December 2003 - cypherpunks-legacy

Re: signing keys for nyms
by Bill Stewart 18 Dec '03

18 Dec '03

At 07:46 PM 8/21/95 -0600, Bryce Wilcox wrote: >Look, I don't have a lot of time here, but I need to say that this whole >"certifying anonymous keys" idea is misled. The fact is, *I* *don't* *care* >what your True Name is. > >I can only think of two reasons why you would need a person's True Name, >and I doubt that anybody here can apply either of these reasons to anyone >else here. > >Reason Number Uno, why you might want a person's True Name: > >Because you want to physically hurt them, or effectively threaten to hurt >them. (Or send someone else to do it, like a hit man, policeman, etc.) > >Reason Number Dos, why you might want a person's True Name: >Because you want to have sex with them. (Or as above, if you prefer to do it >through proxies...) > >Zimmermann et al. were/are naive to emphasize the Web of Trust as a means of >introducing strangers. With very few exceptions, strangers don't *need* >to verify each other's physical identities! This fact is central to some of >the more interesting social evolutions that information technology promises >to cause. In retrospect, the emphasis in "pgpdoc1.txt" on verifying True >Names via mutually trusted introducers will seem quaint. Reason number 0 why you'd want someone's True Nym - Because you've met them in person, or are a friend of a friend, and want to make sure that the key you think is for Mr. X isn't really the key for an imposter - if you've done Lefty Politics over the last few decades, this is not unrealistic. COINTELPRO may have been unreal and UnAmerican, but it happened. Now, trusting people based on mutually trusted introducers may have seemed quaint back in the 60s, and it certainly wasn't foolproof, and planting the suspicion that someone _might_ be a cop was almost as destructive as if they actually _were_ a cop. But it's what there was. (Ok, you had some extra sources of information, like whether the person actually paid all their organization dues (COP!) or smoked dope with you (and inhaled) or started advocating unreasonable violence (probable cop)...) That doesn't mean you checked government-issue ID from people or necessarily even used True Names; you could be dealing with people in person who you only knew as "Bill from Delaware" or "Bear" or "Jeanie from the Sierra Club", but at least if you only trust keys from introducers who know people in person, you're limiting your electronic conspiracy to people you would have conspired with in person as well. (Now, _I_ never bought drugs from Bear, and at this point I don't even remember his True Name - but I didn't turn him in, either...) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- "The fat man rocks out Hinges fall off Heaven's door "Come on in," says Bill" Wavy Gravy's haiku for Jerry

1 0

Divide and Conquer
by monty.harder＠famend.com 18 Dec '03

18 Dec '03

O > As you may have surmised Hal has given us another challenge to satisfy O > the people who want to do a challenge to see *how fast* they can do it O > by involving as many people and their computers as possible. Here's a thought or twelve: Precompute the divsion-of-keyspace problem, in advance of the actual issue of challenge. Use whatever criteria of estimating spare mips (idle_percentage * mips_rate) and allocating slices, then issue each participant a [start..end] space (and a direction flag. More on this later). That way, when the challenge is issued, there is no fumbling about, but rather a simple: "Gentlemen, start your programs." Divide the participants into two roughly equal groups of total spare mips, so as to address reliability and trust issues. Then allocate the entire keyspace twice. Later... For more fun, if the cracker can be coded to read a direction flag from the config file, so that the main loop can go ++ or --, the lists of keyspace could alternate thusly: Red Team Blue Team 0000++ 0000++ --iiii --jjjj This method of allocating keyspace iiii++ jjjj++ puts the key in the space of 4 --kkkk --mmmm different people at once, but only kkkk++ mmmm++ increases average search time by a . . . factor of 2 to protect against holes. / --0000 --0000 since the direction flag is independent of / \ (FFFF--) (FFFF--) team, it reveals nothing to a Bad Guy. / Two ways of saying the same thing. In effect, the ranges computed by the allocator are paired up, and the two people who share the range play "meet in the middle". If there are n participants in the group, and b of them are Bad Guys, the probablity of failure would be roughly (b/n)**4. * On a clear disk you can seek forever --- * Monster(a)FAmend.Com *

1 0

Re: Third World Man
by Peter Trei 18 Dec '03

18 Dec '03

> The US is slipping into the second world as we > speak, with no signs of a turnaround ahead. Only the sheer size of > the economy keeps people from believing it. Just a nomenclature peeve - I'm not sure of the precise time and place the (first|second|third) world meme originated, but it seems to predate 1970, and until very recently it's meaning was clear: First world: Western (and Westernized) nations - mainly the US, Canada, Western Europe, Japan, Australia, & New Zealand Second world: Communist bloc (I can still remember the Cultural Revolution. Prior to that, the Communists seemed a monolithic force, marching in lockstep.) Third world: The rest, mostly poor nations. Back then, the world was a simpler place. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

3 2

Re: DES & RC4-48 Challenges
by dan＠milliways.org 18 Dec '03

18 Dec '03

On Mon, 21 Aug 95 23:13:06 -0400 you wrote: > >Hello all, > > Lets face it the real challenge is DES, but those 56 bits are quite a >bit harder than 40. 65536 times harder in fact. > >40 bit code a tad and set to work. It sounds as if it is comparable to the >RSA-129 prime that was cracked (OK its probably a touch harder but machines are >faster now). > > So who wants to make an RC-48 and a DES challenge? Not having my copy of The Differential Cryptanalysis of the Data Encryption Standard handy, I'd like to know about the distributability of this type of DES attack. Done right, we could significantly reduce the time complexity. The main problem, of course, would be coordinating such an effort. I seem to recall this attack requiring lots of known plaintexts. Time to review the text, I suppose.... Does the Federal Reserve still use single-key DES? Dan ****************************************************************************** "I think, therefore I am" - Descartes Dan Bailey "I don't think, therefore I'm a moustache." - Sartre dan(a)milliways.org Worcester Polytechnic Institute and The Restaurant at the End of the Universe ******************************************************************************

3 2

Re: Entrust Technologies's Solo - free download
by Dave Hayes 18 Dec '03

18 Dec '03

Martin Pool writes: > Dave Hayes wrote: > > Sandy Harris writes: > > > What this scum is actually upset about is Chris Lewis cancelling > > > spam. He calls that "forgery" because the spammer's name goes > > > in the sender field of the cancel message. Nonsense. > > According to RFC 1036 forging cancels for articles that do not > > originate from your news site is not allowed. He is clearly in > > violation of the RFCs. Spam jihads are not sufficient reason > > to ignore internet protocols. > Spamming is a crime (theft of computer resources) I don't know that I can agree with that and still be for freedom. By that standard, so is posting or mailing "non spam" articles containing a topic that the owner of a recipient machine is not interested in. The magnitude of the theft is not relavent. > and sometimes such acts may be justifiable self-defense, such as > when I steal from my employer because they don't pay me enough, or > when I lie on my income tax forms because I want to keep my money > for myself. My point of focus is freedom. Deleting others' messages is not justifiable for -any- reason, IMO. If you have a problem with what is sent, you should take it up with the source of the transmission. The carriers of that transmission cannot care about the content and still profess to be "free" in any way. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet A person was frighteningly ugly. Once he was asked how could he go on living with such a terrible face. "Why should I be unhappy?", answered the man. "I never see my own face; let others worry."

2 1

Don't copy that floppy! Copyright bill roundup (7/30/97)
by Declan McCullagh 18 Dec '03

18 Dec '03

If you give your dad a "free" copy of Microsoft Word, you'll be guilty of a Federal felony, at least under some of the bills that have recently been introduced in Congress. I'm still reading through them, but here's what I've gleaned... Much of the debate will center around the so-called "LaMacchia Exemption," which basically means that non-profit copyright infringing is not a crime. It is, however, already a civil offense -- as the SPA is always eager to demonstrate. I wrote about this recently: http://cgi.pathfinder.com/netly/opinion/0,1042,1107,00.html HR2265: Introduced by Rep. Bob Goodlatte on July 25, the "No Electronic Theft Act" would eliminate the LaMacchia Exemption. If you give pirated software to a friend (exchanging "anything of value" including "other copyright works"), beware. For the first offense, assuming the software is worth at least $5,000, you get three years in the Federal pen. If you make more than ten total pirated copies, you get six years: http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2265: HR2180: Internet services generally would not be liable for their customers' copyright infringements, under this bill introduced on July 17 by Rep. Coble and Rep. Henry Hyde. Called the "On-Line Copyright Liability Limitation Act," it's what ISPs have been demanding for years. Watch major copyright owners like Microsoft frown at this one. Nobody in the Senate has introduced companion legislation yet; the Judiciary Committee had a hearing on ISP liability scheduled for yesterday but it was cancelled due to Justice Brennan's death. http://thomas.loc.gov/cgi-bin/query/z?c105:H.R.2180: HR2281: Arguably the most controversial of the copyright bills introduced so far, this legislation that was introduced yesterday would enact the World Intellectual Property Organization copyright treaty the U.S. signed last December. Problem is, it may go far beyond what the treaty requires. The bill bans "technology" (including both hardware and software) that has few uses other than "circumventing a technological protection measure." It could impact encryption. "Circumvention" is defined as "to descramble a scrambled work, to decrypt an encrypted work." (What does this mean for cryptanalysts?) It also restricts removing "copyright management information" that includes titles, author's name, and copyright notice. Violators would be subject to civil penalties or criminal prosecution. If you "circumvent" protection or remove copyright info "for purposes of private financial gain," you'll face up to a $1,000,000 fine and 10 years in Federal prison. That's serious stuff. And it raises some interesting questions: what if I include a Reuters article in a newsletter I sell, and delete the copyright notice? Am I a Federal felon? Do I have a million dollars? Hmm... "They have criminalized conduct that is legal under the current copyright act," says Adam Eisgrau of the American Library Association. "They have created a new crime that is completely divorced from copyright infringement." Eisgrau says this bill isn't required by the WIPO treaty, which only mandates that countries punish *actions* that infringe, not *devices* that do. This legislation has hefty backing: Rep. Henry Hyde (full committee chair), Rep. Howard Cobel (subcommittee chair), and Rep. Barney Frank (ranking Democrat on the subcommittee). Sen. Patrick Leahy, who likely will endorse this approach, said yesterday that he was studying similar legislation. The SPA, naturally, is also supporting this bill. I've attached their press release below. The text of HR2281 isn't online yet -Declan --- SPA press release WIPO Treaty Implementation Bill Introduced in House Copyright Protections for Software Greatly Enhanced (Washington, D.C. -- July 30, 1997) Rep. Howard Coble (R-N.C.), chairman of the House Judiciary Subcommittee on Courts and Intellectual Property, introduced late yesterday the WIPO Copyright and Performances and Phonograms Treaty Implementation Act (H.R. 2281). The bill will make necessary amendments to U.S. law to enable the Senate to ratify new international intellectual property treaties negotiated last year in Geneva. The legislation is largely based on a Clinton administration proposal delivered by Commerce Secretary William Daley. SPA was a leading participant in the diplomatic conference last December that drafted the WIPO copyright treaty, and considers copyright protection for the Internet to be a major priority. "SPA supports the objectives of H.R. 2281 and, while further analysis must be done, believes that the Clinton administration and Rep. Coble have achieved a workable balance," said Ken Wasch, SPA president. "H.R. 2281 represents significant accommodations to guard against inadvertent liability for multi-purpose computers, software and other concerns. We hope Congress understands that further concessions would undermine the measures needed to make gains in the war against software piracy." "We commend Secretary Daley and his senior advisers for their perseverance in forging the administration's legislative proposal, Rep. Coble and his staff for their determined effort to introduce the measure and the bill's co-sponsors, Reps. Henry Hyde (R-Il.), Barney Frank (D-Mass.) and John Conyers (D-Mich.). In putting this bill before Congress, they have reached an important milestone in establishing the legal framework needed to protect electronic commerce in computer software." H.R. 2281 would also prohibit knowingly provide false copyright management information with intent to induce or conceal software piracy and other copyright infringement, and make technical changes to bring U.S. law into accord with the WIPO treaties. Circumvention of technological copyright protection measures for purposes of software piracy is a serious problem. Today, copyright law cannot be used to stop all kinds of unauthorized circumvention, nor can the making and selling of technology designed specifically to do so. These access and copy control technologies, such as scrambling, encryption and electronic locks, supplement legal protection in fighting software piracy but do not solve the problem. In fact, new problems are emerging on a consistent basis. For example, last May Chico-based SciTech Software, Inc. received ransom demands for $25,000 from an on-line extortionist who threatened to publicize on the Internet the instructions for disabling technology that controls the 21-day evaluation period for its graphics utility program, "Display Doctor." "The scary thing is not that our protection could be circumvented. Dedicated pirates always find a way," said Kendall Bennett, SciTech engineering director. What's scary is that they can get the information on how to circumvent into the hands of millions of casual users who would normally license our software." The immediate threat to SciTech has passed, but the blackmailer is still at large. Other SPA members have received ransom demands for as much as $1 million. That problem would be addressed by the new WIPO Copyright Treaty, which requires the U.S. and other countries to make sure that software companies have effective remedies against circumvention of technical protection for copyrighted works. SPA has spent months building consensus among industry and government on how to do so, and Rep. Coble's bill has put the issues before Congress. SPA is the principal trade association for the computer software industry, representing the leading publishers as well as start-up firms in the business, home office, consumer entertainment and educational markets. SPA supports companies that develop and publish software applications and tools for use on the desktop, client-server networks and the Internet. SPA's 1,200 member companies account for 85 percent of U.S. revenue for packaged and online software. Contact: Mark Traphagen, Vice President for Intellectual Property and Trade Policy, SPA, (202) 452-1600, ext. 322. Steve Bowers, Media Relations Specialist, SPA, (202) 452-1600, ext. 365. ### www.spa.org ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

1 0

Re: your mail
by Will French 18 Dec '03

18 Dec '03

> Thanks again, and I hope you go ahead and start PGP-clearsigning your posts > so that my high opinion of you can become more firmly fixed. > :-) > Regards, > Bryce If I don't PGP-sign my message, you can't prove I sent it. But if you don't put your name and e-mail address at the bottom of your message, I don't even know who you are! (Your message was hit by the "three screens of Apparently-To: headers" bug, and the From: line says "owner-cypherpunks(a)toad.com". The Subject: line also got lost.) Let's get the basics straight first, okay? This has been part of netiquette since before there was a net! Will French <wfrench(a)interport.net>

1 0

Re: Third World Man
by tcmay＠got.net 18 Dec '03

18 Dec '03

At 3:46 AM 8/22/95, Jon Lasser wrote: >On Mon, 21 Aug 1995, Peter Trei wrote: > >> > The US is slipping into the second world as we >> > speak, with no signs of a turnaround ahead. Only the sheer size of >> > the economy keeps people from believing it. >> >> Just a nomenclature peeve - I'm not sure of the precise time and >> place the (first|second|third) world meme originated, but it seems to >> predate 1970, and until very recently it's meaning was clear: >> >> First world: Western (and Westernized) nations - mainly the US, Canada, >>Western Europe, >> Japan, Australia, & New Zealand >> >> Second world: Communist bloc (I can still remember the Cultural >> Revolution. Prior to that, the Communists seemed a monolithic force, >> marching in lockstep.) >> >> Third world: The rest, mostly poor nations. > >Erm, nope. The "First World" (or old world) was Europe and Asia; the "New >World" (not frequently referrred to as the second world, but hey...) The >third world was the developing nations. THAT (as far as I was taught in >history class, so it MIGHT be a lie...) was how the terms originated... Then you should sue your history teacher for giving you a defective education :-}. Perhaps she or he was of my generation and was at Woodstock when she should've been doing her homework. By convention, the First World is the set of "Western" nations, the democratic, capitalist nations. The Second World, though not often used as a term, is the set of Communist bloc nations. The Third World, by far the most commonly used term here, is the set of nations not formally affiliated with either the First or Second Worlds. These nations are often poor, though not necessarily poor, and so the "Third World" is often (incorrectly) associated with poverty. And, to confuse things further, the "lesser-developed countries," or LDCs, are often equated to the Third World. When a certain character in a television show referred to "Third World mutants," he was also referring to "your basic brown types." (His words, not mine. Ten credits to anyone who can identify the t.v. show and the character.) The term "Fourth World" has in the last 20 years come to refer to the countries which are so impoverished as to be almost hopeless. Bangla Desh is the canonical Fourth World nation. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Netly News Fan Mail
by Mike Duvos 18 Dec '03

18 Dec '03

It appears that the CPAC/Sewer folks have read the recent Netly News article on their activities and were not pleased. This little blurb healines the "Sewer List" this morning. -----Begin Officer Paladino Rant----- July 29, 1997, I was told of an article that appeared on the Net. It appeared on a Netly News site. Of course, its good reading if you are a Boylover. Apparently the writer, like many reporters I have known, likes to keep the pot stirring with coin phrases like war, net.vigilantes and so on. To give the article credibility he interviewed CPAC, NAMBLA, ACLU. He also mention this writer but forgot to get a statement from me and 100's of other groups that feel that child porn, molesters and such have no place on the web. In the article he links to a few sites showing young boys but he forgot to link to the 1000's of sites showing young boys in the nude. Why is that I ask. Well to keep the pot stirring. He claims their is gay bashing going on, look on this site and others that link here and you'll find no gay bashing. You will see sites exposing young boys, as young as 4 years old, nude. I, for one, can't not justify nude pictures of 4yr old boys and girls. But the Boylovers insist this is their way of showing love. AND, of course, we always get back to the Freedom of Speech arguement. You know that gigantic excuse for expression. We still have Freedom of Speech in this counrty, while every other liberty is falling by the wayside. As I read the article, I could see the bias and I wonder why???? Maybe the reporter also has an agenda. If he writes another article on this subject, it would be interesting to see which Boylovers will be interviewed. Apparently he has never been to the Sewer or maybe he has? Freedom is a great thing and this is the greatest country in the world. I wonder how many soldiers that gave their lifes fighting for that freedom, had pictures of nude boys in their wallets, instead of their families. Think about that....................... -----End Officer Paladino Rant----- Will someone please buy this poor man a spell-checker? :) -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

1 0

Re: DES & RC4-48 Challenges
by tcmay＠got.net 18 Dec '03

18 Dec '03

At 5:29 AM 8/22/95, hallam(a)w3.org wrote: >I think we can probably do DES within two years. > > Phill I strongly doubt it, and may be willing to bet money against it happening. (If "we" means someone or some group on this mailing list. If "we" means the Net, I still doubt it will happen.) If the "idea futures" and betting markets we've talked about here (which exist) ever take off, this may be a way to make some money for someone. For example, if someone was laying 10:1 odds that SSL would not be cracked in 1995.... And for the "do DES" bet, you need to differentiate (no pun intended) between a chosen plaintext attack and a more general attack. The differential cryptanalysis ("DC" gets another overload) method needs chose plaintext to cut the search space down to 2^47 keys. Wiener's hypothesized "million dollar DES cracker" may do the general attack, but I doubt anyone on our mailing list will do it. That is, the number of workstations and even supercomputers which would have to be lashed-together would be, ballpark, about 2^16 times greater than what was lashed-together for the SSL challenge. Maybe a factor of ten could be cut out with increased cleverness. Maybe. Call it a factor of "only" 6000 times harder than the SSL challenge. Hard to imagine this happening in the next two years. Maybe if much of the Net community was energized to run DES crackers instead of Flying Toasters, but a hard effort to organize...for fleeting reward. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0