December 2003 - cypherpunks-legacy

Revisitting Blum-Macali "digital signatures"
by Paul E. Campbell 17 Dec '03

17 Dec '03

There was some discussion on Usenet a while back about doing "digital signatures" with the Blum-Macali public key method. Briefly, Blum-Macali relies on the BBS generator to generate a "one-time pad". And the pad can be reversed by taking repeated square roots on the random number seed (assuming you know the factorization) to get back to the starting seed. So, the author suggested that one calculate a digest of the message, call it D. Then the author suggested that one calculate D^(1/2), as per the Blum-Micali method. Then he goes on to do the signature check by checking whether or not D^2 == X^4 where X is the "signature". I understand that there is some sign ambiguity involved in calculating square roots mod B where B is a Blum integer (that causes 4 possible roots). And that's the source of ambiguity problems in Rabin digital signatures, but if the Blum-Micali public key method works, then this sign ambiguity shouldn't exist (because they define a SPECIFIC root to use), and the method can be simplified to simply calculating D^(1/2) and the check is simply D==X^2. What am I missing here?

2 1

pgp on linux
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

i can't seem to get pgp compiled on my linux machine. where should i ask about this?- since cypherpunks would be a bad choice. thanks.

4 3

Re: Escrowing Viewing and Reading Habits with the Governmen
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Sun, 28 Jan 96 21:05:08 > From: <alanh(a)infi.net> > Subject: Re: Escrowing Viewing and Reading Habits with the Government > To: "roy m. silvernail" <roy(a)sendai.cybrspc.mn.org> > Cc: "timothy c. may" <tcmay(a)got.net>, cypherpunks(a)toad.com > > > The "Library Awareness Program," administered by the Justice Department, is > > > designed to identify potential criminals before they have a chance to > > > commit their deeds. The visits to libraries made by the FBI are used to > > > determine who is reading subversive or dangerous material. > Do you really think the FBI believes that asking librarians to keep > records of customer useage is an efficient way to read the customers minds? > Do you really think that the FBI foreign counter-intelligence squad has > nothing better to do than keep a database of who is reading Che Guevara > memoirs? Yes. Heck, I remember this was a big issue about 15 years ago. Try asking someone who was active in library science in the late 70's, early 80's. The general reaction of the library community was, I am glad to say, entirely pro-privacy. Peter Trei trei(a)process.com

2 1

Here's how you put your key on the keyservers...
by Ted Garrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I got a message in response to a request I made to someone for their public key. I wanted to check the signatures that they included with their posts to cypherpunks, but their key was not on the keyservers. The key they included was completely unsigned, and when I use it to validate their previous posts as well as the message they sent which included the key, the signatures come back as bad, the contents of the file changed. Names are appropriately withheld (I hope). As I understand the bcc: definition, only I and the first smtp server this message hits should know who it's to. I don't know if anyone else reading this mailing list needs this info, but just in case... here's my reply to the message. At 10:03 PM 1/28/96 -0800, you wrote: >Sorry, I'm a newbie to Internet, and also the Internet usage of PGP. I just >participated in a local keysigning meeting, so maybe my key will find its >way to a server. Don't worry about being a 'newbie'. Everyone starts somewhere. However, your key will usually not 'find its way' to a server without you specifically sending it. The keyserver I usually use is accessed by sending a mail message which fits the following format. As far as I know, all the keyservers use this format to add or update keys in their databases. You only have to send it to one keyserver, and it will propagate to all the others. I have indented the text so that no handlers decide to interpret it as a new message. - - To: pgp-public-keys(a)pgp.iastate.edu - - Subject: ADD - - - - -----BEGIN PGP PUBLIC KEY BLOCK----- - - Version: 2.6.2 - - - - [key deleted to protect the innocent] - - - - -----END PGP PUBLIC KEY BLOCK----- >I'm sorry to have to admit that I don't even know how to do this! Newbie >alert! If you don't admit you don't know something, nobody will usually tell you how to do it. Also, you should sign your own key. That will make it harder to forge, I think. The reasons were spelled out in a couple of the web pages I read, but I've forgotten them. It has something to do with either a denial of service attack or a man in the middle attack, or both. The command to do this is: pgp -ks 0xHEXKEYID Honestly, I've only just begun to use pgp myself. Also, you should add your e-mail address to the user-id of your key. The command to do so is: pgp -ke 0xHEXKEYID You will be asked if you wish to add a user id to the key. Say yes, and give it your e-mail address. What this does is it allows people who are using pgp-enabled mailers to directly encrypt messages to you without choosing your key manually. The reason that I have not encrypted this message to you using the key you provided is that when I extracted the key and re-checked your message, the signature was no good. I've found that (using eudora) I must turn off the word wrap feature of my mailer to allow for good signed messages out. Of course, having said this, I'll probably not get a good signature on this message. Let me know if it signs ok. Now, I have a question. Which attack(s) is/are a person vulnerable to when distributing an unsigned public key in the open? Could this actually be a complex man-in-the-middle attack? Am I paranoid? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQy/ds1+l8EKBK5FAQER8Af/SE1lTj3zcpm3ildFGO75zjZiJByZQi+3 LAkYgcHyBmtvhCTvyYCP2aMF4RjayrR3OHB85XthIA4sPmU0NDCVZYv7riSPjslp iBxUk92dO+BkP8nrTFgqCzR4qPqbOSmZxeovZI0PfQvbm99fG6Fc2kjhdKP7Aq+G cw4r0vvJY8JbqAuXftgZgndL9iGR/+xjfrpl+EWL3xtWzpIRfwMS5KMsR1UOf1ZA g9mlMEGLXy5KC/BwaupgTTwlSA/NOTv5mAY8+UWt9ydMWXBqNVt/yiGFsjg5UR1M CaT2D23pLAnWZ8M7yrjMamadkn2iLBqq4nhBNOGYHfZrGcbm/mhmxQ== =jGo3 -----END PGP SIGNATURE-----

1 0

Re: The Unintended Consequences of Suppression
by Bruce Baugh 17 Dec '03

17 Dec '03

At 08:52 PM 1/28/96 -0600, Alex Strasheim <cp(a)proust.suba.com> wrote: >> You just don't get it, do you? Do-gooders like the Wiesenthalistas >> don't need to be *right*; they need *a steady stream of cash contributions* > >It's usually more effective to point out why what someone is saying is >wrong rather than to speculate as to what their motives for saying it >might be. Particularly in cases where, rightly or wrongly, the folks being subjected to ad hominem have a very favorable public image. Explanations that give credit for good intentions and show how the present action works to undermine them, and which include constructive alternatives, are a _lot_ more likely to be listened to. At least that's the way it works for me. And it works for pretty much everyone I know. If there's anyone here who's more impressed by ad hominem, I'd be curious, but they'd still be in the minority. Bruce Baugh bruceab(a)teleport.com http://www.teleport.com/~bruceab

1 0

Re: An Enigma - Wrapped In a Circle
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Perry E. Metzger" foamed: <snip> I wrote: >> 1. Flame me, in *private* e-mail. [I'll happily ignore you.] >> 2. Go hump a tree. > >What the hell is the cypherpunks relevance here, anyway? I mean, other >than trying to elicit a response from me, which you surely knew would >show up, was there any purpose to this? Why are crop circles important >to people worrying about cryptography and cryptography policy? What >possible linkage could there be? Why Perry! I see your point! Any phenomenon that elicits articles with titles like "Ciphers in the Crops" could have nothing at all to do with cryptography... I repeat: Go hump a tree. In complaining about supposed "noise," you cause more noise than any other person on this list. Learn to read before you spew, or just learn to shut up! JMR Regards, Jim Ray -- Boycott espionage-enabled software! "He that would make his own liberty secure, must guard even his enemy from oppression; for if he violates this duty, he establishes a precedent that will reach to himself." - T. Paine http://www.shopmiami.com/prs/jimray _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 <liberty(a)gate.net> IANAL _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMQxOvW1lp8bpvW01AQFvBgP/YQM2CA/f+wq9jCCc/s6BeXm+Lqr6ihCS BhPeB3556EET0mj91XhR1bl5FPb9aUb2f3CeNMBmacr4L/EjAK5S4Fst0WZ10UA8 m7a07IdFdb8wN+TKpAUR4TMmApV1nHnq3fStrSnn1el32rbnMvMmHBDzfXF6wVfk VKvffK+S+WA= =b8Pt -----END PGP SIGNATURE-----

2 1

Re: more RANTING about NSA-friendly cpunks
by Ted Garrett 17 Dec '03

17 Dec '03

At 01:10 PM 1/28/96 +0800, you wrote: >In message <199601262011.MAA17408(a)netcom16.netcom.com>, > "Vladimir Z. Nuri" wrote: >> has anyone *tried* just ignoring the ITAR wrt crypto and seeing what >> would happen? [snip] >> but aren't we equally as comic in assuming that violating the ITAR >> crypto sections will inevitably bring the 4 horsemen of the NSA?? > >One word... >Zimmerman. >I do agree with what you're saying though. But what he's saying is basically this: If instead of targeting a single entity - (eg Zimmerman) for a crypto violation, they had to look at thousands of separate entities per violation (eg cypherpunks, inner circle, users on AOL who have a clue, mit professors, cryptographic experts, corner preachers, etc.), then soon the court system would be forced to come to the realization that, indeed, the genie IS out of the bottle, and the system as a whole would have to recognize that a change needs to be made. As it stands, they bullied on ONE man for something he didn't do, and could drop the case without there needing to be a precedent set. Because there is now no precedent, the NSA and FBI can still use the ITAR regulations to batter any indiviual who attempts to distribute strong cryptography tools to the general public. If they had been confronted with tens, hundreds, thousands, or tens of thousands of people tangibly involved in distributing cryptographic tools, then it would have been much harder for them to say "We are just going to drop this.". They would have had to either go the distance or dismiss it in the beginning. If PGP had been developed under the gnu charter or the Linux concept, what would the government have been able to do about it being distributed? NOT A DAMNED THING. Or at least that's my opinion.

1 0

New Software
by Rev. Ben 17 Dec '03

17 Dec '03

Release time. And I guess I finally get to add my name to the roles of Cpunks that 'write code'. I finished a release of a simple Zero Knowledge Authentication system that uses the GNU Multiprecision Library to implement a modified Fiat-Feige-Shamir ZKIPS. It is written in C on FreeBSD 2.1-R but should run on anything that uses BSD socket code. I tried to write it fairly portably. It is a very early release with little bounds checking or any of the hardening that would be required in a secure environment--hell in a secured environment, you'd want to write the bignum package yourself. But in any case, its just to get some practice writing this sort of code as well as amuse myself My latest project is to write a HTTP anonymizer--sort of like a bit launderer. The plan would be to allow a server to be browsed without actually giving away its real address by using a proxy. The client would have an encrypted URL that would be passed to the proxy. The proxy, using its own private key would decrypt the real URL and make the HTTP request to the server. This would opaque the server's identity from the client. While this sounds all well and good, unless there are multiple proxies deployed a-la Mixmaster with encapsulated encryption, there is the threat that the proxy would be able to match up server-client pairs. In any case, I'm open to suggestions on this project--its very open ended and should be done in a couple of months. If anyone would like a copy of the work done mail me and I'll send you a tarball. Ben. PS: Does anyone know of any French COMPUSEC firms that I could contact? I'd like to try to get a job there for next year. ____ Ben Samman..............................................samman(a)cs.yale.edu "If what Proust says is true, that happiness is the absence of fever, then I will never know happiness. For I am possessed by a fever for knowledge, experience, and creation." -Anais Nin PGP Encrypted Mail Welcomed Finger samman(a)powered.cs.yale.edu for key Want to give a soon-to-be college grad a job? Mail me for a resume

1 0

Re: "German service cuts Net access" (to Santa Cruz)
by James A. Donald 17 Dec '03

17 Dec '03

The German prosecuters are currently targeting the site of Mr Zundel, "who is well known for his open revisionist positions." Zundel is not in fact a Nazi, but an anti nazi: Here is a sample of his work. Bottom line. German prosecuters are amazingly ignorant idiots. Press Release Date: January 3, 1996 Attention: Assignment Editor / For immediate release Hate all that you can hate in the Nazi Reserves! In The Nazi Reserves, we hate more people before 6am, than most people hate all day! We promise if you join The Nazi Reserves, you will be trained in: 1) Marching 2) Re-learning History 3) Growing a mustache just like Hitler's 4) Burning your own house and blaming it on Jews! 5) Learning how to blame *everything* on Jews! 6) Learning how to blame everything that can't be blamed on Jews on the Blacks! 7) Learning how to blame everything that can't be blamed on the Jews or the Blacks on the Liberals! 8) Learning how to blame everything that can't be blamed on the Jews or the Blacks or the Liberals on the Catholics! 9) How to signal the Alien Nazi UFO Mothership! 10) More marching! 11) How to enjoy being anal probed by Nazi aliens from space! 12) How to make your jackboots *really* shine! 13) How to beat up homosexuals (this one's easy-- just make sure you outnumber them by about 6:1, and make sure you're in Colorado) 14) And yes, MORE marching! If you join now, we promise you there will be *no volleyball* and *no push-ups* and no *5 mile runs!* Yes, even middle aged balding men can join the Nazi Reserves! The Nazi Reserves: It's not just a job, it's a perversion! (Not like my other perversions which involve trying to stuff my plump legs into stockings and prance around in heels.) JOIN NOW AND WIN A FREE TRIP TO THE NAZI UFO BASE AT THE CENTER OF THE EARTH! Surveys show that 9 out of 10 prisons prefer candidates who have learned the skills taught in The Nazi Reserves! Join now and you increase your chances of receiving free meals and housing for the rest of your life! -- Ernst Zundel My right to free speech supersedes your right to exist. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

new(?) anti-usenet censorship technique?
by Jon Lasser 17 Dec '03

17 Dec '03

Playing around online today, it occured to me that much of Compu$pend's subscribers (and many other ISPs, especially smaller ones which might be subject to governmental pressures) rely largely on people who use chat modes frequently, often for sex-related chat... they cannot cut off IRC (for example) without hurting their income substantially. If someone put up an IRC<->news gateway, with a bot that allowed anyone on channel to read newsgroups, it'd be virtually impossible to censor; one could use a variable channel name to increase the difficulty of censoring it. Has anyone done this before? Or talked about it? Jon Lasser ------------------------------------------------------------------------------ Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 Visit my home page at http://www.goucher.edu/~jlasser/ You have a friend at the NSA: Big Brother is watching. Finger for PGP key.

1 0