December 2003 - cypherpunks-legacy

Memme: Crypto=Bullet Proof Vests
by Ray Arachelian 17 Dec '03

17 Dec '03

I came up with this while on a bio break.... ITAR classifies crypto as munitions, but this is the same thing as telling someone who wishes to travel to a warring country that they may not buy a bullet proof vest, but they may buy an vest that will stop pebbles being thrown at them. This is equivalently reasoned that such vests could be used to rob banks and the theives could get away from the police - but how many bank theives have you known that were shot by the cops and not caught by other means? It believes that only the USA has bullet proof vests and it is a matter of national security that no one else have bullet proof vests. These aren't tactical weapons equivalent to 20MegaTon nukes, these are devices that help save lives. Meanwhile other countries have also created bullet proof vests, some that protect against high velocity bullets. We can understand that vest piercing bullets kill policemen and that they are reasonably outlawed, but if someone built a vest that would stop those we wouldn't be able to mail them to those fighting for democracy outside of the USA. In the case of crypto, crypto is a tool that saves your privacy. Why are we not allowed to have the ability to ship the tools needed to help protect privacy of say the students in China (for example) where any suspicion of disidence would be instantly punishable by death. For a country that is intent on making the world safe for democracy, we are sure doing a very bad job. Sure, a bullet proof vest can be used to protect a pornographer or a terrorist, but it will also save the lives of citizens, freedom fighters and children. How many parents who live in bad neighborhoods would object to their kids being able to wear bullet proof vests, could they afford them, while going to school? The recent bills thrown around in congress are attempting to do the equivalent of outlawing bullet proof vests, and only allowing pebble proof vests to be sold, or bullet proof vests that can be pierced by police. Would you want your kid to wear a vest that can be pierced by police fire? Maybe a stray bullet aimed at a drug dealer hitting your kid? Or maybe a criminal getting their hands on the same type of ammo and shooting your kid? We need our kids to wear Strong Bullet Proof vests! Next time they yell "But if it saves the life of one child" give them this. "But if strong crypto can save the life of one child freedomfighter, who are we to limit its use? Support strong crypto and protect the kids of the world!" (Preaching to the choire of course, but who knows maybe the crypto=bullet proof vest arguement will be useful to someone who can talk sense into the crypto clueless cognresscritters.) =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\. ..\|/..|sunder(a)sundernet.com|you once again. I thought you were |/\|/\ <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/ ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/. .+.v.+.|God of screwdrivers"|my eye and there we were.... |..... ======================= http://www.sundernet.com ==========================

4 4

Re: SSL stuff
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Piete: please read the PS at the bottom From: Scott Brickner <sjb(a)austin.ibm.com> >>A random (instead >>of sequential) allocation _by the keyserver_ (out of unallocated >>piecemeal segments) would also take some work to implement. [snip] >The problem is that it's irrelevant to the problem. Random allocation >at the server is equivalent to simply "shuffling" the segments before >assignment, which doesn't affect the rate at which the space is searched. no, but it keeps someone from knowing where the key is at from grabbing it for themselves. If the segments were shuffled, the only way to ensure "getting" the keyspace with the key is to grab HUGE chunks. And grabbing 50,000 segments didn't go over well last time, did it... >I'm not sure I follow you, here. The search wraps around on the unACKed >segments because the work was assigned, but not (as far as the server >knows) completed. This doesn't slow down the discovery of the key, If the segment with the real key is the first assigned and the last ACKed (reporting key found), the search went on 30 hours extra. But that doesn't cause as much problems as a (false) ACK of no key found. >>It would be nice to be able to hit the emergency button and switch to >>random mode, but currently I don't think there's a need to actually >>use it. >I still don't see how the server can use unsolicited NAKs as anything >other than a nominal reduction in the probability that the key is in >the NAKed segment. Perhaps this does give an idea of a server strategy >to do *just* that, though. I mean a setup where if the key server is shut down by a D.O.S. attack, or congestion, or whatever, that the users, if they so desire, can shift into random mode and end their dependance on the server. I don't see a need for all of us to be doing random searches right now just because someone _might_ launch a D.O.S. attack. Another benefit of random mode being implemented, but secondary, is that all of the people who previously had to manually get keyspace by WWW and report it back by hand - they can just put it in random mode and fire-and-forget, just like everyone with brloop does. Don PS: Piete: What's the current status of the server? I've got by brloop working apparently, and I calculate I'm able to search 800 segments a day, and I'm anxious to see if it works. It's stopped giving me only sleep orders, and now appears to give me a keyspace, but it reports a checksum error and sleeps for a few minutes. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMEQKzsLa+QKZS485AQEjjgL/X2jQ0J0k+0gc4GUOzNQrKKtRHvqy4dlq FmxaGDsdnBI+eO8DSu8C6jmRdw+VpcRiFQGDiTMklSmKNEwEqwq0QIvL0Dh4mz7k vTsYXbUdlGwf9KUJv5PtwNojP+nQl9Pe =tTkz -----END PGP SIGNATURE-----

1 0

FYI: c2.org now has reasonable net
by sameer 17 Dec '03

17 Dec '03

Community ConneXion finally has reasonable net. If you thought about getting an account here in order to take advantage of privacy services but thought that the lag was too great for it to be useful, you may want to try again now, as our network line was just upgraded today. Check out http://www.c2.org -- sameer Voice: 510-601-9777 Network Administrator FAX: 510-601-9734 Community ConneXion: The NEXUS-Berkeley Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

An article for Wired magazine
by Jon Matonis 17 Dec '03

17 Dec '03

This is so that you have the complete context of the post. ---------- Forwarded Message ---------- From: Jon Matonis, 74774,3663 TO: Electronic Cash (post), INTERNET:ecm@ai.mit.edu DATE: 8/14/95 11:10 AM RE: Copy of: Re: An article for Wired magazine Robert Hettinga (rah(a)shipwright.com)wrote: >My point is that there isn't e$ denominated in a government's currency, >more to the point, a popular currency like dollars or marks, or yen. That >would make it possible for me to pay a dollar on the net for goods worth a >dollar. That's what I meant by "real" currency. What we have are unique >digital certificates with indeterminate lifetimes which have no nominal >value except what people are willing to pay for them in the open market. >This is fine. In fact it's pretty cool that people are willing to impute >value to them by buying and selling them exclusive of any other economic >backing. Since this is for a magazine article, I want to clear up some misconceptions. The e$ experiment as conducted by DigiCash has broader implications, which the article may or may not decide to address. First of all, digital money can take various forms. Existence on a hard drive is one of those forms. But, it is also possible to have digital money on a card-based platform. Mondex in the UK currently has official government units of account digitally represented for their Mondex card trial in Swindon. They have also announced that in the future this card will hold up to five "official" currencies. Furthermore, they make no secret about the fact that this digital money is ideally suited to transfer on the Net. Visa and Mastercard are both working on stored-value cards which will also digitize official currencies. CyberCash has also announced plans for an electronic token which will most likely represent an official currency. Others will announce soon. Even DigiCash, in its own material, states that they are only the supplier of technology. This cyberbuck experiment was to demonstrate that technology -- primarily to banks. They don't intend to be in this business as the monetary supplier. So, the e$ technical experiment served its purpose. It was unbacked because that was not what they were promoting. Banks, as licensees, will perform the monetary functions and they will undoubtedly issue digital money at par with governmental units of account. The trend here is definitely towards "official" currencies and that will give digital money the trustworthiness and familiarity which it needs so desparately for acceptance. But that is not to say that this is the preferred course. Other trustworthy, brand-name issuers (non-banks, i.e., Coca-Cola, AT&T, United Airlines, Fidelity Investments) with similiar technology (or ones that license it) can certainly monetize any bearer instruments and then digitize those instruments for the purpose of a negotiable unit of value. I argue that this is the preferred course because it will eliminate the reliance on banks (and central banks) and speed up considerably the proliferation of digital money for the benefit of all. Stand-by though: governments and central banks will do everything in their power to discourage and prevent this for the power to issue and coin money is one of THE most cherished privileges of the Crown ! This WiReD article is just the beginning ! Jon W. Matonis

2 1

Initial Public Offering for Gasmaster International
by gasmaster＠internetemedia.net 17 Dec '03

17 Dec '03

THIS EMAIL IS NEITHER AN OFFER TO SELL NOR A SOLICITATION OF AN OFFER TO BUY THESE SECURITIES. THE OFFERING IS MADE BY THE U-7 DISCLOSURE DOCUMENT ONLY. All securities are offered through Intrepid Securities, Inc., Torrance CA. Intrepid is a member of the NASD and is SIPC insured. Gasmaster International, Inc. is a leader in magnetic field technology to create turbulence within the flow of fuel with it's patented Fuel Flow System. This turbulence increases the burning efficiency of the fuel, which results in improved fuel economy and a reduction in emissions. Gasmaster has Fortune 500 clients with applications from boilers to diesel engines. The GASMASTER Fuel Flow System (FFS) was evaluated recently by Hawthorne Machinery Co., the San Diego Caterpillar dealer. It was tested on a Caterpillar 3406 B engine in a Class 8 Peterbuilt Tractor. The vehicle is used daily to deliver equipment in their Rental Division. During the 28-day test period the vehicle accumulated 4,060 miles with the following results: 13% better fuel economy 26% reduction in opacity (the black stuff coming out of the exhaust) Overall, the worldwide market for the GASMASTER(r) Fuel Flow System is considered to range well over $1 billion dollars within the major industrial markets alone, with major extensions in consumer applications also possible. The minimum investment is 300 shares at $2 per share ($600). For more information just click on: http://www.prestigeipo.com/special.htm http://www.prestigeipo.com Don Jones -------------------------------------------------------------- PrestigeIPO respects your online time and Internet privacy. This is a one-time mailing, your name will be deleted from our files. However, if you are interested in receiving more information, updates or future newsletters, please type "subscribe" into the subject line of your reply. Thank you! --------------------------------------------------------------

1 0

Re: The illegal markets of cyberspace
by carolann＠censored.org 17 Dec '03

17 Dec '03

Thank you for the easy to understand concepts. Now where was that nobody(a)nobody.org key again? Love Always, Carol Anne....wondering if the Undernet was as good as the Blacknet? -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

SSL Suggestions
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Many people have suggested improvements to the techinical side of brutessl. I don't think anyone has looked at the user interface side of things. A simple configure script, and a few more reasonable defaults would bring quite a few more volunteers. I know of at least a handful of people who did not contribute because they were overwhelmed by the unfriendly scripts. While a rough user interface could serve as a basic intelligence test, I don't think that this sort of exclusion is necessary, given the nature of the task. DJK -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMEQrvHIf3YegbdiBAQE1pAJYnoXhffJeTrfiEm8R1fDGMuuZCpATw9gL M+A+LawHiPFeoHtcHp3ZBkhzOqEFS6MfMJ1wjbt9e3ILSJkVGC71OrkpiNcDBMKY 0G9G =3NIJ -----END PGP SIGNATURE----- Dietrich J. Kappe | Red Planet http://www.redweb.com/ Red Planet, L.L.C.| "Chess Space" /chess 1-800-RED 0 WEB | "MS Access Products" /cobre Web Publishing | PGP Public Key /goedel/key.txt

1 0

Re: Subject: ANNOUNCE: 2nd SSL challenge - we need your compute!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:16 PM 8/23/95 +0100, aba(a)atlas.ex.ac.uk wrote: >-----BEGIN PGP SIGNED MESSAGE----- > > >[a copy of final announce, start time 18:00 GMT, tomorrow (Thu), as >posted to a list of USENET groups] Is that really 1800 GMT or 1800 BST? 1400 or 1300 hrs EDT? I'm ready to hurl my 7800 keys/sec 486/66 into the fray. I should be able to do about 24 segments over 12 hours tonight using brutessl.exe 1.02 for DOS. Maybe I should have been in line at Midnight to get WIN/95 so I could run it automatically. The 32-bit Windows version does *not* work with my old Windows 3.11 even with the latest Microsoft 32-bit add in. DCF "No Ossifer, I'm not smoking. I'm burning this tobacco in protest against the fascistic policies of the Food and Drug Administration."

3 2

SSL CHALLENGE: 3 hours to go...
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

The start time for the kick off on the race to crack Hal's 2nd challenge is fast approaching... 18:00 GMT That's only a little over 3 hours away. Please start your brloop clients if you have not already. Chuck in any net connected unix boxes, never mind how old or slow, they'll still help. Be ready with the WWW interface at 18:00 GMT if you don't have direct IP. The client runs the brute forcer at nice -20, so it shouldn't interfere with users. All code, and step by step instructions for setup on: http://www.brute.cl.cam.ac.uk/brute/ or ftp://ftp.brute.cl.cam.ac.uk/pub/brute/ Binaries available for DOS, Windows 95/NT, generic C code for unix & others. Please run the socket code if you can, it'll provide best utilisation, and least work for you. May the race being... The c$ prize fund has reached c$ 342.30, and the more compute you personally contribute the greater chance you have of winning it :-) Adam

3 2

Re: Netscape's RNG
by skapp＠cix.compulink.co.uk 17 Dec '03

17 Dec '03

In-Reply-To: <199508300512.BAA23185(a)calum.csclub.uwaterloo.ca> > -----8<-----8<----- > struct RNG > { > unsigned char md5bytes[0x10]; > unsigned char randbytes[0x10]; > int size; > void *md5data; > }; > > RNG_GenerateRandomBytes(struct RNG *i0, char *i1, int i2) > { > char buf[0x20]; > int o1,o2; > > while (i2 > i0->size) > { > memcpy(i1, &(i0->randbytes)+0x10-i0->size, i0->size); > i1 += i0->size; > i2 -= io->size; > if (err = MD5_Begin(i0->md5data)) return err; > if (err = MD5_Update(i0->md5data, &(i0->md5bytes), 0x10)) return err; > if (err = MD5_End(i0->md5data, &(i0->randbytes), buf, 0x10)) return err; > i0->size = 0x10; > o2 = 0; > o1 = &(i0->md5bytes[0x0f]); > do > { > if ((*o1)++) break; > --o1; > } while (++o2 <= 0x0f); > } > > /* i2 <= i0->size */ > memcpy(i1, &(i0->randbytes)+0x10-i0->size, i2); > i0->size -= i2; > return 0; > } > -----8<-----8<----- > This looks very much like the RSAREF random number code, there are a few minor differences, but it still looks very similar. -------------------------------------------------------------------------- - E-mail: skapp(a)cix.compulink.co.uk, skapp(a)sourcery.demon.co.uk PGP fingerprint: 78 1C CD F4 A4 44 D2 CB DD A5 CF EF F1 DD D8 6A -------------------------------------------------------------------------- - RSAEURO: rsaeuro(a)sourcery.demon.co.uk

1 0