December 2003 - cypherpunks-legacy

Re: another factoring thing. . . .
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 11:04 PM 12/30/94, camp(a)industrial.com wrote: >Hey did anyone see the artical, some time ago in Science News (May 14, >1994) their was this artical on using a 'quantum computer'. Through >the marvels of quantum mechanics it is theroretically possible to >build a computer that would be really good at factoring large numbers >such as the ones used in RSA. This combined with team sieving could >possibly be used to signifigantly reduce the time required to factor >a key. Any thougts, did anyone else see the artical, has there already >been a really stimulating discusion that I missed? Well let me know. .... I think that that kind of quantum computer is much less likely to be built to impact RSA style crypto, than some revolutionary sort of factoring algorithm. It is not clear whether the tolerances required for the quantum computer can ever be met and it is not entirely clear if the quantum principles are correct. I don't entirely rule it out however.

1 0

No Subject
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Factoids lifted from apple-internet-users(a)medraut.apple.com: >Jonathan P. Sullivan <jsullivan(a)arpa.mil> wrote : > Here are some other stats culled from an article in the 12/22/94 edition of > Washington Technology: > >* Approximately 300,000 attacks have been made on DoD computers >* Hackers have successfully compromised 350 DoD computer systems >* 88% of all information warfare attacks succeed >* 96% of those successful attacks are never noticed >* Only 4% of those noticed are reported Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

NYT on $GIF
by John Young 17 Dec '03

17 Dec '03

Peter Lewis writes today on Compuserve and Unisys grub for royalties on GIF. Perry has noted its sty, java-eyely. For email copy send blank message with subject: GIF_nip

1 0

_Why_ the print media doesn't like Usenet
by Tommy the Tourist 17 Dec '03

17 Dec '03

As many of you know, recent articles and editorials in the nations main newspapers (_New_York_Times and the _Chicago_Tribute_ to name just two) have presented shockingly distorted accounts of the infamous Canter & Siegel Usenet spam. Ordinary Usenetters, outraged at the socking abuse of the internet by Canter & Siegel, were transformed into "network terrorists" in these editorials. The attorneys, who have haughtily expressed their determination to repeatedly inconvenience millions of Usenet readers by flooding Usenet newsgroups with unsolicited advertisements, were portrayed as the innocent victims of anti-business "vigilantes" bent on terrorizing the attorneys after their widespread Usenet spam last year. The articles also included numerous serious technological inexactitudes which supported the distorted conclusions of the articles. The articles called for increased government regulation of the internet in order to thwart the alleged abuses. Determined efforts by Usenetters to educate the print media into presenting a more balanced (and, I might add, less dis-ingenuous point of view) have been in vein. It seems reasonable to point out the following facts: 1. It has not been unknown for powerful individuals in newspapers (such as editors and owners) to manipulate articles for political purposes. 2. Usenet has often been highly critical of the print media, especially editorials which disagreed with strongly held Usenet views and articles which contained erroneous information. This criticism may have been seen by the print media as damaging. 3. From time to time articles published in newspapers have been posted (sometimes anonymously) to various newsgroups. This has denied the print media of revenue since readers only had to turn to Usenet to read especially sensationalist articles. 4. In the past, the print media has held a monopoly on detailed news. Sure, television could bring news stories instantly, but for detail one had to turn to the newspaper. Usenet and the internet are capable of providing very detailed information rapidly and on demand, changing instantly as conditions change. It is a very real competitor. 5. Government regulation would seriously hurt Usenet. Censorship (like an FCC censor) and regulation of anonymous remailers would result in increased legal liability on the internet. Holding Usenet posters and other providers of information liable for the accuracy and tastefulness of their information would make many people think twice before making their information available. This would eliminate not only inaccurate and tasteless information, but it would also greatly hinder the flow of even accurate information. This would put the print media on a more even footing. These facts together suggest that it might be to the advantage of the print media to call for government regulation. Once this is realized, the behavior of these newspapers can be better understood, and action can be taken against them: 1. Misleading information in the print media about Usenet must be widely disseminated so as to damage the reputations of newspapers that print inaccurate accounts and encourage them to get their facts straight the next time around. 2. The print media's self-interest in government regulation of Usenet must be pointed out, both to the public and to law-makers so as to reduce the effectiveness of their pleas. 3. Usenet should seek the support the of the media (especially rivals like TV media that have less to lose from Usenet) to obtain favorable and anti-regulatory publicity. -> If you found this article interesting, please feel free to distribute widely. <- ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 8 lines: :: Response-Key: the-clipper-key ====Encrypted-Sender-Begin==== MI@```%I^&2?(E<U9BPG1]W7L'=&KH_PWY8"RO>+YR'QAJ3&+D2`UAI&EZX\# M%D0S6>LX!B&XC`CI2S9?]$AN7*P9K`)Q4JT_V`>$K2Z<X!O-/MH$TO5V:@(L %BQ>,T(@` ====Encrypted-Sender-End====

1 0

Remailer postage
by jpb＠gate.net 17 Dec '03

17 Dec '03

Russ, Where can I get the Magic Money software? I'm also interested in a combination FV/MM approach to anonymous postage. I'm still waiting to get my linux box set up (hassle with client paying the bill and all that fun stuff) but am considering starting a remailer once I get the site set up. I am concerned about the ethics of having a paymailer feed into the free remailer soup - how would their operators react if I'm effectively making money (no matter how little) off of them? In the interest of preserving anonymity, perhaps their should be a set postage rate - that way someone could use a digital stamp anywhere, helping to confuse the audit trail. I'm not sure if I want to get involved in the hassles of redemption though. It would probably become a major hassle for all the operators to have to do that much accounting on a regular basis. jpb(a)gate.net finger for pgp and ripem keys

5 6

All I did was properly crosspost!
by Carol Anne Braddock 17 Dec '03

17 Dec '03

I first saw the Dubois Letter in alt.security.pgp the 28th. PRZ posted it here the next day. I "crossposted" it to my favorite 10 newsgroups. Just 10. Some creep complained. (we'll get to him a bit later). I didn't get a chance to get back on-line for 3 1/2 days. I was lied to. I am hurt. My mail has been stolen. I haven't read any of you for four days now. My web pages are vulnerable. Is there somebody who can please help me get my 2 megs of mail? I can't get at your keys. http://www.winternet.com/~carolann/coffee.html has the cypherpunk rant links on the page. I'm proud of them, and proud to be on this list. But to take my account away for crossposting to 10 groups is not right. I'll be back with a better chronology. Love Always, Carol Anne ps Hope you like (and feel free to use) my new .sig

2 2

Re: Are 2048-bit pgp keys really secure ?
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> A somewhat disturbing trend has appeared in the low-end cost-sensitive PC > SIMM market. Some supposedly 9-bit SIMMs are actually 8-bit SIMMs plus > a parity generator. This means that the parity checking is essentially > subverted, because the parity bit is generated from the stored contents > of memory at read time, rather than the stored contents when it was > written to. As such, NO bit errors are detected. So why not do a cheap trick: After the small primes check calculate a CRC checksum over the number. Then do the primality check. If it is a prime, store it together with the CRC. The CRC can be checked for every use of the number. (PGP encrypts the secret key and therefore it generates a CRC for the encrypted packet. But this CRC is generate after the primality check.) We already had some SIMM modules with bit errors. They were detected by a parity check. If cheap pc simms don't have a real parity bit, the probability of having such a bug isn't as low as 10^-40. If cheap parity-less simms are available they get sold (cheap and expensive). Hadmut BTW: Some weeks ago they found motherbords with falsified cache rams: They had just the normal DIL-ICs and the normal pins, but the plastic of the ICs didn't contain a chip. The BIOS was modified to give out a message about a good cache ram check at boot time.

1 0

Re: public vs. private replies
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Tim May writes: > [...] has asked that we reply in e-mail to him, to avoid > "cluttering the list more than I already have...," but the logic of > this is faulty. The few lines of a response such as this one, or even > of several such responses, are as nothing compared to dozens or more > people sifting their own archives so they can each independently send > [...] what they find. Hence my public reply. I'd like to amplify this point, which is missed all too often on Usenet and mailing lists. Replies to requests for fairly widely-known factual information should be directed to the forum (i.e. the mailing list, newsgroup, or what have you). This practice not only prevents duplication of effort by the repliers, as Tim mentioned, but also prevents duplication of effort by others interested in the same answer. I try to make a point of replying to the whole list when someone asks for a list of remailers, mail-news gateways, etc. for precisely this reason. As I see it the basic principle rests on a simple comparison of the number of replies desired with the likely number of replies. If you anticipate getting many more replies than you want, you should ask for replies to the entire forum in which you place the query. Otherwise, seek private email. This is certainly not a perfect heuristic, but it's an excellent starting point IMHO. For example, a few months back I wanted to give away an old AM/FM/ shortwave radio, so I posted to a local newsgroup. I asked for initial public replies, so that I wouldn't be flooded with mail before I had the chance to announce that a recipient had been selected (first-come first-served). After the initial expression of interest, further correspondence continued in private. [...] > In my opinion, having personal access > to past posts is several orders of magnitude more important than > having MIDI-MIME JPEG-II TeX players [...] It takes more disk space from one's personal quota, though (for those who suffer under such restrictions). :[ Let's not head down this road again.... "You've gotta keep `em separated !" -Offspring -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLwz5Mmf7YYibNzjpAQEooAQAlj93pc1CuSMTdApaRTg06ONgPkeyqUfY KhdcqzDmEnuWBDdwgO+YtHOHFsOGlPhoFhOijajJzTh97G1TBYn5plBECaZXs1RJ Au9g1uqEAKtFLFYB/jKDaDA/Xzf13irCKb846IAhttKICwQJ8HfLfgPWLHMa1/f1 ldkXYq7DfY8= =7KNc - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLwz6PCoZzwIn1bdtAQGpbwGAqY6tLm7TAN2TluCpD1WOTsR6kMgI2R27 CMExwcLopwSapiPNO0u/IHnzHUq5ij2C =TyKQ -----END PGP SIGNATURE-----

1 0

True Names
by Angus Patterson 17 Dec '03

17 Dec '03

I've been trying to get True Names by Vernor Vinge, and have been told it's out of print (like most good cypunk ), does anybody have it scanned? I realize this is without permission, so does anybody have Vinge's address? (e-mail or otherwise) or could anybody ask him? Btw, does he have any other crypto/anonymity related stories? Thanks in advance.

4 3

Re: Remailer Abuse
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Russ Nelson writes: > Heh. An anonymous remailer paid for by credit card... > Sure, I'll know who used it, but I'm not going to keep that > information. (Yes, yes, FV says that I have to keep records of who > bought what, but I'll label all my information with a random number, > that simply says that X bought information worth Y, not *what* > information.) And if you don't trust a remailer operator, then you > won't use it. I'd be worried about a couple of issues - one is just the transaction cost - can you successfully market remailer use at a buck a shot or whatever you'd be charging beyond FV's 29c stamp, or would you have some convenient way to aggregate bill? Beyond that, though, are some traffic analysis problems - remailers require a fair bit of traffic to be useful, and unless you receive a reasonable amount of encrypted traffic, and support encrypted email for purchasing remailer service and other merchandise, an eavesdropper would have a fairly good source of traffic data on your remailer users, especially since buying and using remailer service requires two messages within an hour or so. An alternative billing mechanism, which wouldn't use Chaum-patented cash, would be to sell a bunch of one-shot random-number tokens. When you sell the tokens, you add them to the database of valid tokens, and when one comes in on a message you delete it. This allows you to sell more than one message or service-period per FV transaction, and separates the purchase and use by a longer time, without adding the need for record-keeping based on the user's ID. It obviously does require encrypted reply messages. Another variant is for the user to send you a bunch of tokens along with the purchase, which you store. Blind signatures would improve the security of this process, but require more computation and may involve Chaum's patents. In this case, the message from the client to you would be encrypted, but you wouldn't have to send a reply, so the request could come in anonymously. Bill

1 0