December 2003 - cypherpunks-legacy

ANNOUNCEMENT: sepp-talk mailing list
by Erik Bataller 17 Dec '03

17 Dec '03

The sepp-talk mailing list is a forum for comments and discussion regarding the Secure Electronic Payment Protocol (SEPP), proposed by MasterCard to support credit card payments over the Internet. The SEPP specification is available for review from the MasterCard home page: http://www.mastercard.com The CommerceNet consortium operates this mailing list as a service to the Internet community. To subscribe to the sepp-talk mailing list, send email to: majordomo(a)commerce.net ...with a message body of: subscribe sepp-talk <your full name> You should receive a confirmation message which includes instructions for unsubscribing from the list. Shortly, CommerceNet will provide a WWW archive of this list on it's server. A notice will be sent to the mailing list.

1 0

FBI/CIA/NSA, let's merge them all into one. [???!!!]
by Brad Dolan 17 Dec '03

17 Dec '03

AP on 10/25/95: FBI Gets CIA Help On Olympics The FBI and CIA are working together to deal with "substantial" threats to security at next summer's Atlanta Olympics, top administration officials told senators Wednesday. [...] Sen. Bob Kerrey of Nebraska ... chided the FBI for seeking to build a $37 million code encryption center that he said would duplicate facilities operated by the National Security Agency.

1 0

Re: Let's Not Merge Mailing Lists, OK?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

I'm cc:-ing this to both lists just this once, because this message is more or less administrative. I'm not trying to merge www-buyinfo with cypherpunks. tcmay(a)got.net (Timothy C. May) said: >There is great danger in constantly "casting the net wider," in trying to >reach more and more people. I understand the temptation for some on both >lists to cross-post some messages. I urge that they do this, as Bob H. has >done on occasion, by personally forwarding the message, with only _one_ of >the lists getting it. (This because the real danger is as above, where >multiple lists are in the recipient or cc: fields, and followups semi-spam >multiple lists.) I agree with Tim. I've been doing one-way forwards from cypherpunks to www-buyinfo for most of a year now. Most of the people on www-buyinfo are business people who understand that digital commerce *is* financial cryptography, but they don't have time to read all of cypherpunks to find the e$ juicy-bits. When I do this, I put a "(cpx)" in the subject line so that the sizable community of cypherpunks on www-buyinfo can filter them out and won't have to see double. I've gotten a lot of fan-mail for this, even though it's not really in keeping with the original charter for www-buyinfo, which seems to have been subsumed by other groups, like the e-payments list and others. Recently Dave Kristol has said that he's going to retool www-buyinfo, and when he does, I'm hoping to have set up my own structure of 3 hypermail archived e$ lists (a netwide e$ digest, a discussion list, and a newsletter). I'm talking to about 3 or 4 different people about it, and I should have the details worked out within a few days, with an announcement next week, if I'm lucky. Anyway, I've sent a few messages in the opposite direction on occasion (from www-buy to c'punx), but I do try to hold it down, mostly because whatever the topic is, we've usually talked about it on cypherpunks before. I should note, however, that there's a good-sized discussion, for www-buy, anyway, going on over on over there about anonymity, which has heated up over the past few days. I forwarded a message here from Nick Szabo as an example of it yesterday. The cross-posting Tim's talking about is a result of that discussion. There's a whole lot of "what do we need anonymity for, anyway?" opinion in the business community, and it should be addressed with as much reason as possible, and not by shouting them down with moral arguments to the contrary, no matter how right those moral arguments are. Fortunately, I believe there's a great business case for anonymity, and frankly, there had better be, because, in a cryptoanarchic geodesic economy like the one we're fixing to have, nothing is going to survive without a market. Anyway, like I said, I agree with Tim. If you want to post to cypherpunks, you should subscribe to cypherpunks, and suffer the firehose like the rest of us have to do. However, those of us who are on both lists, especially those of us longer-term cypherpunks like Hal, and Nick, and Adam Shostack, should be the ones to forward messages, if any, to cypherpunks, because they are the ones who know whether cypherpunks has seen this before. For instance, the posting of Nick Szabo's that I sent to cypherpunks was more of a rah-rah exercise (no pun intended) than anything else. It was so well thought out that I thought it bore passing around a bit. However, as an actual contribution to the information content on cypherpunks, what Nick said has been said on cypherpunks before, if not typically with such eloquence. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Anonymity: A Modest Proposal
by loki＠obscura.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 3:35 PM 10/23/95, Futplex wrote: >Lance Cottrell writes: >> I think one solution to this problem is to encourage (require) the use of >> pseudonym servers. Having a server like alpha as the entity on the from >> line has several advantages. >> >> 1) Less Spam since it takes some effort to set up the nym and it will be >> taken away as soon as the spam starts. > >I fear this will be a short-lived gain. User-friendly scripts for >establishing pseudonymous accounts are pretty easy to write. They may be >beyond the average Fast Money Maker, but I expect myself and others will be >putting them out on the Net for general consumption. One need not automate the process of setting up anonymous accounts. One might also require some sort of exchange before activating the nym to verify that the return address is working. <SNIP> >Semi-permanent account status confers privileges to the user, IMHO. I >believe a pseudonymous account ideally should be treated the same as a >regular account on an ISP. For example, an admin will not unilaterally close >an account upon receiving a single complaint about the account user. >Certainly I don't know of an ISP that routinely blocks its users' accounts >from sending mail to selected other accounts. Lest I seem too presumptuous, >let me say that I realize all immediately foreseeable pseudonymizers are >free services. Clearly these service providers can set whatever policies they >wish, and are not directly competing with the fee-charging ISPs. Perhaps >future fee-charging pseudonymizers will consider these criteria in offering >enhanced services. > >-Futplex <futplex(a)pseudonym.com> I agree. With both free and for-fee nym servers must clearly spell out what actions will result in the termination of the nym. Perhaps 1 spam, 1 systematic harassment, or more than 5 serious complaints per month. Obvious this would need to be tuned to preserve free speech while allowing abusers to be quickly squelched. I would imagine an ecology of these servers would develop with some short lived permissive servers mixed with long lived more restrictive ones. -Lance -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMI8kEfPzr81BVjMVAQF3QAgAh+Q03VU3b69uQqylri/S2EJvfS5MqQ4V JRTZRu8ZQTjb7Ic6KowQXogXG0yAv/GUa6jEWup+fO1omR2t/s7AtXjcFC6du1hh iwSeRw1QVtyspDu6FHAJNL98uG3b0taSHJxfAueA4CA8lZm00vP1exM1A0ndPjXN 6/oM/O5xdUET2tanlpcW2WDdVOZDDGQGvMORlrG8WmJKWebmcg9GnrE5gyZLs3Wr ijze7CccyPLnET4dZiry9Qd/NRx2hgdfkDopTNiTbvmGCXulzqBpqSZ689KDITAK MNgSagZKgOsy7pRGCFSK9EPljZ2IwPtCrE/s9YX0kkJtDhq84SU3EQ== =UBy5 -----END PGP SIGNATURE----- ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Anonymous Account Help
by hroller 17 Dec '03

17 Dec '03

I have been having problems trying to set up an account at alpha.c2.org. I have followed all the instructions but am still unable to get a reply or anything that works right. What I am doing wrong? This is what I have done so far. I am about to pull my hair out. I have been working on this for 2 days now. Anyway, 1. Created a Reply Block like this: Request-Remailing-To: hroller(a)metronet.com 2. I then encrypted it with remailer(a)replay.com's Public Key. I prepended it with the "Encrypted: PGP". 3. I then created the following message: From: hroller(a)alpha.c2.org Password: MyPassword Reply-Block: :: Anon-To: remailer(a)replay.com :: Encrypted: PGP -------Begin PGP Message---------- "The Encrypted Reply Block Message" ------End PGP Message------------- 4. I then sent it to "alias(a)alpha.c2.org". Then I wait. But never get anything from alpha.c2.org. I have gotten some anonymous messages from replay, but they are still encrypted so I don't know what it is sending me. Any help you can supply would be greatly appreciated. hroller

3 3

Re: [Noise] Paranoia in the Comics
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:27 PM 10/25/95 -0700, you wrote: >This has no real crypto relevance, but some anarchistic relevance. > >Sometimes you find anti-government paranoia in the strangest of places... >In the Ziggy strip for 10/25/95, Ziggy is in a Psychiatrist's office. The >shrink is stating "You're afraid of the government, are you? I'm required >to report that sort of thing you know." Ziggy has long been a libertarian/right winger. Note a Sunday strip of a few years ago. Ziggy bends over and looks closely at some red ants who are carrying picket signs reading "Down with Communism", "Freedom Now", etc. Ziggy observes "It had to happen sometime." Since we are being semi-irrelevant here, yesterday's Broom Hilda strip was good for the net "Universal Access" wars. Broom Hilda sits down at a computer to take a ride on the Information Superhighway. The computer says "Sorry, the information superhighway is a toll road." "What's the toll"? "Brains." So Broom Hilda gives up and sets off on a tour of the back roads of America. Note the proof that competition provides better service than government-monopoly Universal Service. After years of being one of the few Local Telcos that charged residential customers metered rates for local calls, NYNEX (New York Telephone) has announced some flat rate pricing plans. Nothing like a little local loop competition. DCF "School Bus Safety - Are your children safe? - Story at 11:00" -- They're safer on the bus than they are when they arrive at their local institution for the mentally/morally defective.

1 0

Re: your mail about Dr. Dobbs CD-ROM. (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from Unicorn ----- >From cpunks Fri Sep 12 07:14:53 1997 Message-ID: <19970912124749.42396(a)sequent.com> Date: Fri, 12 Sep 1997 12:47:49 +0200 From: Unicorn <hvdl(a)sequent.com> To: coderpunks(a)toad.com Subject: Re: your mail about Dr. Dobbs CD-ROM. References: <c=US%a=_%p=EDS%l=AUADMEDS001-970911232759Z-1185(a)sg-energy-nt01.sg.eds.com> X-Mailer: Mutt 0.81 In-Reply-To: <c=US%a=_%p=EDS%l=AUADMEDS001-970911232759Z-1185(a)sg-energy-nt01.sg.eds.com>; from Garrard, David on Fri, Sep 12, 1997 at 08:27:59AM +0800 X-Files: The Truth Is Out There! X-Disclaimer: Comments contained do not necessarily represent thoseof my current employer. X-Copyright: Portions of this message may be subject to copyright.(c) 1994-1997 Hans "Unicorn" Van de Looy. Sender: owner-cypherpunks(a)toad.com Precedence: bulk --- On Sep 12, Garrard, David apparently wrote -------------------------------- > Has anyone gotten a copy of the Dr Dobb's Cryptography CDROM outside the > US yet ? Nope. But where did you hear that it was available inside the US already? > David Garrard --- and thus sprach: "Garrard, David" <David.Garrard(a)EXCH.EDS.com> ------------ Ciao, Unicorn. -- ======= _ __,;;;/ TimeWaster ================================================ ,;( )_, )~\| A Truly Wise Man Never Plays PGP: 64 07 5D 4C 3F 81 22 73 ;; // `--; Leapfrog With a Unicorn... 52 9D 87 08 51 AA 35 F0 ==='= ;\ = | ==== Youth is not a time in life, it's a State of Mind! ======== ----- End of forwarded message from Unicorn -----

1 0

MD4-derived hash functions
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Tue, 24 Oct 1995 13:14:41 -0400 >From: hallam(a)w3.org >Subject: Re: MD5 weakness >Ron has not mentioned such an event to me and if that were the case I would >seriously doubt that he would not have been told about it. The only comment he >generally makes is that he wrote MD5 because "MD4 was making me nervous". In the MD5 RFC, I seem to recall the statement that MD4 was trading off too much strength for additional speed. However, sometime around that time, it came out that there were attacks on two-round variants of MD4, which is the stated reason for the development of RIPE-MD. Does anyone know whether Rivest was motivated to design MD5 by the partial attacks on MD4, or whether those came later? (This is totally idle curiousity.) >NIST and the NSA trusted MD4 sufficiently to base SHA upon it. SHA is preferable >in many ways to MD5, it has a different approach to extending the scheduling and >resist differential cryptanalysis. There is a problem with the compressor >function of MD5 which I dislike. All of the well-known software hash functions seem to be based on MD4 these days, but that doesn't mean much about the security of MD4--3DES with three independent keys looks pretty strong, as does 3DES with two independent keys, but that doesn't mean that single DES is a strong enough cipher for modern applications. One issue that exists with MD5, but not with SHA or the longer hash versions of Haval, is that MD5 has only a 128 bit hash function output, which corresponds loosely to having a 64-bit key. This implies that a wealthy enough opponent could determine a pair of MD5 inputs that collide, and conceivably use this in an attack. I think we should stick to 160 bit or longer hashes for future designs. (See P. van Oorschot and M. Weiner, "Parallel Collision Search with Application to Hash Functions and Discrete Logarithms," in the proceedings of the 1994 Fairfax Conference, for example). As an aside, what hash functions are there out there that look reasonably strong, have hash outputs of at least 160 bits, and aren't based on MD4? Some of the Snefru variants with many passes (eight?) come to mind, and the GOST hash function fits all the criteria, except I have a hard time convincing myself it's as strong as it claims to be. Is there a generic construction for arbitrary-length hash functions from good block or stream ciphers? > Phill --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMI+Mc0Hx57Ag8goBAQFJ9gP/VMvNefSm77prSY/NMbJfGO1EVmQrUAHn kEQEse+cXiaoJTe7njxUqycuDX0PN09C4XhNVOQJ6IBpCPZOKQMiXsI9FwAfjGWb mibwSfzyiXwxny1kYgfDCffS8KwdlWiVjxj1+MhvqhGQnxPsVA6UVrSCyAyHPZVJ UTXUWBJlJho= =2Pti -----END PGP SIGNATURE-----

7 6

Re: Welcome to cypherpunks
by stevenw＠best.com 17 Dec '03

17 Dec '03

>> Why am I getting this when I am already subscribed to the >>list?????? > >Because someone signed the list up to the list...probably inadvertently. >They probably sent something to majordomo with a line like: > >subscribe cypherpunks cypherpunks(a)toad.com > >thinking it actually made sense for some reason...then again they might >have done it on purpose. Well, the Welcome message says this: ->If you ever want to remove yourself from this mailing list, ->you can send mail to "Majordomo(a)toad.com" with the following command ->in the body of your email message: -> -> unsubscribe cypherpunks cypherpunks(a)toad.com So it is but a small leap of logic to remove the 'un' in order to subscribe, since to my knowlege the Welcome message does not tell you how to subscribe. A human interface problem? ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Re: Court proceedings under new SAFE act
by John Young 17 Dec '03

17 Dec '03

Lucky Green asked about judges of the FISA court, and Declan named Joyce Green. The Chief Judge of FISA is Royce Lambert, who gave talk on C-SPAN about the operation of the court at an ABA conference in D.C. a few months ago. He made the point that few applications for electronic surveillance are turned down by the court (of 8,000 applications 12 were denied) because the judges coach the applicants until they get a request right. And that the DoJ teams are quite adept at complying with the court's requirements, because all pass muster first of a special office set up for that purpose. Judge Lambert said the job is "a lot of fun" because its deals with supremely critical events of national urgency, and that all the judges involved really do like it, especially the secrecy and prestige of being part of one of the most exclusive groups in Washington. This is not a joke. Indeed, the Chief joked that the court's role "may be constitutional." And then said that he'll probably get in trouble for the statement. For how the snoop system is supposed to work see the Foreign Intelligence Suveillance Act: http://jya.com/fis.htm (107K)

1 0