December 2003 - cypherpunks-legacy

NSA advanced knowledge
by Rich Salz 17 Dec '03

17 Dec '03

Is there any indication that the NSA knew about public-key before it entered the open literature?

2 1

Re: Signing nyms' keys (Was: Report on Portland Cpunks...)
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:12 PM 1/24/96 -0800, Bruce Baugh wrote: >At 01:42 PM 1/24/96 PST, janzen(a)idacom.hp.com wrote: > >>Furthermore, by signing a nym's key you place yourself at risk. If you >>sign the nym's key with your own key -- or sign using the key of your >>own nym, and that nym is subsequently "outed" -- then anyone wishing to >>find the individual(s) behind any nym whose key you've signed can >>attempt to coerce you into revealing this information, since you have >>claimed to know it. > >This is the real problem, one which doesn't (to me) have a ready solution. >If others can demonstrate that there [is|is not] some fairly straightforward >way around it, I'd be happy to read it. This is a problem with the web of trust in general. It is known as "Guilt by Association". Person X commits treasonable act A. All of the persons who are signed on to his key could be considered to be co-conspirators. The same applies to nyms. The difficulty with prosecuting nyms is finding the link to the real world individual. Anyone associated with him/her/it will be considered to be guilty by reason of key signage or a way of determining who the real person is... The only way I see getting around this is only signing nyms with nyms or having some sort of zero knowlege proof on a key signing authority. Something where you can issue some sort of proof to the signing authority that you are who you say you are without giving any information about your "real" identity. I know of no foolproof way of doing this... I guess we are stuck with the "Web of Guilt"... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

another thought about random numbers
by Erik E. Fair 17 Dec '03

17 Dec '03

While musing over a roulette table, and noticing the preponderence of electronic games in the various Casinos in Stateline, NV, a thought occurred: does anyone know what sorts of random number generators those electronic games use, and how (if at all) they are measured and regulated by the Nevada Gaming Commission? They might have something to teach us. Erik Fair

3 2

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

>If you properly apply for a license to export the source code >(explainig that the source code licensee might add the features >that he feels are appropriate), is it still a conspiracy? No it's not a conspiracy. But they will not normally allow you to export such source. /r$

1 0

Hack Lotus?
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have no doubt that enterprising hackers will be able to hack the international version of lotus Notes to make it as secure as the domestic version. It is probably just a matter of NOPing some code. The real problem is the 64 bit key in the domestic version. This conforms to the NIST "standard" for an exportable system. In other words to allow the international people to have almost non-existant 40 bit security, they have limited domestic users to 64 bit secuity. The 64 bits keys must be breakable at least in some sense or the limitation would not be in the NIST "standard". The 64 bit keys are probably allocated in structures and stack allocations, so the hacking past the 64 bit limitation will probably be extremely difficult and error prone! (To increase the size of data in a structure or data on the stack means moving all the data beond it. This means increasing the memory allocated and changing all references to data beond the data whose size is increased.) To do this in a patch, may be difficult. In any case, I do not trust the code any large company if I do not have the source code. Big companies are too subject to presure. What we really need is a hack to completely substitute our own external code such as PGP! - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: cp850 iQCVAgUBMQbe8fBUQYbUhJh5AQHDoAQAg9eWu4aJrhQ87n+JqxfTjCOJKEKm8Bfr J9Gggh/jnzW1MY4ApjOtQes7sHR5+66i43E4nUnN0CJYyD+aMCjbJEhwLPU4uHy2 1nF36X0vCYe0+4uSrebW/eMpFBj6fFrVbrmF8tiGD2VrqSQ2Fda00PY9erKKD2KN GTmeqFL/QVY= =SDNt -----END PGP SIGNATURE-----

2 1

Re: Associating Local Port Number to PID
by pete＠stc.com 17 Dec '03

17 Dec '03

"Karl A. Siil" <karl(a)cosmos.cosmos.att.com> writes: > I'm working on a program for UNIX (SVR4, Solaris 2.4) systems that needs to > associate PID with local TCP/IP port number, so as to pass session keys > accordingly to already running processes. This sounds like such an obviously > needed association that someone must have done it already. Take a look at how implementations of identd (RFC 1413) do it. This daemon associates a TCP port with its UID, but I'm sure the PID is very close by in the netstat data structures. It might actually find the PID first, then look up its owner's UID. Anyway, look at the pidentd stuff at ftp://ftp.lysator.liu.se/pub/ident/. --Pete ======= Pete Wenzel === Senior Member, Technical Staff and DNRC ======= == Software Technologies Corp., P. O. Box 661090, Arcadia, CA 91066 == == Phone: 818-445-7000 x311 = http://www.stc.com = FAX: 818-447-0879 == http://PGP.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=pete@stc.com

1 0

ANNOUNCE: NEW MIXMASTER REMAILER
by lead remailer 17 Dec '03

17 Dec '03

Hello all, I am pleased to announce a new mixmaster remailer. This remailer was compiled and installed primarily using the mix-installer script available from Adam Shostack. To get the script, send a message to adam(a)lighthouse.homeport.org with Subject: get mix-installer. here is the relevant info: address: mix(a)zifi.genetics.utah.edu long name: lead remailer short name: lead for your type2.list file: lead mix(a)zifi.genetics.utah.edu a76c3fda7294a6695c5e6a931d1c0b73 2.0.3 Here is the public key for lead remailer: =-=-=-=-=-=-=-=-=-=-=-= lead mix(a)zifi.genetics.utah.edu a76c3fda7294a6695c5e6a931d1c0b73 2.0.3 -----Begin Mix Key----- a76c3fda7294a6695c5e6a931d1c0b73 258 AATH5fR56oEcdVRNn2SrjJ4XsoWb+lP2E2GgGdgI 2A3//3ctBkQ13xb5MHOfix8ra63PZmeCrK+6QbbV Ql1iwboMMaWz8NPmNpQz2K0/vnTnp8tWEyL5vo95 jlRmACXPefXdLOzszAgfMn02rzzXrq+9AnaUAUxD idxVglBkXRkriwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB -----End Mix Key----- Here is the mix-help file: From: mix(a)zifi.genetics.utah.edu (Mixmaster remailer at zifi) Subject: Instructions for using anonymous remailer This message is being sent to you automatically in response to the message you sent to mix(a)zifi.genetics.utah.edu with subject "remailer-help". This is a Mixmaster remailer. It provides an extremely high level of security. To use it, you must have a client program to produce the messages. This software is available from ftp://flame.alias.net:/pub/replay/pub/remailer Read the README file for instructions. Some information can be sent to you by the remailer by including the following commands (one per message) in the subject line of mail to the remailer. remailer-help This file. remailer-stats Useage statistics for the last 24 hours. remailer-key The mixmaster key file for this remailer. This section of the helpfile is blatantly plagarized from the mixmaster faq located at: http://www.obscura.com/~loki/remailer/mixmaster-faq.html. --- What is Mixmaster? Mixmaster is a new class of anonymous remailers. Inspired by the existing "cypherpunk" remailers and discussions on the Cypherpunk mailing list. Mixmaster is the next generation in the evolution of remailer technology. What is an anonymous remailer? Quoting from Andre Bacard's remailer FAQ: An anonymous remailer (also called an "anonymous server") is a free computer service that privatizes your e-mail. A remailer allows you to send electronic mail to a Usenet news group or to a person without the recipient knowing your name or your e-mail address. What do I need to use Mixmaster remailers? Unlike other remailers, you can't just make your own message and send it to the remailer. Mixmaster's security comes in part from using a special message format. The disadvantage of this is that you need a special program to make the message for you. Once you have that program (the client) remailing is as easy as running the program, and telling it which remailers you want to use. How do I get the Mixmaster client software? There are two sites for distribution. First, is ftp to obscura.com and read /pub/remail/README.no-export. The other is by anonymous ftp to jpunix.com. You will have to follow the instructions there to get Mixmaster. Because Mixmaster contains cryptography, it may not be exported from the U.S and Canada. The reason for the circuitous route to download Mixmaster is to show my good faith efforts to keep Mixmaster from being exported. I have heard rumors that someone has already broken this law, and that Mixmaster is available from Europe. I do not approve of this and will not support that site. Does Mixmaster use PGP? No, Mixmaster uses the rsaref package from RSA. Mixmaster uses its own keys and key file formats. To add a key to a key ring, simply append the key to your key file using your favorite text editor. Can mix(a)zifi.genetics.utah.edu post to News? No. News posting is not supported at this time. Abuse Policy: I consider the following to be inappropriate use of this anonymous remailer, and will take steps to prevent anyone from doing any of the following: - Sending messages intended primarilly to be harassing or annoying. - Use of the remailer for any illegal purpose. If you don't want to receive anonymous mail, send me a message, and I will add your email address to the block list.

1 0

Re: NSA advanced knowledge
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:34 AM 1/25/96, Rich Salz wrote: >Is there any indication that the NSA knew about public-key before >it entered the open literature? I've asked Whit Diffie about this issue more than once. He, too, is very interested in the real answer to this. In the Gus Simmons book, there are cryptic (sorry) references to what the NSA may have known. And certainly Don Coppersmith was no slouch, having been a Putnam winner in the early 70s (I was invited to take the Putnam about that time, and was so overwhelmed and unprepared--especially being that I was studying physics then--that I just gave up and left the room!). On the other hand, the comments are sufficiently elliptical that it may just be the NSA putting the best face on an embarrassing development. At Crypto '88, I put this question to NSA cryptographer Brian Snow. He just played the Cheshire cat. Which told me nothing. A friend of mine who was an active amateur cryptographer in the 1970s pointed out to me--much later--that there were NSA boxes used on ships and similar remote outposts which appeared to have no provision for providing keying material, suggesting a sealed-box public-key system. He was just speculating, of course. Here's to hoping the Bamford-Madsen 2nd edition sheds more light on this subject. I can't say I'll be surprised to learn that NSA was as surprised as the rest of us. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Several Edupage mentions
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

The first is nice, given the vulnerability of international services to pressure from one country. The second could be a problem. The third shows, like the ITAR, that sometimes one government department can have a lot more sense than the others. Possibly Commerce is benefiting from private sector contacts? -Allen From: Educom <educom(a)elanor.oit.unc.edu> ***************************************************************** Edupage, 18 January 1996. Edupage, a summary of news items on information technology, is provided three times each week as a service by Educom, a Washington, D.C.-based consortium of leading colleges and universities seeking to transform education through the use of information technology. ***************************************************************** EXODUS FROM COMMERCIAL SERVICES? Commercial online services are having a difficult time keeping customers and differentiating themselves, as more savvy computer users switch over to small Internet access providers. "Most everything I find on the online services, I can find using an Internet service provider," says one customer who's made the switch. "For me, the need for an online service is diminishing." "AOL is like the Internet on training wheels," says another, who feels he's "graduated." In tandem with subscriber defection is the problem of content providers who increasingly are setting up their own shops on the Web, bypassing the commercial services altogether. The popularity of the Web "turns the model of the online services industry upside down," says Scott Kurnit, the former No. 2 executive at Prodigy, who's now running an Internet service for MCI and News Corp. While the number of commercial service subscribers has grown to about 12.5 million over the past decade (doubling in the past year), the number of World Wide Web users increased eight-fold, to eight-million, in just the past year, according to International Data Corp. (Wall Street Journal 18 Jan 96 A6) ONE IS ENOUGH The number of people subscribing to more than one online service has dropped significantly since 1991 when almost a third of online users carried multiple subscriptions. Now, 97% report they can do everything they need to using a single service. (Business Week 22 Jan 96 p8) [...] CROSS-BORDER CULTURE WAR LOOMS Canada's federal regulator is in Washington trying to persuade a skeptical U.S. government that Canadian efforts to black out American TV signals that contravene standards on violence and nudity do not violate NAFTA. U.S. Trade Representative Mickey Kantor has warned Canadian Trade Minister Roy MacLaren that the U.S. government, while supporting the development of a V-chip to allow parental control, will react negatively if Ottawa takes wholesale action to block American programming from distribution through Canadian cable systems. (Toronto Financial Post 18 Jan 96 p5) Meanwhile, Power DirecTV says the explosive growth of satellite TV piracy and the flood of American direct-to-home dishes into Canada is threatening to wipe out Canadian broadcasting. The company urged the Canadian government to create rules that aid new Canadian DTH companies and to enforce laws that prohibit the import of American dishes into Canada. (Toronto Star 17 Jan 96 B3) [...] *************************************************************** [...] EDUPAGE is what you've just finished reading. (Please note that it's "Edupage" and not "EduPage.") To subscribe to Edupage: send a message to: listproc(a)educom.unc.edu and in the body of the message type: subscribe edupage Jane Austen (assuming that your name is Jane Austen; if it's not, substitute your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu and in the body of the message type: unsubscribe edupage. (Subscription problems? Send mail to educom(a)educom.unc.edu.) [...] ARCHIVES & TRANSLATIONS. For archive copies of Edupage or Update, ftp or gopher to educom.edu or see URL: < http://www.educom.edu/>. For the French edition of Edupage, send mail to edupage-fr(a)ijs.com with the subject "subscribe"; or see < http://www.ijs.com >. For the German edition, genugt eine E-Mail an: infomat(a)stern.de mit der Betreff- oder Textzeile "STERN Online Edupage". For the Hebrew edition, send mail to listserv(a)kinetica.co.il containing : SUBSCRIBE Leketnet-Word6 <name> or see < http://www.kinetica.co.il/newsletters/leketnet/ >. For the Hungarian edition, send mail to: send mail to subs.edupage(a)hungary.com. For the Italian edition : < http://dbweb.agora.stm.it/webforum/infotech > or send mail to: b.parrella(a)agora.stm.it. for info. For the Portuguese edition, contact edunews(a)nc-rj.rnp.br with the message SUB EDUPAGE-P Seu Primeiro Nome Seu Sobrenome. For the Spanish edition, send mail edunews(a)nc-rj.rnp.br with the message SUB EDUPAGE-E Su Primer Nombre, Su Apellido.

1 0

Export Regulations
by Laszlo Vecsey 17 Dec '03

17 Dec '03

What if you encrypt the encrypted software and put it on a server, and then have the key to it printed out on paper... you take the key with you to another country and fetch the 'incomplete' software through the net. It only becomes useful data once you apply your legally obtained key. I guess this would be the same as putting the software on a private ftp site though, where only you would know the password.

1 0