December 2003 - cypherpunks-legacy

ADMIN: List wipeout and recovery
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

Yeghads, it happened again. Last night at about 22:47 the disk partition that holds the cypherpunks mail list filled up and when someone tryed to sub/un-scribe using Majordomo the list got zeroed. No one broke into the system to do any evil, it's just confusion, rotten software and poor management by yours truley that casued the problem. Next problem was that toad.com had changed a lot in the last 9 months, and we had moved things about in such a way that I did not seem to have any backups of the file! Today our gracious host, John Gilmore called up to see what the problem was and if there was any way to fixit. Using two heads was better than one and we realized that we had a online backup only 2 days old. Minutes later it was installed and the list is back to where it was late on 1995/07/11. So, some of you will need to un-subscribe again, our apologies about that. I will dig out the lost messages and make a digest-ish like post of everything that was posted since about 22:30 last night. I will also look at moving away from MajorDomo as list software due to its being moribund, old, stupid and bothersome! Thanks also goes to L. McCarthy <lmccarth(a)cs.umass.edu> for sending pleasant email to the right folks (majordomo-owner(a)toad.com is best) to lets us know that there was a problem. If you have any questions please send them directly to me as the list is allready full of off topic posts (big hint folks...). ||ugh Daniel Majordomo Potty Trainer majordomo-owner(a)toad.com

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Wed, 12 Jul 95 18:20:07 -0400 >From: "Brian A. LaMacchia" <bal(a)martigny.ai.mit.edu> >Finally, we begin to see the attack on all forms of un-escrowed >encryption. The bill provides an affirmable defense of >giving the keys to the government ahead of time! > > `(c) It shall be an affirmative defense to prosecution under this > section that the software at issue used a universal decoding device > or program that was provided to the Department of Justice prior to > the distribution.'. This isn't escrowed encryption being allowed here. This is straight giving of keys (or a back door) to the gov't. Even Clipper fails this test. - Carl

1 0

Stego Standards Silly ? (Was: Re: def'n of "computer network")
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

Hugh seems to have restored the full list on Majordomo, so I'll forward the last couple of messages I sent/received yesterday that should have gone to the whole list.... -Futplex Forwarded message: >From lmccarth Fri Jul 14 00:12:07 1995 Subject: Stego Standards Silly ? (Was: Re: def'n of "computer network") To: cypherpunks(a)toad.com (Cypherpunks Mailing List) In-Reply-To: <9507140229.AA13447(a)snark.imsi.com> from "Perry E. Metzger" at Jul 13, 95 10:29:29 pm -----BEGIN PGP SIGNED MESSAGE----- .pm writes: > Indeed -- how could the recipient even know to look, unless these > things arrived regularly and with a fully standardized form of > stegonography, in which case why bother, all you've done is come up > with a very odd form of transfer encoding. I agree, but AFAICS an odd form of transfer encoding is exactly what the doctor ordered. For plausible cryptodeniability, one wants to send ciphertext using a transfer encoding that doesn't automatically ring alarm bells. Steganography amounts to laundering Content-Type: headers. > If the recipient does know to look, that implies either that there is > a hint, in which case the stegonography is useless, or it implies that > you have prearrangement, in which case my comments on prearrangement > hold. If the recipient isn't getting spammed with GIFs (or whatever), she (or rather her MDA) can simply look at all of them by default. Of course this does not help with anonymous message pools on the order of Usenet, but that is a sub-issue. Deranged Mutant raised an IMHO important issue a few months ago. He suggested that Mallet could go about trashing the purportedly "random" bits in each instantiation of some transfer encoding used in a stego standard. For example, he shuffles the LSBs of every passing JPEG. I'm not sure how feasible this would really be (both technically and sociopolitically), but it could be a big annoyance if only a few people were suspected of using stego method XYZ. The standard answer to agent-in-the-middle tampering is of course digital signatures. Now, the question is, will we be allowed to sign our possibly-stego-enclosing GIFs with reasonable confidence that the govt. can't forge our signatures ? Obviously the signature itself can't be stegoed, or else we fall into an infinite regress. -Futplex <futplex(a)pseudonym.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAXuSWf7YYibNzjpAQHlpQP/f3/e5iRl67zU3TLYZH1oNBBjC1+LYPH8 VkQMhvtRdlo2xBkY56jaZ6hZuzWanknVD1EKrG72vl5sPytXXDs5dVplFlelVw6f VjC2UxNHe0dQHmmJqXNMMq4qlC8ZxgtNf4P9O+6iJKjz6SbA7F6LuRd+3TXv5tHm xgGSY5bzJp8= =ia+X -----END PGP SIGNATURE-----

1 0

Re: Mr. Newbie...
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 05:35 PM 7/13/95 -0400, The Gate wrote: > > Okay folks, here comes Mr. Newbie. > > Duh...How can I figure out how to use pgp. Is there a good place >to learn the background and basics in a step-by-step easy to understnad >way? Duh... I think I wanna know... The documentation that comes with PGP isn't bad; read the pgpdoc1 and pgpdoc2 files. (If you buy ViaCrypt, you get them in nice spiral-bound manuals, but it's basically the same stuff.) Here's an overview of the basics: - RSA public-key encryption lets you create a public encryption key which you can publish, so that other people can encrypt files that can only be decrypted with your private key. It also lets you sign files by decrypting them with your private key, which other people can check by encrypting with your public key to get the original message (or a hash of it) back. What makes this mathematically cool is that it does it in a way that takes exponentially long amounts of time to find your private key from the public key, so anybody who wants to crack a reasonably long key needs to run a big hairy computer for about the age of the planet to do so, but you can do decryption reasonably fast because you already know the private key, and the same algorithm works well for both encryption and digital signatures. - RSA encryption isn't very fast, so most real programs that use it encrypt the file with a conventional crypto algorithm (PGP uses IDEA) using a randomly chosen session key, and encrypt the session key with RSA; it's a lot faster. - The problem with public-key encryption is that anybody who wants to send you a message needs to be sure they've really got _your_ public key instead of a key that some Bad Guy published saying "Here's Alice's public key - trust me!". Since RSA can do digital signatures, PGP uses them to create a "Web of Trust", where you can sign a message saying "Here is Alice's key, signed Bob", and anybody who's got a good copy of your key (and trusts you) will know they've got a good copy of Alice's key. If they didn't get a copy of your key directly from you, they may have a message saying "Here's Bob's key, signed Carol", or maybe they got that and Carol's key, signed by Dave, and they know Dave personally so they've checked it with him. How big a Web of Trust can you trust? Well, you probably need more security if you're running a revolution than if you're trying to find out if a Usenet article is genuine or bogus, so PGP lets you choose, but the default is 4 levels deep. - OK, so how do you get PGP? - there's an occasional publication on the net that tells you where, but you can get it from ftp.ox.ac.uk by ftp with no hassle. Inside the US, you want version 2.6.2 for non-commercial use, and you have to buy ViaCrypt's licensed version if you want to sell services using it. Outside the US, the version's something like 2.6.2i or something ending in i. 3.0 will be out "Real Soon Now", probably in 1995, but it's hard work. Versions are available for DOS, Mac, Unix, and a few less popular OSs. ViaCrypt has a special Windows version; the rest of us Windows users can either run it from DOS or use a front-end program like Private Idaho (ftp.eskimo.com/joelm/) or WinPGP, available from popular FTP sites. If you're using the Unix version, it's assumed you know how to read readme files and compile using Make; DOS folks get binary as well as source and documentation. Unix folks will notice that the command line has this ugly DOS feel to it :-) - So you've got it installed and you've read the documentation, and messed with the config.txt file if you didn't like the default options, and now you want to do something. Type "pgp -h" to get help, or "pgp -k" to get help with keys for a reminder. Then type "pgp -kg" to generate a key - you probably want a 768-bit or 1024-bit key for normal use, unless you're paranoid or have a slow computer. Because RSA keys are long strings of binary data that are hard for humans to remember, PGP stores them in a file, encypted with IDEA, and will prompt you for a "passphrase" for the encryption. Make it something long and complicated enough to be secure, but easy for you to remember without writing it in a yellow sticky-note, and not blatantly obvious. You'll need to use it any time you decrypt a file somebody else sent you, or sign a file you're sending to someone else. You'll also need a name - typical format looks like Bob Dobbs <jrd(a)slack.com> which has your name and email address. Most of the time you'll just use an abbreviation and let pgp figure it out. To send your key to someone else, once you've generated it, type "pgp -kx Dobbs filename" and it'll create a file you can mail somebody else which will let them encrypt stuff to you. To decrypt a file you got from someone else, type "pgp filename", which will do the right thing for decryption, checking signatures, receiving new keys, etc. To encrypt a file to someone else, type "pgp -e filename theirname" and pgp will create a file called filename.asc (or filename.pgp if you don't have the ascii-armor option set, which you should.) To sign a file to send somebody, type "pgp -s filename", which will do the same, and there are various options you should read in the manual. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

ping
by cjl 17 Dec '03

17 Dec '03

Cypherpunks, It was my intention to write a little summary of the story in the most recent issue of SCIENCE, which in addition to reporting some progress towards constructing a quantum computer, also reports in a side bar on a Los Alamos demonstration of untappable quantum cryptography in which a message was sent over 14 kilometers of fiberoptic cable and read with a 1% error rate, secure in the knowledge that Eve couldn't possible be listening. However, I have not gotten any mail from the list today which leads me to believe that there is something wrong with the list-server, you couldn't all possible have been struck dumb with terror by the Your-ass-is Grassley Act :-) So this is a test, this is only a test. Had this been a real message I would have sent more details about the stuff in SCIENCE. C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

2 1

Re: Timothy C. May: Re: Crisis Overload (re Electronic Racketeering)
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

Tim's original transmission of the following message didn't make it out to the (briefly annulled) list. I've already replied to Tim in private, but I'll offer my apologies if I've misled anyone as to whose mail originally went where. -Futplex Forwarded message: > From tcmay(a)sensemedia.net Fri Jul 14 02:01:08 1995 > Date: Thu, 13 Jul 1995 23:03:50 -0700 > X-Sender: tcmay(a)mail.sensemedia.net > Message-Id: <ac2b562c03021004310a(a)[205.199.118.202]> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > To: futplex(a)pseudonym.com, cypherpunks(a)toad.com > From: tcmay(a)sensemedia.net (Timothy C. May) > Subject: Re: Timothy C. May: Re: Crisis Overload (re Electronic Racketeering) > > At 2:57 AM 7/14/95, L. McCarthy wrote: > >> Perry, > >> > >> I have all I'm going to take of your acerbic rudeness to me. > >> > >> I will no longer be responding to any of your messages. > >> > >> --Tim > > > ><sigh> > > > >Everybody needs to take a deep breath and count to 1,000. Seriously, > >we're all feeling plenty of stress today. Various people have been > >talking about getting out of the U.S. while the going's good (?), and > >it doesn't sound much like hyperbole this time. It's not surprising that > >we're releasing our frustration on each other, lashing out at the nearest > >quasi-tangible targets. > > Note that I didn't post that to the list. > > Your requoting it, without the intermediate quoting of the person who _did_ > post it to the list, makes it appear I was spewing this garbage to the > list, when I wasn't. > > I don't care for your pop psychology. I would've followed your advice and > left these comments in e-mail only, had you done the same. > > --Tim May > > .......................................................................... > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero > 408-728-0152 | knowledge, reputations, information markets, > Corralitos, CA | black markets, collapse of governments. > Higher Power: 2^756839 | Public Key: PGP and MailSafe available. > "National borders are just speed bumps on the information superhighway."

1 0

IEEE P1363 (public key crypto) standards meeting after Crypto
by John Gilmore 17 Dec '03

17 Dec '03

Even if you aren't going to Crypto, there are draft standards documents, etc, FTP-able. See below. I haven't read them yet. John Date: Thu, 13 Jul 95 10:56:18 PDT From: Burt Kaliski <burt(a)rsa.com> To: pem-dev(a)TIS.COM Subject: Meeting announcement IEEE P1363: Standard for RSA, Diffie-Hellman and Related Public-Key Cryptography MEETING NOTICE Thursday, August 31, 1995, 1:00-6:00pm Friday, September 1, 1995, 9:00-6:00pm University of California, Santa Barbara, CA This meeting of the P1363 working group, open to the public, will focus on the editing of a draft standard for RSA, Diffie-Hellman and other public-key cryptography. The meeting follows the CRYPTO '95 conference, held August 27-31 at the same location. AGENDA 1. Approval of Agenda 2. Approval of Minutes from May Meeting 3. Officers' Reports 4. Update on Patent Issues 5. Proposals for New Sections 6. Meeting Schedule 7. Editorial Work (schedule to be determined based on availability of draft material) 8. New Work Assignments Depending on the amount of editorial work, the meeting may end sooner than 6:00pm Friday. If you'd like to participate, contact Burt Kaliski, the working group's chair, at RSA Laboratories, 100 Marine Parkway, Redwood City, CA 94065. Phone: (415) 595-7703, FAX: (415) 595-4126, E-mail: burt(a)rsa.com. Draft sections and copies of previous minutes are available via anonymous ftp to ftp.rsa.com in the "pub/p1363" directory. The working group's electronic mailing list is <p1363(a)rsa.com>; to join, send e-mail to <p1363-request(a)rsa.com>. There will be a meeting fee, though the amount has not yet been established, pending arrangements with the university. It will also be possible for participants to arrange accommodations at the university. DIRECTIONS (excerpted from the CRYPTO announcement) The campus is located approxmately two miles from the Santa Barbara airport, which is served by several airlines, including American, America West, United and US Air. All major rental car agencies are also represented in Santa Barbara, and AMTRAK has rail connections to San Francisco from the north and Los Angeles from the south. Santa Barbara is approximately 100 miles north of the Los Angeles airport, and 350 miles south of San Francisco. For more information on the CRYPTO '95 conference, contact Stafford Tavares, the general chair, at (613) 545-2945 or <tavares(a)ee.queensu.ca>.

1 0

Re: Free The World Web Server project.. :)
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Hooking up a mass mailer to congress seems like a bad idea to me, because they're really only interested in their constituants. If they start getting mass mailings, they might start thinking there's only one person or a small group of people "behind the curtain". Sending results of an e-petition, however, would be unobtrusive. A web page that mails a form letter to _your_ congressperson's form-letter-readers (ie staff readers) would be much better, IMHO. Don

1 0

Re: ping
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 19:13 7/14/95, cjl wrote: >Cypherpunks, > >It was my intention to write a little summary of the story in the most >recent issue of SCIENCE Can you scan it in? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

SEK_hel
by John Young 17 Dec '03

17 Dec '03

7-14-95. NYPaper: "U.S. Spells Out Antitrust Inquiry Into Microsoft." The Justice Department said today that the Microsoft Corporation might well be violating antitrust laws by including software for its new on-line network in Windows 95, its much-anticipated operating system for personal computers. JUS_kid "Sting on Internet Leads to a Child Sex Case." In a case involving child pornography, the Internet and a self-appointed enforcer whom one critical defense lawyer calls an "electronic vigilante," a Nevada man is facing prison for crossing state lines with the intention of having sex with a 14 year-old girl he had met on a popular computer network. SHE_dev [Editorial] "The Guns of Waco and Ruby Ridge." There is little doubt that the Federal Government contributed heavily to two of the biggest law enforcement fiascoes in recent memory. One was the disastrous 1993 Federal raid on the Branch Davidian compound at Waco, Tex. The other was the tragic 1992 encounter between the F.B.I. and a band of white separatists at Ruby Ridge, Idaho. LIT_bub 3: SEK_hel

1 0