December 2003 - cypherpunks-legacy

Big Bill: "You will be assimilated"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:37 PM 1/5/96, Duncan Frissell wrote: >At 01:47 PM 1/5/96 -0500, Gordon Campbell wrote: >>At 12:56 AM 1/5/96 -0500, Larry Sudduth wrote: >> >>>Attachment Converted: C:\WORK\WINMAIL.DAT >> >>What, pray tell, is this? >> > >When a MS Mail attachment wanders around the world, it is accompanied by a >data file of some kind. That is winmail.dat. So every MS MAIL attachment >is really two attachments. Try to ignore it. You know, between Microsoft Mail, Microsoft Exchange, and other weirdnesses associated with Microsoft, it's almost as if Big Bill (the guy in Washington, but not D.C.) is trying to tell us be assimilated or face continued pseudo-spamming. (No insult to Microsoft intended, but other companies seem to understand it is up to them to make efforts to comply with conventional Internet standards, while MS seems to relish doing things its own way, the rest of us be damned.) I hate the thought of putting all Microsoft domain addresses in my kill file, but at least it solves the problem. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: get mix-installer. (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From adam(a)lighthouse.homeport.org Fri Jan 5 20:23:21 1996 From: Adam Shostack <adam(a)lighthouse.homeport.org> Message-Id: <199601060225.VAA21165(a)homeport.org> Subject: Re: get mix-installer. To: ravage(a)ssz.com (Jim Choate) Date: Fri, 5 Jan 1996 21:25:59 -0500 (EST) In-Reply-To: <199601060152.TAA04065(a)einstein.ssz.com> from "Jim Choate" at Jan 5, 96 07:52:17 pm X-Mailer: ELM [version 2.4 PL24 ME8b] Content-Type: text Content-Length: 367 Jim Choate wrote: | I would like a copy to use in my consulting business as well as put on the | Austin Cypherpunks ftp site. Both are fine. I assume that a copy was auto mailed to you; let me know if there is a problem. May I ask who pays to get mixmasters installed? -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

http://www.rsa.com/rsalabs/cryptobytes/
by Rich Salz 17 Dec '03

17 Dec '03

FYI. ---------- Begin Forwarded Message ---------- From: <Jueneman(a)gte.com> Message-ID: <30ED605E-00000001(a)wotan.gte.com> Date: Fri, 05 Jan 1996 12:31:08 EST Subject: Recent cryptographic findings To: ietf-pkix(a)tandem.com For those who may not have seen it, the most recent issue of CryptoBytes (Vol1, No. 3) put out by RSA Laboratories has a wealth of information in it. I have not had the time to fully digest the importance of all of the articles, but in the first one Adi Shamir has proposed an "unbalanced RSA" variant of RSA which "makes it possible to increase the modulus size from 500 bits to 5,000 bits without any speed penalty." Another article discusses means of deliberately constructing collisions (due to Hans Dobbertin of the German Information Security Agency) when using MD4, and concludes that "where MD4 is in use, it should be replaced." So far, at least, it appears that MD5, RIPEMD, and SHA-1 would resist this kind of attack, but a certain amount of nervousness might be in order. (Hugo Krawczyk of IBM Research and I considered some of these possibilities in conjunction with work we did on the SEPP protocol, which uses a salted hash function as a means of confirming the knowledge of a secret to a third party without having to use encryption. We were concerned that collisions might be possible, and also that it might be possible to partially reverse a hash function and glean at least information about the message that was being hashed, (the credit card number) in the case of a very short message. We ended up proposing a combination 140-bit hash function which includes both MD5 and SHA-1, assuming that it would be much more difficult to break both algorithms than just one. I will post the analysis to this list in a subsequent message.) Finally, Burt Kalisky provides a compendium of some of the possible attacks against RSA, and discusses simple and practical countermeasures. It seems to me that the most important of the various attacks involve the encryption and decryption of small messages. Since small messages are frequently generated for key exchange and for signature purposes, it is important that we consider these issues carefully. In particular, the use of pseudo-random padding for both encryption (a la the Bellare-Rogaway Optimal Asymmetric Encryption Padding) seems very beneficial, and padding is also important in the signature block. This group certainly ought to examine these issues very carefully, and we should probably give serious consideration to adopting OAEP for message encryption and key exchange. I believe we should also give serious consideration to a increased length message digest function such as SHA-1, and perhaps incorporate the use of multiple message digest algorithms for particularly important signatures , e.g., CA certificates. The back issues of CryptoBytes are available at http://www.rsa.com/rsalabs/cryptobytes/. Bob ---------------------------- Robert R. Jueneman GTE Laboratories 1-617-466-2820 Office "The opinions expressed are my own, and may or may not reflect the official position of GTE, if any." ----------- End Forwarded Message -----------

2 1

Mixmaster On A $20 Floppy?
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Jan 05, 1996 19:06:21, 'Adam Shostack <adam(a)lighthouse.homeport.org>' wrote: > Towords the goal of making Mixmasters in a box, I've written >an installer script for mixmaster. If you're running on one of the >supported platforms (alpha, bsdi, hpux, linux, sunos, solaris), the >script will walk you through everything from the make to setting up >cron jobs & /etc/aliases. > > If you've been putting off setting up a remailer because its a >pain, give this a shot. Lance will probably be including it in the >next release of mixmaster, but you can get it now by sending me a >message with the Subject: get mix-installer. > > Comments, bugs, bug fixes are welcome. Thanks to Rich $alz >for a extensive comments & suggestions for portability. > >Adam > I've reports that the latest version of SyQuest's external parallel port EZ135 "floppy" drive is due on the shelves this month. Also reported is the ability to effectively boot off the thing, and thus run whatever OS resides on the SyQuest "floppy" rather than an OS that has to be on the host's hard drive partition. Weight, under two pounds. Price ~$US250. Capacity 135 Mb formatted. Price of spare disks: $US 20. Take it off a computer. Put it in a briefcase. Carry it with you nicely out of public view. Hook it up to another machine and .... Question 1: Can you fit linux, pgp, mixmaster, etc. on the 135 Mb disk and have enough useful space left over for a useful amount of data? Question 2: Anybody want to speculate on what traffic analysis is like when encrypted data comes INTO one known Mixmaster site but goes OUT on one or more "unknown" or (partially) random Mixmaster sites? Question 3: Anyone want to speculate on what data recovery is like when encrypted data and the horse it rode in (and out) on has all been physically destroyed at a replacement cost of only $US20? -- -- tallpaul -- "If they think you're crude, go technical; if they think you're technical, go crude." William Gibson "Johnny Mnemonic"

5 4

Scaling Web-of-Trust
by Kevin L Prigge 17 Dec '03

17 Dec '03

Sorry for the noise, someone had emailed a while ago with the URL for a paper on scaling the web of trust for PGP, and I've lost the email. If whomever it was could resend the information, I'd be most appreciative. Thanks. -- Kevin L. Prigge |"Have you ever gotten tired of hearing those UofM Central Computing | ridiculous AT&T commercials claiming credit email: klp(a)tc.umn.edu | for things that don't even exist yet? 010010011101011001100010| You will." -Emmanuel Goldstein

2 1

Re: Starting an e-cash bank
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 12:41 1/4/96, Scott Brickner wrote: >Wait a minute. I can see how one needn't be a bank to convert ecash >into pcash, but going the other way requires that the cash be >transferrable in ways that Digicash isn't. > >If I withdraw ecash from the bank, it's marked so I'm the one who's >identified if it's double-spent. If I give the cash to someone else >(different from paying it to them, which requires they have an account) >they're free to double-spend with (relative) impugnity. Present day Ecash is bases on online clearing. I does not encode any user idendifiying information into the coin. You are thinking of offline Ecash. Besides, wherer users get the Ecash from, be it by putting money into their account at MT or buying it from you doesn't matter. They still need an account with MT. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

TAL_kup
by John Young 17 Dec '03

17 Dec '03

1-10-96. NYPaper: "Group Urges an Internet Ban On Hate Groups' Messages. Joins in Move to Censor Offensive Material." Citing the "rapidly expanding presence of organized hate groups on the Internet," a leading Jewish human rights group yesterday began sending letters to hundreds of Internet access providers and universities asking them to refuse to carry messages that "promote racism, anti- Semitism, mayhem and violence." A sage says, "It is not possible to end idiocy by censoring it. The best response is cellular." TAL_kup

2 1

Why Companies are Poor at Finding Bugs
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:37 AM 1/9/96, Lucky Green wrote: >Very true. But why does it always seem to take an exploitable crack before >companies pay attention to security flaws? Is it because they are unable to >admit that they have made a mistake? Everybody makes mistakes. What's the >big deal? I really don't understand it. Any psychologists on this list? I'm not a psychologist, though I doubt that would help. (Having had a girlfriend who was one, she had no special knowledge about corporate motivations...) Companies are pyramids, with a flood of signals flowing up and down the pyramid. Few of the signals are truly important, most are just noise. Hence the difficulty with corporations responding to crises. When a confirmation of a serious problem is made--a building collapses, a floating point bug is found in a chip, a random number generator is found to be flawed, etc.--then there is little doubt that a real problem exists, or at least that a public relations problem must be dealt with. Therefore, a flurry of corporate activity ensues, task forces are created, press releases issued, etc. I'm neither surprised nor disheartened by this. It often takes hitting a company over the head with a two-by-four..."to get their attention." (I saw this many times at Intel, and they were ahead of most of their rivals in spotting problems early on. The "Pentium debacle" is a perfect example of what Lucky is decrying, as internal memos on the problem had been basically pooh-poohed and ignored, until a major public relations disaster hit.) And this has always been a major role of extra-corporate agents: safety inspectors, insurance companies, independent testing laboratories, and so on. The in-house testing departments are frequently inclined to overstate concerns (known universally as "CYA," for "cover your ass"), so it is not surprising that their concerns are often treated as a non-urgent matter. Until a crisis happens, then they are lambasted for not having spoken up more loudly and more forcefully. This was true in ancient Sumeria, in the early factories in Europe, on the communes in China, and in the high-tech labs of today. An easily understandable mixture of psychology, systems analysis, group dynamics, economics, and evolutionary game theory. The Cypherpunks group is, to some extent, helping in this process by trying to break or cripple new software. (As several of us have noted, the NSA's second official role, that of securing commercial cryptography, COMSEC, seems to have been ignored. We are thus left to fill in for these slackers.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Is this true...
by Ted Garrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Being new to crypto subjects, I guess I'm pretty gullable about how much one should use encryption in general. I remember reading somewhere that it would probably be best for the 'world as a whole' if everyone used encryption whenever possible so that when you DO send encrypted messages that actually contain information you want kept secret, it doesn't stick out like a sore thumb. To that end, I should imagine that once I have a person's pgp key, they may well never see another cleartext message from me again! Of course, now I'm trying to figure out how to use the anonymous remailers and such. Boy, this is fun! Of course, the fact that my government doesn't really care for the idea of publicly available cryptography makes it even more enticing. - -- Ted Garrett Live Systems Integration -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPQhKc1+l8EKBK5FAQGkqgf7BN6GxJ5MHCAJZwfuS1JjNNQanT471L3O 0VEhkg0S0GG+827Swly3Bi+0BABcGcQatBSMGFRiecjIEzrRRa/6ME4tAr8qT/EW DXVksWk4Bf6ax8uIF1uPf0uIOeQHOuCZwVnH7uHYCpaOMaMeTVobbyLeT30Gc5Ou YhRIeyUvTazqlWqQaNSLSJX1no9Ph0R6WnDMUYGXof+VXgLw//jddcEfMYYn24hA C8860mAbzke95iuACGcu6hzrr6njVaPMJHqyHb8kZwOjuESzDxZw0cYxt3VRPE72 NXqHzati0Rc/uzpx9FXV5lopRd0fFQUBOK75w0PA3Q5h/RQE6cvj+g== =SQ81 -----END PGP SIGNATURE-----

2 1

IRS/FBI story re Internet
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 9-JAN-1996 20:19:54.25 To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" IRS, FBI EYE INTERNET WITH SUSPICION The Clinton administration's reluctance to ease up on export controls for encryption software stems in part from pressure from U.S. law enforcement agencies, and the owner of a New York-based software company sees heavy lobbying behind the government's desire to regulate content on the Internet: "I think the Internal Revenue Service and the FBI are watching this one very carefully. They wouldn't mind seeing the government set a precedent for deciding what can and cannot go on the Internet." The IRS fears that easy access to cheap and sophisticated encryption software will make income- and sales-tax evasion too easy, and the FBI worries about criminal and terrorist plots hatched in cyberspace, but some observers say government control tactics are too little, too late. A Hudson Institute economist says, "Electronic money gets really interesting when you realize how impossible it is to put national walls around it, mandate the use of national currencies, or require that transactions go through banks... The country will have no practical choice but to rely more than ever on voluntary tax compliance. That means tax rates will have to be kept as low as possible on people and on businesses." (Investor's Business Daily 9 Jan 96 B1) [...] EDUPAGE is what you've just finished reading. (Please note that it's "Edupage" and not "EduPage.") To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Warren Buffett (assuming that your name is Warren Buffett; if it's not, substitute your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu and in the body of the message type: unsubscribe edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.)

1 0