December 2003 - cypherpunks-legacy

Re: MIT distributing PGPfone -Reply
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

>PGPfone was out of the U.S. less than 3 hours after first appearing >publically at the MIT site. > >As I noted in a previous message, MIT takes various steps to ostensibly >protect against export, but there is clearly no practical means of stopping >export once the software has been received by someone. > >I got my copy of PGPfone 16 hours after its public release, via an >anonymous person who posted it on the Cypherpunks list through an anonymous >remailer. Of course that list is distributed to more than 20 foreign >countries, so "export" happened that way, as well as by other means. > >--Tim May > As tim May's .sig should say: "National borders are not even speed bumps on the information highway." Buford C. Terrell 1303 San Jacinto Street Professor of Law Houston, TX 77002 South Texas College of Law voice (713)646-1857 terrell(a)sam.neosoft.com fax (713)646-1766

1 0

Re: PGPfone over Appletalk
by Hal 17 Dec '03

17 Dec '03

From: "Rev. Mark Grant" <mark(a)unicorn.com> > Can someone tell me how to run PGPfone over Appletalk ? The > documentation says that support has been added for this release, and > there's a preferences box to check to use it, but there's no information > I can find in the documentation on how to initiate a call over > Appletalk.. it just says to enter a telephone number to dial. If I > press 'Connect' without entering anything it hangs up the Mac. > > How do I tell it which machine I want to connect to ? I changed the preferences box setting, but then I exited and restarted the program so that it came up in "appletalk" mode. This is probably the step you are missing. I did this on two different machines, and then when I clicked connect it no longer tried to open the modem, instead it put up a dialog box allowing me to click on the machine running the other PGPfone. I did that and it connected OK. There is a nice audio simulation of an old-fashioned telephone bell ringing. Unfortunately my appletalk "network" consists solely of my power mac and an old 68030 mac laptop, the latter apparently being underpowered for PGPfone. The voice quality changed occasionally as the software adaptively tried different coders, and the powermac instance of the program finally printed a message saying that the list of coders had been exhausted. Hal

1 0

Quickly checking signatures
by Hal 17 Dec '03

17 Dec '03

Let me describe Shamir's method for quickly doing a probabilistic signature check. Since this was a rump session paper he didn't have it written up. Shamir uses a variation of the Rabin system. The Rabin encryption system is similar to RSA, but instead of exponents which are relatively prime to the predecessors of the factors of the modulus, the exponent used is 2. This requires somewhat different techniques. A message M is encrypted by doing M^2 mod n. The decryption is then done by taking the modular square root. There are a few technical hitches that occur here but nothing major. Similarly a message M is signed by calculating its modular square root S such that S^2 = M mod n. Note that with Rabin you can't just sign any arbitrary number as that may allow the factors to be revealed. However this is not a major problem because practical systems in use today sign specially padded hashes, not arbitrary numbers. Now Shamir uses a slight modification to this. Normally we have: S^2 = M mod n This can be written as: S^2 = M + C*n for some C, which is simply the definition of modular equality. Now, what he suggests is that instead of sending S as the signature of M, you send C. This is justified on 3 grounds: - C is the same size as S - C has the same security as S (knowing M and n you can derive C from S and vice versa) _ C and S are equally easy to generate However, by sending C as the signature of a message M it allows a fast screening to be done. The idea is that the message should be accepted if M+C*n is a perfect square (because then S can be derived as the normal square root - that is how you get S from C as mentioned above). And this is something that can be checked quickly. In number theory there is a notion of a "quadratic residue" modulo some number. If a number is a quadratic residue that simply means that it has a square root, that it is the square of some other number using the modulus. With a prime modulus half of the numbers are quadratic residues and half are not. For example, with modulus 7 the q.r.'s are 1, 2 and 4 and the non q.r.'s are 3, 5, and 6. It turns out that testing whether a number x is a quadratic residue modulo a prime p can be done by calculating x^((p-1)/2) mod p. This will be 1 if and only if x is a q.r. Now, the key idea is this: if a number is a perfect square then the result of taking that number modulo a prime must be a quadratic residue. This means that we can quickly determine that C is a perfect square by checking whether C mod p for various random small primes p is a quadratic residue. By picking p to be a single precision prime of say 16 bits, the q.r. calculation can all be done without using multiple precision arithmetic and so it will be very fast compared to actually checking a signature. So, the procedure for the check is as follows: given n, M and C, choose a small prime p and calculate M+C*n mod p. Then raise this to the (p-1)/2 power mod p and see if the answer is 1. If it is, we give a "provisional" acceptance to the signature. If it is not, we reject the signature; it cannot be valid. This test may be repeated a few times with different values of p to improve the rejection of bad signatures. Once we have taken the input numbers mod p the rest of the arithmetic can be done with ordinary single precision integer variables. (One thing I overlooked is the possibility that M+C*n will be a multiple of p. In that case M+C*n mod p will be 0 and this is a provisional pass.) Of course checking the signature the old-fashioned way just takes a single multi precision multiplication, which won't be all that slow. So this puts a limit on the number of p's you can check this fast way before it becomes slower. Also, you'd have to choose the primes at random as otherwise an attacker who knew your p's could conjure up a C which would produce a quadratic residue for some small number of known p's. Hal

1 0

Re: David Downey asks to be shot
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: > > At 6:23 AM -0700 8/19/97, David D.W.Downey wrote: > >blackjack(a)hotmail.com wrote: > >> Saw your post in the newsgroups. > >> Check this out! > > Ya know, this shit really pisses me off. I understand that we have to > >protect everyone's rights if we wish are own to be protected. > > I understand that we have to protect the enemies' > >rights too, but can't we just shoo a few of them first? Lowers the > >numbers needing protection and might help us out in the end. > I agree. We should shoot a few of the enemies first. > I suggest you be shot. Better yet, let's shoot the people "needing protection." Once they're dead, there will be no need for all those laws designed to protect them. What a brilliant idea! I'll probably get the Nobel Peace Prize for this one! FuckingForVirginityMonger

1 0

SUMMARY: Not-so-volatile volatile memory
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

About a month ago, I asked for comments about recovering data from semiconductor memory after power had been removed. After much procrastinating, I've finally finished the summary of what people sent me. Many thanks to everyone who responded, in particular to Bob Hale for answering many questions about the possibility of recovering data from DRAM's. If anyone has any further comments to add to this (I'm particularly interested in actual figures for data retention in DRAM cells, although I've been told this is burn-before-reading proprietary information), you can send it to me at the above address. Peter. -- Summary: Data retention in semiconductor memory -- Contrary to conventional wisdom, "volatile" semiconductor memory does not entirely lose its contents when power is removed. Both static (SRAM) and dynamic (DRAM) memory retain some information on the data stored in it while power was still applied. SRAM is particularly susceptible to this problem, as storing the same data in it over a long period of time has the effect of altering the preferred power-up state to the state which was stored when power was removed. Older SRAM chips could often "remember" the previously held state for several days. In fact, it is possible to manufacture SRAM's which always have a certain state on power-up, but which can be overwritten later on - a kind of "writeable ROM". DRAM can also "remember" the last stored state, but in a slightly different way. It isn't so much that the charge (in the sense of a voltage appearing across a capacitance) is retained by the RAM cells, but that the thin oxide which forms the storage capacitor dielectric is highly stressed by the applied field, or is not stressed by the field, so that the properties of the oxide change slightly depending on the state of the data. One thing that can cause a threshold shift in the RAM cells is ionic contamination of the cell(s) of interest, although such contamination is rarer now than it used to be, because robotic handling of the materials and the purity of chemicals is greatly improved. However, even a perfect oxide is subject to having its properties changed by an applied field. When it comes to contaminants, sodium is the most common offender - it is found virtually everywhere, and is a fairly small (and therefore mobile) atom with a positive charge. In the presence of an electric field, it migrates towards the negative pole with a velocity which depends on temperature, concentration of the sodium, the oxide quality, and the other impurities in the oxide such as dopants from the processing. If the electric field is zero and, given enough time, the sodium contamination tends to spread itself around evenly. Other factors which affect the rate of change are temperature, the field strength of the stored charge, the quality of the oxide, and the concentration of dopants and other impurities which have already been mentioned above. The stress on the cell a cumulative effect, much like charging an RC circuit. If the data is applied for only a few milliseconds then there is very little "learning" of the cell, but if it is applied for hours then the cell will acquire a strong (relatively speaking) change in its threshold. The effects of the stress on the RAM cells can be measured using the built-in self test capabilities of the cells, which provide the the ability to impress a weak voltage on the storage cell in order to measure its margin. Cells will show different margins depending on how much oxide stress has been present. Many DRAM's have undocumented test modes which allow some normal I/O pin to become the power supply for the RAM core when the special mode is active. One way to activate the special test mode might be to underdrive a pin and turn on its protection diodes(s), which will be recognized internally and will change a multiplexer so that the core is powered by some pin which is normally a digital I/O pin. Another way, if the DRAM has suitable clocks, is to recognise an invalid combination of clocks (such as CAS before RAS, if the DRAM doesn't use that mode for higher speed operation) to enable the test mode. Great care must be taken to ensure that the test mode isn't inadvertently entered so that the memory system appears to be malfunctioning (for example in the first case if the system has substantial undershoot at the wrong time, the test mode could be activated). This problem can be avoided by designing the test mode signals such that a certain set of states which would not occur in a normally-functioning system has to be traversed to activate the mode. Manufacturers won't admit to such capabilities in their products because they don't want their customers using them and potentially rejecting devices which comply with their spec sheets, but have little margin beyond that. One way to speed up the annihilation of stored bits in semiconductor memory is to heat it. Both DRAM's and SRAM's will lose their contents a lot more quickly at Tjunction = 140C than they will at room temperature. Several hours at that temperature with no power applied will clear their contents sufficiently to make recovery difficult. Conversely, to extend the life of stored bits with the power removed, drop the temperature below -60C (some people even claim that you can permanently "imprint" an SRAM with its stored bits by rapidly cooling it below liquid nitrogen's boiling point). In any case it should lead to weeks, instead of hours or days, of data "retention". Simply repeatedly overwriting the data held in DRAM with new data isn't nearly as effective as it is for magnetic media. The new data will begin stressing or relaxing the oxide as soon as it is written, and the oxide will immediately begin to take a "set" which will either reinforce the previous "set" or will weaken it. The greater the amount of time that new data has existed in the cell, the more the old stress is "diluted", and the less reliable the information extraction will be. Generally, the rates of change due to stress and relaxation are in the same order of magnitude. Thus, a few microseconds of storing the opposite data to the currently stored value will have little effect on the oxide. Ideally, the oxide should be exposed to as much stress at the highest feasible temperature and for as long as possible to get the greatest "erasure" of the data. Unfortunately if carried too far this has a rather detrimental effect on the life expectancy of the RAM. Therefore the goal to aim for when sanitising memory is to store the data for as long as possible rather than trying to change it as often as possible. Conversely, storing the data for as short a time as possible will reduce the chances of it being "remembered" by the cell. Based on tests on DRAM cells, a storage time of one second causes such a small change in threshold that it probably isn't detectable. On the other hand, one minute probably is detectable, and 10 minutes is certainly detectable. The most practical solution to the problem of DRAM data retention is therefore to constantly flip the bits in memory to ensure that a memory cell never holds a charge long enough for it to be "remembered". While not practical for general use, it is possible to do this for small amounts of data such as encryption keys.

1 0

Unclear on Bell / Re: The Real Bell Issue / Re: Bell, etc
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: > One lesson, or reminder, I take from the Bell matter is this: > > Avoid doing stupid and petty things like using multiple Social Security > numbers, evading taxes, and releasing stink bombs into government (or > other) offices. > > (These are things Bell has pled on, as I recall the transcripts, so > there's little doubt about them. And had he pled not guilty and gone to > trial, apparently the evidence would've convicted him on most of the > charges. Perhaps this is why he pled.) I am unclear on something. Did the government imprison without bail a citizen who evaded taxes and made a government office smell bad, or did the government allow a terrorist who was actively plotting to overthrow the government to plead guilty to inconsequential charges? If I get arrested for plotting to Nuke D.C., should I hire Bell's lawyer and try to get it reduced to jaywalking? Or should I avoid jaywalking to prevent getting arrested for plotting to Nuke D.C.? ???Monger

1 0

Re: David Downey asks to be shot
by nobody＠neva.org 17 Dec '03

17 Dec '03

William H. Geiger III wrote: > Tim May <tcmay(a)got.net> said: > >At 6:23 AM -0700 8/19/97, David D.W.Downey wrote: > >>blackjack(a)hotmail.com wrote: > >> > >>> Saw your post in the newsgroups. > >> > >> I understand that we have to protect the enemies' > >>rights too, but can't we just shoot a few of them first? Lowers the > >>numbers needing protection and might help us out in the end. > >>Grrrrrrr!!!! > > >I agree. We should shoot a few of the enemies first. > > >I suggest you be shot. > > I'll second the motion shall we put it to a vote?? :) I vote one bullet. Motion carried. BulletMonger

1 0

Re: O.J. ObCrypto: Fuhrman's Folly Fans Fakery Fears...
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

BS> For the problem that started this discussion, though, there's no good solution. BS> Since the Bad Guys _can_ encrypt a message to you with your signature key, BS> and send it to you by anonymous remailer, they can plant a reason to suspect BS> that you may have evidence encrypted with that key. You've got it backwards. The problem that I originally posited was a corrupt key escrow agent using my signature key to forge a document. The fact that my signature pubkey could be used to encrypt messages to me is not particularly relevant. My employer could set up filters to keep me from recieving email on company time that is not encrypted to a key that the corporate escrow authority has in its possession. NBD. My concern here is with the NGACK situation. Companies have valid reasons to want escrow for their own purposes. I'm just warning people not to accept a signature key being escrowed by =anyone=. When you create a key to be escrowed, make sure the userid includes something like [Not Valid For Signatures]. * Pro Choice on Abortion. * No choice on Education. * Huh? --- * Monster(a)FAmend.Com *

1 0

24 Hour CASH Grab is on......$$$$
by Important.News＠mail.impulse.net 17 Dec '03

17 Dec '03

$$$ 24 Hour CASH grab is on !! ... $$$ Want to fill your mailbox with CASH and orders right away ? You can. Just take advantage of this once in a lifetime CASH grab by stuffing your ad in 1 million emailboxes! That's 1,000,000 ! Cash, money orders and checks could start filling your mailbox in a few days! The profits and results can be mind boggling. Bargain Cellar does it again ! Our techniques have been so successful that they are being mimicked by others in their ad pitches. However, NO ONE has the targeted primary service lists that we do. If you're looking for a way to succeed NOW, the following chance of a lifetime is for you.. You've seen what other services charge- many charge 10 times this amount and more. Retail email ads that make it tough for you to get a running start on the way to success. NOW...For the First time EVER ,, email ads to big lists are affordable for everyone.. One advertiser reported regularly receiving an average 12 orders a day during a run ! Just read what a few say about us.. " I have tried other bulk email services. Yours is the first that really cared about my success...I am pulling responses like crazy! The checks are coming in.. You have a customer for life !" C.H. "Working with your business gave me hope that I could succeed....I was about to give up...now I have more orders than I ever hoped for....Your techniques and advice have made the difference..you mean what you say" HR, Ca. SPECIAL Limited Offer.. 24 HOURS ONLY !! Your ad sent to : 1million email addresses- $69.95 ! Now LOOK at this ! GUARANTEE- All ads postmarked within 24 hours of reading this message will reach 1 million email addresses in the order of receipt. Our lists are all professionally filtered for maximum positive response. THIS IS A ONE TIME OFFER ! Order Form. Name________________________________ Address_____________________________ City______________________State_____ Zip______________ EMAIL ADDRESS (( VERY IMPORTANT )) Please Note: We will not add your email address to our list. Ad copy ( Place your ad below) Please run my ad (above) according to the terms checked below. ____I am postmarking my order within 24 hours Enclosed is my check or money order for $_____________ Please make all checks payable to : Bargain Cellar Internet Advertising Dept. 1125 Lindero Cyn Rd Dept A8241 Thousand Oaks, CA 91362 ................................................................. Money Orders get immediate processing and ad runs ! Checks will be processed for payment prior to any ad being sent. We will not knowingly accept any ads which involve illegal or pornographic material or reference. Thank you and Welcome to Success ! Bargain Cellar All Rights Reserved 1997

1 0

Re: A problem with anonymity
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

TC> Oh, I agree, of course. Except that the escrow agent need not be a TC> "nonymous" agent, to use Monty's terminology here. Sorry, my Greek is rusty. Shoulda been "onymous", I suppose. But if the escrow agent is anonymous, we simply recurse, moving now to the question of whether anyone can trust the Anonymous Escrow Agency not to take the money and run. TC> (I mention banks because, when you look at it closely, today's banks can TC> quite easily claim that a customer made a withdrawal when he didn't. That TC> they don't says more about the nature of persistent businesses than about TC> any government oversight or security features. This is a side point, but it TC> bears keeping in mind that the real world of banks and businesses, etc., is TC> not fully secure, either. And yet it mostly works pretty well. The reasons TC> for this are interesting to consider.) A bank has $$ invested in impressive-looking buildings, (so that vanishing into the ether and setting up shop elsewhere is rather difficult) and several officers whose TrueNames are registered with the appropriate agencies, so that they may be sued if they pull this crap. While individual stockholders might appreciate the anonymity (and protection from legal action) of owning stock in a bank or escrow agency (might just combine the functions, while we're at it), they demand onymity of the officers with whom they entrust the keys to the corporation. * --- * Monster(a)FAmend.Com *

1 0