December 2003 - cypherpunks-legacy

Electronic Grille Cipher?
by Deranged Mutant 17 Dec '03

17 Dec '03

An idea occurred to me the other day, for hiding multiple texts in one file using multiple keys. The gist of it is to take a reasonably large file of random data and then to hide the bytes of a message in scattered locations. The method of determining where each byte is would be based on a good cipher which for each iteration would return a relative offset from the last location in the file. It's the electronic form of those ciphers where you have a message in a grid, the key being random holes punched in a card and the rest of the boxes filled with junk... I think it's called a Grille Cipher, right? If the file is reasonably large and the messages reasonably small, then multiple messages with multiple keys can be hidden in the same file. Thus one passphrase can decrypt an innocuous message while another decrypts the real message. (Some care should be taken to make sure there are no collisions.) If an unencrypted plaintext was intermixed in a "truly random" file this way, it would be difficult for an attacker to extract it (though it's nicer to intermix an encrypted file...). This method could also be applied to stego when hiding a file in graphics or sound files since an attacker who suspects a stegoed file would have trouble detecting a PGP header. Any comments? Has this been thought of before? --Rob

1 0

Re: Telecoms Bill
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- mark(a)unicorn.com ("Mark Grant, M.A. (Oxon)") wrote: > >Well, if "cypherpunks write code", is there any code we should be >writing in response to this? I'm not familiar with SSL protocols, but something that would anonymize web page access and keep it entirely encrypted (not just credit card or forms transactions) would be good. Encrypted/truly anonymous ftp would be nice (though some folx would understandably have problems with truly anonymous uploads, and crypto export restrictions in the US could be problematic legally). I think there is already work on encrypted telnet (stel) by the CERT/IT people. On the non-net side of things, implementing encrypted BBS/communications and file-transfers is useful. I'm told PGP-Phone is supposed to support encrypted communications/file-transfers... so a host-script language that enables a simple BBS would be nice. Implementing encrypted/anonymous mailing lists is another idea. Other ideas? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRcHsioZzwIn1bdtAQHUzwGAwVy5oX7+XwznGkF+CHVXBqeI1dSMT1tt gNIENdPUnst6bIPvGX4FigUnzEBPiNMH =gV+C -----END PGP SIGNATURE-----

1 0

Re: Why am I wrong?
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:54 PM 2/5/96 -0500, Decius wrote: >I am posting this pondering to cypherpunks in hopes that it will be refuted. [stuff deleted] > > Crypto-Absolutism > decius(a)ninja.techwood.org [more stuff deleted] > On the other hand, we have the crypto-anarchists. They believe >that the existence of anonymous transactions will naturally lend itself >to a situation where everyone is anonymous, no transaction can be >tracked, no communications can be monitored, and basically, no >government can possibly control the transactions and interactions of its >citizens. They support the broad use of military grade cryptography and >anominity. Let no message be crackable or traceable. This, also, is an >absolute belief and it is also flawed. We have governments for a >reason, we came together and founded societies for protection, and if >we tore apart our current social structure and created an anarchy, >people would immediately form small societies for their own fiscal >protection. Creating an anarchy is a massive step backward in social >development, not a step forward. Furthermore, PEOPLE WANT TO BE >ACCOUNTABLE FOR THEIR ACTIONS. <sigh> Well, I suppose that if there is anyone who is most opposed to the opinion you expressed in the paragraph above, it is myself. I believe: 1. Governments will no longer be "necessary," if they ever were. 2. Protection will no longer depend on having a "government." 3. Anonymous networking technology will protect our rights, to the extent they can be protected. 4. Your statement, "...anarchy is a massive step backward..." is absolutely incorrect. Note for the others: I am forwarding this person a copy of my essay. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRb5FfqHVDBboB2dAQFvlQP/Wmsc0OLvEowD3rQ2Rvu2UDcg34ovQt/S g5HDiraykfk8SpBxyYDWlq+EEO21GssY0w9wmOaf0PKGwk81gZsqqccVpXpJq2Ha H+ABrgmzCEkiMnL6anFs2RGkZZrlwB2ZGityvV0YZ8HvpP1Ek1Xj0ZD97hYMmYBz P3gxGE2VCEQ= =nhzg -----END PGP SIGNATURE-----

1 0

Re: paper on remailers in the intelligence community
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:06 AM 2/7/96, t byfield wrote: > Surely you jest. It's one of the weirdest hodgpodges of inane free >association I've ever read. The authors are a couple of regular Jack D. >Rippers. Highlights: It's about par for these "management" conferences. A deep, thoughtful analysis is just not likely (and I don't mean this as a complete insult: his paper is mostly just to touch on what these issues are, not to do an academic study). Strassman is a regular columnist for "Computerworld" and a member of various advisory councils (including a conspiracy-feeding thing called the "EC World Council"). He was a bigshot in the DOD, works for the "Information Warfare" folks (the much-hyped new area generating so many conferences), and has all sorts of ties to the mil-info complex. An Alta Vista search on the string "Paul A. Strassmann" is revealing. >>One of the most prominent anonymous re-mailers is <anon.penet.fi> is in >>Finland. It is frequently used by the Russian (ex-KGB) criminal element. > Maybe he got this from all of the stuff that is sometimes attached automatically to remailed messages: KGB, Sarin, Corona, Area 51, IRA, and those cute slogans like "the shipment will be out of the Port of Oakland at...," etc. :-} But more seriously, any mil-info complex effort to demonize remailers must of course invoke one of the Horsemen. At this time, "Russian Mafia terrorists" is the putative focus of joint U.S.-Russian intelligence activities, and was even the plot of the latest James Bond movie. (Rumor has it that 007 will be doing battle with MEDUSA, the cyberspace descendant of SMERSH, in this case meaning "death to tentacles.") --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Hardware RNG support for PGP 2.63
by rngaugp＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There is now support for using a hardware random number generator with the most recent version of PGP, (pgp263i) Version pgp 2.63i is now supported. The files for this modification of pgp are at the export controled ftp site in the directory: ftp://ftp.csn.net/mpj/I_will_not_export/crypto_????????/pgp/rng the files are: rg263.zip (compiled both ways, so there are executables approapriate for both inside and outside USA.) Sources for the modifications are included. Executables are included for OS/2 and MSDOS. In the above ????????? varies because of the export control scheme. To get the files if you are in the U.S. and Canada first get the file ftp://ftp.csn.net/mpj/README.MPJ and follow the instructions. Many thanks to mpj(a)netcom.com for providing storage at the export controled ftp site. Other ftp sites are welcome to store these files. Be aware of ITAR. By the way I used to use the mail address: mg5n+alias!rngaugp(a)andrew.cmd.edu But I now use: rngaugp(a)alpha.c2.org because it is faster. But you can tell it is the same person because I sign with the same PGP key. Here is the README file that comes with the modifications. - ------------------------------------------ Hardware Random Number Support for PGP. PGP 263 international version Ever get tired of typing in keyboard timing strokes while generating a PGP key? Ever want to use PGP unattended, but be foiled because there is no one there to type the keyboard timing strokes? Ever wonder if PGP's method of generating random number might have some subtle flaw which would expose it to cryptanalysis? This is a modified version of PGP which allows it to be used with a hardware random number generator. Two kinds of RNG are supported: First, any RNG with a IO driver that makes the RNG look like a file that can be opened (fopen) such that each byte read is a random byte. Second, a bus RNG under the x86 architecture such that random bytes my be obtained with a simple "IN" instruction. The CALNET/NEWBRIDGE RNG is an example of this kind of RNG. A crude sanity check is done to check that the bytes appear to be random. To use the hardware random number generator feature of this software, you must define _ONE_ of the new configuration file parameters RNGDRIVER or RNGPORT in config.txt or from the command line. If you have a RNG of the first type, define RNGDRIVER to be the complete path to the RNG driver. If you have a RNG of the second type, define RNGPORT to be the port number from which to get random numbers. You can use hexadecimal i.e. 0x300. Examples: RNGDRIVER=/dev/random or RNGPORT=0x300 If neither of these are defined the modified PGP will get its RANDOM numbers in exactly the same way that regular PGP does, through keyboard timing. If one of these parameters is set correctly, the modified PGP will get its random numbers from the RNG and you will never be asked to type keyboard timing stokes. I have compiled a version of PGP that supports a hardware RNG for MSDOS and OS/2. I have included the source files for each file that has been modified. To compile get the original source files, put in the modified files and compile as usual. The new source files and this software are covered by the same license as the original, the MIT licence. The USA version pgp263 (without the i) is covered by the RSA license. If someone out there has an PSI-LINE random number generator that attaches to a RS-232 port as if it were a modem, please test it with this software. If the software line characteristics (baud rate, flow control, stopbits, ect) are set correctly (You will have to do this yourself, as this modified PGP does not do this) then all you should have to do is set RNGDRIVER to the RS232 device name. I have not tested this because I do not have this kind of RNG. Someone may wish to add code to set the software line characteristics, but this may be difficult, as the code would vary by operating system and even among the various flavors of UNIX. If you do such a test please report the results to alt.security.pgp and cypherpunks. The executables in the subdirectory "USA" are linked with the RSA library and will not allow you to disable the legal kludge. They should be OK to use in the USA. The executables in the "I" subdirectory are not linked to the RSA library and allow you to disable the legal kludge. It should be OK to use in countries outside the USA such as CANADA. The executables in the subdirectories "DOS" can be used with MSDOS. The executables in the subdirectories "EMX" can be used with OS/2 if you have the EMX runtime system installed. The executables in the subdirectories "OS2" can be used with OS/2. The zip file should be unziped with the "-d" switch if using pkunzip. -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: cp850 iQCVAgUBMRZneM29s2mG+tTVAQEeVgP/dHnlQd73Yyyzw4uB1lwo76aDZOiVe+i4 VV5aUBpTtBYTknPNeKFaUhLOxZo2tykSrByPXuAQ0dzKyL5MxIOAt52sBx2nQoOi EOFq6mlQH+yUfcfRcjnFGoWtyasBfpdEzO07/shiB8Ts1rRxSR2z0rCoXNuRM8a6 5oU8NDc1vVw= =H9r8 -----END PGP SIGNATURE-----

1 0

Fw: Release of Pronto Secure first Beta
by geoff klein 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=d4os3ia2um1ynatbsrvdecfwxgqzhl To: cypherpunks(a)toad.com Date: Wed Feb 07 09:53:01 1996 > THIS IS A MESSAGE IN 'MIME' FORMAT. Your mail reader does not support MIME. > Some parts of this will be readable as plain text. > To see the rest, you will need to upgrade your mail reader. - --d4os3ia2um1ynatbsrvdecfwxgqzhl Content-Type: text/plain Content-Description: Fw: Release of Pronto Secure first Beta The previous version of this message was posted to the list in ascii-armor, my embarrassed apologies to all. To: All who have already applied - you will be receiving a message with down load instructions before the end of the week. New applicants are also requested to mail me their public keys, please. Thanks, Geoff - -----Begin Included Message ----- Date: Tue, 6 Feb 96 18:52:41 IST From: geoff klein <geoff(a)commtouch.co.il> To: cypherpunks(a)toad.com Cc: To: cypherpunks(a)toad.com Date: Tue Feb 06 19:12:56 1996 Commtouch has decided to offer a controlled release of Pronto Secure to the Cypherpunk community. We believe that scrutiny of the product by members of this list will help us to release a safe and secure E-mail client. Pronto Secure is an Internet E-Mail client for Windows, which uses external security providers to enhance e-mail with cryptographic security features. The current beta version relies on the proven security facilities of PGP to provide encryption, authentication, integrity and key management features. Future versions will include S/Mime and MOSS compliance. Product requirements: - - MS-Windows 3.1 / Windows for Workgroups 3.11 / Windows 95 / Windows NT - - Winsock 3.11 compliant environment (TCP/IP stack) - - Installed version of PGP. We plan to make Pronto Secure available via FTP at the end of this week. Parties interested in joining the beta-test program are invited to send me pgp-signed e-mail requesting down load instructions and our public key for authenticating the version. Beta-testers who provide us with feedback will be eligible to receive a free final release version. Sorry no T-shirts, but we guarantee that you'll get more wear out of Pronto Secure :). - ----------------------------------------------------------------- Geoff Klein email: geoff(a)commtouch.co.il Product Manager - Pronto Secure http: //www.commtouch.com - ----------------------------------------------------------------- CommTouch SW Inc, U.S CommTouch, Israel 1206 W. Hillsdale Blvd 10 Technology Ave San Mateo, CA 94403 Ein Vered, 40696 Tel: (415) 578-6580 Tel: 972(9)963445 Fax: (415) 578-8580 Fax: 972(9)961053 - ----------------------------------------------------------------- - ---- End of forwarded message ---- - --d4os3ia2um1ynatbsrvdecfwxgqzhl-- -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMRhaXULv5OMYFK1FAQHG5AP9FyxJgjFRo5Y8iuFtMIZXmhWZA9XtD3mV YJrLglBpdOsYpKkaqy9NfTooAdIUzqfytc6MDuwDZCWbAiS9lHNMZSHUXXo6s95z NoIBeEG6qReoGBc0XsNxR/UUQ1vER88gbM4W3jrWv3zPEIV6Yo8y/tv4BbfHfhdH FOX9htLNeQg= =zDru -----END PGP SIGNATURE-----

1 0

Re: paper on remailers in the intelligence community
by Greg Broiles 17 Dec '03

17 Dec '03

At 12:37 AM 2/7/96 -0800, Tim May wrote: >Strassman is a regular columnist for "Computerworld" and a member of >various advisory councils (including a conspiracy-feeding thing called the >"EC World Council"). He was a bigshot in the DOD, works for the >"Information Warfare" folks (the much-hyped new area generating so many >conferences), and has all sorts of ties to the mil-info complex. An Alta >Vista search on the string "Paul A. Strassmann" is revealing. Ah. A feeble attempt to deflect attention from your own cooperation with the Grey aliens and their boot-licking military-industrial-complex errand boys. Even more revealing is an Alta Vista search for "timothy c. may" and "william marlow" Now you'll probably claim that you've never met Marlow or Strassman. Sure. We know what you're up to. You're not fooling us, Medusa. :) -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Re: [noise] the individual and the tribe
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: I originally said: > > ... in the sense that > >tribal societies are individualist. > > I absolutely don't agree. The subordination of the individual to the tribe > is fundamental of their vision of the world. Individualism is not about > personnal opinions, it is about the vision of Man as an entity in itself, > a type of cattle that owe his service to the collectivity of the tribe. Beware of stereotypes about "tribal culture". The individualism in a tribal culture is different than in western society. In some ways the west is way more collectivist than tribal societies... taxes, public works, laws... even the bare minimums that would exist in libertarian societies. Certain forms of self-expression and practices with regards to sexuality, drug use, etc. are quite acceptable in some tribal cultures... even encouraged over western conformism. The use of myths with regards to nationalism and cultural purpose is actually a western phenomenon. Creation myths, "how we got here" etc. stories have different functions in tribal socieities, and are not used as a rationalization of collectivism or submission to the will of the tribe. Decision making in tribal cultures generally is often based on group consesus... if no consensus is reached, no decision is made. Disagreement is acceptable, and in some cultures also encouraged as a sign of adulthood. In western collectivist societies there is decision by manufactured consent of the majority in an air of perpetual crisis.... a tyranny of the majority. > > Crypto makes the tribe (and it's sorcerers) loose their grip... :) Tribes aren't run by chiefs or sorcerers. Large industrial nations are. Rob. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRheMyoZzwIn1bdtAQHtQAGAyvJmtmErKscUNS5WZUAlPrcFJpSKJxJg c/VoBAcOd/dmF6wvyUO4EuZ9q6PS4xb3 =hjlN -----END PGP SIGNATURE-----

1 0

GE's Transaction Tech
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

GE Info Services Launches New Transaction Technology Rockville, Md., 6 February 1996 -- General Electric's GE Information Services division said it is launching a new set of hardware and software products that will protect business transactions over the Internet. One of the features of the new system, called "GE InterBusiness," involves using one-time use encryption codes for each online session. The new offering combines the one-time, or dynamic, encrypted session key, mutual authentication, and advanced firewall technology, officials said. By using standard Internet protocols, a user can conduct electronic data interchange, electronic messaging, and electronic file transfers via a secure "pipeline." Those three elements are key in both electronic commerce and GE Information Services' Business Productivity solutions. Anne Biehl, manager of market development for GE Information Services, said one of the key differentiators between her company's secure business transaction technology and offerings from other companies lies with the dynamic encrypted session key. "This is the first system on the market today, that we know of, that's using (this technology)," she said. "It's a pretty powerful 'ring of security' for our users. It's a nice feature we've integrated into our total solution." With the dynamic session key, the session is encrypted to secure all information passed from sender to receiver. The key itself is never seen on the Internet, and hackers can't break the encryption, officials stressed. The new system uses the standard networking and connectivity of the Internet to interface with systems used by GE's 40,000-plus customer companies, officials said. GE InterBusiness runs on all browsers, resides on any Internet-compatible desktop, and interacts with standard Internet applications. GE InterBusiness is available now, Biehl said. Pricing varies depending on the client's requirements, she said. Biehl said today's announcement has nothing to do with the completed sale of the group's GEnie online service to Queens, New York-based Yovelle Renaissance Corporation, reported last month. For additional information, those with Internet World Wide Web access can surf to GE Information Services' Web site at http://www.geis.com/. --

1 0

Fax Fools US Espionage
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

"Foolproof" Encrypted Fax System Derby, England, 6 February 1996 -- Wordcraft, the Derby-based software house, has announced that its proposals for a "foolproof" secure fax transmission system will be considered by the International Telecommunications Union's meeting in Geneva, Switzerland, next week. According to Mike Lake, the company's managing director, Wordcraft has been working closely with a number of other companies, notably Chantilly (another UK firm) on the proposals, which will be considered alongside a competing set from French and German companies. Lake told Newsbytes that the Wordcraft system is known as Automatic Fax Services (AFS) and consists of four elements: authentication, message confirmation, integrated encryption, and a certificate of receipt. The authentication element of AFS revolves the generation of the fax device's serial number and unique transaction number for each fax transmission. Message confirmation is generated by the distant fax device, while the certificate of receipt is printed after confirmation is received. "Existing fax transmission reports are just that -- a note of transmission. AGS creates a new document, a certificate of receipt, which proves that a fax was transmitted," Lake said. The encryption system, meanwhile, uses a proprietary, but open systems standard of encryption, using a one-time passkey, which is transmitted by the sending fax device in a secure manner. "This contrasts with the French/German system which is based on RSA's private and public key system. That system is flawed, since it relies on the US Government licensing a manufacturer to use the algorithm, something that the Government is unlikely to do with, for example, a Japanese fax manufacturer," Lake explained. According to Lake, even if the ITU Study Group 8 approves the French/German secure fax system next week, no major fax vendor is likely to implement such a system on their fax machines if the US Government is allowed to licence each fax machine for use. "The AFS system is secure, yet does not need the permission of anybody to use it. In that sense, it's a more global system," he said. So what does Wordcraft get out of the proposed standard? According to Lake, the company is offering a series of C language routines for inclusion in the firmware of fax machines, and fax software drivers. These routines, he said, allow driver programs to be coded very easily. It is the modest licence fees for this software with which Wordcraft is hoping to recoup its investment. --

2 1