December 2003 - cypherpunks-legacy

DOH!
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I see that the subscription rolls got nuked again. *sigh* Did I miss anything juicy after the rants of yesterday? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 1.0 iQCVAwUBMAbIizokqlyVGmCFAQHHUAQA0gTXvdTsIfY+l2yKXhbVcYJh38Ud1Tx9 ald4e52YaTW2256rOxmuoN1pBSu1rnpjWkEytHRHJ12rkLSrocAKT66Xk0wW0o7t Pml8gLFlpX4XznmTNkGV36Vv7s0ly+sDsJxd4R8WIXEpCr77I9Pyc1WIiJW3Oo/1 gJFHp0vBCzE= =qLuY -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> Cthulhu Matata \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> hayden(a)krypton.mankato.msus.edu \/ Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

1 0

Re: The MoJo Wire thanks you
by schwartz＠bach.convex.com 17 Dec '03

17 Dec '03

hello everybody, Please direct all your future replies related to this message and the Mother Jones junk to truher(a)mojones.com Also, please do *not* "group reply": check to ensure that only truher(a)mojones.com is included in the "To:" part of the email header, and do not include anyone in the "Cc:" part of the email header. Thanks very much. (BTW, I have absolutely nothing to do with Mother Jones or its WWW site.) Nicholas Samuels writes: > >With this message, you also included a note from silversh(a)rmmi.com, >wishing to "unsubscribe." Since I don't administer your listserv, you >might want to do something with that.

1 0

Re: Crisis Overload (re Electronic Racketeering)
by Bolivar Shagnasty 17 Dec '03

17 Dec '03

"Overweaning." "Iowa." Yes, yes, I know. Fingers think for themselves. Too used to typing "weenie." Just read DOJ report. Don't write. Bolivar

1 0

Free The World Web Server project.. :)
by The Gate 17 Dec '03

17 Dec '03

15:57 EST July 14th, 1995 New Haven, CT. From the Yale Computer Center: Got an idea for y'all, from the heart and mind of Elizabeth Walker, with whom I live. Let's set up a web site where someone can submit a letter that will be automatically sent to every senator, congressperson, elected and appointed federal official. If we run into trouble, we can scale it down, narrow the various target areas... Also, we could write our own letters, post them, and if someone wants to resend it, they could do so at the click of the mouse. Example, someone logs on to the Freedom Speaks webserver, and is greeted by the message, "Welcome, enter your message for Federal officials in the box provided, then hit the submit button." "If you would like to submit one of our pre-written letters, just click on any of the ones you see below." For those without web access, we could set up a mailing list to do the same. I.e. to send a message to all our elected and appointed officials, send message to freetheworld(a)gateway.net. From there it gets spooled everywhere. What do you think? I could probably do it somehow, but someone with access to better resources and knowledge of cgi-bin might be better for the job. If anyone is interested in this project, let me know... R. Leland Lehrman ____________________________|||||||||||||||||||||______________________________ R. Leland Lehrman@The Gate, New Haven, CT. http://id.wing.net/~gate/gate.html God, Art, Technology and Ecology Research and Development >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Do you love the Mother?>>>>>>>>>>>>>>>>>>>>>>>>

1 0

ping
by cjl 17 Dec '03

17 Dec '03

Cypherpunks, It was my intention to write a little summary of the story in the most recent issue of SCIENCE, which in addition to reporting some progress towards constructing a quantum computer, also reports in a side bar on a Los Alamos demonstration of untappable quantum cryptography in which a message was sent over 14 kilometers of fiberoptic cable and read with a 1% error rate, secure in the knowledge that Eve couldn't possible be listening. However, I have not gotten any mail from the list today which leads me to believe that there is something wrong with the list-server, you couldn't all possible have been struck dumb with terror by the Your-ass-is Grassley Act :-) So this is a test, this is only a test. Had this been a real message I would have sent more details about the stuff in SCIENCE. C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

2 1

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Thu, 13 Jul 95 11:19:29 -0400 >From: "Brian A. LaMacchia" <bal(a)martigny.ai.mit.edu> >>In the subsection that explicitly mentions crypto, it says that it's >>unlawful to put (non-GAK) crypto on an open net, "regardless of whether such >>software has been designated non-exportable". If the phrase "nonexportable" >>means the same thing in the context of this subsection, then provision (b) >>would only seem to apply RICO to stuff that already falls under ITAR. > >What worries me is the first sentence: "each act of distributing >software is considered a predicate act." The crypto section has no GAK exclusion. It makes it as illegal to release GAKed crypto on a net as PGP. I believe that the concern about defining predicate acts this way comes from the RICO requirement that there be TWO instances of a crime in order to pass the test of perpetrating a *pattern of crime* and therefore be ranked as a mobster subject to RICO. My guess is that the intent is that from one placement on an FTP server or one posting to a newsgroup, the perpetrator of that heinous act will have passed his RICO qualification and therefore be subject to having all he owns taken from him. ------- Meanwhile, the Federal civil forfeiture fund goes to good things. The last $9M (I believe it was) went to buying up AT&T DES phones to be made into Clipper phones. Of course, the conversion hasn't happened yet and the DES phones are sitting in a warehouse someplace -- but the $9M fund went to really good use, saving the world from AT&T DES. (sarcasm off) +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

3 3

ADMIN: List wipeout and recovery
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

Yeghads, it happened again. Last night at about 22:47 the disk partition that holds the cypherpunks mail list filled up and when someone tryed to sub/un-scribe using Majordomo the list got zeroed. No one broke into the system to do any evil, it's just confusion, rotten software and poor management by yours truley that casued the problem. Next problem was that toad.com had changed a lot in the last 9 months, and we had moved things about in such a way that I did not seem to have any backups of the file! Today our gracious host, John Gilmore called up to see what the problem was and if there was any way to fixit. Using two heads was better than one and we realized that we had a online backup only 2 days old. Minutes later it was installed and the list is back to where it was late on 1995/07/11. So, some of you will need to un-subscribe again, our apologies about that. I will dig out the lost messages and make a digest-ish like post of everything that was posted since about 22:30 last night. I will also look at moving away from MajorDomo as list software due to its being moribund, old, stupid and bothersome! Thanks also goes to L. McCarthy <lmccarth(a)cs.umass.edu> for sending pleasant email to the right folks (majordomo-owner(a)toad.com is best) to lets us know that there was a problem. If you have any questions please send them directly to me as the list is allready full of off topic posts (big hint folks...). ||ugh Daniel Majordomo Potty Trainer majordomo-owner(a)toad.com

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>Date: Wed, 12 Jul 95 18:20:07 -0400 >From: "Brian A. LaMacchia" <bal(a)martigny.ai.mit.edu> >Finally, we begin to see the attack on all forms of un-escrowed >encryption. The bill provides an affirmable defense of >giving the keys to the government ahead of time! > > `(c) It shall be an affirmative defense to prosecution under this > section that the software at issue used a universal decoding device > or program that was provided to the Department of Justice prior to > the distribution.'. This isn't escrowed encryption being allowed here. This is straight giving of keys (or a back door) to the gov't. Even Clipper fails this test. - Carl

1 0

Stego Standards Silly ? (Was: Re: def'n of "computer network")
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

Hugh seems to have restored the full list on Majordomo, so I'll forward the last couple of messages I sent/received yesterday that should have gone to the whole list.... -Futplex Forwarded message: >From lmccarth Fri Jul 14 00:12:07 1995 Subject: Stego Standards Silly ? (Was: Re: def'n of "computer network") To: cypherpunks(a)toad.com (Cypherpunks Mailing List) In-Reply-To: <9507140229.AA13447(a)snark.imsi.com> from "Perry E. Metzger" at Jul 13, 95 10:29:29 pm -----BEGIN PGP SIGNED MESSAGE----- .pm writes: > Indeed -- how could the recipient even know to look, unless these > things arrived regularly and with a fully standardized form of > stegonography, in which case why bother, all you've done is come up > with a very odd form of transfer encoding. I agree, but AFAICS an odd form of transfer encoding is exactly what the doctor ordered. For plausible cryptodeniability, one wants to send ciphertext using a transfer encoding that doesn't automatically ring alarm bells. Steganography amounts to laundering Content-Type: headers. > If the recipient does know to look, that implies either that there is > a hint, in which case the stegonography is useless, or it implies that > you have prearrangement, in which case my comments on prearrangement > hold. If the recipient isn't getting spammed with GIFs (or whatever), she (or rather her MDA) can simply look at all of them by default. Of course this does not help with anonymous message pools on the order of Usenet, but that is a sub-issue. Deranged Mutant raised an IMHO important issue a few months ago. He suggested that Mallet could go about trashing the purportedly "random" bits in each instantiation of some transfer encoding used in a stego standard. For example, he shuffles the LSBs of every passing JPEG. I'm not sure how feasible this would really be (both technically and sociopolitically), but it could be a big annoyance if only a few people were suspected of using stego method XYZ. The standard answer to agent-in-the-middle tampering is of course digital signatures. Now, the question is, will we be allowed to sign our possibly-stego-enclosing GIFs with reasonable confidence that the govt. can't forge our signatures ? Obviously the signature itself can't be stegoed, or else we fall into an infinite regress. -Futplex <futplex(a)pseudonym.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAXuSWf7YYibNzjpAQHlpQP/f3/e5iRl67zU3TLYZH1oNBBjC1+LYPH8 VkQMhvtRdlo2xBkY56jaZ6hZuzWanknVD1EKrG72vl5sPytXXDs5dVplFlelVw6f VjC2UxNHe0dQHmmJqXNMMq4qlC8ZxgtNf4P9O+6iJKjz6SbA7F6LuRd+3TXv5tHm xgGSY5bzJp8= =ia+X -----END PGP SIGNATURE-----

1 0

Re: Mr. Newbie...
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 05:35 PM 7/13/95 -0400, The Gate wrote: > > Okay folks, here comes Mr. Newbie. > > Duh...How can I figure out how to use pgp. Is there a good place >to learn the background and basics in a step-by-step easy to understnad >way? Duh... I think I wanna know... The documentation that comes with PGP isn't bad; read the pgpdoc1 and pgpdoc2 files. (If you buy ViaCrypt, you get them in nice spiral-bound manuals, but it's basically the same stuff.) Here's an overview of the basics: - RSA public-key encryption lets you create a public encryption key which you can publish, so that other people can encrypt files that can only be decrypted with your private key. It also lets you sign files by decrypting them with your private key, which other people can check by encrypting with your public key to get the original message (or a hash of it) back. What makes this mathematically cool is that it does it in a way that takes exponentially long amounts of time to find your private key from the public key, so anybody who wants to crack a reasonably long key needs to run a big hairy computer for about the age of the planet to do so, but you can do decryption reasonably fast because you already know the private key, and the same algorithm works well for both encryption and digital signatures. - RSA encryption isn't very fast, so most real programs that use it encrypt the file with a conventional crypto algorithm (PGP uses IDEA) using a randomly chosen session key, and encrypt the session key with RSA; it's a lot faster. - The problem with public-key encryption is that anybody who wants to send you a message needs to be sure they've really got _your_ public key instead of a key that some Bad Guy published saying "Here's Alice's public key - trust me!". Since RSA can do digital signatures, PGP uses them to create a "Web of Trust", where you can sign a message saying "Here is Alice's key, signed Bob", and anybody who's got a good copy of your key (and trusts you) will know they've got a good copy of Alice's key. If they didn't get a copy of your key directly from you, they may have a message saying "Here's Bob's key, signed Carol", or maybe they got that and Carol's key, signed by Dave, and they know Dave personally so they've checked it with him. How big a Web of Trust can you trust? Well, you probably need more security if you're running a revolution than if you're trying to find out if a Usenet article is genuine or bogus, so PGP lets you choose, but the default is 4 levels deep. - OK, so how do you get PGP? - there's an occasional publication on the net that tells you where, but you can get it from ftp.ox.ac.uk by ftp with no hassle. Inside the US, you want version 2.6.2 for non-commercial use, and you have to buy ViaCrypt's licensed version if you want to sell services using it. Outside the US, the version's something like 2.6.2i or something ending in i. 3.0 will be out "Real Soon Now", probably in 1995, but it's hard work. Versions are available for DOS, Mac, Unix, and a few less popular OSs. ViaCrypt has a special Windows version; the rest of us Windows users can either run it from DOS or use a front-end program like Private Idaho (ftp.eskimo.com/joelm/) or WinPGP, available from popular FTP sites. If you're using the Unix version, it's assumed you know how to read readme files and compile using Make; DOS folks get binary as well as source and documentation. Unix folks will notice that the command line has this ugly DOS feel to it :-) - So you've got it installed and you've read the documentation, and messed with the config.txt file if you didn't like the default options, and now you want to do something. Type "pgp -h" to get help, or "pgp -k" to get help with keys for a reminder. Then type "pgp -kg" to generate a key - you probably want a 768-bit or 1024-bit key for normal use, unless you're paranoid or have a slow computer. Because RSA keys are long strings of binary data that are hard for humans to remember, PGP stores them in a file, encypted with IDEA, and will prompt you for a "passphrase" for the encryption. Make it something long and complicated enough to be secure, but easy for you to remember without writing it in a yellow sticky-note, and not blatantly obvious. You'll need to use it any time you decrypt a file somebody else sent you, or sign a file you're sending to someone else. You'll also need a name - typical format looks like Bob Dobbs <jrd(a)slack.com> which has your name and email address. Most of the time you'll just use an abbreviation and let pgp figure it out. To send your key to someone else, once you've generated it, type "pgp -kx Dobbs filename" and it'll create a file you can mail somebody else which will let them encrypt stuff to you. To decrypt a file you got from someone else, type "pgp filename", which will do the right thing for decryption, checking signatures, receiving new keys, etc. To encrypt a file to someone else, type "pgp -e filename theirname" and pgp will create a file called filename.asc (or filename.pgp if you don't have the ascii-armor option set, which you should.) To sign a file to send somebody, type "pgp -s filename", which will do the same, and there are various options you should read in the manual. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0