December 2003 - cypherpunks-legacy

re: [NOISE] Chi Sun Times SS# Sweepstakes
by Weld Pond 17 Dec '03

17 Dec '03

"Lynne L. Harrison" <lharrison(a)mhv.net>: > There may be *an ulterior motive* of getting the person's ssn, i.e., for >the purpose of the newspaper (and the winner) reporting winnings to IRS. In >addition, the newspaper may also feel that, in selecting a 10-digit number, >it probably will not repeat such as someone's birthdate. Personally, I lean >towards the former. Why not just make giving up your SS# a condition of receiving the prize *if* you are a winner like lotteries do? I think the real reason is they need a unique number and are lazy and uncreative about generating one from the info people send in. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/~weld L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

1 0

The future will be easy to use
by Raph Levien 17 Dec '03

17 Dec '03

Here's a quote from Bill Gates' book: The mechanism that will make this possible is based on mathematical principles, including what are called "one-way functions" and "public-key encryption." These are quite advanced concepts, so I'm only going to touch on them. Keep in mind that regardless of how complicated the system is technically, it will be extremely easy for you to use. You'll just tell your information appliance what you want it to do and it will seem to happen effortlessly. (Thanks to the anonymous person who typed it in) We may not all like Bill Gates, and some of us even boycott his software, but we must admit he is a very shrewd businessman and knows which side of his toast is buttered. I think this paragraph is right on the mark. The competition for which cryptographic protocol wins will be decided on the basis of usability. The "dark forces" are no doubt aware of this fact, and have already made some advances in this area. One example is the Fortezza card. If cypherpunks are to have any hope of getting their vision of strong crypto implemented and deployed, it has to be in the context of usable systems. Form this perspective, let's take a look at the recent thread on "establishing trust." Carl Ellison advocates the MOSS alias system. My understanding of this system is that individual users associate "aliases" with public keys. If done right, it can work well. However, from a usability perspective, it is just one more trouble spot. First, on what basis will users decide which keys are worthy of being assigned which aliases? Public keys are big hunks of base64 encoded gibberish. They are difficult to present in a user interface, difficult to communicate in alternate, known secure channels (such as telephone calls and face to face communication). There is no way that a person could memorize one. The other issue is how much time and energy the user has to spend keeping the alias database up to date. There is no way to communicate securely with anyone who's not in the database. If the user is communicating with a large number of people, then it's very tempting to get sloppy. There's no way around it. This kind of system will not make it in the big time. As I see it, any system that does must have the following properties: * Some variant on the Web of Trust. * Online key-servers for getting keys in real time. * A clean mechanism for validating keys through alternate channels. There are three possible outcomes: we build it, the NSA builds it, or Microsoft/Netscape builds it. This last outcome might not be so bad, but only in the first one can we rely on our principles being advanced. Raph

1 0

Re: GOST for sale
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:43 AM 11/24/95 +0100, Mats Bergstrom <asgaard(a)sos.sll.se> wrote: >According to a short article in a Swedish newspaper (DN) >with the title 'Spy Code of KGB can make computers safe', >JETICO INC., located in Finland (Tammerfors), introduced >a new crypto system on the world market last week. It's >based on GOST, the Russian federal standard algorithm. >This product, called BestCrypt, is implemented at least >partly in hardware. Alledgedly it uses 'GOST 28147-89', >whatever that stands for. > >GOST is probably very secure - a huge keyspace (256 bits) and >KGB would not have left a trapdoor for NSA to take advantage >of, would they? >From what I've read of GOST, it's really a family of cyphers with different sets of S-boxes - routine military gets one set, top secret gets another, civilian govt another, etc. Aside from possible differences in security level for the S-boxes, one motivation is that you can't take civilian govt decryptors and use them to read or forge top secret military crypto, etc. If this is correct, then some sets of S-boxes probably do have trapdoors (at least susceptibility to differential cryptanalysis_; how good are the ones that Jetico is selling, what credentials do they have to convince us their cryptanalysis is good enough, and why are they doing parts of it in hardware? #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: Cypherpunk Certification Authority
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:20 AM 11/25/95 -0800, you wrote: >At 01:53 AM 11/26/95 -0800, anonymous-remailer(a)shell.portal.com wrote: >>You'd rather sign before encryption?? >>Doesn't that give you "known plain-text" to attack? > >The signature is not known unless the whole message being signed is >known. Signatures often have known, or easily guessed, plaintext in them, like the signer's name or ID number, or various header fields such as X.509's equivalent to ----- BEGIN PGP .... >And any encryption scheme that is vulnerable to known plaintext attack >where only a part of the message is known, is worthless anyway. DES isn't worthless. It's a bit weak, but not worthless. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

2 1

Re: The future will be easy to use
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 11:06 AM 11/27/95, Raph Levien wrote: .. stuff.. >The competition for which cryptographic protocol wins will be >decided on the basis of usability. .. stuff.. > If cypherpunks are to have any hope of getting their vision of strong >crypto implemented and deployed, it has to be in the context of usable >systems. .. stuff.. > There's no way around it. This kind of system will not make it in the >big time. As I see it, any system that does must have the following >properties: > > * Some variant on the Web of Trust. > > * Online key-servers for getting keys in real time. > > * A clean mechanism for validating keys through alternate channels. > > There are three possible outcomes: we build it, the NSA builds it, or >Microsoft/Netscape builds it. This last outcome might not be so bad, but >only in the first one can we rely on our principles being advanced. This is a very important period. The technology is young enough that a window is open for a non-giant to produce a dominant product. On the other hand, it takes actual coordination of resources. I'm not sure that it is within the range of Cypherpunks to take advantage of this window. There is still no agreement whether the group can be said to have a single vision, nor whether people within it want to be bounded by another's view. If people really wish to take advantage of this and really push things, it means forming a group, made up of Cypherpunk members perhaps, but much smaller, and capable of working together. Also capable of handling not only the theory, but good solid code, GUI, PR, meetings, talking to the government, etc. It is an open window yes, but not a simple one. I'd love to see widespread use of secure encryption, however I don't think the potential exists within the Cypherpunk framework to reach it as 'Cypherpunks'. The question then is, whether Cypherpunks should change, or whether a smaller group will be formed. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

4 3

Announcement: mixmaster 2.0.3 released!
by Mixmaster 17 Dec '03

17 Dec '03

Announcing the release of Mixmaster version 2.0.3 Among other improvements it includes an new and improved Makefile. Installing Mixmaster is a SNAP! For information about Mixmaster, and how to get it, check out http://obscura.com/~loki or read the Mixmaster FAQ which will be posted soon. -Lance

1 0

Cray's New T3E
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

WSJ, Nov 27, 1995 Cray Research to Unveil 2nd-Generation Parallel Processor for Technical Market By William M. Bulkley Cray Research Inc., bidding to reassert its dominance of high-end scientific supercomputing, is expected to unveil tomorrow a new parallel-processing supercomputer with unprecedented speed. The Eagan, Minn., computer maker has been best-known for its multimillion-dollar vector supercomputers that use just a few very powerful processors. The new Cray T3E will be its second-generation parallel processor. Unlike its predecessor the T3D, it operates without being connected to a traditional vector supercomputer. People familiar with the machine say it will have a theoretical top speed of more than one trillion operations a second, or one teraflops, a measure of supercomputer speed. Currently the only planned teraflops machine is one that Intel Corp. is building for the Energy Department's Sandia National Laboratories. 'Back in the Game' "We look at this as evidence of Cray reasserting its franchise in the technical computing market," said Debra Goldfarb, who follows supercomputers for International Data Corp., a market research firm in Framingham, Mass. "Cray's back in the game." The smallest models are likely to be priced at well under $1 million. Buyers will be able to increase power by adding just a few processors at a time in the future making the systems "highly scalable" in industry parlance. The T3E can be built with as few as 16 processors or as many as 2,048 processors. "This reconfirms Cray's capabilities to build very efficient high-performance computers," said Philip Samper, chairman and chief executive officer, who was hired last spring. Cray has said it will report a net loss for the current year, reflecting restructuring charges as Mr. Samper cuts costs, and sales are weak as customers have been waiting for new generations of both Cray's T90 vector supercomputers and the T3E. Mr. Samper said that Cray will be profitable in the current fourth quarter on an operating basis before an expected restructuring charge, and "We expect to be profitable in 1996. That's very important for this company." Mr. Samper, who declined to discuss details of the T3E, said in an interview, "We have $100 million in orders already in house. When customers get so excited they put money on the line, that's the ultimate test." The T3E won't be available for sale until the end of the first quarter of 1996. Cray's total backlog was $355 million at the end of the third quarter, including orders for the T3E. Cray, the longtime leader in scientific supercomputing, faced challenges from a host of smaller companies in the late 1980s as well as three big Japanese computer makers. But with the end of the Cold War, military need for supercomputers diminished, Cray's sales plateaued and several of the smaller companies went out of business. Offsetting Some Declines Analysts estimate the high-performance-computer market at about $3 billion a year, with growth in commercial markets for large databases and video-servers for interactive-media, offsetting declines in government business. International Business Machines Corp. and Silicon Graphics Inc. have both grown rapidly by selling parallel-processing systems in those markets. Cray sells small commercial supercomputers and commercial servers for computer networks of Sun Microsystems Inc. workstations. However, analysts say it needs revenue from the high-performance scientific market to rebound. Jay P. Stevens, an analyst with Dean Witter, says sales in the current year will fall 27% to $615 million from $921.6 million. Next year he forecasts a 20% rise to $808 million. Mr. Stevens predicts a net loss before charges for 1995 of $73 million, or $1.25 a share, compared with net income of $55.7 million, or $2.32 a share, in 1994. Mr. Samper said that during the year, Cray has reduced research-and-development spending by 16% and lowered overheads. He said it plans to buy more parts from outside suppliers, and is also controlling costs by negotiating with government agencies to have them pick up certain research and support costs. -----

2 1

Re: The future will be easy to use
by Jonathan Zamick 17 Dec '03

17 Dec '03

>* Clear goals. > >* A leader, someone who would call the shots, and would also serve as the >person you'd have to convince. > >* Open communications. Shrouding a project in secrecy is a good way to >kill it. This is one potential advantage we have over the spooks. > >It _is_ doable. I know the skill is out there. Wei Dai, Eric Young, Peter >Gutmann, and others have proved themselves quit capable of writing good >solid code. Sameer Parekh has done an incredible job with PR. Phil Karn, >Dan Bernstein, and some others (who I'm not sure want to be named) are >talking to the government. GUI I'm less sure about, but I'd hope that some >cpunks would come out of the woodwork. > >It is not a matter of ability, but of will. It is also a matter of funding of course. While development can be donated time, the rest often takes money. Still, its something to look into. Handling RSAREF is sapping much of my time, otherwise I'd jump right in, however I like to always pause before committing my time to endeavors. I wouldn't mind helping out though. Certainly Consensus probably has some resources with its own contacts to contribute. I agree with your points though. Another thing to consider, are some alternate methods of enterprise design that involve better communication, iteration of goals vs product, etc. (Actually I need to work on a speech about this that is coming up soon. Yet another project. :) Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

3 2

Judge won't drop Netcom from suit
by Joey Grasty X3697 P6611 17 Dec '03

17 Dec '03

Check out the story on the Scientology suit. http://www.sjmercury.com/scie1127.htm

2 1

Cyberangels vs Anonymnity
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Here's the section from the Cyberangel FAQ which should explain why I put the addresses on the list. Given that their main tactic so far is telling ISPs, I would guess that any unauthorized remailers may be in trouble... once they get a clue enough to spot them. Yes, the shouting is theirs. -Allen _9) WHAT KINDS OF CHANGES WOULD THE GUARDIAN ANGELS / CYBERANGELS LIKE TO SEE?_ A) WE WOULD LIKE TO SEE AN IMPROVEMENT IN USER IDENTIFICATION. USER ID IS IMPOSSIBLE TO VERIFY OR TRACE BACK. THE VERY ANONYMITY OF USERS IS ITSELF CAUSING AN INCREASE IN RUDENESS, SEXUAL ABUSE, FLAMING, AND CRIMES LIKE PEDOPHILE ACTIVITY. WE THE NET USERS MUST TAKE RESPONSIBILITY FOR THE PROBLEM OURSELVES. ONE OF OUR DEMANDS IS FOR MORE ACCOUNTABLE USER IDS ON THE NET. WHEN PEOPLE ARE ANONYMOUS THEY ARE ALSO FREE TO BE CRIMINALS. IN A RIOT YOU SEE RIOTERS WEARING MASKS TO DISGUISE THEIR TRUE IDENTITY. THE SAME THING IS HAPPENING ONLINE. WE WOULD LIKE TO SEE USER ID MUCH MORE THOROUGHLY CHECKED BY INTERNET SERVICE PROVIDERS. ________________________________________________________________________ CYBERANGELS EMAIL ADDRESS: ANGELS(a)WAVENET.COM

1 0