December 2003 - cypherpunks-legacy

Re: Non-US SSL128 site
by Peter Trei 17 Dec '03

17 Dec '03

> > a) Use 128 bit SSL if the client allows it. > > b) Tell users which cipher is being used on a secure session. > Netscape's press release on the RC4-40 crack seems to have disappeared from > their home page, but I don't remember any specific mention of 128-bit > U.S.-only clients, just servers. > So what's up? Netscape sells a 128-bit US-only client for $39 Peter Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

4 3

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Only for the moment we are saying nothing. - A'Tak A'Tdorn

1 0

Re: Forgery, bills, and the Four Horsemen (Articles and Comment)
by Mats Bergstrom 17 Dec '03

17 Dec '03

Black Unicorn posted a very interesting info summary on the subject of foreign state US$$ forgery. This is a story I heard, long ago, from a Brit, Mr Waterlow, about something that happened to his grandfather, chairman of the Waterlow bank: Early in this century Portugal didn't print it's own money but contracted this job to the Waterlow Bank in England. Some skilled conmen succeeded in making the bank beleive they were representatives of the Portugeese National Bank. Then they ordered a huge amount of new bills and got away (at least for some time) with it. Now, the point is that this was acually GOOD for the Portugeese ecomomy, the real National Bankers having underestimated the optimal size of their cash stock. So, I wonder, perhaps the world economy might benefit from some Iranian addings to the number of $$ araound? A Keynesian boost? Just drifting (I know very little about economy...). Mats

1 0

Re: Reproductive Rights and State Benefits (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 24 Aug 1997 00:04:51 -0500 (CDT) > From: Mac Norton <mnorton(a)cavern.uark.edu> > Subject: Re: Reproductive Rights and State Benefits > Perhaps so, but that says nothing about the federal gov't > enforcing the First Amendment to the US Constitution against > the states, irrespective of the provisions of their constitutions > or other laws. It is a difficult thing to get from "Congress > shall make no law" to "No gov't anywhere in this country > shall make any law," but we've managed to do it, probably to > our credit on the whole. If that was what he had it would truly be great, unfortunately we don't have that. What we DO have is the feds and the state governments doing everything they can to get around limitations such as this. In effect we have exactly the opposite of your supposition. The fed's are currently deciding on just exactly how federal employees can express their religous beliefs. Do you really think the founding fathers were so stupid that they wouldn't have thought of this if their intent was to truly prevent any government from enacting such laws? ARTICLE I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. If you really believe what you state above I have a few of questions: [well actualy I have a lot of questions, but it would be pressing the point I suspect] * How does the federal government justify their limitations on the Native American Church or the Coptic Church when federal laws relating to religion are clearly prohibited? * If we truly have freedom of speech and the fed's respect that, just exactly who passed the CDA? * If we truly have freedom of speech and the fed's respect that, why is the fight for strong encryption being fought so hard? * If we truly have freedom of press AND the feds are the only agency per the Constitutio to regulate inter-state commerce then how can one state arrest citizens of another state when the 'crime' in state of the accussed isn't a crime? * Why has the federal government NEVER passed a law detailing the process we may use to petition the government for greivences? It clearly is not meant as a reference to the courts. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Emergency File Wipe Algorithim
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Peter Gutmann writes in an article quoted by Christian Wettergren > The greater the amount of time that new data has existed in the > cell, the more the old stress is "diluted", and the less reliable > the information extraction will be. Generally, the rates of change > due to stress and relaxation are in the same order of magnitude. > Thus, a few microseconds of storing the opposite data to the ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ > currently stored value will have little effect on the oxide. ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Phill Hallam writes: > If the power is cycled as opposed to turned off only then a memory > self test program will probably erase the data. Assuming Peter Gutmann is correct, a memory test program "probably" won't do much. Of course, you data must be worth quite a pretty penny for an attacker to attempt to recover data from the oxides on the cells in your RAM. andrew

1 0

Re: Reproductive Rights and State Benefits (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 24 Aug 1997 00:11:52 -0500 (CDT) > From: Mac Norton <mnorton(a)cavern.uark.edu> > Subject: Re: Reproductive Rights and State Benefits (fwd) > On Sat, 23 Aug 1997, Jim Choate wrote: > > If accepted as fact this provides even less reason for the 14th. As it > > clearly does not prevent federal rights over-riding state rights. > > Jeez, it's too late to conduct Con Law Seminar 701, but focus > on "liberty" in the 14th Amendment as transfering the Bill Of > Rights, or most of it, to govern the states as well. OK? > Cause that's the SCt's view of it, and as I've said, it seems > to work reasonably well, reagardless of the chinks in the logic. Unfortunately neither does the 14th respect any right, only immunities and privileges (which clearly are not rights since they can both be revoked by the granting agency) but it doesn't work because it allows the feds to intrude in areas they were not meant to be involved in. The original Constitution already had a clause applying the Constitution and all laws derived from it to the states and preventing judges or other agencies from bypassing them. So, given that such extensions were already in place just what does the 14th do? ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: SUMMARY: Not-so-volatile volatile memory
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:54 AM 9/5/95, Anonymous wrote: >> -- Summary: Data retention in semiconductor memory -- >> >> Contrary to conventional wisdom, "volatile" semiconductor memory >> does not entirely lose its contents when power is removed. Both >> static (SRAM) and dynamic (DRAM) memory retain some information on >> the data stored in it while power was still applied. SRAM is >> particularly susceptible to this problem, as storing the same data >> in it over a long period of time has the effect of altering the >> preferred power-up state to the state which was stored when power >> was removed. Older SRAM chips could often "remember" the previously >> held state for several days. In fact, it is possible to manufacture >> SRAM's which always have a certain state on power-up, but which can >> be overwritten later on - a kind of "writeable ROM". > >Is this a new discovery? When I used to work with DOD classified >data, not so long ago, disk drives had to be declassified using an >approved program, such as Norton Utilities' "WIPEINFO". (That was >approved up through the SECRET/SAR level, anyway. I don't know >about TS/SCI/SI.) But those same regulations said that RAM was >considered declassified within a certain time (30 seconds, I think) >after power was removed. (That time figure was UNclassified, BTW.) >I think it was just to allow time for the voltage to bleed off of >the power supply's filter capacitors, and not related to the >relative volatility of DRAM. The Gutman article was discussing residual/remnant storage a lot more subtle than the usual "bleed-off" charateristics. One interesting twist is using radiation sources to "snapshot" or "freeze" the internal contents of dynamic RAM. I worked with DRAMs for more than a decade at Intel, though never on this particular issue. But I read a lot of the public papers on radiation effects on DRAMS, including the "freezing" of data patterns into DRAMs by exposure. (I recall thinking at the time, circa 1980, that someday raids on computers could involve bringing in flash radiation sources to "snapshot" the contents of DRAM.) Sandia Labs did a lot of the work on this, and results are reported at the annual Nuclear and Space Radiation Effects Conference. The December issue of "IEEE Transactions on Nuclear Science" every year includes the proceedings of this conference. Any large university library should have it. It's also possible to literally freeze a DRAM--with "Arctic Freeze" spray, for example--and stop the self-discharge of DRAM cells. I doubt any of these efforts are being used, though. Looking at how raided computers are simply carted off in the backs of pickup trucks, with disk drives thrown in with monitors, I suspect nothing this sophisticated has ever been tried. Quantico might have some more sophisticated approaches, but they're not publically discussing them. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Slightly faster checking for encrypted messages to me
by cman＠communities.com 17 Dec '03

17 Dec '03

Hal -- I've actually given this some thought in the past, and the most practical solution IMHO is much lower tech, although it only works on non-initial messages in a correspondence. If two entities want to communicate via a message pool, without worrying about traffic analysis, but don't want the overhead of trying to decrypt every headerless message to the pool, then they can do the following: 1) In a "headered" message, one of the entities (A) sends a collection of large random numbers to be used as return markers, encrypted with the public key of the desired correspondent (B). 2) B can then respond to A with an essentially headerless message prefixed with one of the numbers send by A. This initial message should contain a list of similar numbers for B, that A can use to send messages to B. 3) Numbers are only used once; entities can now quickly scan the message pool by hashing the initial N bits of each message into a lookup table seeded with all the remaining random return markers they've distributed. 4) As an extension, you can divide your message pools into "initial contact" pools, which would begin with headerless public key encrypted blocks, and "conversation" pools that would begin with return markers. (Of course this is trivially open to denial of service attacks.) This is the basic principal behind the TA-resistant streams over UDP stuff I wrote up for cypherpunks last spring, except in that case a given server does the lookup first, and only then tries to treat the header as a public key encrypted block instead of a MAC. The Rabin stuff is a step in the right direction for the long term, however.

1 0

Re: Reproductive Rights and State Benefits (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 24 Aug 1997 00:58:55 -0500 (CDT) > From: Mac Norton <mnorton(a)cavern.uark.edu> > Subject: Re: Reproductive Rights and State Benefits (fwd) > Well, quite a bit actually, as interpreted by the SCt. It makes > many, perhaps all, of the Bill of Rights prohibitions on Congress > applicable to state gov'ts as well. Art. VI, to which I think > you refer, does not do so of its own accord. * From the original Constitution: Section 1. Full Faith and Credit shall be given in each State to the public Acts, Records, and judicial Proceedings of every other State. And the Congress may by general Laws prescribe the Manner in which such Acts, Records and Proceedings shall be proved, and the Effect thereof. Section 2. The Citizens of each State shall be entitled to all Privileges and Immunities of Citizens in the several States. Section 4. The United States shall guarantee to every State in this Union a Republican Form of Government, and shall protect each of them against Invasion; and on Application of the Legislature, or of the Executive (when the Legislature cannot be convened) against domestic violence. This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding. * The 14th: ARTICLE XIV. Section 1. All persons born or naturalized in the United States, and subject to the jurisdiction thereof, are citizens of the United States and of the State wherein they reside. No State shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws. Sections 2-5 deleted * Now please be so kind as to explain the following: - Where in the 14th does it mention the Bill of Rights or apply them to the states in such a manner that is not done in the original Constitution? - Why does the last section of the last item prior to my quote of the 14th not apply said Bill of Rights since it is clearly a part of the Constitution and worded much stronger than the 14th? - Why does section 2 above not apply considering it is copied practicaly word for word in the 14th and clearly equates the states under federal law? Especialy since the wording of section 2 is much stronger than the wording of the 14th? - Section 4 above clearly equates the states and a citizens expectation of equal protection under the law, how does the 14th extend this? - Section 1 does something even stronger than 'equal protection' as it forces recognition and support of each states laws by the other states even if a given state makes a law that makes an action in one state a crime in another, how does the 14th add anything to this? - Is your claim that the rulings of the SCt apply to citizens instead of being the final arbiter for government agencies? If so, how can this be considering that the SCt can't instigate any legal actions on its own but must act in a reactive manner? - And finaly, why should we as citizens accept the rulings of the SCt as the final word since we and not the federal government are the ones granting the power to govern? Add to this that Constitutionaly the role of the SCt is to limit Congress and not the citizenry. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

A recent article on Electronic Commerce
by David Neal 17 Dec '03

17 Dec '03

In the August 28, 1995 issue of Communications Week, the editor Mitch Irsfield briefly discusses electronic checking, and the joint venture between Sun, BBN, IBM, et al. He also references an article explaining the venture on Page 5 of the same issue. I dropped him a quick note thanking him for writing a non-hysterical article on cryptography, and also briefly mentioned that some of us would prefer electronic cash to electronic checking. Since part of being a cypherpunk is political, I'd like to encourage everyone to write a quick e-mail which expresses your own views to Mr. Irsfield (678-7017(a)mcimail.com) Speaking of talking to the 'public' about crypto-cash, we really need a meme of our own. Just as The Other Side invokes the specters of terrorism and child pornography, we need something like 'traceable transactions', 'government approved checking', 'uncle sam's clearing house', or 'irs approved bill payments.' Obviously the creative types on the list can come up with much better. But, I digress. The Page 5 article doesn't go into much detail, but says in essence that the system is an api layer and a smart card. In the cases of larger corporations, they may require a seperate processor. This says 'encryption in hardware' to me. Gee, wonder if someone found a use for all those useless tessera cards after all? :-) David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

1 0