December 2003 - cypherpunks-legacy

Newsweek on PGPfone
by John Young 17 Dec '03

17 Dec '03

Newsweek, August 28, 1995, p. 10. Encryption: Pretty Good Phone Privacy [Photo] 'This is what I do': Cryptomaster Zimmermann In the wake of reports that the Clinton Administration is considering another Clipper-like scheme to ensure government access to encrypted conversations and e-mail, Phil Zimmermann is striking again. The 41-year-old author of the notorious PGP (Pretty Good Privacy) software program that scrambles e-mail so snoops can't read it is about to release a sequel: PGPfone, which allows people to use their computers as secure telephones. If you have a recent Macintosh (a Windows verson comes next month) and a fast modem, you and a friend can speak in total privacy. As with its predecessor, Zimmermann is giving the software away, via MIT's Internet sites. Meanwhile, he's still waiting to hear whether the Feds will indict him for export violations in the distribution of PGP. Does Zimmermann worry that releasing PGPfone -- which can theoretically frustrate law- enforcement wiretaps -- will further inflame those who wish him arrested? "I'm a cryptographer, " he says. "This is what I do." [End]

1 0

No Subject
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is an article that I just posted to alt.security.pgp and sci.crypt. Having had a couple of hours to calm down, it seems a little frenetic, but there is enough truth in it that I will now repost it to cypherpunks. Context: Someone was asking how he could go about verifying the identity of an anonymous interlocutor, so that he could sign his public key. - -----BEGIN PGP SIGNED MESSAGE----- Look, I don't have a lot of time here, but I need to say that this whole "certifying anonymous keys" idea is misled. The fact is, *I* *don't* *care* what your True Name is. I can only think of two reasons why you would need a person's True Name, and I doubt that anybody here can apply either of these reasons to anyone else here. Reason Number Uno, why you might want a person's True Name: Because you want to physically hurt them, or effectively threaten to hurt them. (Or send someone else to do it, like a hit man, policeman, etc.) Reason Number Dos, why you might want a person's True Name: Because you want to have sex with them. (Or as above, if you prefer to do it through proxies...) Okay now does anyone want to do any of the above two things to me? If not then *don't* *worry* about whether my public key is signed by anyone or not. It makes zero difference to you until such a time as one of the above motivations acquires. Zimmermann et al. were/are naive to emphasize the Web of Trust as a means of introducing strangers. With very few exceptions, strangers don't *need* to verify each other's physical identities! This fact is central to some of the more interesting social evolutions that information technology promises to cause. In retrospect, the emphasis in "pgpdoc1.txt" on verifying True Names via mutually trusted introducers will seem quaint. Bryce Announcement: I have had technical difficulties. If you sent me e-mail between Aug 5 and Aug 20 and didn't receive a response, please re-send. signatures follow: + public key on keyservers /. island Life in a chaos sea or via finger 0x617c6db9 / bryce.wilcox(a)colorado.edu ---* - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta iQCVAwUBMDkLf/WZSllhfG25AQFhxwP6AzS0nus2QK8UEF5rvyqhFrwpzeAEE/Vr BwRXJtstk5ln2f3SRh7BSYfda/TQDJe2VRt0qMF1xNCt1VLP+QCyr06LqZ0i/qv0 /CpC85/QRAgpQtrgyFKR6v3Ryi3MbeiUQuEOSgU+OelvZ5XcoRP3o5WDp18N4+Pv 5ddGzIVXQEk= =5rxb - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta iQCVAwUBMDk3AfWZSllhfG25AQGQCgQAld0FFtRVZgDKZ1ofok4pK9zAAqlJHCiO A+eLsSolfIvvfpTiE0viJUOuXIywnWzBT50js4LodwsQI4cKSVfnHdYNI4aoyQJf G2P7dy7BaryOj8C74U2gYYq8Lys6Mh/i640KEa77EV4ZEDpLhSi25R+LB58qjvwJ l705Z8I/Bhs= =+xrs -----END PGP SIGNATURE-----

1 0

Crack some code...
by Frank Knobbe 17 Dec '03

17 Dec '03

Howdy folks. Who would be willing to try to crack a code that I implemented in one of my programs? The file is a simple index file containing ASCII characters besides pointers. If someone is interested in cracking that agorithm, simply send me a mail. I'm curious of how good that algorithm is... Greetings from Tennessee, Frank ----------------------------------------------------------------------------- Frank Knobbe: FKnobbe(a)ix.netcom.com (preferred), Frank(a)TechEx.com PGP 1024/26639025 fingerprint=7A EA FF 87 BF EA 00 CD 83 B1 89 81 7E D2 69 96 http://www.techex.com/~frank/home.html (<- Under Construction!) IPhone: Elwood(a)iphone.vocaltec.com, Ch: Tennessee ----------------------------------------------------------------------------- Signature Space for Rent! Imagine your signature here. For more info contact: Don(a)twr.ite.us

1 0

Eric Hughes?
by sw＠tiac.net 17 Dec '03

17 Dec '03

Eric Hughes, if you're listening, please send me a note so I can update my address file. I don't receive cypherpunks right now. --Steve Witham <sw(a)tiac.net> :o)-: -

1 0

DES & RC4-48 Challenges
by hallam＠w3.org 17 Dec '03

17 Dec '03

Hello all, Lets face it the real challenge is DES, but those 56 bits are quite a bit harder than 40. 65536 times harder in fact. But if people broke 48 bits then maybe they might start to see 56 as being in reach. After all everyone wants to be in for the biggie. So before the NSA fobs us off with 48 bits can we crack it? Wind up the 40 bit code a tad and set to work. It sounds as if it is comparable to the RSA-129 prime that was cracked (OK its probably a touch harder but machines are faster now). So who wants to make an RC-48 and a DES challenge? Phill.

1 0

Re: signing keys for nyms
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:46 PM 8/21/95 -0600, Bryce Wilcox wrote: >Look, I don't have a lot of time here, but I need to say that this whole >"certifying anonymous keys" idea is misled. The fact is, *I* *don't* *care* >what your True Name is. > >I can only think of two reasons why you would need a person's True Name, >and I doubt that anybody here can apply either of these reasons to anyone >else here. > >Reason Number Uno, why you might want a person's True Name: > >Because you want to physically hurt them, or effectively threaten to hurt >them. (Or send someone else to do it, like a hit man, policeman, etc.) > >Reason Number Dos, why you might want a person's True Name: >Because you want to have sex with them. (Or as above, if you prefer to do it >through proxies...) > >Zimmermann et al. were/are naive to emphasize the Web of Trust as a means of >introducing strangers. With very few exceptions, strangers don't *need* >to verify each other's physical identities! This fact is central to some of >the more interesting social evolutions that information technology promises >to cause. In retrospect, the emphasis in "pgpdoc1.txt" on verifying True >Names via mutually trusted introducers will seem quaint. Reason number 0 why you'd want someone's True Nym - Because you've met them in person, or are a friend of a friend, and want to make sure that the key you think is for Mr. X isn't really the key for an imposter - if you've done Lefty Politics over the last few decades, this is not unrealistic. COINTELPRO may have been unreal and UnAmerican, but it happened. Now, trusting people based on mutually trusted introducers may have seemed quaint back in the 60s, and it certainly wasn't foolproof, and planting the suspicion that someone _might_ be a cop was almost as destructive as if they actually _were_ a cop. But it's what there was. (Ok, you had some extra sources of information, like whether the person actually paid all their organization dues (COP!) or smoked dope with you (and inhaled) or started advocating unreasonable violence (probable cop)...) That doesn't mean you checked government-issue ID from people or necessarily even used True Names; you could be dealing with people in person who you only knew as "Bill from Delaware" or "Bear" or "Jeanie from the Sierra Club", but at least if you only trust keys from introducers who know people in person, you're limiting your electronic conspiracy to people you would have conspired with in person as well. (Now, _I_ never bought drugs from Bear, and at this point I don't even remember his True Name - but I didn't turn him in, either...) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Divide and Conquer
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

O > As you may have surmised Hal has given us another challenge to satisfy O > the people who want to do a challenge to see *how fast* they can do it O > by involving as many people and their computers as possible. Here's a thought or twelve: Precompute the divsion-of-keyspace problem, in advance of the actual issue of challenge. Use whatever criteria of estimating spare mips (idle_percentage * mips_rate) and allocating slices, then issue each participant a [start..end] space (and a direction flag. More on this later). That way, when the challenge is issued, there is no fumbling about, but rather a simple: "Gentlemen, start your programs." Divide the participants into two roughly equal groups of total spare mips, so as to address reliability and trust issues. Then allocate the entire keyspace twice. Later... For more fun, if the cracker can be coded to read a direction flag from the config file, so that the main loop can go ++ or --, the lists of keyspace could alternate thusly: Red Team Blue Team 0000++ 0000++ --iiii --jjjj This method of allocating keyspace iiii++ jjjj++ puts the key in the space of 4 --kkkk --mmmm different people at once, but only kkkk++ mmmm++ increases average search time by a . . . factor of 2 to protect against holes. / --0000 --0000 since the direction flag is independent of / \ (FFFF--) (FFFF--) team, it reveals nothing to a Bad Guy. / Two ways of saying the same thing. In effect, the ranges computed by the allocator are paired up, and the two people who share the range play "meet in the middle". If there are n participants in the group, and b of them are Bad Guys, the probablity of failure would be roughly (b/n)**4. * On a clear disk you can seek forever --- * Monster(a)FAmend.Com *

1 0

Don't copy that floppy! Copyright bill roundup (7/30/97)
by Declan McCullagh 17 Dec '03

17 Dec '03

If you give your dad a "free" copy of Microsoft Word, you'll be guilty of a Federal felony, at least under some of the bills that have recently been introduced in Congress. I'm still reading through them, but here's what I've gleaned... Much of the debate will center around the so-called "LaMacchia Exemption," which basically means that non-profit copyright infringing is not a crime. It is, however, already a civil offense -- as the SPA is always eager to demonstrate. I wrote about this recently: http://cgi.pathfinder.com/netly/opinion/0,1042,1107,00.html HR2265: Introduced by Rep. Bob Goodlatte on July 25, the "No Electronic Theft Act" would eliminate the LaMacchia Exemption. If you give pirated software to a friend (exchanging "anything of value" including "other copyright works"), beware. For the first offense, assuming the software is worth at least $5,000, you get three years in the Federal pen. If you make more than ten total pirated copies, you get six years: http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2265: HR2180: Internet services generally would not be liable for their customers' copyright infringements, under this bill introduced on July 17 by Rep. Coble and Rep. Henry Hyde. Called the "On-Line Copyright Liability Limitation Act," it's what ISPs have been demanding for years. Watch major copyright owners like Microsoft frown at this one. Nobody in the Senate has introduced companion legislation yet; the Judiciary Committee had a hearing on ISP liability scheduled for yesterday but it was cancelled due to Justice Brennan's death. http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2180: HR2281: Arguably the most controversial of the copyright bills introduced so far, this legislation that was introduced yesterday would enact the World Intellectual Property Organization copyright treaty the U.S. signed last December. Problem is, it may go far beyond what the treaty requires. The bill bans "technology" (including both hardware and software) that has few uses other than "circumventing a technological protection measure." It could impact encryption. "Circumvention" is defined as "to descramble a scrambled work, to decrypt an encrypted work." (What does this mean for cryptanalysts?) It also restricts removing "copyright management information" that includes titles, author's name, and copyright notice. Violators would be subject to civil penalties or criminal prosecution. If you "circumvent" protection or remove copyright info "for purposes of private financial gain," you'll face up to a $1,000,000 fine and 10 years in Federal prison. That's serious stuff. And it raises some interesting questions: what if I include a Reuters article in a newsletter I sell, and delete the copyright notice? Am I a Federal felon? Do I have a million dollars? Hmm... "They have criminalized conduct that is legal under the current copyright act," says Adam Eisgrau of the American Library Association. "They have created a new crime that is completely divorced from copyright infringement." Eisgrau says this bill isn't required by the WIPO treaty, which only mandates that countries punish *actions* that infringe, not *devices* that do. This legislation has hefty backing: Rep. Henry Hyde (full committee chair), Rep. Howard Cobel (subcommittee chair), and Rep. Barney Frank (ranking Democrat on the subcommittee). Sen. Patrick Leahy, who likely will endorse this approach, said yesterday that he was studying similar legislation. The SPA, naturally, is also supporting this bill. I've attached their press release below. The text of HR2281 isn't online yet -Declan --- SPA press release WIPO Treaty Implementation Bill Introduced in House Copyright Protections for Software Greatly Enhanced (Washington, D.C. -- July 30, 1997) Rep. Howard Coble (R-N.C.), chairman of the House Judiciary Subcommittee on Courts and Intellectual Property, introduced late yesterday the WIPO Copyright and Performances and Phonograms Treaty Implementation Act (H.R. 2281). The bill will make necessary amendments to U.S. law to enable the Senate to ratify new international intellectual property treaties negotiated last year in Geneva. The legislation is largely based on a Clinton administration proposal delivered by Commerce Secretary William Daley. SPA was a leading participant in the diplomatic conference last December that drafted the WIPO copyright treaty, and considers copyright protection for the Internet to be a major priority. "SPA supports the objectives of H.R. 2281 and, while further analysis must be done, believes that the Clinton administration and Rep. Coble have achieved a workable balance," said Ken Wasch, SPA president. "H.R. 2281 represents significant accommodations to guard against inadvertent liability for multi-purpose computers, software and other concerns. We hope Congress understands that further concessions would undermine the measures needed to make gains in the war against software piracy." "We commend Secretary Daley and his senior advisers for their perseverance in forging the administration's legislative proposal, Rep. Coble and his staff for their determined effort to introduce the measure and the bill's co-sponsors, Reps. Henry Hyde (R-Il.), Barney Frank (D-Mass.) and John Conyers (D-Mich.). In putting this bill before Congress, they have reached an important milestone in establishing the legal framework needed to protect electronic commerce in computer software." H.R. 2281 would also prohibit knowingly provide false copyright management information with intent to induce or conceal software piracy and other copyright infringement, and make technical changes to bring U.S. law into accord with the WIPO treaties. Circumvention of technological copyright protection measures for purposes of software piracy is a serious problem. Today, copyright law cannot be used to stop all kinds of unauthorized circumvention, nor can the making and selling of technology designed specifically to do so. These access and copy control technologies, such as scrambling, encryption and electronic locks, supplement legal protection in fighting software piracy but do not solve the problem. In fact, new problems are emerging on a consistent basis. For example, last May Chico-based SciTech Software, Inc. received ransom demands for $25,000 from an on-line extortionist who threatened to publicize on the Internet the instructions for disabling technology that controls the 21-day evaluation period for its graphics utility program, "Display Doctor." "The scary thing is not that our protection could be circumvented. Dedicated pirates always find a way," said Kendall Bennett, SciTech engineering director. What's scary is that they can get the information on how to circumvent into the hands of millions of casual users who would normally license our software." The immediate threat to SciTech has passed, but the blackmailer is still at large. Other SPA members have received ransom demands for as much as $1 million. That problem would be addressed by the new WIPO Copyright Treaty, which requires the U.S. and other countries to make sure that software companies have effective remedies against circumvention of technical protection for copyrighted works. SPA has spent months building consensus among industry and government on how to do so, and Rep. Coble's bill has put the issues before Congress. SPA is the principal trade association for the computer software industry, representing the leading publishers as well as start-up firms in the business, home office, consumer entertainment and educational markets. SPA supports companies that develop and publish software applications and tools for use on the desktop, client-server networks and the Internet. SPA's 1,200 member companies account for 85 percent of U.S. revenue for packaged and online software. Contact: Mark Traphagen, Vice President for Intellectual Property and Trade Policy, SPA, (202) 452-1600, ext. 322. Steve Bowers, Media Relations Specialist, SPA, (202) 452-1600, ext. 365. ### www.spa.org ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: your mail
by Will French 17 Dec '03

17 Dec '03

> Thanks again, and I hope you go ahead and start PGP-clearsigning your posts > so that my high opinion of you can become more firmly fixed. > :-) > Regards, > Bryce If I don't PGP-sign my message, you can't prove I sent it. But if you don't put your name and e-mail address at the bottom of your message, I don't even know who you are! (Your message was hit by the "three screens of Apparently-To: headers" bug, and the From: line says "owner-cypherpunks(a)toad.com". The Subject: line also got lost.) Let's get the basics straight first, okay? This has been part of netiquette since before there was a net! Will French <wfrench(a)interport.net>

1 0

Re: Third World Man
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:46 AM 8/22/95, Jon Lasser wrote: >On Mon, 21 Aug 1995, Peter Trei wrote: > >> > The US is slipping into the second world as we >> > speak, with no signs of a turnaround ahead. Only the sheer size of >> > the economy keeps people from believing it. >> >> Just a nomenclature peeve - I'm not sure of the precise time and >> place the (first|second|third) world meme originated, but it seems to >> predate 1970, and until very recently it's meaning was clear: >> >> First world: Western (and Westernized) nations - mainly the US, Canada, >>Western Europe, >> Japan, Australia, & New Zealand >> >> Second world: Communist bloc (I can still remember the Cultural >> Revolution. Prior to that, the Communists seemed a monolithic force, >> marching in lockstep.) >> >> Third world: The rest, mostly poor nations. > >Erm, nope. The "First World" (or old world) was Europe and Asia; the "New >World" (not frequently referrred to as the second world, but hey...) The >third world was the developing nations. THAT (as far as I was taught in >history class, so it MIGHT be a lie...) was how the terms originated... Then you should sue your history teacher for giving you a defective education :-}. Perhaps she or he was of my generation and was at Woodstock when she should've been doing her homework. By convention, the First World is the set of "Western" nations, the democratic, capitalist nations. The Second World, though not often used as a term, is the set of Communist bloc nations. The Third World, by far the most commonly used term here, is the set of nations not formally affiliated with either the First or Second Worlds. These nations are often poor, though not necessarily poor, and so the "Third World" is often (incorrectly) associated with poverty. And, to confuse things further, the "lesser-developed countries," or LDCs, are often equated to the Third World. When a certain character in a television show referred to "Third World mutants," he was also referring to "your basic brown types." (His words, not mine. Ten credits to anyone who can identify the t.v. show and the character.) The term "Fourth World" has in the last 20 years come to refer to the countries which are so impoverished as to be almost hopeless. Bangla Desh is the canonical Fourth World nation. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0