December 2003 - cypherpunks-legacy

Re: There's a hole in your crypto...
by Rich Salz 17 Dec '03

17 Dec '03

> The emergence of NSA >from absolutely secret agency to semi-public status (writing letters, >P.R. concerns, opening a museum, etc.) at the same time as the general >availability of what's considered by many [including me] to be strong, >free, cryptography "for the masses" is interpreted by many [including me] >as an implicit NSA comment on the availability of strong crypto in >general, and on the availability of PGP in particular. Call me stupid, but what is the implicit comment? /r$

1 0

Re: There's a hole in your crypto...
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- On Thu, 3 Aug 1995, James Childers wrote: >On Thu, 3 Aug 1995, Jim Ray wrote: > <snip> >I'm afraid I don't follow. Are you saying that the NSA is assuming a more >public role because (apparently) stong crypto is now widely available to >the public? yep. Sorry if I was unclear. Possibly even the recent Rosenburg revelations are related, though they were reported in the media [in Miami at least] as coming from "the CIA" rather than from the NSA. <sarcastic, unspoken, thoughts about "The Herald" here> >I don't see the connection between A and B if this is what >you are claiming. I do, but I am told I'm "paranoid." If I were running the NSA, I would _NOT_ leave an obvious connection anyway, but those who know me say I'm not exactly "NSA material." ;-) > >Unless they're gearing up for a PR campaign... Which is my theory. "They," for me, includes FBI director Freeh, whose post OK City mass-murder paranoid anti-crypto comments I saw on C-SPAN. [Hence my PGP comment below.] >I wonder how the NSA has >been portrayed in Hollywood in the past. I've just seen them mentioned in >one movie I can think about ("Crimson Tide"). Anyone else know of references? Sorry, I'm almost movie-illiterate these days, but I do plan to see "the Net" soon,and I promise NOT to post my "review" unless I can add anything meaningful to the previous ones, which is doubtful.<g> > >"Freedom is meaningless unless you can give to those with whom you >disagree." - Jefferson <partial snip> Agreed. "Liberty is like love, in that you can't have any until you give it all away." [Unknown author, aprox. quote] JMR - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMCE+5W1lp8bpvW01AQFV8QQAmW853KKBf9xba6B1/+reAAT1wu/UQD+f ly8hNMen1NQWEERHJ5fyGOmC0oikJ3tepzh+5KLfegOTLqkZ8/omnYj2euKFNlVH uSLs/f0PuLMWnPvpv/ntSVheJ8xA4u/PEz+WspLDKg7+nm/E4BP1Rb6PM79wsdKE fb3wRuOcCmY= =K5fD - -----END PGP SIGNATURE----- Regards, Jim Ray "The people will again respect the law when the law again respects the will of the people." Jim Ray, Campaign '92 - ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 - ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMCFHgioZzwIn1bdtAQHcbwGAxhmZ8SCA9eF5WGGVNVOnudcqmkyHtrsn inY/IoGrB8maPP4h/IdGzVrdddcOCkpH =Gz8W -----END PGP SIGNATURE-----

1 0

Re: Java, Netscape, OpenDoc, and Babel
by strick at Jihad 17 Dec '03

17 Dec '03

> But in which framework or language, given the profusion of frameworks and > languages? > > We had some TCL advocates a while back (Strick, Hal...)...any reaction to Java? TCL solved my specific problem at that time. Unfortunately I haven't studied Java. PM's comments (as usual) intrigue and bother me; I need to study it. TCL's biggest problem is that it's slow -- it's designed to be used in the parts where speed doesn't really matter -- and it sounds like java sovles that. Perry -- do you have the same basic objection to Safe-TCL that you do do to Java? I would think so. strick > And so it goes. > > --Tim May

3 2

Re: There's a hole in your crypto...
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Rich Salz wrote: <snip> >Call me stupid, but what is the implicit comment? I'm not sure, and I do not wish to speculate just now, with so many people on this list who are so much better qualified to speculate on the NSA's motivations than I am. Perhaps my word "implicit" was poorly chosen. Anyway, going from silence to non-silence counts for _something_, and I doubt this kind of step was taken without high level thought or consul- tation or infighting, considering the NSA's former near-monopoly on strong cryptograpy capabilities. <snip> PS I doubt *anyone* on this list is stupid, though all of us probably do stupid things from time to time... ;-) JMR - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMCFYTm1lp8bpvW01AQGWYgP+NRdp4rfJ2PhFdiKQkOH1W9mV74l1Z7c9 hiPCLKbdkl8uq3lc53cS57wibF6XsuF2+cfcImsT2I0/C3jvijOgVOD917XJJrul CbD9yEUuYL0DTeCc+pUSvdNiAsaKzXgaZE99d0tyHgo6Y3VTUMkP911kpyHrSCHF aOWAJFTu+CM= =XSiz - -----END PGP SIGNATURE----- Regards, Jim Ray "The people will again respect the law when the law again respects the will of the people." Jim Ray, Campaign '92 - ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 - ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMCFayCoZzwIn1bdtAQHXjgGArZLvrCRLpWOGf9CEwPJw+599uR/1UTir kZBwiMrsg724XmEgTnpZYD6bvISv8Fdw =X31m -----END PGP SIGNATURE-----

1 0

Appropriate Topics?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 8:35 PM 8/3/95, Ray Cromwell wrote: >> Good idea. >> >> I would have some suggestions, but first >> an important question: >> >> Is it to be discussed on the Cypherpunks list? > > I don't see why not. It's related to crypto, and it's related to >writing code. Or has the cypherpunks list degenerated into an arena >where the top subjects are the Waco hearings, paranoid government/NSA >rumors, US vs German censorhip, and irrelevent political messages? As I see things, talking about Ray's ideas for an object-oriented crypto library is a big part of what this list is for. (Ditto for Wei Dai's code, for Hal's code, and so on.) However, it's a mistake to think that the _only_ thing appropriate for the list is talking about code (of either kind). Not that Ray said this. It seems to me the list is pretty well-balanced between several different kinds of topics: * crypto -- RSA, Diffie-Hellman, entropy, randomness, denial of service attacks, and so on. * software -- PGP implementations, hooks to other programs, MIME, Unix, C++, Java, TCL, etc. * policy -- Exon, EFF, Perl t-shirts, law, export, etc. (The worst of these are the long policy analyses forwarded to this list from other places.) * cultural -- movies with crypto or security themes, books, comments, humor, etc. * speculation -- tax effects, money laundering, crypto anarchy, etc. * rants and conspiracies -- coverups, NSA, Waco, black helicopters, Masons, etc. (the worst of these rants are long, rambling conspiracy theories forwarded to this list from other places...these are probably the items that least belong here). (Note that the two serious problems--policy statements and conspiracy rants forwarded from other places--share a common point: they are not written for the Cypherpunks list by Cypherpunks...they are just stuff forwarded, with only tangential interest to the list. And they tend to be long.) Are these themes appropriate? Some folks want to read posts on one topic, some on others, etc. It's a fact that highly-specialized or detailed posts about, say, crypto libraries, will not get as many general comments--in real life or on this list--as a reference to a current movie will get. That's the nature of things. I could go on about why this is so, but I think you all know why. The "Cypherpunks write code" mantra, sometimes cited by those who dislike the discussions they see, has a broader interpretation. To wit, instead of asking others to write the code you want to see, try writing it yourself. And this directly relates to postings: instead of asking for a different kind of post, one should just _write_ that kind of post! People will talk about what they want to talk about. If they get _too_ far off into themes only distantly related to the ostensible themes of this list, then usually some slight peer pressure will work. Plus, if people don't respond, the threads die. The noise messages of the form "This is not about writing code; this does not belong on Cypherpunks" are misguided. The list is made up of people who have crypto and privacy concerns broader than just writing C++ code for Sparcstations. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

the Mix-L mailing list
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, I just discovered earlier this morning that in transitioning to a newer version of the FreeBSD OS, the majordomo code that runs the mix-l mailing list had become slightly broken. I'm not sure if subscription requests were being processed correctly. The list is fixed now. If you have tried to subscribe to mix-l in the past and have gotten no response, please try again. send email to majordomo(a)jpunix.com with the BODY (not subject) of the message being: subscribe mix-l if you are interested in knowing about the goings-on with the development and operation of the Mixmaster remailer code. - -- John Perry - KG5RG - perry(a)jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMCFgvaghiWHnUu4JAQGijQf+LfBnZZh9SBNg+X16FFrqugMdoiTljXRV 09SQ5bzw31a6eZ3GMNhZpkCP4oYu/f6bYELJiWeAuBXc6BUGP8TsUDRR2ydYeZyv Pl5u/JBmozu3KQx05b+E3RscQcVVqWxy2zZGNri0eA6yKt9yd3HvuCzBWIFQflov /CkhA/Y3HalcNNc2jzQkdiwufSK8ke/N020su25UYg1foIeHL7Zc0mskHAILcsjl 7wwqmVxgbXabdAETCZF8Hhv2czVHF0GXkXKOukW79j10R5ny0cOXf1r8nwBTLzvO XWjjcokOlYwrGIYtBAmtzbLbRy/VS9D7m56pqWb2y5nbBOV3E0Qp/w== =HfwW -----END PGP SIGNATURE-----

1 0

SuperMac Sentinel: Customer Support tale
by Russell Whitaker 17 Dec '03

17 Dec '03

jfg(a)fuente.engr.sgi.com (John Gibbon) wrote: >I got this from a friend, who got it from a friend, > who got it from a friend ... > > -------------------------------------- >SuperMac records a certain number of technical support calls at >random, to keep tabs on customer satisfaction. By wild "luck", they >managed to catch the following conversation on tape. > >Some poor SuperMac TechSport got a call from some middle level >official from the legitimate government of Trinidad. The fellow spoke >very good English, and fairly calmly described the problem. > >It seemed that was a coup attempt in progress at that moment. However, >the national armoury for that city was kept in the same building as >the Legislature, and it seems that there was a combination lock on the >door to the armoury. Of the people in the capitol city that day, only >the Chief of the Capitol Guard and the Chief Armourer knew the >combination to the lock, and they had already been killed. > >So, this officer of the government of Trinidad continued, the problem >is this. The combination to the lock is stored in a file on the >Macintosh, but the file has been encrypted with the SuperMac product >called Sentinel. Was there any chance, he asked, that there was a >"back door" to the application, so they could get the combination, >open the armoury door, and defend the Capitol Building and the >legitimately elected government of Trinidad against the insurgents? > >All the while he is asking this in a very calm voice, there is the >sound of gunfire in the background. The Technical Support guy put the >person on hold. > >A phone call to the phone company verified that the origin of the call >was in fact Trinidad. Meanwhile, there was this mad scramble to see >if anybody knew of any "back doors" in the Sentinel program. As it >turned out, Sentinel uses DES to encrypt the files, and there was no >known back door. The Tech Support fellow told the customer that aside >from trying to guess the password, there was no way through Sentinel, >and that they'd be better off trying to physically destroy the lock. > >The official was very polite, thanked him for the effort, and hung up. >That night, the legitimate government of Trinidad fell. One of the >BBC reporters mentioned that the casualties seemed heaviest in the >capitol, where for some reason, there seemed to be little return fire >from the government forces. > > > -- Russell Earl Whitaker whitaker(a)sgi.com Webmaster, Silicon Junction Silicon Graphics, Inc. Mountain View, CA =============================================================== http://reality.sgi.com/employees/whitaker

1 0

Re: Java, Netscape, OpenDoc, and Babel
by Rich Salz 17 Dec '03

17 Dec '03

>Perry -- do you have the same basic objection to Safe-TCL that you do >do to Java? I would think so. Safe-TCL comes from a different starting place. For example, the original intent was to actually remove all the dangerous operations such as file manipulation. As Perry's explained, this is different, and better, then just having the run-time "guarantee" that all file I/O is in a "Safe" place. Claimer: I invented safe-tcl, started by creating a mailing list with Ousterhout and Borenstein. Disclaimer: I walked away in disgust with the announcement of "enabled mail" so they may have broken things. /r$

3 2

Re: a hole in PGP
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

DF> How is it "unscholarly, unprofessional, needlessly personal, and just DF> plain insulting" to question the idea that hundreds of thousands of DF> people are trusting their freedom to software that is probably not ^^^^^^^^ This is where you go too far. You have no basis for assigning such a probability. While the incentives for releasing a crippled version are there, the program has been subjected to intense scrutiny. As time goes on, the failure to detect the kind of weaknesses you describe only increases trust in the algorithms. But if you are paranoid, get a hold of one of the international versions, use it to generate your keypairs, and then use MIT PGP to encrypt and decrypt your communications. Nobody can know what version you are using to make keys. Hell, if you are seriously paranoid, get the source code for key generation, and compile your own stand-alone keymaker. Post it to some .binaries thing via a remailer, and be happy that you foiled the dastardly plot. And send a copy to me, while you're at it. With source. I can compile my own from it that way. [Uh-oh. Sounds like "C'punks write code...."] * Everyone should have a cause. I have a cause. It's smut. I'm for it --- * Monster(a)FAmend.Com *

1 0

Re: EU Data Protection
by Kari Laine 17 Dec '03

17 Dec '03

> Date: Thu, 03 Aug 1995 13:25:25 -0400 > To: cypherpunks(a)toad.com > From: Duncan Frissell <frissell(a)panix.com> > Subject: EU Data Protection > Could I bother the members of this list with a request that anyone who has a > copy of (this week's or a recent) Computerworld, look and see if I'm quoted > in an article by Mitch Betts on the European Union's humorous decree on > Euro-wide data protection. I was interviewed last Thursday. The decree > (July 24th) threatens to cut off data flows to any nation that doesn't adopt > Eurosclerotic data protection standards. Excuse me - what the f**k is this? Does it bear some truth in it or is it just a bad joke? If it is not a joke where to get the damn text - thanks. Sorry for the language but this does sound just the thing I have heard some rumours of and which certainly would result in banning strong crypto. Regards Kari Kari Laine buster(a)klaine.pp.fi LAN Vision Oy Tel. +358-0-502 1947 Sinikalliontie 14 Fax +358-0-524 149 02630 ESPOO BBS +358-0-502 1576/1456 FINLAND

1 0