December 2003 - cypherpunks-legacy

cyphertext-only remailers / cryptanalysis code ?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alex Strasheim writes: > One solution that I've thought about is only passing messages which are > composed of cyphertext. Does this make any sense? This sounds useful, but I'm curious how you would enforce it. I would think you'd need to do some nontrivial statistical analysis to be reasonably sure you weren't allowing various binaries, uuencoded files, etc. with faked PGP headers, without preventing people from using other encryption schemes. I'd say this is the flip side of the challenge faced by governments trying to outlaw transmissions using strong crypto. Incidentally, I'd love to get pointers to online pieces of code which perform various statistical tests on data to find patterns characteristic of particular encryption schemes, &c. for cryptanalysis. I want to cryptanalyze a couple of encryption algorithms and would like to do some experimental work. Please send me mail directly and I will summarize to the list later on. My starting points are Applied Crypto, the CEB, and Tim's Cyphernomicon. -L. Futplex McCarthy; use "Subject: remailer-help" for an autoreply PGP key by finger or server; "Better watch what you say, or they'll be calling you a radical...a liberal" --Supertramp "[CIA/KGB mole Aldrich Ames] took information in shopping bags out the front door" --miscellaneous Congressperson -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLtJ3tWf7YYibNzjpAQGOVwQApexTVG/PfeHNQcE+xr5lsCWxtnC13/EL GE8A8T77YavVQDUt3P7zWH8nw05OUosUgwe3QQKu+rRQGV1Y5dLcpxMQIk/iFSE1 3hMzZYCv6L6OQ0wyt8VOuEGmg8ffvBIod9C9i9PndmHZY73j3WPoSbDXLsBXlQu4 my8Oz2NLAP4= =Zxlu -----END PGP SIGNATURE-----

1 0

Guerilla Remailers
by anonymous-remailer＠xs4all.nl 17 Dec '03

17 Dec '03

> From: skaplin(a)skypoint.com (Samuel Kaplin) > Has anyone else given thought to "Guerrilla Remailers?" Basically someone > obtains an account on one of the freenets or similar free account, sets up > a remailer and lets it sit for a while. (Until telnet and/or phone logs > are overwritten) After this time frame the address of the remailer is > posted. The remailer then would be used until it is shut down by the Powers > that be. The account would be set up under a bogus name etc. This would I think such a scheme would be limited by how difficult it is to integrate the remailer software into the Freenet mail routines. Most Freenets (at least Toronto, Buffalo do) use a generic type of software, Freeport, developed by the Cleveland Freenet. I'd need other's comments as to how easy it is to configure the remailer software to integrate with the Freeport software that you get a working remailer. If that step is possible, then yes, it is certainly possible to set up a guerilla remailer. > make the remailer the ideal candidate for the last hop in a remailer chain. > (After all if they can't find Juanna DuBone or Jack Mehoff they can't apply Both Cleveland and Buffalo, at last check simply require you to send in a signed form (that you can capture when you log in) as to your age, address, etc. No photo ID (ie Drivers license etc) is required so a phoney account is relatively easy to set up.....I know...I had one on the Buffalo Freenet until certain anarchistic activities got it canned :>. However....here is another interesting point. I'm a Canadian, living across the border basically from Buffalo and Cleveland. Not only would the authorities be unable to do anything due to it being a phoney account, but being across the border would also place me beyond the pale of the U.S. authorities even if I actually was ever tracked down. All that would happen is the account would be shut down. Same for a U.S. resident utilizing the Toronto, Victoria or Ottawa Freenets. Overall, this is an interesting concept and I'd be willing to give it a shot. They key facet of it is whether we can configure the Freeport software with the remailer software.....or vice-versa.

2 1

Re: Brad Templeton, ClariNet, and remailers
by Alex de Joode 17 Dec '03

17 Dec '03

In article <aaf7ed2a000210042b2a(a)[17.205.6.17]> you stated: : I might be the (ex-)remailer operator in question. I find Brad's lack of : knowledge about remailers quite surprising in light of almost 4 hours of : conversation devoted solely to this topic, by telephone, over the course of : a month. My remailers have been used several times, to redistribute ClariNet articles, apperantly ClariNet has an "snitch"-line where people can mail to to get an reward, some people have the courtisy to inform the remail-operator that they have done so. I have *never* received any request for information from ClariNet. (maybe because my 5-line disclaimer says it all: the account used was an anonymous-remailer: so if you donnot like that, start your own !!) Regz, -- Exit! Stage Left. Alex de Joode <usura(a)xs4all.nl>

2 1

Re: DC-Net implementation
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

acspring(a)knoware.nl (Andrew Spring): > >Using a central node to coordinate the DC-net traffic requires that the > >participants trust that central node. If the central node is evil, > A collation of N-1 nodes will always produce garbage; the whole set is > needed for the message to fall out. > Example > ... > A sends 14 - 5 = 9 to Central node > B sends 5 - 11 = -6 Central nodes are not nice for various reasons, including the usual networking and security (trust) advantages of wide distribution. IAC a central node is not necessary; for example, if each node were to output to the next: B sends Anum XOR Brnd (XOR msg) to C where Brnd is B's random number, msg is B's message (if any) and Anum is the similarly generated output of A. This is much closer to the original DCNet _bit_ flipping - the first XOR checks for equality while the second commits the 'lie' In this case whatever number A gets from D is the output of the net. There are lots of interesting cryptographic sub-protocols to make too much trust unnecessary. I also believe that error-correction is best left to lower levels of the network - there's no need for a DC Net not to assume a reliable data channel. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: Voice PGP, When?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:37 PM 11/22/94 -0500, Perry E. Metzger wrote: >James Hightower says: >> I'm wondering if I should continue writing my own. > >Why not? Let a thousand flowers bloom... Remembering of course what happened when these words were last used seriously... ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Remailer FAQ?
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Anyone know of a Frequently Asked Questions on remailers? Where is it available? Thanks, -R --------------------------------------------------------------------------------- Reuben Halper I'm not growing up, I'm just burnin' out." Montclair High - Green Day - Montclair, NJ E-mail: fhalper(a)pilot.njin.net PGP 2.6ui Public Key available upon request ---------------------------------------------------------------------------------

2 1

HTML browser/editor for MS Word 6.0
by xpat＠vm1.spcs.umn.edu 17 Dec '03

17 Dec '03

>From PC WEEK, Nov 21, 1994, a summary: Bill Gates demonstrated an HTML browser/editor for MS Word 6.0. It is called Internet Assistant. It just entered beta testing, and will be available under the "What's New" heading of the Microsoft Home Page by the end of December, and later it will come with the 32-bit version of Word for WIN95. It will also include a viewer which will "display any Word document distributed across a network." I've read that the PGP code is not highly modular, but this is just one more indication of an OLE document centric universal editor based loosely on Word. I could eventually see their mail product calling most of the same code. Has anyone considered OLE compliant PGP encrypter/decrypter objects that would act on the contents of the document? A tool on this platform could be the most rapid path to widespread use of encryption. Almost everyone is able to use Word, and it comes bundled with a *lot* of new computers. And if it is OLE compliant, it can drop inside of your favorite OLE aware application. -pd-

1 0

Re: A Chance Encounter with Brad Templeton, of ClariNet
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Adam Shostack writes, incorrectly (:-)) : > Brad is in the 'intellectual property' business. He makes his > money selling access to information. There is an entire parasitic > class that does nothing useful, but makes money from the idea of > copyright. (Most entertainment industries operate like this. [ Economic and political descriptions and predictions deleted. ] Brad's really in the information collection, sorting, and distribution business, which relies primarily on contractual agreements rather than copyright. The newswire services, like AP and Reuters, sell their news stories to newspapers, who print them on paper, and don't redistribute the raw feeds to other places mainly for contractual reasons; otherwise the AP and Reuters would sell them news service. Sure, copyright laws reduce the number of newspaper readers who cut the stories out and sell them to newspapers themselves, but those cutout stories are something far worse than copyright violations - they're Yesterday's News, and hence not worth much. In Brad's business, he buys the wire service reports and sells them to *his* customers, who also agree not to redistribute them without paying Brad and/or the wireservices their fees. Anybody who rips off one of his stories is either violating a contract with Brad, or perhaps with his/her network provider, assuming the network provider has done a proper job of contracting about such items. Unlike newspaper stories, however, stolen Clarinet stories are Five Minutes Ago's news, which may still be worth something. As far as the Marxist-drivel "middlemen are parasites" argument goes, in old-style physical stuff businesses, you had workers who really made stuff, bosses who decided what stuff to buy and bought the raw materials, money-lenders who loaned money to bosses (*with varying splits of the risk), distributors and salesmen who helped stuff-users and stuff-makers get together, and truckers who brought the stuff to the users. NONE of them are inherently parasitic, and markets find ways to avoid paying for parasites because they cost more money than the "services" they may provide - the main parasites in those businesses were the folks who got their cut by threatening to use violence against people who didn't pay them - like tax-collectors and Mafiosi and some of the union folks (not most of them, most years.) In the information business, many of the same people are around, in similar functions. You've got information-generating workers, bosses, venture capitalists, salesdroids, distributors, internet-providers, and the like. The differences are fuzzier - sorting through information to find *interesting* information is somewhat like generation and somewhat like distribution. I tend to agree with Adam's dislike of "intellectual property", since having a copy of a piece of information doesn't deprive the original holder of his/her copy, and if it's an invalid concept, than some use of intellectual property laws (and the government force threat behind them) can be parasitic and abusive - but on the other hand, the so-called "parasites" are usually the information-generating workers themselves or folks who've paid those workers money in return for the privilege of exploiting their work - so be careful who you insult! In the music industry, the reason modern artists have much less need for the producers and distributors and moneylenders isn't because all those people are unnecessary parasites - they were there because they were providing useful services for the artists and/or consumers. The change is because technology has altered the economics of production and distribution, and the services that they used to provide, which were critical at the time, are less useful now because we have other ways to get similar functions done at lower cost. Bill Stewart, Anarcho-Capitalist for Sale or Rent.....

2 1

Re: San Diego CYPHERPUNKS symposium (11/30) ID & Fingerprint
by adam.philipp＠ties.org 17 Dec '03

17 Dec '03

>How is the person who stands up identified? If the group is small (I expect >less than 10 people) then there is no problem with handing a fingerprint and >a fist full of ID to each person at the table, one at a time. This worked quite well last time, also considering that many of the attendees seem to be repeats there is hardly a need to go through the permutations with every person present. I'll be the one wearing the black motorcycle jacket with a painting of Georgia O'Keefe's "Red White and Blue Cow Skull" on the back. I'll also be holding drafts of a handbook on intellectual property consideration for crypto-system developers/users. Don't ask for it until the meeting, it isn't nearly finished. Adam Philipp -- PGP Key available on the keyservers. Encrypted E-mail welcome. Sub rosa: Confidential, secret, not for publication. -Black's Law Dictionary

1 0

Re: cyphertext-only remailers / cryptanlysis code ?
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > One solution that I've thought about is only passing messages which are > > composed of cyphertext. Does this make any sense? > > This sounds useful, but I'm curious how you would enforce it. I would think > you'd need to do some nontrivial statistical analysis to be reasonably sure > you weren't allowing various binaries, uuencoded files, etc. with faked PGP > headers, without preventing people from using other encryption schemes. I'd > say this is the flip side of the challenge faced by governments trying to > outlaw transmissions using strong crypto. I realize I can't enforce this perfectly. My goal isn't to force people to use encryption, it's to cut down on my risk as a remailer operator. Basically, I'm going to make sure that there are headers, a pgp version number, and that there are no obvious problems with the text (ie. no whitespace, full length lines, etc.) Someone who really wanted to make trouble for me could still do it with my remailer, but I think that someone who wanted to mail death threats or post forbidden material would probably use another remailer as the final hop. Your letter has brought a fairly serious flaw in my plan, though: it's possible to simply ascii-armor a binary with PGP isn't it? A brief scan of the pgp docs hasn't revealed the command, so I can't tell what an ascii-armored binary looks like, but I'll be it's just like cyphertext. That means I'll probably have to read the ascii-armor if I want to do this. == Alex Strasheim | finger astrashe(a)nyx.cs.du.edu alex(a)omaha.com | for my PGP 2.6.1. public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtK6HBEpP7+baaPtAQGyCQQAkYssaS1iZ6KMJ3m4AKNLGbIAX3E7Bopq k39a+weRm6hzznbMoCHao5wcZ9V89tvgAg8aABxQ3wB894y71s9sAYs8J5GnbrBE fCqdxMfPxp+XaWh6pQO9ggDnw04eS5bFS1TPr4MeQumjMdx4CmcQegjhp5VNLSVH qZ7M9Q5x+hg= =utlk -----END PGP SIGNATURE-----

1 0