December 2003 - cypherpunks-legacy

Re: RE: Stego-Rants ?
by Rich Salz 17 Dec '03

17 Dec '03

> From: "Peter Trei" <trei(a)toad.com> > The book contains many fascinating stories of stego and attempted > stego, including mailed knitting patterns ... It was the best of times, it was the worst of times. /r$

1 0

Re: Commercenet document on cryptography
by Rich Salz 17 Dec '03

17 Dec '03

> http://www.commerce.net/information/position/position.062695.html Thanks to Steven for mentioning this -- it's a great paper. Send it to your gov't representatives. /r$

1 0

Secure Courier and Amex Card
by nobody＠valhalla.phoenix.net 17 Dec '03

17 Dec '03

Mountain View, Ca., July 18 -- With the support of Intuit and MasterCard International, Netscape Communications has announced Secure Courier, an open, cross-platform digital envelope. The new protocol allows secure transfer of credit card, debit card and micro-transactions across the Internet. Secure Courier is an open, cross-platform protocol, meaning it will operate in Macintosh, Windows, and Unix operating environments common to Internet traffic. Specifications for this new protocol are currently available from Netscape's World Wide Web site at http://home.netscape.com/newsref/std/credit.html . _________________________________________________________ New York, NY, July 18 -- American Express' Travel Related Services Company said it is establishing relationships with four technology companies for secure Internet credit card transactions using the American Express card and the Optima card. The four companies involved, CyberCash, First Virtual Holdings, Netscape Communications Corporation, and Open Market, have different ways of securing transactions over The Internet's World Wide Web.

1 0

Re: Root Causes Roots cont.
by Michael Froomkin 17 Dec '03

17 Dec '03

As my final word on this thread, let me say that if you are really interested in the 9th Amendment, by far the best legal article on the subject that I know of is Charles L. Black, Jr, On Reading and Using the Ninth Amendment. I have not visited the Cato web pages, but their journal tends to be on the shallow side. I am far from LEXIS right now so I can't give you a citation for the Black article, but it is brilliant. It would also make a libertarian's hair stand on end. For hours. -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 Rain. Sun. Rain. Sun. Rain.

2 1

Re: Stego-Rants ?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 7:57 AM 7/19/95, Douglas B. Renner wrote: >Just a few thoughts: > >1. Use the randomness in a computer generated piece of English text to >hold your real message, encrypted, and obscured. > >2. Even more entertaining would be if the foreground text could somehow >be contrived to be meaningful. I know this would be a "good trick" but >I'd conjecture that it's possible. Imagine fractal compression of a text >file, with the decompression routine adding some "randomness" which would >be your message, obscured at a very abstract level. Depending on how >much "randomness" was added, I'm wondering if the resulting text might >possibly retain some of its original legibility (?) I am assuming that >a companion fractal re-compressing routine would be required to retrieve >the cypher. > >(I am looking at an ad for a graphics program, "Images Incorporated" by >Iterated Systems which with fractal techniques can achieve 100:1 >compression -- and then -- decompress to 8 times the original bitmap size >with minimal added distortion.) But fractal compression schemes are usually _lossy_, that is, some of the original bits are irretrievably lost. (This should be clear also from the amount of compression achieved....multiple files/images compress to the "same" smaller file--by the "pigeonhold principle.") Lossy compression is often OK for visual images and audible files, a la music, but would be pretty bad for any scheme dependent on encryption. (Not totally out of the question, as error correction could be used to maybe construct the critical bits, but then there's a messy battle going on between lossy compresssion to get more bit density and adding bits for error correction...) --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

cypherpunk "Zen" victories
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I was recently marvelling at how much the "cypherpunk agenda" is being advanced even in light of what would seem to be setbacks. Particularly in the area of anonymous remailers. We now have a very major article on remailers and Julf's setup in the NYT that portrays them in an unbiased, unhysteria-stricken mode. Also in the article, it quotes the police as regretting their falling victim to Scientology manipulation and investigating the remailer "without cause". A major officer is quoted as saying, roughly, "we are going to need a crime before we investigate in the future". Look what we got out of this: 1) incredible positive publicity for Julf, Hero of the Net 2) introduction of the concept of anonymous remailers to the layman 3) police awareness. increased reluctance to go on anonymous remailer witchhunts. advice to other police to do the same. 4) only *one* address was compromised on Julf's system. a small price to pay for all this 5) Time Magazine also did an article on Julf a few months ago and this compromise in identity. *astonishing* publicity. All in all, I would say the effect was an overall "net positive". It reminds me of a zen-like saying, "sometimes you lose by winning and win by losing". It would seem on the face of it that the Helsingius Affair was a debacle from the point of view of pseudonymity. However I would consider it a extraordinary success. The major foes of pseudonymity have so far been misguided police forces in Finland, who now say they resent the solicitude of the US into their own affairs, and would not be so eager to cooperate in the future; another foe is a radical religious cult that is finding its own set of 20th century heretics, and attempting to excommunicate them. In the meantime, with each exposure, the idea of anonymity and pseudonymity is gaining powerful friends. Also, a long time ago a major foe of anonymity was Dick Depew. An article came out on him in the WSJ that made him look awfully silly. He is roundly considered one of the more legendary net crackpots today. === I'd also like to point out that the recent Rimm job affair is another "net positive" for the net. Rimm has been so utterly thoroughly discredited and blackened by his own personality and background, as reported by Brock Meeks recently, it is amazingly hilarious. Rimm has become the laughingstock of cyberspace in the way that Cantor and Siegal were We could not have asked for a better setup for embarrassing and humiliating the media into realizing the core issues involving pornography on the internet. If someone did this intentionally, it would have been considered a brilliant trap. Time and DeWitt have been savaged by very reputable people, and I'm sure they consider the article a fiasco from a credibility standpoint. Any magazine that covers pornography in cyberspace in the future will be very gunshy and will not be so flippant, if they can stand poking the hornet's nest at all. === Another area is in the bills that are being introduced in congress. It would seem these are a fiasco from the point of view of those interested in cyberspace. But there are backlashes even in congress. Was it Markey that introduced a bill that made cyberspace off limits to future draconian legislation? All this also forces legislators to figure out what the hell they are dealing with, and they are finding out what their own authority in the matter is. I think the wise ones may figure out that if they don't play nice, we may take our marbles away and go play with someone else. D.Frissell said something profound in his letter to the editor, "Congress thinks the Internet can be controlled. We who built it, and continue to build it, think it cannot be. It will be interesting to see who is right". His comparing it with the ideas in the declaration of independence, that "when a government no longer serves the people, they have a right to overthrow it", is extremely apropos in cyberspace, where it may be more possible than ever for those who desire freedom to make those who are apposed to it, completely irrelevant. T.May suggest that we just give up the fight in congress, saying that bills can be introduced faster than we can fight them. I agree with the observation but not the conclusion. Bills have a very hard time getting to be law. They are very fragile in initial stages, and at these points they can indeed be killed with a little pressure in the right spots. We are learning where those spots are. At this point I think it is not in the interests of those promoting cyberspace to try to evade congress. So far, it has not proved itself to be completely hostile to the point of trying to shut down cyberspace to the degree it does not fit its own agenda. And as long as they are not outright enemies, some could be turned into powerful promoters. The idea of abandoning educating/influencing congress entirely seems like a kind of unhealthy nihilism to me. There are allies in congress and there are people listening there. Their unawareness seems amazingly proportional to the cluelessness of the general population about cyberspace (and I see extremely encouraging signs both are rapidly diminishing). The bills seem to becoming more desperate and draconian in their language. This is a sign of fear and dread on the side that seeks to regulate bits. They are in a tricky position, because the more draconian the language, the less likely it is to be passed and taken seriously. People become suspicious and hypersensitive to the infractions. To a large degree, many parts in the government only gain their power through secrecy. As people become more aware of the power flow, they disrupt and seize it themselves. Every bill that has more desperate language is the other side revealing their secret agenda, to control thought, which I think reasonable people are increasingly considering and recognizing as bogus and bankrupt. Congress will eventually polarize into being generally promoting of cyberspace, or outrightly hostile to it. Cyberspace will inevitably escape its grip if congress goes in this direction. To use Zen analogies again, there is the idea that water is the most powerful force on the earth, because it simply flows around that which opposes it. I find that cyberspace is wholly analogous. In fact it seems to me that cyberspace would give Lao Tzu a whole new cuttingly apt metaphor for his philosophies!! === So the next time that you rant about how some bill or another means the Death of the Net, or the police investigating a remailer means the downfall of cryptoanarchy, or a lousy article with a zillion distortions comes out, think again. The greatest cypherpunk victories are emerging through what would appear at first to be the "blackest" moments. viva la cryptoanarchy!!! ~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ \ / ~/ |\| | | |> | : : : : : : Vladimir Z. Nuri : : : : <vznuri(a)netcom.com> \/ ./_.| | \_/ |\ | : : : : : : ftp://ftp.netcom.com/pub/vz/vznuri/home.html

2 1

TINSIGN: Simple script for PGP signing messages in Tin 1.22
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Howdy, me again. In keeping with my wish to make PGP signing of transmissions simple and commonplace, I've got another script for y'all. This is for the Tin Newsreader. I hope you find it useful. Comments appreciated. ============================================================ #!/bin/sh # TinSign v1.0 # Written by Robert A. Hayden <hayden(a)krypton.mankato.msus.edu> # Based in part on the PGP editor wrapper, Version 1.0 (editpgp) # Copyright (c) 1994, Mark Lewis <nostra(a)city.ac.uk>. # TINSIGN is a simple program that will allow you to automatically sign # your news messages composed with the TIN 1.2pl2 news reader. It # may also work with other news programs, but it has not been tested. # INSTRUCTIONS FOR CONFIGURING TIN # # You need to define the following options in Tin. This is done via # editing the $HOME/.tin/tinrc file. # # A) start_editor_offset=ON # B) default_editor_format=<path to this script> +%N %F # Example: /users/foo/bar/tinsign +%N %F # C) default_sigfile=/dev/null # NOTE: I have been unable to get my copy of tin to read # any file other than $HOME/.signature, no matter # what this parameter is set to. The solution I # found was to remove $HOME/.signature and create # another file that is read in by defining the # variable below. You may want to experiment with # this to find out what works best for you as this # might be a bug specific to our local compilation. # INSTRUCTIONS FOR CONFIGURING TINSIGN # # The PGP program must be in your path, and the PGPPATH environment # variable must be defined. See the PGP documentation for details. # # In addition to PGP and the editor you define, TinSign also will use the # following programs: # awk # cat # echo # egrep # mv # rm # sleep # # Double check that the first line of this program points to sh. # # Execute the command "chmod 700 <path/to/tinsign>". # # Edit the SIGPATH and TINEDITOR variables to point at your signature # (if any) and the editor you wish to use for your Tin messages. Default # signature will be the file .signature-tin in your $HOME directory. # Default editor is pico -z -t. # # Define SIGPATH=/dev/null if you do not have an ASCII signature to # append. SIGPATH=$HOME/.signature-tin TINEDITOR='pico -z -t' # INSTRUCTIONS FOR USING TINSIGN # # When you compose a message, you will compose your message as normal. # # When you exit your editor (control-X in Pico), you will receive a # prompt asking for your PGP passphrase. Type this in. # # At this point, if you have defined one, your ASCII signature will be # appended to the message AFTER the digital signature. # # You will then be put into the Tin menu asking if you wish to edit your # posting some more, quit the post (ie, abort it), or post it. ### DO NOT TAMPER BELOW THIS LINE UNLESS YOU KNOW WHAT YOU ARE DOING ### # Define internal variables filename=`echo $2 | cut -f$# -d' '` tmpdir=/tmp #Run editor $TINEDITOR +$1 $2 # Split the headers from the body of the article awk '{ print }; /^$/ { exit }' $filename > ${tmpdir}/tmp$$.hdr awk 'body == 1 { print }; /^$/ { body=1 }' $filename > ${tmpdir}/tmp$$ # Remove "--" egrep -ve '^--$' ${tmpdir}/tmp$$ > ${tmpdir}/tmp2$$ mv ${tmpdir}/tmp2$$ ${tmpdir}/tmp$$ # Sign the message pgp -sat +comment="PGP Signed with TinSign 1.0" +clearsig=on ${tmpdir}/tmp$$ if [ $? -eq 0 ]; then cat ${tmpdir}/tmp$$.hdr ${tmpdir}/tmp$$.asc > $filename else echo ""; echo "*Error in signing. Aborted." sleep 5 fi # clean up any files in temp space rm -f ${tmpdir}/tmp$$.hdr ${tmpdir}/tmp$$.asc ${tmpdir}/tmp$$ # append your ASCII signature to the message echo " " >> $filename cat $SIGPATH >> $filename -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.1 iQCVAwUBMA1AZjokqlyVGmCFAQGv4QP/XB8BU91sU0KlzWTKkyZaW4j2KYKDzGin SgbFtdd9KdcoalhLU0myzOvMcpr3QAhAbaXN4Zq56IE/OYm5WL0MUJnJ6GF7kdEc F2r0vC9Nt7iZrWoG7LsqJrKrlLDp8eFhcWrpkwhH7trWA2jAjqHzof4Gy0fr8LD0 Xc1KEPpQ+JA= =Jsj3 -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> Cthulhu Matata \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> hayden(a)krypton.mankato.msus.edu \/ Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

1 1

RE: Stego-Rants ?
by Bolivar Shagnasty 17 Dec '03

17 Dec '03

Peter Trei wrote: >> Which of the following is the cleartext? >> 1. Bit and byte dropout can significantly impede communication. >> 2. Flower and shrub planting can greatly enhance landscaping. >> 3. Word and phrase substitution can hopelessly disguise meaning. >> 4. UFO and space-alien belief can seriously damage credibility. >> (deletia) >> Bolivar > >This class of code is fairly old. Thank you. I would never have suspected. I grew up in Heinlein's barrel, fed through a hole in the side, until I was 18. >(deletia> >The suspected spy immediatly sent back 'Is father dead or deceased?', >and was arrested. > >The book contains many fascinating stories of stego and attempted >stego, including mailed knitting patterns, crossword puzzles, >drawings, sports statistics, etc. >(deletia) (shrug). The point is not whether people have used this before, or how cute the anecdotes of wartime failures or detections. The point is that everyone uses language in innumerable explainable contexts, and that we have computers with which to effortlessly transform text into other text. There is no need to knit, or invent crossword matrices, concoct drawings, or fabricate verifiable sports statistics. With word substitution, anything can mean anything. I never suggested it take the place of encryption, or that I thought it a new form of stego. The implications may be new in the context of ubiquitous high-speed computers and electronic communication, in that the evidentiary value of written language can be shown to be so malleable as to be useless. For example, how would you like to have to ascribe particular meaning to the accumulated notes and files of someone who collects "exxon" wordlists? Virtually anything you process against any of the wordlists will change into something equally as interesting (or uninteresting) as the original. The presence in a system of wordlists tends to reduce the content of natural language files in that system to examples of sentence structure. As an example of just how malleable sentence structure templates can be, the defense in such a case might convert the prosecution's charging document into a glowing commendation of the defendant, suitably introduced through an expert witness. Bolivar (who hopes to retire when he finishes school)

1 0

"Hey Phil! Stop telling people *not* to use PGP!" (plus: "help me with my PGP problems!")
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [I posted the following to alt.security.pgp and sci.crypt. -Bryce] (If you don't want to help with my problems, skip to "Zimmermann needs to change pgpdoc1.txt" at the end.) First, I am trying to communicate with a fellow who refuses to upgrade to PGP2.6 because if RSA (as opposed to RSAREF) was good enough for Phil then it's good enough for him! Assuming for the moment that convincing him to upgrade is not feasible, isn't there a hack by which I can interoperate with him? He's using 2.3a and I'm using 2.6ui, 2.6.2, 2.6.1 and 2.6. (More on that later...) I can hack the C code if that is what is necessary to interoperate. Second, I am using several public keys and several different versions of PGP because I work from various computers with various levels of security. That is: when I am in the University's computer lab I use one key <617C6DB9> and the University's 2.6.2 but when I am on my home computer I use another <148A11E5> and my linux PGP 2.6.1 (I'm going to upgrade it any day now...). I also have a couple of other keys with "Bryce Wilcox" in the User ID field for other uses. The problem/gripe is that whenever I try to manipulate public keys on my keyring, PGP grabs the first one with User ID "Bryce". How do I extract, edit, sign, etc. the *other* "Bryce" keys on my public keyring. I tried giving PGP the Key ID, which seemed like the most reasonable user interface to me, but that didn't work. Third, how do I set those "PGP-Note" strings that appear in some people's PGP Signature Blocks? And lastly, a gripe. Zimmermann's "pgpdoc1.txt" needs to be changed. Let me explain: I am in the (long, drawn-out) process of trying to convince my friends and family members to use PGP. The first hurdle is that it is a pain in the butt to use, and they are not going to use it if it means they have to learn a handful of Unix commands and spend 30 seconds screwing with it every time they want to send mail. But that isn't the subject of this gripe. The second hurdle manifests when I send them a copy of "pgpdoc1.txt". They start browsing through it and come upon "NEVER EVER use PGP on a remote, multi-user system. It wouldn't have maximum security in that situation." They say "Oh, well I guess I can't use it then because damned if I'm going to upload and download all of my mail at 1200 baud just so Bryce will quit bugging me about this PGP thing." So I say "No no no, using it on a remote system is still better than nothing. Just be aware that it is easier to crack your secret key when you use it there than if you kept it on your home computer." So they go back to reading "pgpdoc1.txt" and it says "NEVER EVER use a public key which was sent to you through the Net. It could be tampered with." So they say, "What, I have to make a long-distance phone call to Cousin Joe in Israel before I can send him a 'Happy Birthday' message using PGP? Why bother?" And I say "No no no, using a key which you got through the Net is better than using no key at all, just be aware that if someone *really* wanted to spy on you that they could have tampered with it. When you see Cousin Joe next Christmas you can compare keys with him and make sure you have the right one." In short, pgpdoc1.txt needs to quit saying "NEVER EVER use PGP in other than MAXIMAL SECURITY situations" and start saying "If you want MAXIMAL security, do it this way, and if you are satisfied with lesser security, here are other options." I am fond of saying that we PGP enthusiasts have two choices ahead of us within a couple of years: either 5,000 enthusiasts using PGP with MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with push-button interfaces and multi-user remote systems. The important thing, of course, is the easy-to-use, e-mail-integrated software (version 3.0, I hope?), but it would also help if Zimmermann's PGP Doc didn't tell those computer-illiterates to either "become enthusiasts or don't use it." Bryce signatures follow /=============------------ URL of the Day: DigiCash bv Bryce Wilcox, Programmer The currency of the future! Give me a bryce.wilcox(a)colorado.edu cyberbuck because I gave you this URL: ------------=============/ http://www.digicash.com/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMA1EKPWZSllhfG25AQHzPAP+MB/JLhN+Un9yVXRv5fejb297YONynlPF EXxN6L7OwcD4q9XE23XdlutlQbAoK2tKbBLjTYat7s/t53W+jpCyKOChN7zn4V+I bdAu8TKE4IG9a7fzxK0jqcpHBWqU2SaRxpaPEKl7HXbtFJxdKqn1n/M7INPJxF2w /JsyZom8gmk= =Tzje -----END PGP SIGNATURE-----

2 1

Government Mandated Keys
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

I want to register the 1-bit key of "1". I expect to send about half my message bits encrypted, the rest will be clear-text. Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0