December 2003 - cypherpunks-legacy

"Radio Free Cyberspace" and the "Silicon Curtain"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:25 PM 1/29/96, Dr. Dimitri Vulis wrote: >So, develop the tools to make the (illegal) flow of information easier and >the prosecution more difficult. E.g., the former Soviet Union couldn't stop >its people from listening to Western propaganda on short-wave radio, >although it was illegal, and more repressive governments did confiscate all >short-wave radios in the past. If I were a PR sort of person, and interested in funding a "liberation channel" into the countries behind the "Silicon Curtain," I'd think about a catchy name for the program. Not radio, of course, just a nod to the olden days of "Radio Free Europe" and "Voice of America" (which was, unfortunately, partly staffed by former members of the Mobile Killing Squads which rounded up Russian Jews). --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

DRE_ams
by John Young 17 Dec '03

17 Dec '03

1-29-96. WSJ: "MCI, Microsoft Form Partnership to Sell Each Other's Products World-Wide." 1-29-96. FinTim: "News and MCI put their money on DBS." Includes proposal that Microsoft distribute by MCI satellite for pennies rather than for dollars by wire. 1-29-96. WSJ: "Sun to Unveil Prototype of Low-Cost PC for Internet That Uses Java Language." Java as OS and browser, sidestepping MS and NSCP. DRE_ams (for the 3)

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:54 PM 1/27/96 -0800, shamrock(a)netcom.com (Lucky Green) wrote: >Wonder how long before they will include gereral purpose proxies in the >proposed ban. >We should start a "banned websites pool". If a site gets banned, the >controversial content will be mirrored at all other sites. There are enough >ISPs on this list to make that happen. Will they have the courage? If I were running an ISP, I wouldn't go providing free host space for a mirror of Nazi files just because they'd been banned (and an obvious scan is to go claiming you've been banned just to get free space.) On the other hand, an HTTP relay site would be a highly reasonable service, perhaps with NNTP relaying as well. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # http://www.idiom.com/~wcs

1 0

Re: Over-reacting?
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:22 PM 1/28/96 -0800, Alan Olsen wrote: >The reason for the killfiling is your habit of adding multiple additional >mailing list into the To: and cc: list. I have seen more than one post >where you have added a Libritarian list and the "Democracy Now Channel 2' >list into the fray, not to mention other individuals. THAT is why you are >getting the golden killfile, not your association with Jack "Acid" Hammer. >(Though that may help...) Hmmm.. It's odd that nobody has ever warned me of this before. (Another spoof?) That's why I'm using the term, "over-reacting." -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQyDUvqHVDBboB2dAQFduAQAlas9DMaiatiYd51WKepEzLGPBWl4I9+2 FNOUzoQoy3OQ+wdk7lT1FFqvrDqSqviIj8MZ6j7/7ENO55W6D8AiN2fFXBbd3iY5 7krA13rTlx6N8ztvqE2+QY0/0RMtHZV6mLOR0SdbedOahUMc6/8qxF1auvJTxtJq 5qU3zS+71IQ= =9edM -----END PGP SIGNATURE-----

1 0

BAI_bcg
by John Young 17 Dec '03

17 Dec '03

1-29-96. FinTim: "High street dinosaurs wake up. Online prospects are making the banking industry restive." Covers a new Bank Administration Institute/Boston Consulting Group report, "The Information Highway and Retail Banking." BAI_bcg ----- An FT reviewer of the KDM/TSU books writes that "Littman reveals how little divides the sheriffs of cyberspace from its outlaws. Shimomura resembles Mitnick more than he would like to admit. The big difference is that the computer expert on the right side of the law becomes a media celebrity, earns consultancy fees telling companies how to defend themselves, and has others pay his expenses and buy his equipment. The expert who does not inhabits a prison cell with six other men, and is reduced to writing pleas for help with a stub pencil."

1 0

Re: The French do some things right...
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:01 PM 1/26/96 -0800, Timothy C. May wrote: >One thing I have been hoping for as America's scandal-fixated society asks >whether Bill inhaled, whether Rush has a mistress, whether Madonna's >grandmother is really shacked up with a 19-year-old musician...one thing I >have been hoping for is that the American public will say "Enough!" This is one I've never worried about. As I look around at work and see the disorderd personal lives and body piercings of my fellow workers, it is obvious that the amount of that sort of social control that is being applied is way down. And since fewer and fewer of us will have to (be able to) work for large soulless bureacracies as these things are ruthlessly downsized by the market, we will have much greater choice of employers. One would have to be really way out on one of the unfortunate tails of a bell curve distribution to be unable to find someone to work with. DCF

1 0

The Lotus Position
by Timothy C. May 17 Dec '03

17 Dec '03

At 4:03 AM 1/20/96, Bill Stewart wrote: >40-unknown-bit RC4 may take a week for an ICE workstation or a herd of >net-coordinated workstations, but it would be much faster to crack on >a specialized machine actually designed for RC4. I think Eric's estimate >was $25-50K for a machine that could do it in 15 minutes, built out of >programmable gate arrays. That's not $10,000/crack, or $584, but $0.25-.50. >Would they crack all the keys they wanted for a quarter each? Sure; >at that rate it's probably cheaper to crack them than read them >(though in reality they'd feed most of them to keyword scanners.) I take it as self-evidently true that NSA would spend the relatively small amount of money to build a dedicated key cracker...probably at least several for each major cipher. "In this room, where we used to have the famed acre of Crays, now we have tenth of an acre of superfast custom key crackers." (Yes, I know the Crays are used for other things besides key cracking. In fact, their main use probably is not for crypanalysis. Also, I'm not talking about cracking ciphers that are essentially uncrackable with any amount of compute power, I'm talking about cracking specific instances of ciphers with NSA-approved key lengths.) To consider just how _cheap_ such a dedicated machine is to them, consider that in the late 50s and early 60s they built the "Harvest" machine, in conjunction with IBM and based to some extent on IBM's "Stretch" machine, as I recall. (Bamford has a bunch of stuff on it, and our own Norm Hardy worked on it for IBM in the early 60s...he gave a good talk at a Cypherpunks meeting on how big it was, how much it cost, its capabilities, etc.) The Harvest machine, and its ancillary units, such as the world's largest and fastest tractor tape drive, cost something like $100 million in today's dollars, according to Norm and others. And Harvest was still running in 1975-6, when it was finally replaced by the Cray 1. NSA also funded the early efforts that later became Control Data Corporation (CDC), and NSA was a major customer of Seymour Cray's CDC 6600, and the later 7600 (and maybe even the ill-fated Star). NSA and AEC were also the early customers for the Cray-1, of course. This gives you some feel for what kind of expenditures "the Fort" is prepared to make when it sees the need. And the black budgets of other intelligence agencies, as described in Richelson's excellent books and other books (such as "Deep Black," an unauthorized history of the National Reconnaissance Organization), can only be described as "stupefyingly large." A surveillance satellite can run upwards of $1.5 billion, so spending a tiny fraction of that to decrypt what you've sniffed out of the airwaves is a gimme. The deep black budget is estimated to be something like $25 billion a year. Recall that the Wiretap Bill _alone_ provided for up to $500 million for compliance measures. Clearly the FBI somehow view their surveillance capabilities as being worth at least this much to them, and probably a lot more. Throw in the budgets for the DEA, IRS, FinCen, FBI, BATF, and all the other agencies fighting the Four Horsemen and the citizen-units who stray outside the drawn lines, and it's clear that NSA could budget several hundred million dollars *each and every year* for breaking its "approved ciphers." Like many, I take it for granted that 40-bit RC4 can be broken for "small change." Moreover, my guess is that foreign traffic is routinely cracked if it is encrypted. After all, it's the encrypted traffic that is likeliest to be interesting. (Sure, some dumbos like Pablo Escobar speak in the clear on cellphones, but the correlation is definitely in the direction of encrypted traffic being likelier than unencrypted traffic to contain interesting stuff. This will become even more the case as more people become educated and as crypto gets built into more things...this is the intelligence and law enforcement communities' worse nightmare.) A $25,000 machine. 4 cracks per hour, 100 per day, and 36,000 per year. Running for an active life of several years (before being replaced, of course, by something several times faster/cheaper), there you have the $0.25 per crack that Bill cites above. Even at 100 times this estimate, it's cheap. (Not for random vacuuming, but for anything targetted, even casually.) And think of what just a few percent of the "Harvest" budget buys you: 100 of these machines. Several million cracks per year. And from these cracks, think of the correlations, the contact lists, and the further targetting that can be done. [Sidebar: One thing that bothers me about any of these LEAF-related schemes--and I don't know if and how the Lotus scheme checks both ends for compliance, etc.--is that they are fundamentally at odds with remailers which hide the origin. If remailers are allowed to continue to exist, schemes involving LEAF fields won't work. Unless I've forgotten how these things work in the couple of years since I last looked at Clipper et. al. in depth. So, I expect a move against remailers as part of the campaign. And with no remailers, if this could ever be enforced, the ability to make contact lists based on random decryption is frightening.] Back to their 100 machines.... My guess is that they haven't even bothered to buy this many machines, that the intelligence they get from a few tens of thousands of cracks is more than enough to point to further leads, to trigger additional HUMINT, etc. But even if the estimates are off by orders of magnitude, we know that a 40-bit RC4 can be cracked in ~hours with ~hundreds of Sun-class machines. (Personally, I think it obvious the NSA has at least speeded up this work factor by at least a factor of ten.) This is also essentially a minor consideration compared to the amount of work done in ordinary wiretaps. And in a few years, 40-bit RC4 will be even more ludicrously weak. The Lotus position is untenable. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Revisitting Blum-Macali "digital signatures"
by Paul E. Campbell 17 Dec '03

17 Dec '03

There was some discussion on Usenet a while back about doing "digital signatures" with the Blum-Macali public key method. Briefly, Blum-Macali relies on the BBS generator to generate a "one-time pad". And the pad can be reversed by taking repeated square roots on the random number seed (assuming you know the factorization) to get back to the starting seed. So, the author suggested that one calculate a digest of the message, call it D. Then the author suggested that one calculate D^(1/2), as per the Blum-Micali method. Then he goes on to do the signature check by checking whether or not D^2 == X^4 where X is the "signature". I understand that there is some sign ambiguity involved in calculating square roots mod B where B is a Blum integer (that causes 4 possible roots). And that's the source of ambiguity problems in Rabin digital signatures, but if the Blum-Micali public key method works, then this sign ambiguity shouldn't exist (because they define a SPECIFIC root to use), and the method can be simplified to simply calculating D^(1/2) and the check is simply D==X^2. What am I missing here?

2 1

pgp on linux
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

i can't seem to get pgp compiled on my linux machine. where should i ask about this?- since cypherpunks would be a bad choice. thanks.

4 3

Re: Escrowing Viewing and Reading Habits with the Governmen
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Sun, 28 Jan 96 21:05:08 > From: <alanh(a)infi.net> > Subject: Re: Escrowing Viewing and Reading Habits with the Government > To: "roy m. silvernail" <roy(a)sendai.cybrspc.mn.org> > Cc: "timothy c. may" <tcmay(a)got.net>, cypherpunks(a)toad.com > > > The "Library Awareness Program," administered by the Justice Department, is > > > designed to identify potential criminals before they have a chance to > > > commit their deeds. The visits to libraries made by the FBI are used to > > > determine who is reading subversive or dangerous material. > Do you really think the FBI believes that asking librarians to keep > records of customer useage is an efficient way to read the customers minds? > Do you really think that the FBI foreign counter-intelligence squad has > nothing better to do than keep a database of who is reading Che Guevara > memoirs? Yes. Heck, I remember this was a big issue about 15 years ago. Try asking someone who was active in library science in the late 70's, early 80's. The general reaction of the library community was, I am glad to say, entirely pro-privacy. Peter Trei trei(a)process.com

2 1