December 2003 - cypherpunks-legacy

Re: Mixmaster Security Issues
by loki＠obscura.com 17 Dec '03

17 Dec '03

At 8:45 PM 8/30/95, Russell Nelson wrote: > Date: Wed, 30 Aug 1995 18:17:02 -0700 > >Can't answer all of your questions, but I'll answer the ones I can, >which will save time for someone else to answer the rest of them. > > Apart from thwarting traffic analysis attacks, how does the security > of a Mixmaster Type II remailer packet compare to that of a > PGP-chained Type I message? > >Well, on the one hand, PGP uses IDEA, which is arguably better than >triple-DES, but PGP also only uses the key length(s) of choice, which >is to say that if you use the minimum length, you have very little >security. Also, Mixmaster packets remain the same length from hop to >hop, so they are harder to track. I am not sure this is the consensus opinion. Three key triple DES uses 168 bits of key, whereas IDEA only (only?!?) uses 128. DES is also much better studied and understood. IDEA is still a young algorithm (though close to the heart of every cypherpunk). The rest of what you said looks good. Too bad I did not see it before I typed my own answer ;) ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Is the book Network Security any good?
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

Has anyone read the book "Network Security Private Communication in a PUBLIC World" yet? It's by Charlie Kaufman, Radia Perlman, and Mike Speciner, and has a copyright date of this year. Is it good? What's the level? Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

3 3

"Citizen-Unit Identification" a Red Herring
by tcmay＠got.net 17 Dec '03

17 Dec '03

All this paranoid talk about the dangers of thumbprints on ID cards, about driver's licenses, and about magstripes got me to thinking. So, I accessed my NLETS (National Law Enforcement Telecommunications System) and downloaded my own record: Citizen-Unit ASCII Name: "Timothy Christopher May" NLETS Actual Name: G0Yj34C1qm92H7u Known Aliases: "Klaus! von Future Prime," "Lance," "Nick Szabo" Residence: 427 Allan Lane, Corralitos, CA 95075 Driver's License: N4197484 SSN: 227-80-5823 Passport Number: H673qop90 Race: Aryan Origin: Europe Hair: Brown Eyes: Blue Weight: 210 pounds (10/94, recorded at SFO) Known associations: Anarchist Alliance, Young Students for Discordianism, Vernor Vinge Fan Club, Information Liberation Front Magazines Subscribed To: Newsweek, Playboy, The Economist, MacWeek, Anarchy Today, Liberty, FertilizerWorld, Reason, MacUser, NewtonGazette, Bay Aryan Events, Information Week Consumer Preferences: beer (+++), wine (+), cigarettes (-) Electricity Patterns: consistent with either marijuana cultivation or heavy Net usage, or both Threat level: Class 3 Security Threat I don't see what the big deal is. The NLETS record implies I'm some kind of security threat, but also correctly notes that I'm an Aryan, so I guess I'm safe. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: C2.ORG REMAILER
by Tim Scanlon 17 Dec '03

17 Dec '03

Sorry for my last empty message, it's late & i confuse the "deliver" icon with the "mail format" icon (I was attempting to change the type from NeXTmail to plain text) I don't see why an anonymous remailer can't be set up in some country with an inet connection, but with little respect for idiocy originating from other countries & in particular the US. Allot of that issue is treaty dependent and that's probably what people should look at. I like what people are doing well enough, don't get me wrong. But the vulnerability exists via co-operative law enforcment arrangments & legal venue operations. That's the stuff of treaty's. I think probably an appropriate place could be found & arranged with some effort at this point. Hell there's GOT to be some countries out there that would have little respect for the antics of the Church 'o Bucks who'd be intrested in it. Stick the database on an encrypted partition, and arrange a a two party setup on the keys & administration and it'd make them a damn bit harder to retrieve anyhow... "I'd comply, but I don't have the keys, and the keyholder is refusing contact. And NO I don't know his 'True Name' and can't find him." That'd make things a tad rough, and isn't illigal anyplace that I'm aware of. Call it "Apllied Stenography" (Sorry about the pun, but I couldn't resist it :> Tim Scanlon ________________________________________________________________ tfs(a)vampire.science.gmu.edu (NeXTmail, MIME) Tim Scanlon George Mason University (PGP key avail.) Public Affairs I speak for myself, but often claim demonic possession

1 0

O.J. ObCrypto: Fuhrman's Folly Fans Fakery Fears...
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

Regardless of whether Ito allows the tapes into evidence, the public has heard a LEO matter-of-factly discussing the fabrication of evidence against US citizens. We should take advantage of this, by connecting the Fuhrman/Good Ole Boys from BFART bit, and GACK. If my private key must be escrowed with Lawn Forcement Agencies, the very real possibility exists of a Fuhrman using it to forge evidence against me. In =any= Key Escrow arrangement (including the non- government variety preferred by 4 out of 5 Cypherpunks in a recent survey) there must be a division between encryption keys and signature keys. I recommend that anyone who will be using escrowed keys generate two pairs: First, the signature key, including in the userid some kind of [sig use] identifier (we should settle on a standard abbreviation for this) follower by the encryption key. This way, when a person gets your pubkeys, they get the encryption key =last=, which gets it searched first whenever they PGP -e... something. Whatever arrangements are made for escrowing my encryption key, =nobody= gets my signature key. If I am fired, quit, become brain damaged or dead, my key can never be used by anyone to implicate me in any criminal activity. Please don't mention to anyone the fact that my signature key can be used to send me something that even the escrow agents can't read.... * --- * Monster(a)FAmend.Com *

1 0

Re: Remailer hating Nazis (was Re: The BIG Lie (Jesus Confesses))
by Anonymous 17 Dec '03

17 Dec '03

At 09:58 AM 8/15/97 +0200, you wrote: >I wrote two remailer programs, I ran several remailers, and I am working >on bugfixes for replay. I couldn't care less about your founding >fathers who killed the native americans and raped their women. >Killing virtually unarmed people with guns is an act of cowardice. According to you, remailer using people are cowards. So quite frankly, why the hell are you helping remailers if you get so pissed at people using them? Sounds like you don't have your priorities straight. >Flaming me through a remailer is the equivalent of shouting >'hey asshole!' and then running away. Children do it often. If that's what you think of the blessed gift of anonymity, then, quite frankly, FUCK YOU. Theres's nothing childish about using remailers, and if you think otherwise, then stop making them! >I also cannot reply to you privately, so all other members of >this mailinglist have to suffer our private flamewar. I think they might even join in the fun. Have a nice day, remailer hating Nazi.

2 1

Re: A glance at the future of missing child identification
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:52 PM 8/20/95, Hadmut Danisch wrote: >These transponders are already used for many year. They inject >them in pigs and cows to identify them. And some car manufacturers >put the into the ignition keys as theft protections. The subcutaneous animal things are only detectable at very short ranges. Typically, a vet (animal doctor) uses a handheld wand to pick up the signal. Useful for tracking pets, farm animals, etc. There has so far been no known uses of this on humans, at least as a matter of routine. Possibly some developers have tried injecting themselves, for the usual reasons. The car system used here in the U.S. is called "Lo-Jack," as in the opposite of "hijack." I don't see how putting the transponders in ignition keys would do much to stop theft, but maybe I'm unaware of European developments. (There are keys with chips in them, acting as electronic keys, or to make the keys harder to duplicate, but not to track the cars.) >Technology is not new. Perhaps it is already used for criminals? >Somewhere I heard that in America criminals are sentenced to stay >at home because the jails are overfilled. A sender is attached to >their leg and the police is informed if he leaves his home. Yes, these exist. Not using the same technology as the transponders used in pets and livestock, though. >Perhaps a drug dealer may be more usefull if he moves free and >has a transponder inside which he doesn't know about, that having >him in jail. Not technologically feasible at this time, but maybe in several years. Even so, it wouldn't be hard for his friends to scan him for bugs. Sure, some will argue that pseudorandom, very intermittent, frequency-agile signals could be emitted...I say it's a hard problem to escape detection by antennas a few centimeters away when the signal has to be detectable by surveillance antennas at least kilometers away, and more likely tens or hundreds of kilometers away. The infrastructure of antennas is lacking. >Here in Germany most department stores have big antennas at the >doors which are normally used to detect thefts. Perhaps these antennas >also recognize certain people. You can be sure even criminals go to >department stores, undergrounds, or bus stations. Some hidden antennas >and it's easy to be on their track. Implausible. The theft detectors are not picking up specific transponders, just the "on" or "off" state of the things attached to clothing, books, CDs, etc. (I say "things" because some of them are strips inserted in books, some are tag-like things clamped to clothing, etc.) Again, the infrastructure is lacking. The simple detectors in stores would have to be upgraded to track more sophisticated transponders. The stores would have to cooperate, etc. Implausible. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 3

Economic Espionage?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:25 AM 8/31/95, Tatu Ylonen wrote: >> >It was said that Pres. Clinton had given a speech while >> >visiting the CIA HQ in Langley/Virginia. He allegedly >> >said in this speech that obtaining industrial >> >informations has the highest priority and this were the >> >new task for the spies. > >There was a fairly large article about this in Helsingin Sanomat, the >largest newspaper in Finland, some weeks ago. It was quoted as being >originally from the New York Times. (I have the clip saved at home >and can check the date if anyone is interested.) > >I do find it rather shocking that the most powerful country in the >world sets industrial espionage as the primary task of their >intelligence services. What confirmation can you give us for this statement? I'd like to see the actual comments, not just second-hand reports. The issue of economic surveillance has come up several times, and I know of no formal policy to institute such a program. The U.S., with generally multiple competitors in each market, would have a hard time figuring out who to tell "foreign secrets" to. Would Ford be told? Or just General Motors? What about companies with operations in multiple countries? Former DIRNSA (Director of the NSA) William Odom has said repeatedly that economic espionage cannot plausibly be a central task of the NSA. Before anyone accuses me of being an apologist for the NSA (usually these claims arrive anonymously), I've been looking for evidence of an economic intelligence role or mission of the U.S. intelligence agencies for more than 7 years. Let's see some evidence. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Poisson numbers for random keyspace assignment
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

[Great statistical summary deleted] TC> * For opportunistic attacks on keys in challenges, the odds are 95% that a TC> key will be found with only twice the total effort (or time) using a TC> totally random method of picking up keyspace to search. The odds can be improved somewhat by scaling the granularity of the sweep to the size of the sweep. (Align larger chunks on large-chunk boundaries, eliminating the chance of overlap with other large chunks.) TC> * This is probably good enough. (And if one only wants to be 90% sure of TC> finding the key, even less effort is needed.) The best advantage of the random method is that it allows people to participate completely anonymously, as there is nothing to report save the Eureka!, and that can be done through a remailer anyway. When the challenge is solved, everyone can stop cracking. It is one thing to work on an academic exercise, but the =real= test is how well the resources could actually be marshalled for a =real= attack. The requirement of leaving an audit trail to participate reduces the supply of volunteers. This approach can not be challenged as unrealistic. The whole thing can be managed via Imail, which I must point out to you Totally Connected People, is the least-common denominator for participation here. You have =lots= of people out here who would like to join the Cypherpunks Brute Squad (We gotta get T-shirts for this one!) but don't have WWW access. * John was a complete D**k, until Lorena got through with him. --- * Monster(a)FAmend.Com *

2 1

ASSETS FORFEITURE BILL ON THE MOVE
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: (Unverified) Mime-Version: 1.0 Date: Fri, 15 Aug 1997 09:22:03 -0700 To: rah(a)shipwright.com From: Vinnie Moscaritolo <vinnie(a)vmeng.com> Subject: SSETS FORFEITURE BILL ON THE MOVE GENERAL-RKBA digest 282 ASSETS FORFEITURE BILL ON THE MOVE At press time, the U.S. House Judiciary Committee had passed H.R. 1965 -- an assets forfeiture bill. This legislation contains provisions that would allow the Clinton-Gore Administration to seize the assets of virtually any business on any pretext -- including firearms-related businesses! Even if the warrant for the original seizure is struck down, the government would then be given additional time and "discovery" to examine the business records to try and build a case to continue holding the assets (read: firearms). Virtually any business that has any substantive inventory and that is extensively regulated by the government is in danger of having its goods seized -- even for non-criminal regulatory infractions. H.R. 1965 is a Clinton-Reno scheme -- and a civil rights nightmare -- and we strongly believe it will be used as a tool against gun stores, collectors, or anyone else who has a firearms collection or inventory worth stealing. We are trying to work in Congress to get the needed changes to this legislation before it is brought to the House floor, but it may be put on a fast-track to try and dampen opposition. Call your Congressman now at 202/224-3121, and explain the problems with asset forfeiture from the gun owner's perspective, and urge him to oppose the Reno-backed asset forfeiture scheme. AND THE TALL TALES GET TALLER Hoping that going on the offensive would provide him with a good defense, President Clinton has elevated the falsehoods surrounding the Brady Act to new heights. Obviously anticipating that the Supreme Court would strike down the "mandated background check" provision of the Brady Act, the President, along with Sarah Brady, began touting their latest statistics on the Brady Act's "success." (For a complete summary of the Court's decision, see the article on this subject in the September issue of the American Guardian.) Previously, the President, Attorney General Janet Reno, and others used the inflated figure of 186,000 to note the number of felons, fugitives, and stalkers they claimed were prevented from buying a handgun under Brady. That 186,000 figure was derived from a February 1997 Bureau of Justice Statistics (BJS) report that concluded that of nine million handgun transactions nationwide, 186,000 (2%) were rejected. The President, in turn, incorrectly claimed that the BJS study showed that the Brady Act had resulted in 186,000 handgun purchase attempts by prohibited persons being denied. However, the BJS stated on the front page of its report the 186,000 was a national estimate. Recognizing that 18 states and the District of Columbia have never been subject to Brady's five-day waiting period, BJS noted only 86,000 denials occurred in the 32 "original Brady states." Even that figure is inflated, however, because 12 of those 32 states are no longer subject to Brady, having adopted instant check or other laws in the past three years. Additionally, many Brady-exempt states conduct records checks on people who purchase long guns, while Brady only applies to handguns. However, prior to the Court's ruling, Mr. Clinton upped the ante by unveiling his newest "success statistic." According to the President, apparently in the course of a few months, the number of felons denied handgun purchases under Brady miraculously skyrocketed to 250,000! Even if that claim was true, "handgun purchase denials"--warranted or not (data indicates that most denials are not)--is not the standard by which the Brady Act should be judged. Rather, the effectiveness of a law titled the "Handgun Violence Prevention Act" should be measured by how much handgun violence is prevented. And on that test, Brady is a failure, as we know our prisons aren't bursting at the seams from "felons" who violated federal law by attempting to purchase a handgun. In fact, there have still been only three individuals who've seen the inside of a prison cell for violating the Brady Act. Unfortunately, in addition to the numerous individuals who've been denied a handgun purchase under the Brady Act because they had unpaid parking tickets or had the same name as a prohibited person, the truth apparently will continue to be another casualty of this misguided law. Vinnie Moscaritolo Apple's Key Escrow Agent (for now) http://www.vmeng.com/vinnie/ PGP: 4FA3298150E404F2782501876EA2146A DSS/DH: B36343A790489C8D4E149147D57A7566C206F586 1 if by land, 2 if by sea. Paul Revere - encryption 1775 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0