December 2003 - cypherpunks-legacy

Re: Forgery, bills, and the Four Horsemen (Articles and Comment)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199509052310.QAA10027(a)jobe.shell.portal.com>, hfinney(a)shell.portal.com (Hal) wrote: >This is not completely correct; there is a degree of anonymity in >DigiCash's ecash. That is anonymity of how a person spends his money. >Neither the bank nor the payor is in a position to learn who or where a >particular piece of ecash comes from (assuming that anonymous >communication means are used). So it is harder to compile dosiers on people. Big deal. The recipient can still determine who gets the goods paied for by the "anonymous" ecash by conventional means (hint: shipping address), so the payee anonymity is of little value as far as protecting the privacy of the payer (most likely the recipient of the goods) is concerened. Ecash of course is of *no* value for the various assasination markets, drug dealing, money laundring, etc that routinely get mentioned in the same paragraph as Ecash. The reason is the *full traceability* of the payee that has been deliberately built into the current version of Ecash. A "feature" that you may rest assured will be part of all future versions backed by anyone with even marginal reputation in the financial markets. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMEz/CyoZzwIn1bdtAQErdwGA3TrIYF5+O1EOQ+qdCyZRo8ePJnxmAAAl EeES8xBtWDBFwqUXTFRbj1hqLv9kwQ6K =7w8Q -----END PGP SIGNATURE-----

2 1

North American Crypto Archive status (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from Michael Paul Johnson ----- >From cpunks Mon Aug 11 00:38:22 1997 Message-Id: <3.0.3.32.19970810222548.00923ad0(a)teal.csn.net> X-Sender: mpj(a)teal.csn.net X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32) Date: Sun, 10 Aug 1997 22:25:48 -0600 To: coderpunks(a)toad.com From: Michael Paul Johnson <mpj(a)ebible.org> Subject: North American Crypto Archive status Sender: owner-cypherpunks(a)toad.com Precedence: bulk -- Start of PGP signed section. WHAT HAPPENED TO THE NORTH AMERICAN CRYPTO ARCHIVE? The North American Crypto Archive at http://www.sni.net/~mpj/crypto.htm is rather limited right now. I have deleted everything except the few files that I contributed to the site. This was to save money, since I suddenly lost some sponsors (who wish to remain anonymous, but I appreciate them greatly) who were paying for the costs associated with the site. I am still planning to resurrect the North American Crypto Archive, but this will likely take a while. I think that almost all of the files were successfully rescued before the site went down by at least one person. Note that much of what was there can be found by following the links at http://www.sni.net/~mpj/freecrypt.htm or by using appropriate search utilities. WHY RESURRECT THE NORTH AMERICAN CRYPTO ARCHIVE? 1. To provide a place for U. S. and Canadian citizens to freely and openly exchange cryptographic information, papers, programs, etc., without fear of government reprisals. 2. To provide a friendly central repository for cryptographic libraries, code, and papers, thus making it easy to find and use such information. 3. To provide a reasonably high bandwith connection for North Americans. 4. To exercise "freedom of the press" and press towards a constitutional EAR. HOW MUCH SPACE WILL THIS TAKE? My total archive space was at about 125 megabytes, but it had been trimmed from what I would like to have. For example, downlevel versions of software were generally deleted, and some things that are historically and cryptographically interesting were not carried. I forsee usage of around 500 megabytes or more in the near future if we can make room for it. The storage need not all be at the same site, however. HOW MUCH BANDWIDTH WOULD IT TAKE? I'd like to see at least ISDN connectivity. I've seen as many as 425 files downloaded in a day from the current archive. Again, the storage and loading need not all be at the same site. WHAT DO YOU MEAN BY NOT HAVING ALL THE STORAGE AT ONE SITE? I envision a new plan for running the archive such that one master index page (like the "export controlled" one at http://www.sni.net/~mpj/na) points to hidden directories all over the continent, wherever free space can be gleaned. The only requirements on the remote sites to maintain the "export controlled" status would be to maintain a cron job that changed the name of the hidden ftp directory containing the files on the same schedule and using the same key as used at the index site. For now, http://www.sni.net/~mpj/na can remain as the password-controlled index site. This does require a slight change to the architecture of the "export control" system in that the directory name would be a function of the current time (UTC) and a secret key, instead of being truly random like it is, now. The relative loss of security in this change is inisgnificant relative to the (obvious) weak links of the system. (Yes, I know that it can be defeated, but I also believe that the system complies with the EAR as well as most do, anyway.) The gain in this approach, of course, is that the index and ftp site need not reside on the same server, as long as the system clocks are reasonably well synchronized (within a few minutes). One other advantage of having several sites is that popular files can be placed on several different servers to lower the average traffic from any one server and to make the system more robust against failures and overloads. The archive would still have a single point of failure (at least initially) in the index site, but that could also be replicated fairly easily as long as users don't mind obtaining a separate password from each index site. WHAT REMOTE SITES DO YOU PLAN TO USE? I've had several people make inquiries or make offers, some of which sound better than others. I hope that this one open letter answers all of the questions that I got. I am looking for sites that: 1. Are *nix-based (at least for now). 2. Have some free disk space and bandwidth that can be used for this cause. 3. Have GNU C++ installed (or at least are identical to a host that I have access to that does). 4. Grant me access to a shell account and an ftp account to maintain the site. 5. Grant me access to cron so that I can have the hidden-directory renaming program run at the right schedule. 6. Are likely to be available for a reasonably long term. 7. Are in the USA or Canada and controlled by a U. S. or Canadian citizen. WHAT MAKES PEOPLE THINK THAT YOU WILL GET ALL OF THESE FREE RESOURCES? The same thing that makes me think that people will donate otherwise idle CPU resources for the fun of cracking a DES key or factoring very large numbers. HOW DOES THE "EXPORT CONTROL" SOFTWARE WORK? Ahh... here is the meat of the message that keeps it on topic for coderpunks and sci.crypt: First of all, it is important to understand the design restraints. The EAR states that mere posting of cryptographic software on the internet is not an export if guests must affirm a couple of things (see the regulations) and if there is some kind of check that the "address of the receiving computer is verified to be in the USA." Strict compliance with the latter is impossible, but if the guest's email address is in a domain not commonly used in the USA and Canada (.gov, .com, .org, .edu, .mil, .net, .us, or .ca), then I suspect the guest of lying and deny access. Naturally, this is imperfect, but it is honestly the best I could figure out how to do on a normal ISP shell account that gives me no CGI script access. This really boils down to the honor system. That is OK with me if it is OK with the U. S. Government, and the way I interpret the law, it is. Given that, here is the process: 1. http://www.sni.net/~mpj/usa is an html form that asks 3 "magic" questions to verify eligibility to legally access the strong cryptographic software, as well as the guest's email address. The 3 questions all default such that the user must change each answer to be granted access. The email address must be correct, because the user name and password are sent back via email, not as a web page. The "submit" button sends this data to cgiemail, an application that Colorado SuperNet does allow me to use. This form also invites nonqualified guests to explore most of the same data via http://www.sni.net/~mpj/freecryp.htm (links to crypto sites outside of North America). 2. When cgiemail gets the data from the above form, it simply formats the data using a template I supplied and mails it to me at mpj(a)csn.net. 3. I have an incoming mail filter that checks for any automated messages from cgiemail (which all have a rather long fixed hexadecimal number for a subject line), and processes them. If the guest answered all 3 questions properly, and the email address given doesn't "look foreign," then a form letter is filled in with a valid user name and password and mailed to the given email address. (There are some other checks, like limiting the email address to one destination, etc.) Noncompliant requests are simply discarded (since the "thank you" message from the submission form really already answered them). I thought about a courteous denial letter, but most of the bogus submissions also have bogus email addresses, so I decided not to do that. 4. If our guest can spell his or her email address right (among other things), then the email message directs him or her to http://www.sni.net/~mpj/na with a valid user name and password. 5. http://www.sni.net/~mpj/na is password protected using the security features of the Apache web server (as slightly tweaked by Colorado SuperNet). This is the index of the files in the archive, which are in a subdirectory of a hidden directory with a non-obvious name. 6. The hidden directory names are changed periodically to discourage the use or posting of a copy of the page at http://www.sni.net/~mpj/na without password protection. The idea is that by the time the cheater posted it and anyone found it, the hidden directory names would have changed again, invalidating the renegade index. The index is altered on the same schedule to the same new names by a companion program. (Right now the same program does both tasks, using a truly random number based on the arrival times and CRCs of all of my mail, but this would have to change in the new distributed archive model). IS THAT REALLY GOOD ENOUGH? I think so. It is the best export control model that I have seen that doesn't lock out U. S. and Canadian citizens in the U. S. A. and Canada. I saw a little more elaborate system on a Microsoft web site for distributing some 128-bit RC2 software, but it locked me out because it didn't like the way Colorado SuperNet registered their "whois" information. It also locked me out from work, since SSL connections can't get past our firewall. My model is much less likely to lock out a duly qualified guest, and it is much better than my old "warning message only" model that I used before crypto export regulations passed from the ITAR to the EAR. WHAT ABOUT CRYPTO SITES OUTSIDE OF NORTH AMERICA? Please keep them up, and be ready to mirror any information that might suddenly become legal to export from the USA on short notice. I say this because the EAR is being challenged in court, and it is likely that cryptographic software export regulations may be struck down. It is also likely that the U. S. Government may quickly move to replace those regulations with others in a very short amount of time after the EAR is struck down. I don't want to encourage anyone to violate currently active regulations, however. If you have a good cryptographic software site outside of North America, and it isn't on my list at http://www.sni.net/~mpj/freecrypt.htm, please let me know. WHAT IS YOUR PGP KEY? RSA key for PGP 2.6.x: ftp://ftp.csn.net/mpj/mpjkey.asc (mpjA) DH/DSS key for PGP 5.0: ftp://ftp.csn.net/mpj/mpjdhkey.asc (mpj(a)ebible.org) (Note that my RSA key uses mpj(a)csn.net for an address. That old address still works.) -- End of PGP signed section, PGP failed! ----- End of forwarded message from Michael Paul Johnson -----

1 0

Re: Scientology and police visit XS4ALL Amsterdam
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:09 9/5/95, announce wrote: [...] > Police and members of Scientology church enter offices of XS4ALL > ================================================================ I am wondering about the legalities of booby trapped computer equipment. Would it be legal if a clear warning to the fact was posted on the hardware? Interesting side note: a few months ago, several hundred 5 gallon containers of insecticide were stolen from the lot of an agricultural supply dealer here in California. The incident made a small note in the SF Chronicle. It was mentioned that the FBI is taking part in the investigation. What wasn't mentioned was that this insecticide is an ideal precursor to various forms of neuro toxins, namely Tabun and Soman, two types of nerve gas so vicious and toxic that even Hitler refused to approve their use. I predict that eventful times are just around the corner. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Emergency File Wipe Algorithim
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:47 9/5/95, Sameer R Manek wrote: >> May I also point out that the rules of economics do not apply to the >> federal government, since it insitsts - quite successfully - on having a >> monopoly on using lethal force to extract arbitrarily large amounts from >> hundreds of millions of working Americans? > >How do you figure the above? You only get to go to jail if you don't >pay taxes...then you can't pick up the soap. If aren't willing to pay your taxes, which by the way are nothing but forced labor for a large part of the year, it is unlikely that you are willing to spend the same or more forced time maufactoring license plates. If your resist that kidnapping and introduction into a slave labor camp that follows a "conviction" for not paying your taxes you will be forced to comply. If you then resist that force you will be killed. Chisel it in granite: the ultimate threat by which any government compels compliance is _always_ lethal force. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Shooting the taggers
by Alex Le Heux 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 22 Aug 1997 23:48:57 +0200, in list.cypherpunks you wrote: [...] >Here in Santa Cruz, graffiti spray-painted on the walls of businesses is a >big, and growing, problem. And laws require the businesses to paint over >the grafitti, or otherwise render it invisible, in a quick and timely >manner. (The idea is that the grafitti is offensive to the sensibilities of >others, or somesuch, and that it encourages rival gangs to counter with >their own grafitti.) > >And yet can J. Random Businessman defend his property against this >defacing? Nope. The cops say "Let us handle crimes." But they don't. > >There's a solution for taggers: snipers. [...] Grafitti is criminal (although many of us probably do things that are 'criminal' under some silly law or other), it is definately very annoying and I wouldn't like someone spraying it on my front door, but shooting people for it is a bit over the top I think. Grafitti (as in writing your name on or in something that you don't own) has existed for ages. Only since the invention of spraypaint has it become a big problem. Technology can also provide a solution. Surfaces can be treated so that grafitti can easily be removed. All this of course costs money, but that is, imho, the price of being part of a pile of millions of people, ie. a city. Another solution, which works very well for shopfronts over here, is to actually contract and pay a grafitti gang to spray the shops logo or whatever on the front (or steel blinds). Shooting people for this will probably only make them shoot back, which will ony result in overworked morgue employees and/or high hospital bills. Alex -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNABxOtuYAh4dUSo/EQJk2ACbBvQib5rPa4x2wykBPZbzS/8D2ZUAoMHX CBChEIemL4afO5M4hL7B8oJX =8989 -----END PGP SIGNATURE-----

1 0

National Labs Want Dole or Deal
by John Young 17 Dec '03

17 Dec '03

NYT reported yesterday on the national labs efforts to attract commercial clients to offset declines in national security funding, with Sandia being featured. http://jya.com/sandia.htm We've been receiving from Bill Payne, ex-Sandia cryptographer, a series of reports and letters on what's happening to enraged Sandia scientists and staff as the budgets decline and piddling new missions are sought, while facing the congressional threat to close all the labs and the entire Department of Energy. We'll offer one of the astute assessments shortly which describes the bind imported managers are in to turn the labs into dog-eat-dog corporate sweatshops, and how the not so dumb scientists are learning to fuck with the heads of the hatcheters, refusing to work, bickering, prolonging disputes, sabotaging projects, maybe/maybe not whispering secrets to bad people in other countries, or worst of all, disclosing vital national information to commercial interests, that is, outfox management by arranging a private deal. As the NY Times recently reported on the fearsome threats nuclear weapons scientists are making to keep funding coming, noting that the Russians are doing the same, all rather brilliantly saying: keep us "peacekeepers" doing the dirty work happy or suffer the consequences when the loyal patriotic guards go over the fence, or simpler, open the gates, that is sell the PAL codes, barter the diagrams, to maintain our "entitlement". Yep, the Sandia manager claims that the best and brightest scientists of the US believe that their dole should be for life. Or they are going to get very black market ammo oriented, that's market-Oriented. The Times editorialized today that the nation's leaders must not give in to nuclear blackmail from its own professional nuclear blackmailers. Yet who's going to pay the nuclear gunslingers if we don't? Eh, Mr. Crispin? What do you know that we don't and what will you charge to tell?

1 0

Key Certification by US Post Office
by Tweetpunk＠aol.com 17 Dec '03

17 Dec '03

Copious apologies if this is old news, but I just got a chance to read some mags from the last few weeks: An article in *The Economist* (August 5th-11th 1995 p56) reports that the United States Postal Service has plans to offer *electronic certificates of identity encoded to prevent forgery* It goes on to say that they are working with the usual suspects (Microsoft and Lotus/IBM) to get appropriate software included in their products. Future services include timestamping, multimedia kiosks in post office lobbies and e-mail print out and delivery services (for the connectivity challenged). I guess this puts a new twist on saying that PGP is an envelope for your e-mail. ------- Greg Anders tweetpunk(a)aol.com To have loved and lost liked Patsy Cline, it is better to have never loved at all.

1 0

Re: NSA says Joe Sixpack won't buy crypto
by Pat Farrell 17 Dec '03

17 Dec '03

Black Unicorn <unicorn(a)access.digex.net> writes: > On Tue, 5 Sep 1995, Jeff Simmons wrote: >> So what form of GAK or trap-doorodoes lotus notes contain? > No, it's just been so weak before the current implementation of RC4 (and > note the export version still has 40 bits) that it might as well be > nothing. Uni is right. Notes used RSA, which starts out fine. but it has nothing like PGP's passphrase to protect the private key. You can simply copy the "username.ID" file, and you can sign and encrypt messages with "username"'s nym. Of course, Corporate america loves Notes, which is why IBM bought it. Weak encryption for weak minds. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: CAST key size
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>Just a quick question on the keysize of the CAST algorithm. According to >the bible of Bruce, CAST uses a 64 bit keysize, while in the manual of >PGP 5.0 (page 89), Phill states that CAST uses a 128 bit keysize... > >Am I missing something? "CAST" isn't a particular algorithm, but a design process for creating algorithms. The particular CAST instantiation used in PGP 5 is either CAST-128 or CAST5, depending on who you ask. Other versions of CAST abound, including an earlier one used by MS for unknown purposes which had a 64-bit key, probably the one Bruce is referring to. Peter.

1 0

Lotus Notes vs. the Web and the Net
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:23 AM 9/6/95, Pat Farrell wrote: >Of course, Corporate america loves Notes, which is why IBM bought it. > >Weak encryption for weak minds. It may also signal that Lotus Notes has peaked, as IBM has a knack for "buying at the top." Interestingly, the current issue of "Wired" (morphed Aryanized OJ) says that Lotus Notes is tired, and Web-based groupware is wired. On this one I agree...and I've said this here on this list. Local groups, such as university departments, corporate departments, even entire corporations, can use the Web/Net in ways similar to what Lotus Notes provides (using their own LANs, or even the Internet, with suitable security steps). Granted, Lotus Notes currently has more stuff oriented towards groupware (from what I've been reading for several years, as I'm not a user), but I'd expect a huge amount of work on Netscape and similar browsers, and other Net systems, will make the Web/Net a more common groupware platform. I don't know this is so, but this is where I'd bet money. No way would I pay $3 billion for Lotus Notes! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0