the source of Dr. Cohen's assertion that the burden of proof is on those who claim something is secure. PGP is practically a poster child for how not to write a secure piece of software. It has had a great many authors. It is non- modular. It is large and complex. Simplicity is almost always sacrificed at the altar of even slight performance gains. It is absolutely infested with platform-dependent code. And these are only the problems that directly impact its security... it's also strongly tied to a tty-style interface and implements a poorly-designed format. With respect to "tiger teaming" PGP, I think it is a pretty hopeless proposition. It is never, ever going to be as secure as some people would like it to be. Given the past and current bug discovery rate, it is almost inconceivable that there are not exploitable bugs. This is not to say it isn't "pretty good", but it is not what someone with a formal background in real secure systems developement would ever bless as "secure". PGP needs to be thrown away and rewritten from scratch. This has, in fact, been done, but while this development effort has been incrementally better, it still doesn't qualify as a secure development approach. Also, nobody has this product yet for reasons that I won't mention as we don't need to start another tangential flamewar. In any event, I think it's important for people to realize that in the security community, the burden of proof _is_ on the software developer, not on those claiming security problems. I'm surprised Perry hasn't chimed in on this score yet, many of his posts allude to similar notions of security by design and by construction. Doug

1 0

Re: U.S. Banks are not all that bad
by Michael Froomkin 17 Dec '03

17 Dec '03

In message <v02120d01ac4219a2e38e(a)[199.2.22.120]> Douglas Barnes writes: > ... > > I must say that I've had some absolutely amazingly bad experiences > with banks in Asia, Mexico and Central America, so I'm a skeptic > when it comes to assuming that non-US banks are light years better. The U.K. banks make the U.S. look awfully good.... > Although I have no direct experience of European banking, I do know that > the European banking industry, taken as a whole, is substantially > behind the US banking industry in automation and efficiency. Most of Oh yes oh yes oh yes...and I've banked with Lloyds on and off for 12 years... > .... -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 "Rain in parts, then dry" --BBC See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html

1 0

C'punks at DefCon
by QLDM75A＠prodigy.com 17 Dec '03

17 Dec '03

> Are any of us cpunks having a gathering at Defcon? (besides the > one Well, a couple other c'punks have mailed me to determine a time and a place. It looks like everyone wants to meet in the lobby of the Tropicana sometime Friday before Hacker Jeopardy. Nobody has stated a concrete time yet so I guess we'll all just wander through the lobby every now and then. Any suggestions on a time? Eldon Jenkins

3 2

Sex & Crime TV filter
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Yesterday I heard in the radio that someone in America has developed some device which darkens the TV screen if there is sex or crime on TV. Does anyone know whether this is true and how it works? Hadmut

2 1

BOOK: "Artificial Intelligence: A Modern Approach"
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

On a lighter note, I've recently gotten a new book, "Artificial Intelligence: A Modern Approach," by Stuart Russell and Peter Norvig, 1995, Prentice-Hall, ISBN 0-13-103805-2. In 900 pages of well laid-out text, with excellent use of typography to make finding topics easy, it seems to be a great compendium of methods loosely called "AI." AI has gotten a bad rap, perhaps deservedly after the hype of the mid-80s, but the methods are useful for various purposes. This book is focussed on "agents," and lots of code fragments are available (in Common Lisp) for actual construction of agents. Topics that relate to Cypherpunks are scattered throughout the text, including stuff on planning, provably correct designs, game theory, simulations, neural nets, belief, and ontology. Lots more stuff, too. (If I were writing a formal book review, I'd say more. But this is just a pointer, so that interested folks can check it out at their local technical bookstore or university library.) Not a lot to do with getting PGP 3.0 out the door, and not a lot to do with building remailers, but stuff I find interesting. Let a thousand flowers bloom. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0