December 2003 - cypherpunks-legacy

Re: Truelly Random Numbers
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:11 AM 3/3/96 -0500, Gary Howland wrote: >Surely the process of counting up until you get a prime means >that the chances of getting certain primes are greater than >others (eg. 17 is more likely than 19) ? In order to use this information, one would need to determine the number of primes in the vicinity of a potential prime factor. This costs more than actually checking for the factor, hence is not useful. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

No Subject
by burma＠alpha.c2.org 17 Dec '03

17 Dec '03

Hello Everyone! I'm trying to help my friend. He doesn't have his own computer. He uses and abuses the school computers. Here is the problem the guy has. Read on! I don't know if any of you have problem with scrolling through the BurmaNet News article recently. It freezes my VT100 screen and give me KBD LOCKED errors at certain spot. It also freezes the xterm window. It turn out that the file contains non-printable ( invisible ) charecters, dc3, to be exact, which screw up something. Below is the octal dump of the BurmaNet content on a unix box. Note the 'dc3' charecter right before "The definition often the ..." on line 4300 and 6700. If any of you are having similar problem please drop me a note.

1 0

cryptography
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Response to Freedom Now! program on PBS, regarding expanding use of cryptography by individuals. - ----------------------------------------------------------- Unfortunately, the NSA representative (Mr. Baker?) on today's (3/3/96) show neglected to mention that the Clinton administration called for the introduction of the Clipper chip in *all* phones, NOT just those used by the government. This may be readily verified online via the archives at the EFF (http://www.eff.org) EPIC (http://www.epic.org) and even the White House' (http://www.whitehouse.gov) own ftp-able copies of the President's speeches. Also missed was the fact that the Clipper chip would readily permit the implementation of what is called "traffic analysis" - knowing who spoke with whom, regardless of content. Traffic analysis data could readily be misinterpreted. If I were to make a dozen calls to a KKK office, traffic analysis would show such; it would *not* indicate whether the calls were in support of, or opposition to, the KKK's existence. I found 'interesting' the NSA representative's emphasis of the fact that with the introduction of the automobile, the government's response was licensing and requirements for absolute identification. Extending that response, and the extensive licensing and identification procedures used to (legally) acquire (legal) firearms, to the use of cryptography and communications: are we going to see licensed telephones? Are we going to be obliged to present a National ID card before being able to use a public pay phone? Somehow, I have trouble equating a submachine gun to a Princess phone... but then, I'm not a (probably justifiably so) paranoid government official. David K. Merriman merriman(a)arn.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTks9MVrTvyYOzAZAQF+tQP/Z1WQQ5lA04Lkt1e4pDM6x/MA113+LuAQ DnKSSy50778cblcW44IimEkeWvxAQ/ee4FYtDlDvpxVgCXJc9ARUdawpZ0eFoCON 5nQ1VixVUMhmMrZYUrx1MFmacvgYDfkqXS7QEHmkrQzvZTKsjM67gs2VKCUhJm0D p54R34ooaKM= =1HPq -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

1 0

remailer, web site, listserve
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I and a partner are expecting to be online by the 8th of March with a commercial web server (shellback.com) As part of this presence, I am working on hacking together a program to interface with the SLMail95 (yes, it will be running on a Win95 machine :-) email server to allow operation as a remailer. Initially, I anticipate that it will be a fairly 'dumb' remailer, offering only remailing, reordering, and PGP encryption. Additional CP-style features will be added as my time to implement them permits. I am offering to maintain an initially limited archives of CP materials and a listserve host (if needed/wanted). I am also actively soliciting (via email to me personally, please, and forgive me if I don't acknowledge it) pointers and materials (files, documents, etc) to include on the site. I have the PGP files from the CP ftp site (before it got 'lost' again), but anything else is *most* welcome. We will also be offering anonymous email accounts for $5/month. Following is the PGP key for the remailer we'll be operating (remailer(a)shellback.com) I want to emphasize that the remailer will *not* keep *any* kind of logs. Bad headers, bounces, or anything else not processed on the first go-through will simply fall into the bitbucket for electron recycling. Since I'll be the postmaster/webmaster, I can say that with no small measure of confidence :-) - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzE0kfEAAAEEALf5sIOqMfEAFi3geJ6aofyaCRy1ZJt8D91QBqPPeU1X3ond BoIcEcfaMf7s3cOBaiEl7rKFMYqEpL08G7FFelQxc1WRvsR5XtTN+xFB3j0RPNON vMxju5j6anjPVb2RMnowSYqNKUWIEYd4Soa7L+ZWpaHgLSGkhb6Ex2tu6LdpAAUR tCFSZW1haWxlciA8cmVtYWlsZXJAc2hlbGxiYWNrLmNvbT6JAJUDBRAxNJK/xWtO /Jg7MBkBAfiVBACk6dDtebwemmY2+nxK+WD46a0Uj/lwpXLGzJvixdYGo4mwYG2/ LUw/23xBNxLIvPCFR8Qvt9zguyPdMWAp07I64ZlL6yv9Co3DETtTLB8wBdPce6Wx CLswIWAQ3MSLOmgVB35TzOYrYf5RzYtNKktCl3YDa9mxV4sug9xAx5uxvw== =9EvL - -----END PGP PUBLIC KEY BLOCK----- We return you now to your regularly scheduled anarchy..... Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTkzSsVrTvyYOzAZAQGVxQP/cFSgADQRFs58aTRv9FmzVFKK5xP4Ew2T lFajc73ltr0u6qa3luCfZKUqhG93REt8KXqzj2j65i+wrSKzs10DN2N75dEfRHO9 oGm0ka82eTmY+NXLLuNn1THw0+J8EsH9itQD0H4IzEWFkqUYq/C8pEtARF8LCt3V oKN1V/E6zPs= =sfA+ -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

1 0

Re: Duress
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:49 PM 03/3/96 EST, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >"A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> writes: >> Those of you who follow FIREWALLS may recall that I premote the use of >> "minefields" on networks, machines that should never be accessed and will >> trigger an alarm/response on any access. >> >> Some years ago I wrote a spec for cryptographic securing of notebooks/ >> E-Mail that included a "duress" capability: a "password" that, when >> entered would appear to be properly accepted but would report an error >> on retrieval. Optional was to be overwriting of any material whose access >> was attempted. > >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. > Many (if not most) alarm companies make the duress code the *reverse* of the normal code. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTlEzsVrTvyYOzAZAQG9sAQAjfAQP6pEReh/vzx/dsJKU987FOMbqWgV Ik/NtzW7fRRzVYmruribT1ZtPQAcPTkdORZC22xHvk82E/m9Awv9q6Zhkbd29/TQ kcLQ42G3ddcUMA7EWtWtP231tofnyQtM5M7KRdIkKyT7oZdyXgjP42mysjGNDHAy wv2VcfiPwPQ= =fc6C -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

2 1

Re: NYT login
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just Rich wrote: > > Rumour has it that there might be a cpunks/cpunks (cypherpunks was taken). This brings up an interesting prtoblem which I have been trying to solve. How can we fund content providers on the Web while not compromising privacy? Early on I targeted political and governmental sites as likely users of the Web. This also reflected a personal belief that I have in open government. What I did not anticipate was the speed with which the mainstream press started appearing on the Web. In part this was due to the Whitehouse server which has legitimized the Web in many corporated boardrooms. There is a problem though, nobody has a fully convincing revenue model yet. This will have to chage if sites like the NYT are going to stay online. Ideally I would like these sites to be free to the readers because it helps break down international chauvnism and petty minded nationalism. I believe that the significant number of trans-national relationships forged over the internet have lead to a significant shift in support for French Nuclear testing for example. Ten years ago many French supported terrorism such as the sinking of the Rainbow warrior in persuit of this policy, this time round there has been much less support for the government posistion. The challenge therefore is to find a means by which NYT etc can pay their staffs. Advertising is an obvious mechanism but here there is a problem. Advertisers need to know what they are receiving by way of value for money. Don't believe the stories of $50K per month advertising charges, many of these prices are very heavily discounted. $50K is what advertisers are willing to pay once they know for sure the Web works for them. If we apply traditional advertising logic it would be necessary to use very intrusive methods to discover how effective the Web is. This is not necessarily the case on the Web since it is an interactive medium. As Jock Gill pointed out at a recent conference we organised, instead of targetting customers the Web permits a participatory process which may be far more profitable for big name brands, allowing them to establish the high value long term relationships they really want. So the question is how can we square the circle? I have no problem telling the NYT's advertisers that NYT have a reader who is in the high tech goodies purchasingcategory. I have a serious problem allowing the government to know that I read the NYT, remember that in many countries that could lead to getting you arrested. I also think we need to be cautious about comapnies collecting similar information. Imagine for a moment that the US elected a fascist president opposed to "left wing intellectuals". It would be a bad thing if he could obtain a list of likely left wing intellectuals compiled from readership of various magazines, visiting of left wing Web sites etc. This is a live issue in Holland where no phone records are kept because stored records were used by the NAZIs when they were invaded to find out who was talking to whom. Some Ideas I had: 1) An anonymous session identifier generated by the browser constructed in a cryptographically secure manner so as to prevent linkage across sites. This would allow NYTs to find out that a reader had moved from the sports section to the politics section within the site but not to track them from the NYT to Time Warner. 2) A privacy code of conduct. Sites adhering to this code would be alowed to display a trademarked icon on their pages. This code would cover items such as not selling log files not maintaining online records of identity. There are many people who are willing to put in the effort to make the Web a place where people can interact in privacy. I know very senior people in very large companies who are as concerned as many cypherpunks on this issue. The point is that we need to come up with a scheme which addresses their legitimate business needs and protects privacy. Otherwise the market will decide and it does not care much about privacy. I have written up some working drafts. You can get them from the IETF in ascii text or via the web as W3c working drafts http://w3.org/ Phill Hallam-Baker - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMToQuyoZzwIn1bdtAQFSZgGAwMeBfDr4g3yBclG08m6f8K2Ml1Gv07i1 L5wybpz4/8o4Gy7/P3UUP+82IcEpgGrl =hUU/ -----END PGP SIGNATURE-----

4 3

Re: A brief comparison of email encryption protocols
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:01 AM 2/29/96 -0800, Laurence Lundblade <lgl(a)qualcomm.com> wrote: .....CME wrote.... >>Like X.509, my certs have an Issuing-name and a Subject-name -- but >>they're both cryptographic hashes of public keys. You can take a portion >>of those hashes [e.g., low order 12 bits] and use it to index a hash table >>of certificates or keys. The cert is more general than X.509 -- that is, ...... >Isn't using a hash as the identifier replicating the key distribution >problem that PGP has or are you including some other data that can be used >to look up the cert? I think a problem occurs when you have 20 billion of >these certs (two for every person in the year 2010 or such). A simple hash >into a table isn't going to cut it because you a single database (with >replication?) isn't going to be possible. Some hierarchical lookup like >DNS is going to be needed. The look ups are needed to check for revocation. There's a name collision on the word "hash" here. Carl was using both hashes in the same sentence. A "cryptographic hash" is a strongly one-way mapping from an input string (in this case a public key) to a number. A hash table is a data structure that uses a mapping from an input string to a number to decide where to put things. An MD5 cryptographic hash function used on PGP public keys (e.g. to get the fingerprint) is 64 bits long, so there may be a few collisions if there are 2**34 keys out there; if things scale to that point, PGP 4.1.3 need to use SHA for fingerprints instead (or in addition). Carl is proposing using a hash table (indexed by a hash-table hash of the cryptographic hash) to store public keys; that's a separate problem, though of course if you want to store 20 billion keys in one place, there are better data structures than simple hash tables. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Netcom and Credit Cards
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: > > The "credit card numbers were stolen" point, that I believe Ed Carp was > > referring to, had to do with the Mitnick affair, and is very old news. > > The fact that they had been stolen was mentioned in an edition of 2600 > 6 months before the Mitnick saga. Netcom had been told about the > security breaches many times, but refused to acknowledge that their > site was insecure. It was this arrogance that pissed people off > more than their insecurity. As someone who was involved in the recent iKP / SEPP /STT / --> SET event I would like to point out that it was the storage of CC numbers in databases connected to the Internet which was the primary concern of credit card companies. Sending credit card numbers across the internet in the clear was to an extent a side issue. Clearly if the merchant was nopt going to be able to store the number the number would have to not be received in cleartext by the merchant. Phill - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMToR2yoZzwIn1bdtAQEBDAF+Mgb3VluBwhqkjIgPCJ5YurkDWWm9MRwg RJoqXdalTBmM20ldY5qddiuTGoxni4ac =9L/X -----END PGP SIGNATURE-----

1 0

Request Comments: Transpose/XOR Hash
by Olcay Cirit 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi! I'm working on a cipher that utilizes Cipher Block Chaining and One-way hashing to create a sequence of pseudo-random numbers to XOR against a plaintext. I'd like to know if anyone has comments regarding the hash method I came up with. It is a combination of Transposition and XORing. Basically, it works like this: Let's say K is the 8 character key that will be hashed. There are two binary accumulators M and L, which store the Most and Least significant bits in each byte of K. After M and L are both 8 bits long, they are XORed together and the resulting value replaces byte N in the Key. This is repeated 8 times, and each time, N is incremented by one. Any thoughts, comments? -olcay - -- "For he who lives more lives than one, |) Olcay Cirit -- olcay(a)libtech.com more deaths than one must die" (| http://www.libtech.com/olo2.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTpumyoZzwIn1bdtAQHnqAGA2CzuLVpiPdRQ84MuC8aBxy7vcIZsujLr 85hGcVoknfAujjXFoy7KOxGQrZt3RorK =jQ7w -----END PGP SIGNATURE-----

2 1

(Fwd) Gov't run anon servers
by James Caldwell 17 Dec '03

17 Dec '03

This states that some anonymous remailers are run by various gov't and that encryption keys up to 1000 bits are crackable. Whether this is true or disinformation, you are using a 1024 bit key and all your messages through anonymous remailers are encrypted aren't they? Also note that while later versions of PGP are capable of larger keys, that these versions of PGP are not known to be secure. PGP 2.3a is the last version released prior to gov't interference. PGP 2.3a will do 1264 bit keys if you enter 1264 in the box instead of the number it askes for when if asks for the type of key security you want. ------- Forwarded Message Follows ------- alt.privacy.anon-server,alt.anonymous.messages,alt.anonymous, talk.politics.crypto,alt.politics.org.covert,alt.politics.org.nsa,alt.politics.datahighway, alt.culture.internet,alt.culture.usenet,alt.cyberspace,alt.conspiracy From: an366601(a)anon.penet.fi (** CRAM **) Date: Sun, 3 Mar 1996 13:15:55 UTC Subject: Strassman & Marlow comment on NSA/remailers Forwarded message: >From ausman(a)wired.com Tue Feb 6 01:42:13 1996 Message-Id: <199602060109.RAA09056(a)wired.com> To: sameer(a)CSUA.Berkeley.EDU Subject: has this been on cypherpunks? Date: Mon, 05 Feb 1996 17:09:17 -0800 From: Jim Ausman <ausman(a)wired.com> Received: (from daemon@localhost) by wired.com (8.7.3/8.7.3) id QAA27559 for pork-list; Mon, 5 Feb 1996 16:13:51 -0800 (PST) Received: from [204.62.132.47] (mckinley.wired.com [204.62.132.47]) by wired.com (8.7.3/8.7.3) with SMTP id QAA27543 for <pork>; Mon, 5 Feb 1996 16:13:43 -0800 (PST) Message-Id: <v0213050bad3c4c88b88d(a)[204.62.132.47]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Mon, 5 Feb 1996 16:14:37 -0800 To: pork(a)wired.com From: kate(a)hotwired.com (Kate McKinley) Subject: CIA and you Sender: owner-pork(a)hotwired.com Precedence: bulk Status: O >Sorry to send this through the "help email address" but I couldn't find >your news email address. >I attended last weeks "Information, National Policies, and International >Infrastructure" Symposium at Harvard Law School, organized by the Global >Information Infrastructure Commission, the Kennedy School and the >Institute for Information Technology Law & Policy of Harvard Law School. >During the presentation by Paul Strassmann, National Defense University >and William Marlow, Science Applications International Corporation, >entitled "Anonymous Remailers as Risk-Free International Infoterrorists" >the questions was raised from audience (Professor Chaarles Nesson, >Harvard LAw School) - in a rather extended debate - whether the CIA and >similar government agencies are involved in running anonymous remailers >as this would be a perfect target to scan possibly illegal messages. >Both presenters explicitly acknowledged that a number of anonymous >remnailers in the US are run by government agencies scanning traffic. >Marlow said that the government runs at least a dozen remailers and that >the most popular remailers in France and Germany are run by the >respective government agencies in these countries. In addition they >mentioned that the NSA has successfully developed systems to break >encrypted messages below 1000 bit of key length and strongly suggested >to use at least 1024 bit keys. They said that they semselves use 1024 >bit keys. >I ask Marlos afterwards if these comments were off or on record, he >paused then said that he can be quoted. >So I thought I pass that on. It seems interesting enough, don't you >think? >Best >Viktor Mayer-Schoenberger >Information Law Project >Austrian Institute for Legal Policy Kate McKinley kate(a)hotwired.com CAVE CANUM \ \ \ \ \ \ \ \ \ | / / / / / / / / / / _______ ________ _____ _____ _____ /// \\\ ||| \\\ /// \\\ |||\\\///||| ||| ~~ ||| /// ||| ||| ||| \\// ||| ||| __ |||~~~\\\ |||~~~||| ||| ~~ ||| \\\ /// ||| \\\ ||| ||| ||| ||| ~~~~~~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~~ / / / / / / / / / | \ \ \ \ \ \ \ \ \ \ C y b e r s p a t i a l R e a l i t y A d v a n c e m e n t M o v e m e n t --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi Yet she became more and more promiscuous as she recalled the days of her youth, when she was a prostitute in Egypt. There she lusted after her lovers, whose genitals were like those of donkeys and whose emissions were like that of horses. So you longed for the lewdness of your youth, when in Egypt your bosom was caressed and your young breasts fondled. Ezekiel 23:19-21 Fight the Communications Decency Act or suffer not being able to transmit the Bible online. http://www.cdt.org/ I like cats, probably more than I should. They are cute, cuddly and kill things and then lay them at my feet in tribute.

1 0