December 2003 - cypherpunks-legacy

Sometimes ya just gotta nuke em
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:12 AM 2/3/96, Rich Graves wrote: >Who holds up the nuking of Hiroshima and Nagasaki as great victories >against tyranny? Since you ask, I do. A land invasion of Japan would've likely cost half a million American lives, and perhaps a million or more Japanese citizen lives, according to comprehensive studies I think are on the mark. (Anecdotally, my father was on Guam at that time, and was part of the force being prepared for the land invasion of Japan. He was mighty happy to hear about the new wonder weapon and how it ended the war in days rather than months.) If the war was just, then ending it quickly and decisively was more just than ending it more slowly and painfully. That some Japanese died in a nuclear fireball rather than in conventional firestorms or blockbuster bombings is neither here nor there. Sometimes ya just gotta nuke em. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Analysis of PGP keyserver web of trust
by Neal.McBurnett＠att.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I wrote a Java program to analyze the the PGP web of trust and I've documented it on some web pages. They include information on the strongly connected components (the largest has 1291 keys in it), the longest "shortest-path" (21 signatures long), the 'central trustee' and 'central truster', the mean path length (6.4, by one definition), etc. http://bcn.boulder.co.us/~neal/pgpstat/ (For those who saw the earlier version, I've fixed some small bugs.) There is a lot of useful information here for folks who want to improve the connectivity of the public PGP web of trust. Cheers, Neal.McBurnett(a)att.com 503-331-5795 AT&T Bell Labs, Denver/Portland WWW: http://bcn.boulder.co.us/~neal/Home.html (with PGP key) - ----------------------------------------------------------------------- PGP Keyserver Statistics This is an analysis of the web of trust among users of the leading technology in the world of secure email communications, Pretty Good Privacy (PGP). See the [1]PGP Frequently Asked Questions for more information on PGP itself and other related tools. There is a set of public key servers around the world which allow PGP users to register their keys and publicly sign each other's keys via [2]email and [3]WWW interfaces. This analysis is based on the public keyring obtained from [4]ftp://ftp.uit.no/pub/crypto/pgp/keys/pubring.pgp on _1 Jan 1996_. For comparative analysis, here is the [5]Jan 1 version (7,976,108 bytes long). I could also provide a shorter and simpler file format which just lists which keyIDs signed which keyIDs. If there is interest, updates can be provided. Overall Statistics Public keys submitted ('pub'): 19124 Signatures ('sig'): 28031 Total number of unique keys referenced: 21107 Revoked keys: 839 Self-signed keyIDs: 7300 Other unique keyID-signs-keyID pairs: 17908 Note that less than half of the keys are signed by themselves. People should _always sign their own UserID_ on their own key! Otherwise, someone else can surreptitiously change the email address in order to encourage correspondents to send email to the wrong place. Only about 1/3 of the keys are signed by at least one another key, and only 1/6 have 2 signatures. To be a "good PGP-citizen", you should * Be very careful about signing keys. Have first-hand knowledge based on hard-to-forge communications that the key's fingerprint (pgp -kvc) in your keyring matches the user's real fingerprint. * Sign the keys of at least two other people * Get at least two signatures on your own key. * Extra credit: Sponsor a [6]key-signing party Strongly-Connected Components A 'strongly-connected' set of keys is defined as a set in which every key leads to every other key via some chain of signatures (aka signature path). Note that we are not incorporating any PGP-specific rules for establishing trust (e.g. the default CERT_DEPTH of 4, the default requirement for two 'marginally trusted' introducers to establish trust, etc.). After running pgp -kc on the keyring (with MIT PGP 2.6.2, for almost 2 days...) the number of signatures dropped from 28031 to 25810, presumably because some old signatures where thrown out. The analysis here was done with the original keyring, so all versions of PGP will not recognize all the signatures which are accepted here. Note that the program used for this analysis (pgpstat.java) so far only deals with keyID-keyID relationships, rather than dealing separately with each keyID/UserID pair. It does properly ignore revoked keys. Size of 'strong': largest strongly-connected component: 1291 Size of 'signees': keys signed by 'strong': 2775 Size of 'signers': keys which sign 'strong': 2001 The [7]largest strongly-connected component of this keyring (the set names 'strong') has 1291 keys in it. The [8]next-largest strongly-connected component has only 16 keys in it. There are another 1484 keys which are directly or indirectly signed by at least one key in 'strong' but which do not sign any key in 'strong' and are thus not in the strongly-connected component, for a total of 2775 keys in the 'signees' set that can be reached from the 'strong' set. Similarly, there are a total of 2001 keys in the 'signers' set which directly or indirectly sign at least one key in the strong component. Shortest-Path Distances Using a breadth-first search of the keyspace, we can calculate the shortest path from one keyID to other keyIDs it has directly or indirectly signed. Mean distance from strong keyIDs to signees: 6.41189 Mean distance to strong keyIDs from signers: 6.70961 Maximum shortest-path distance: 21 First, for each key in 'strong', we compute the mean length of the shortest path necessary to reach each key in 'signees': 6.41189. Next we do the converse, following paths of signatures into the strong component rather than out of it. The mean distances are different because a different set of keys is involved: signers vs signees. Finally, we note that there are several pairs of keys which have a shortest path distance of 21 between them. Here is the [9]example path, between these two keys: 6CB05C95 Karl F. Scheibner <scheibner(a)llnl.gov> 82996935 Brett Dubroy <1:225/357@fidonet.org> Anyone who is along this path can improve the tightness of the web of trust by finding someone they know further along the path and carefully signing their key. Centers of Trust: the Central Trustee and Central Truster By examining the shortest-path data more closely we can identify the keys which are closest to the 'center' of the web of trust. The 'central trustee' is the key which is signed most directly by others: the key which has the shortest mean distance from all of the 'signers'. Here is the current "top 10": Mean Max KeyID UserID 4.17191 11 CE766B1F Paul C. Leyland <pcl(a)foo.oucs.ox.ac.uk> 4.30235 12 53AAF259 Klaus-Peter Kossakowski, DFN-CERT <kpk(a)cert.dfn .de> 4.37881 12 32DD98D9 Vesselin V. Bontchev <bontchev(a)complex.is> 4.38381 12 D410B7F5 DFN-CERT <dfncert(a)cert.dfn.de> 4.4043 13 DA0EDC81 Phil Karn <karn(a)unix.ka9q.ampr.org> 4.4073 12 F82CEA91 Simon Cooper <sc(a)sgi.com> 4.43778 13 C1B06AF1 Derek Atkins <warlord(a)MIT.EDU> 4.46527 13 466B4289 Theodore Ts'o [SIGNATURE] <tytso(a)mit.edu> 4.47576 12 C7A966DD Philip R. Zimmermann <prz(a)acm.org> 4.48426 12 8E0A49D1 Wolfgang Ley, DFN-CERT <ley(a)cert.dfn.de> You can also get the [10]full list by mean distance. Here is the [11]distance to the cental trustee from the each of the signers along with info on how many keys sign and are signed by each key. The converse of this is the 'central truster', the key which trusts other keys most directly: Mean Max KeyID UserID 3.91928 10 32DD98D9 Vesselin V. Bontchev <bontchev(a)complex.is> 3.97694 11 C7A966DD Philip R. Zimmermann <prz(a)acm.org> 4.0191 12 DA0EDC81 Phil Karn <karn(a)unix.ka9q.ampr.org> 4.0418 12 0DBF906D Jeffrey I. Schiller <jis(a)mit.edu> 4.05838 11 CE766B1F Paul C. Leyland <pcl(a)foo.oucs.ox.ac.uk> 4.08396 12 7B7AE5E1 Germano Caronni <caronni(a)tik.ee.ethz.ch> 4.08973 11 4D0C4EE1 Jeffrey I. Schiller <jis(a)mit.edu> 4.13405 12 666D0051 Assar Westerlund <assar(a)pdc.kth.se> 4.17333 12 5826CF8D John Gardiner Myers <jgm+(a)cmu.edu> 4.17982 12 466B4289 Theodore Ts'o [SIGNATURE] <tytso(a)mit.edu> You can also get the [12]full list by mean distance. Here is the [13]distance to each of the 'signees' from the central truster, along with info on how many keys sign and are signed by each key. Further Questions Many other aspects of the web of trust could be explored. * It is important that the web be multiply-connected. p Good software to do bi-connectivity (or tri-connectivity, etc.) for directed graphs would be useful, especially if it identifies the most significant articulation points (keys which are critical for the connection of big pieces of the web). * Identification of large cliques or near-cliques (sets of keys which all sign each other, related to coloring problem, very hard.) * Software to generate a high-level graphical view would be useful. For example, a directed-acyclic-graph of the connectivity of the larger strongly-connected components would be interesting. * It shouldn't be too hard to make pgpstat.java into a server which could answer custom queries (shortest path from x to y, size of component that x is in, suggestions for who might be able to sign your key (e.g. other keys from the strongly-connected component which are in your domain), etc.) Tools The analysis tool, pgpstat.java, is an application written in the very nice new language [14]Java (Perl just doesn't have any decent hierarchical data structure support...). Source code will probably be made available after some cleaning-up for others who want to explore different keyrings or other avenues of analysis. Performance note: the algorithms used here mostly scale linearly in time complexity, based on the sum of the numbers of keys and signatures. In particular this is true for the code that finds the strongly-connected components (thanks to a favorite professor of mine, Bob Sedgewick, and his "Algorithms" book!) The one notable exception is finding the centers of trust and the longest shortest-path, which is quadratic in the size of the connected set, but doesn't have to be computed nearly as often, as a practical matter. The full analysis took less than 30 minutes using one processor on a Sun Sparc 1000 (50 Mhz?). There are lots of opportunities for optimization, and hopefully non-quadratic algorithms for at least approximating the center/longest path problems. Please let me know if you have any feedback on this analysis. _________________________________________________________________ [15]Neal McBurnett <neal.mcburnett(a)att.com> References 1. http://www.quadralay.com/www/Crypt/PGP/pgp00.html 2. http://www.pgp.net/pgp/email-key-server-info.html 3. http://www.pgp.net/pgp/www-key.html 4. ftp://ftp.uit.no/pub/crypto/pgp/keys/pubring.pgp 5. file://localhost/home/neal/public_html/pgpstat/public-keys.960101.pgp 6. http://www.quadralay.com/www/Crypt/PGP/pgp06.html#608 7. file://localhost/home/neal/public_html/pgpstat/strong-from 8. file://localhost/home/neal/public_html/pgpstat/strong2 9. file://localhost/home/neal/public_html/pgpstat/maxpath 10. file://localhost/home/neal/public_html/pgpstat/strong-from 11. file://localhost/home/neal/public_html/pgpstat/signers 12. file://localhost/home/neal/public_html/pgpstat/strong-to 13. file://localhost/home/neal/public_html/pgpstat/signees 14. http://www.javasoft.com/ 15. http://bcn.boulder.co.us/~neal/Home.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMRL1t8KbwnFPAGm1AQHizwIAn+HiF7ohgcxlYAI9OS4St9FFghzCQ+8v TQYKssbcqS06Y0kkeTYyKFBRfwTrulxugE+aq6Jchpw2vo0C6YvEdA== =mXbe -----END PGP SIGNATURE-----

2 1

Re: OFFSHORE RESOURCES
by Edgar Swank 17 Dec '03

17 Dec '03

Another URL for offshore investing, etc. is http://www.dnai.com/offshore/offshore.html Edgar W. Swank <edgar(a)Garg.Campbell.CA.US> -- edgar(a)Garg.Campbell.CA.US (Edgar Swank) The Land of Garg BBS -- +1 408 378-5108

1 0

Re: Imminent Death of Usenet Predicted
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 8:02 PM 2/2/96, Timothy C. May wrote: >*Universities, corporations, and even ISPs are explicitly adopting policies >that allow them to inspect e-mail at will. (If the arrangement is made in >advance, it may not violate the ECPA to do this...and I'm not saying there >aren't some good reasons why these entities would want the right to inspect >e-mail (their liability being a good example), just noting the growing >situation. On that note... A good friend of mine was fired (forced to resign) from her Wall Street programming job recently. The reason: her employer "just happened" to stumble onto a message she'd posted to a mailing list a year ago, in which she'd said some "very unflattering" things about the company. The message in question was posted from her personal email account (so it in no way violated the company's rather strict internet use policy) and was the only such message she'd ever posted. However, one other piece of email was cited, this one also containing an unflattering reference to the company but never mentioning them by name. The obvious conclusion is that they hadn't merely come across this stuff in an innocent Alta Vista search for "Company Name," but rather had searched for my friend's name specifically. My friend is looking into various legal options, so she's asked me not to say any more for now. But I consider this a very serious development and a frightening precedent. The company in question, incidentally, also does routine scans of email and archives all incoming and outgoing mail. As I and others have been saying for a while: what's happening on the net is another "enclosures" movement. Yes, I know that on this list that's a politically incorrect view. Deal with it. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

1 0

PGP & thee
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a couple of questions about the variants of PGP on the CP ftp site: 1> What are the different Mac versions about? Which one goes with which Mac? 2> What are the differences in the different DOS/OS2 versions? Reason I'm asking is that I've got some folks interested in using PGP, and I want to be able to point them in the right direction. Emailed responses preferred to save listwidth :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRJGisVrTvyYOzAZAQHxygQAoSHE5FOC20manSJvjprKjUkZyrj/3iCC dz59IKftq6xxVYEE6ys/m0xnwIEBygayfqQzcvco66QfasFjCbKWakGQgOuW7bnk UToLUSpnP31UBCozASRrSCDh1he535WHCegqTVCr7dUweDuPC7CGmpp9G78WsmfH mWNvdOim76s= =tgOX -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

1 0

Re: Germany investigates AOL for providing Zundelaccess
by James A. Donald 17 Dec '03

17 Dec '03

At 07:34 PM 2/2/96 -0500, Declan B. McCullagh wrote: > America Online spokesman Ingo Reese in Hamburg said his company > also was happy to work with the prosecutors. The company is ``totally > opposed'' to illegal propaganda, he said, They target the gutless, in order to create precedents without having to go to court. You will recall that AOL also shopped its customers to the feds over child pornography. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Imminent Death of Usenet Predicted
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 1:18 AM 2/3/96, Dave Mandl wrote: >As I and others have been saying for a while: what's happening on the net >is another "enclosures" movement. Yes, I know that on this list that's a >politically incorrect view. Deal with it. "Politically incorrect" on this list? What's gotten into you, Dave? Really! PCism is what all those goddamn Tax-n-Spend Leftist Liberals do--you know, like the ones in the _Life of Brian_. Folks here would never engage in _any_ kind of PCism. I'm shocked, shocked... Don't you get it? Nation-states are going to collapse Real Soon Now (after all, their Imminent Death has been Predicted), and the Markets, guided by an irresistably beckoning Invisible Hand, will Rise Up against their Tyrannous Masters and be guided out of State Space into Crypto-Anarchy[T{C}M], the land of milk and honey. And everyone who's positioned themselves shrewdly--as your friend no doubt has--will prosper. No problem! Tell your friend she has _nothing_ to worry about. In a few months, she'll look back and laugh. --Victor! von Kredulous-am-Kapitalismus Visit Pere Lachaise! We got majordomos, we're typing on phone lines, it's Realpolitik Lite & Fun 2! ---------:---------:---------:---------:---------:---------:---------:---- Nostradamus F. Xavier | Clipto-nemesis: privatization, tons of $$$, victor(a)get.not 212-255-2748 | end of history, optimistic tax deductions, G.A.D.D.I.S.: Nag Hammadi, EG | C-corps, lecture circuits, insider trading, Higher power: "What me worry?" | carpal tunnel syndrome, other cool stuff. "Sleeping policemen are national borders on the Information Soapbox Derby."

1 0

Re: Helping the Crypto-Clueless
by Rich Graves 17 Dec '03

17 Dec '03

Bruce Baugh's latest missive inspired me to send the following to my new racist friends, and also, coincidentally, to those at the Wiesenthal Center, law enforcement agencies, and so on who also read the list. Posts to Stormfront-L are moderated to keep out any non-racist "noise," but I assume that this message will be approved. Don really has no other choice. I imagine that this message will inspire greater awareness of and interest in cryptographic applications, though I do not have great confidence that it can do much to address my friends' cluelessness as such. I was not inclined to give them any real specifics on how to obtain and employ cypherpunkish tools. After all, we're not very close friends. -rich ---------- Forwarded message ---------- Date: Sat, 03 Feb 96 08:21:32 0800 From: Not_By_Me_Not_My_Views Publishing <rich(a)c2.org> To: stormfront-l(a)stormfront.org, rich.graves(a)leland.stanford.edu Subject: Publicizing Stormfront-L; Internet privacy resources; Copyrights -----BEGIN PGP SIGNED MESSAGE----- I was surprised and disappointed to learn recently that there are no public archives of the Stormfront list. Many organizations, most of whom are strongly opposed to Stormfront's goals, seem to be keeping private logs of everything that is said on Stormfront-L, but to date none have made their archives public. I find this silly. It's an open list, after all, and you know that people who do not share your goals are reading the list. With all this talk about The Enemy and free expression, it's odd that only The Enemy has accurate chronicles, and that you deny the general public the right to read what you say. To address this oversight, I will be opening up my personal archives of Stormfront-L to public view on c2.org's Web server. I haven't worked out the details yet, but I'll probably be using hypermail, if this use is judged to satisfy the license terms. Don't bother unsubscribing me. There are lots of people who would be only too happy to send me their copies of list mail, anonymized. Don't bother moving to another list, either, unless you don't mind losing all members of the list whose loyalties cannot be established beyond a reasonable doubt. See, you can't exactly announce on the list that you're moving to a new list where The Enemy can't find you. Despite the fact that it has always been trivial to determine the list membership, I plan to respect list members' privacy by giving you all a day to avail yourselves of the large number of anonymity and double- blind pseudonymity resources available on the Internet. For information on the most well-known remailer, the penet.fi anonymous contact service, send email to both help(a)anon.penet.fi (sends you the FAQ) and ping(a)anon.penet.fi (assigns you an ID). The disadvantages of the penet.fi service are that it is slow (mail is delayed as much as 24 hours) and that it is not really secure (records of which IDs belong to which real email address are kept on a computer in Finland, and are therefore available to very determined law enforcement officers and other armed thugs). Those with a technical bent may wish to look into more secure cypherpunk remailers, but they require some brains. Even I don't really use them. Alternatively, if one or more of you have the means and incentive to set up a public Stormfront-L archive on the Internet, and very soon, then please let me know, and I will drop my plans. The advantages of an official public list archive run by someone who shares your goals should be obvious. Of course, private archives will still be kept by third parties in order to ensure that the official archive remains accurate and up to date. Checks and balances, natch. I would be happy to provide some technical assistance if you need help getting started. On to copyrights. The issue of who owns the copyrights to the Zundelsite pages has been raised both privately and publicly (very publicly). It appears that Mr. Zundel has made his choice. The Zundelsite materials are in the public domain. Anyone can use them, abuse them, modify them, or sell them without violating anyone's intellectual property rights. May a thousand Zundelsites bloom. You may also include his works on BBSes, CD-ROMs, and T-shirts that you sell for personal profit. I'm working on a T-shirt for the "Zundel Detournement" contest right now. I doubt any of you would be interested in buying one, though. Still, it would be much better if a formal network of mirror sites was established. That way you'd have a channel for receiving updates direct from Zundel's webmasters. Unfortunately, it seems that Mr. Zundel is embarrassed by the thought of being associated with the people who actually want to mirror his site for the content. He has had to publicly distance himself from the very proud white supremacist Joe Bunkley, for example. Most sincerely, - -rich P.S. You may have heard it reported recently that the author of PGP, which I am using (if this message does not bear a valid PGP digital signature, it is probably a forgery) is a Neo-Nazi sympathizer. This was untrue, and Phil considers this suggestion to be a serious libel. The newspaper that ran the allegation posted a very public and detailed retraction. Of course some Neo-Nazi sympathizers do use PGP, and so can you. In fact I'd love to exchange key signatures with one of you guys in the San Francisco Bay Area (I'm sure there are a lot of you here). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRMa2Y3DXUbM57SdAQFQfwP+LV5H6+YPv9E7HHfmgcm7dQLDf/layB8s xzUjH5QX8zdWNE5t+9gQt3W7sG3pN1IQ32IxclcmlMBZIQmVzmZ7rbsGq07gwpPc I7yLqK0KAz8tNND+ZBtXX/lLQ4zu46cb6p2fJsMDS5Gv+cWA+smNE44CiM9reeNX xlQAV5UeeLA= =LpPb -----END PGP SIGNATURE-----

1 0

Re: Just what the Internet needs right now...
by ethridge＠Onramp.NET 17 Dec '03

17 Dec '03

> I'll try to see if I can find some bomb-making information from a >non-US web site; it may help in counterarguments. Given that I'm still not >that good at searching, it would be nice if someone else could locate it also. > -Allen > >Reuters New Media > > _ Friday Febuary 2 4:54 PM EST _ > >Boys Arrested for Plotting Bomb > > > > NEW YORK (Reuter) - Three 13-year-old boys have been accused of > plotting to blow up their school after learning how to build a bomb > over the Internet, police said Friday. > > The boys were arrested Wednesday after other students at Pine Grove > Junior High School in Minoa, New York, heard rumors of their plans and > police were alerted, said Capt. William Bleyle of the nearby Manlius > police department. > >[...] > > One of the boys, believed to be the ringleader, admitted to police > that the three eighth graders learned how to build the bomb from > instructions they found on the Internet, the global network accessible > from home computers. This was on the national TV news tonight as well. I'm still trying to figure out what planet all these people are from. Boys and bombs have gone together at least since i was a boy. Teenage boys were building pipe bombs back when i was a teenager, in the seventies, before anyone had heard of personal computers or the internet. Of course, i didn't learn about bombs for blowing up entire buildings until much later, when some television show mentioned combining diesel fuel with fertilizer. This show even got specific as to the type of fertilizer, but i forgot to take notes. The only counter-argument than makes any sense to me is that this isn't new. Boys have been building bombs for years. Now they get their information from the internet instead of the library or older kids down the street. The information has always been available. Of course, there is always the argument about parental responsibility, but that's not as sexy as the evil internet. allen

1 0

Re: Denning's misleading statements
by James M. Cobb 17 Dec '03

17 Dec '03

Jeff, On 01 28 96 you say: We [cypherpunks] are becoming the "Bad Guys" in a well orchestrated Psy Ops campaign propagated naively by the 4th Estate. A few days ago I bought Markoff and Shimomura's Takedown. I've read the first three chapters. In my opinion: (1) the book is an important part of that well orchestrated Psy Ops campaign (2) the book's designed from the word go to play that part. Cordially, Jim

2 1