December 2003 - cypherpunks-legacy

Re: Big Brother is watching
by Sean Roach 17 Dec '03

17 Dec '03

At 03:43 AM 9/4/97 +0200, Anonymous wrote: ... >>With this wonderful sucess, We can all look forward to this items being >>placed in our domiciles in order to further protect us from crime. > >And I'll give my kids a can of spray paint and a ladder. Maybe I'll offer >bonus prizes if they can figure out an inventive, undetectable way to disable >the fucker. ... In Altus, it is illegal to sell spray paint to persons under the age of 18. That makes two violations of their rights that I know of. The curfue which was enacted a couple years ago being the first. All because the local politicians are fully aware that they are too young to vote.

2 1

[NOISE] Unabomber - crypto-anarchist?!?
by Sherry Mayo 17 Dec '03

17 Dec '03

Found this quote from the Electronic Telegraph, the online version of a UK daily newspaper. (world news section, Weds 20th Sept) http://www.telegraph.co.uk/et/access?ac=116192744309&pg=//95/9/20/wunab20.h… "Editors forced to print manifesto of Unabomber By Charles Laurence in New York ...The heart of his argument is that industrial society has led to ways of life for which people are fundamentally unsuited. He calls for a crypto-anarchic revolution and a new order based on small, village-style units." ^^^^^^^^^^^^^^^ Uh? Crypto-anarchic? Surely he's not one of ours? ;-) ;-) ;-) Sherry ps You are supposed to register to read the ET but I registered as "cypherpunks" passwd "cypherpunks" - don't worry I didn't give the mailing list address.

1 0

U.S. Prison Labor
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

Does anyone have pointers to information/details about U.S. prison inmates being used as slave labour for international corporations? Thanx

4 3

Re: "Hackers"-- brief review and anecdote...
by Rich Salz 17 Dec '03

17 Dec '03

>The question was, essentially, what do you think should happen to a >teenage hacker ... Oops. Sorry for the mistake. /r$

1 0

Crypto Law Survey updated
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

I have just updated my survey of existing and envisaged cryptography laws and regulations. See the Crypto Law Survey at http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm This update includes: -update on Australia (Walsh recommendations), Denmark (report by Expert Committee), France (decree deemed imminent), Sweden (Inspection for strategic goods), US (Bernstein decision, Junger amended complaint) -change on Singapore (unclear availability domestic crypto) -URL added to Sweden (export law) -FAQ added -lay-out restyled Besides, I have added to my homepage pages on my research (crypto & crime) and on key recovery and PKIs. I've also added a collection of links on these areas. See: http://cwis.kub.nl/~frw/people/koops/research.htm Comments are as always welcomed. Kind regards, Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

1 0

Re: Verification of Random Number Generators
by David Van Wie 17 Dec '03

17 Dec '03

On Tue, 19 Sep 1995 09:04:29 -0700 "Erik E. Fair" wrote: -------- >> >> Just an idle thought: it might be possible to do a probabalistic >> verification of a RNG by sampling it over some number of samples, and >> statistically analyzing the sample space. This would be analysis under the >> model of "RNG as black box" as opposed to (or rather, if you're smart, in >> addition to) code inspection & review. Any statisticians among us? >> >> Erik Fair >> The problem with a statistic is that it assumes an independent variable. If the variable is not truely independent (which happens with some frequency in real world analysis), any purported statistical result is meaningless (undefined, to be more precise). Clearly, the hack of netscape relied on the fact that the vairable was not independent. >But statistical tests of randomness alone do not make a good RNG. >At least, not for cryptographic use. A cryptographically secure >RNG is also unpredictable, i.e., computationally unfeasible to >predict the next random bit will be given the algorithm, and not >reliably reproduced, i.e., multiple runs with the exact same input >do not generate the same sequence. This is almost right. Statistical tests work fine if they are conducted on independent variables. dvw

1 0

Re: [PGP-USERS] Crypto-logic US$1 million Challenge
by geeman＠best.com 17 Dec '03

17 Dec '03

There was a Snake-oil FAQ floating around for quite a while that addressed all this in some detail. This scheme/scam has circulated before, too although I forget the name of the perpetrating company. At 02:40 PM 9/3/97 -0400, William H. Geiger III wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In <97090316550827/0002595870PK5EM(a)mcimail.com>, on 09/03/97 > at 11:55 AM, Jeffrey Gold <0002595870(a)MCIMAIL.COM> said: > >>Although it's not PGP, I thought this might be of interest. >>I've condensed a Wall Street Journal Article with info from >>the web page http://www.ultimateprivacy.com > >> A start-up company is offering a $1 million challenge. Crypto- >>Logic Corp. of Austin, Texas, claims to have created an encryption >>system for electronic mail so foolproof that it can't be broken. If >>someone can figure out a special encrypted e-mail message within a >>year, the company says it will pay a reward of $1 million. > >> Cryptologists agree that the decades-old encryption method that >>Crypto-Logic is claiming to use -- called a "one-time pad" -- >>is theoretically unbreakable. Each "pad" has a set of uniquely >>random digital symbols that are coded to the actual message. >>The recipient uses the same symbols to decrypt the message. >>The pads are used only once. > >> Of course, the problem with any one-time pad is the distribution >>of multiple pads. A new one is needed for each message. Public-key >>cryptography (used by PGP) addresses this issue. It is not clear >>how Crypto-Logic Corp. addresses the distribution issue. > > >ROTFLMAO!!!!! > >What a sweet little scam they have going here. :) > >While there product cost $99, which is not unreasonable for a security product of this nature, they charge $49 for the "OTP's" (I'll get to the OTP's later)!!! > >Now they way they have this set-up is that for each person that you are communicating with requires a separate "OTP". The program comes with 2 "OTP's" and additional "OTP's" can be purchased for $49. So say you have 10 people you wish to communicate with you are talking almost $500 out the gate to get going!!! This is just silly. > > >Now to "OTP's". These are the things that snake-oil salesmen's dreams are made of. Here is how their sales pitch works (and i have seen many of them over the years): > > >1) OTP's are unbreakable >2) We use an OTP >3) Our program is unbreakable >4) You should use our program > >I will address all three points of their sales pitch and show the flaws in it. > >1) OTP's are unbreakable: > > To understand how one can make this claim (and it is true) on needs to understand what a OTP is and how it works. > >A OPT (One Time Pad) is just a file of random numbers. That's it, nothing fancy here. To encrypt a message one takes the bits in the plaintext and an equal amount of bits from the OTP and XOR them together. The result is just another random file of bits. To get the plaintext back one takes the "encrypted" files and Xor's it with the same bits used the first time. > >Quite simple but there is a catch: > > Your OTP must but TRULY RANDOM!! If there are any patterns in your "random" data you are dead in the water. The biggest flaw in products that claim to use OTP's is they use what is called a PRNG (pseudo random number generator). Unfortunately the data that PRNG's produce are not sufficiently "random" for use in OTP's. It has long been accepted in the field of cryptology that you *MUST* use a real world sample for random data, things like measuring the time intervals between click on a Geiger counter measuring background radiation. > >A second catch: > > You must never, never reuse any of the bits from your OTP!!! As simple as this seems (after all this is why they call it an One Time Pad) there are programmers out there that fail to grasp this basic concept. Now AFAIK there is no pad reuse with this program. That's where their revenue stream is comming from charging you for the new pads! > >So if you use truly random data (no PRNG's) and you never reuse bits then an OTP encrypted message is provably unbreakable. > > >2) We use OTP's > >I have seen numerous claims by various "snake-oil" salesmen that their program uses an OTP only too see that they are using a PRNG to generate their "OTP". I even had one claim that it was ok to reuse his PRNG generated pad. > >Now since the company provided no details on how they generate the OTP's who knows what they are doing. > >3) Our program is unbreakable > >Well if they are dotting all their I's and crossing all their T's when it comes to generating and using OTP's then yes the message is unbreakable. > >But wait their program does not generate the OTP's you must buy them from the company!! This means that a 3rd party outside of you and the person you are communicating with has a copy of the pad!!! This is a big no-no in cryptology. Anyone who has access to the OTP can decrypt any message that was encrypted using it. What type of security do they have on site? Who has access to the OTP's?? How are they generated?? What are their policies if the government requests access to these OTP's?? All questions left unanswered by the company. > >I must say that I seriously question the on-site security of the OTP's considering how the initial OTP's are sent to the customer, (drum roll please), the just MAIL them!!!! > >This brings us to the third catch to using OTP's: How to exchange the pads. > >Before the advent of Public Key Encryption this was the most daunting task in cryptology. How do you get the keys to the people who need them to decrypt the message??? With OTP's or any form of cryptology where the same key is used to encrypt and decrypt the message the user must find a "secure" channel for exchanging the keys. This is no different than a key to a house or a car, the same key is used to lock and unlock the door. Anyone who has a copy of the key can unlock the door. Need less to say you don't just send the key in the mail. Usually such exchanges are done in person or if this is not practical a "trusted" courier is used to exchange the key. Not very practical for every day use. > > >4) You should use our program > >Consider the following: > >- -- Unknown methods used for generation Otp's >- -- Customer unable to generate their own OTP's >- -- Unknown "on-site" security >- -- Otp's escrowed by company (they have a copy of your keys) >- -- Additional cost for each new key >- -- Obvious lack of security in mailing initial Otp's to customers >- -- No solution to the key exchange problem >- -- No source code for program > >I would not use this program nor would I recommend it to anyone else. There are may other programs that provide overall better security than what this program ever can or ever will provide. > >I will CC: the Cyberpunks & Coderpunks list as there may be others there who can better expand on this issue. > > >- -- >- --------------------------------------------------------------- >William H. Geiger III http://www.amaranth.com/~whgiii >Geiger Consulting Cooking With Warp 4.0 > >Author of E-Secure - PGP Front End for MR/2 Ice >PGP & MR/2 the only way for secure e-mail. >OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html >- --------------------------------------------------------------- > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3a >Charset: cp850 >Comment: Registered_User_E-Secure_v1.1b1_ES000000 > >iQCVAwUBNA2vRI9Co1n+aLhhAQF7NgP/TIfrhNW8QMiqNBE0atN0lVBeZFtTk1Jh >ARJeGkh+ZxV+yphx0CGe9xMWRLYx3qqFPmb69iPG3AdRiLFVigSoK5HiNo857ilh >6pSt3ZHVJStJ8BjPazH+n3QXQGtrCZ2hBF6kBWfPxDMFdc+dZZ0y0/4kSt60Dnx1 >CulFvdCNIK4= >=yDMp >-----END PGP SIGNATURE----- > > >

1 0

Re: FBI calls for mandatory key escrow
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: > Even the weaker form of Freeh's suggestion, that key escrow capabilities be > forced into all Internet products, even if the use is "voluntary," seems to > lack constitutional support. Could the Federal Trade Commission force all > products to have such features? The Consumer Safety Products Commission? > > I don't know where the authority for mandatory seat belts and air bags is > claimed to come from, either. Or helmet laws in various states. The 'authority' comes, as always, from power and money. The "Drive 55" mandate is a perfect example of the government stealing the citizen's money, then giving it back in the form of highway funding, with the condition that those states who don't give up their right to decide their own state laws don't get any cash. The greedy fucks feeding at the government troughs want to get their hands on that money _now_, because there is no telling who will be ahead of them in at the trough by the time the Constitutional issues are settled. The bottom line is that the federal government gets their authority by virtue of armed robbery, bribery and illegal seizure. Who is going to stop them? They have the guns! When our elected officials in Congress delved into the INSLAW affair, the Department of Justice told them to "Fuck off." and refused to cooperate with those who represent the citizens. Congress's reaction was to say, "Yup. They're defying us." Ipso facto--Congress is not running the country. The LEA's are running the country. Go figure... TruthMonger # -23A(Sub.C)-009

1 0

Re: Militias
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: > > I just watched an hour-long special on CBS, "The Birth of a Militia," about > the Rocky Mountain Militia is southern Utah. > The militia member who was arrested, tried, and convicted of illegally > owning a gun, evading the police, and driving without a license, apparently > committed no serious crimes, by my standards. He didn't rob, he didn't > rape, he didn't kill. > > As the Sheriff was quoted several times as saying, he "mouthed off." And > apparently being a "skinhead" and a "militia member" is ipso facto proof of > criminality. The Sheriff said he planned to get Johnny. I watched the show and couldn't figure out exactly what the 'crimes' were supposed to consist of. I eventually got the impression that the real 'crime' was "intent to have a bad attitude." My basic read is that they are going to fuck with those they don't like until their sense of human dignity forces them to make a stand, and then they will murder them and use the event as more evidence of our need to be protected from 'unauthorized' nuts with guns. I don't know about you, but I would much rather get murdered by an 'authorized' nut with a gun, than an 'unauthorized' nut with a gun. It seems so much more civilized, somehow. When militia members leave for their meetings, do their mothers remind them to put on clean underwear, in case they get murdered by law enforcement agents? This is what cypherpunks enquiring minds really want to know. TruthMonger

1 0

Re: netscape broken on NPR
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:06 PM 9/19/95 -0500, you wrote: >NPR reported on the security flaw in Netscape, > >3:05 pm CDT. As well as CNN Headline news. (With the big Netscape N logo and everything.) They spent a fair amount of time (for CNN Headline news) on the story. | Minister of Forced Caffinization in the DNRC | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

1 0