December 2003 - cypherpunks-legacy

Re: Witch Hunts
by jim bell 17 Dec '03

17 Dec '03

At 08:55 PM 4/1/96 EST, Dr. Dimitri Vulis wrote: >Bruce Zambini <jlasser(a)rwd.goucher.edu> writes: >> On Sun, 31 Mar 1996 JonWienke(a)aol.com wrote: >> > Unicorn = Detweiler = Agent Provocateur >> >> Well, I won't say it's impossible. > >Don't you get the hint -- Unicorn == Sir Lancelot == Lance. Hey, I never thought of that! I guess my knowledge of early English mythology is a bit weak. Jim Bell jimbell(a)pacifier.com

1 0

Pathfinder Survey
by survey＠pathfinder.com 17 Dec '03

17 Dec '03

Dear Pathfinder Member: Will you help us on a very important project? You are one of a representative group of Pathfinder members that we are asking to take part in a special survey. The answers you provide us with will help us make Pathfinder a pleasurable experience for its users. Our survey is available online (you can cut and paste the URL into your browser) at: http://pathfinder.com/poll Please take a few minutes and complete the questionnaire now. Your answers will be treated in the strictest confidence. Since you are part of a small, carefully selected sample, your response is very important to the success of our study. Thank you very much for your help. Sincerely yours, Gina Monaco Market Research Manager

1 0

Majordomo and anon.penet.fi
by Mark M. 17 Dec '03

17 Dec '03

In case anyone is interested, I have written a patch for Majordomo 1.93 that will automatically convert an address of the form "anXXXXX(a)anon.penet.fi" to "naXXXXX(a)anon.penet.fi". I have tested the code I used to patch up Majordomo, but I haven't verified that it actually works within Majordomo. *** majordomo.pl.orig Sat Jan 7 12:34:27 1995 --- majordomo.pl Tue Apr 2 23:24:15 1996 *************** *** 81,86 **** --- 81,91 ---- $ReplyTo = $array{'apparently-from'} unless $ReplyTo; join(", ", &main'ParseAddrs($ReplyTo)) if $ReplyTo; + if ($ReplyTo =~ '^(an).*\(a)anon\.penet\.fi') + { + $anonid = substr($ReplyTo, 2); + $ReplyTo = "na$anonid"; + } $ReplyTo; } -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 "The concept of normalcy is just a conspiracy of the majority" -me

1 0

Re: software with "hooks" for crypto
by Hal 17 Dec '03

17 Dec '03

From: me(a)muddcs.cs.hmc.edu (Michael Elkins) > I've written a Unix e-mail client which contains support for PGP/MIME and > also a front end for mixmaster. Right now I basically reap all the "bad" > code before I distribute it (at _least_ 50% of my testers are outside the > US). However, this has been annoying for those users because they want > to be able to use the PGP support (so do I!). So, what I'm wondering is > what the laws are regarding snail-mailing source code to these people. > The actually pgp/remailer stuff isn't more than a few pages of code, which > could easily be transcribed or scanned in with OCR software. Would I > have to get a "license for export" in order to send the code outside the > US? Let me first point out that this procedure is not as easy as it sounds. Phil Karn has an interesting description of what happened when he actually tried to do this, as part of his suit to try to export the Applied Cryptography source code on disk. It is at <URL: http://www.qualcomm.com/people/pkarn/export/karndecl.html >. This is something that people have talked about for a long time, and it is interesting to see what happened when he tried it: 5. I began by first photocopying, on a standard office photocopier, the 18 pages containing the Triple DES source code listing from Part V of the Book. This took about 5 minutes. Second, I scanned in the 18 sheets on a Macintosh Quadra 610 computer system equipped with an HP ScanJet II flatbed scanner and Omnipage Professional optical character recognition (OCR) software. The computer, scanner, and software are all readily available through normal consumer computer supply channels. The total scanning process took about one and a half hours. About an hour of this time was spent learning to use the scanning system and conducting trial runs, as I had only used it briefly some time ago. The actual scan of the 18 pages took about 15-20 minutes. Third, I transferred the resulting machine-readable file from the Macintosh to my own personal computer and brought it up under GNU EMACS, a popular and widely available text editing program that I have used for many years. In EMACS I compared, by eye, the scanned file displayed on my screen against the printed listing in the Book. I began correcting the scanner's many errors, such as mistaking the digit '0' for the letter 'O' or mistaking the vertical bar '|' for the letter 'I'. 6. After manually correcting those errors noticed through visual comparison with the Book, I invoked the "C" language compiler on the (partially) corrected file. The compiler immediately pointed out additional errors I had overlooked in my visual inspection so I could also correct them by reference to the Book. I also noticed several errors in the listing printed in the Book. However, the programmer's intentions were obvious from the context of each error and were easily fixed. About fifty minutes later, I successfully compiled the file without error. 7. The fourth step was to write a small test program to execute the DES code with the test vectors given at the end of the source code listing. This trivial program took less than 5 minutes to write. Unfortunately, the test did not succeed, meaning that at least one error went undetected by the compiler in either the code as printed in the Book or as scanned. Scrutinizing the code more closely, I quickly found another error in the printed version that was easily corrected. However, it still did not produce correct results. After about an hour of searching, I finally located the error in a list of numbers in a table -- another error in the printed version. By reference to the DES algorithm description in the first part of the Book, which includes the correct numbers in tabular form, I found and corrected the error. 8. At this point the test finally succeeded, so I knew I had a correct program. As you can see, it took a long time. Part of the problem was that the printed copy of the code was apparently simply wrong. Presumably if you printed it this would not be the case. Also, your code is shorter than the 18 pages that Phil had to work with. Still OCR may not be that well adapted to source code. Most texts use ( a lot more than {, and the OCR may not pick out that kind of difference well. I will also note, parenthetically, that it is a credit to Phil that he was obviously being very honest and above-board in describing what he had to go through, possibly to his (and our) own detriment. If the process of turning the book into the floppy were easier and did not appear to require so much expertise, the government's case might have been weakened. Your bigger question is about the legalities of it, and that is harder to answer. There is a continuum of cases. At one end we can say that it is apparently legal to discuss cryptographic algorithms with foreigners. This happens all the time at international conferences. As long as the material isn't classified, you can talk about the technical issues. At the other end, it is at present definitely illegal to export a working cryptographic device. In between there is a gray area. Currently it appears that exporting cryptographic source code in machine readable form on magnetic media is illegal, at least pending some resolution of the Karn suit. Probably exporting it in other ways, such as by email, would be treated the same. My guess is that exporting in machine readable form on paper, such as by a bar code, would also be equivalent. There is a little more effort involved in scanning it in, but if the bar code has good redundancy and is reliable, it is not much more. The next step is printed source code. There are fonts (or other tricks, such as per-line checksums) which can be used to make scanning this in relatively reliable. I don't have enough experience to know how good it can get. But let's suppose it were practically error-free. By the reasoning above, this would also be restricted. OCR'ing the text, if it can really be done mechanically and automatically (which is clearly not the case with the technology that Phil Karn had access to) is not much different from getting it on a floppy. Yet we know that at least in the case of Applied Cryptography the book, export permission was granted. So at least in some cases, printed source code can be exported. I understand that the PGP source code book is in an OCR friendly font. It would be interesting to hear whether Phil's experience above is actually made easier with the PGP source code book. I think the bottom line is that the government will restrict any method which makes it significantly easier for a foreigner to get working source code than by typing it in from a book by hand. (BTW, Phil's lawyer did have two secretaries do that. It took under 3 hours, although presumably the code was subject to some of two same printing errors that Phil had to fix in his test.) So my guess is that technically you could get in trouble by doing what you propose. I'm not a lawyer though - Hal

1 0

Re: Chaumian ecash without RSA
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>> 2: Nobody except the bank can verify that a coin has face validity. At 04:55 PM 4/2/96 +0100, D.A. Wagner wrote: > I claim that statement 2 is also true of Digicash's protocol as well. > > Recall that Digicash is using an *online clearing* protocol-- so you > can't tell whether a coin is valid without consulting the bank. > Consulting the bank is absolutely necessary to prevent double spending. Suppose Alice generates an unsigned coin, blinds it, and shows Bob the usigned, blinded coin. Bob then has the bank sign it, and gives the signature to Alice. If we use RSA to sign the coin, Alice now knows she has a valid coin, because she can verify the coin herself without needing to show it to the bank. So Bob has paid Alice some money, and nobody can double spend the coin, because Alice, and only Alice, knows the blinding factor. So Alice does *not* need to check with the bank. Alice cannot do this with your protocol, so we cannot have payee anonymity with your protocol. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: software with "hooks" for crypto
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 02:31 PM 4/2/96 -0800, Michael Elkins wrote: >Hello all, > >I'm trying to figure out exactly what the laws are regarding the export of >software which contains "hooks" for PGP. In various forms, I've heard >that it's not the ITAR which prevents this, but more a "suggestion" by >the NSA that we "shouldn't do it." Does anyone have any pointers to >real legislation/laws regarding this? Evidently you are under the impression that we are still governed in accordance with the rule of law. Since the legislation in question was intended to prohibit gun running, it naturally contains no such thing. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Article on PGP Viacrypt
by walter＠cithe302.cithep.caltech.edu 17 Dec '03

17 Dec '03

Hi Folks, There is an interesting article by Simon Garfinkle in this morning's(Apr 2nd) electronic version of the San Jose Mercury news. Its on the index page so I don't think you need an account to read it. The article deals with the new key management features and extensions in Viacrypt and how PRZ is upset since it allows employers to read their employees messages. The URL is: http://www.sjmercury.com/business/priv401.htm -Chris walter(a)cithe501.cithep.caltech.edu

2 1

Re: Elementrix Technology Announces Power Quantum Cryptography
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:58 AM 4/1/96 -0800, sales(a)elementrix.co.il wrote: >By using a novel method (covered by trade secret law and now patent-pending >in 26 countries) our server software transmits packets onto your local >network without reading them, thus preserving their unique quantum >properties. Any attempt to read the packet, except by the intended >recipient will destroy the quantum waveform of the packet. Our >sophisticated error-recovery system will detect this and re-initialize >with a predefined Emergency Quantum State, which has all the same >characteristics as the Normal Quantum State, but has not been compromised >by the attempted eavesdropper. Unfortunately, the method can be cracked easily. Because the system uses two patented states, a Normal Quantum State and an Emergency Quantum State, and it's patent-pending in 26 different countries, you can divide the 26 patent-pending states by the two patented states giving a pending 13. By rotating the 13 twice, of course, the original text can be recovered. However, the method is partially useful, using a lemma by Dr. Denning. While 26 is divisible by 2, it's not divisible by 3, so the addition of a third state renders it effective again. Denning's paper recommends use of a National Security State as the additional state, which provides effective protection, additional security and supports the legitimate needs of law enforcement. So if you want your crypto to be secure, it's an offer you can't refuse... Another approach has been suggested by the Syndicate for Quantum Deconstruction, in their prescient 1998 paper "Smash the State". By deconstructing the quantum packet on arrival, an imbalance is created which can only be resolved by constructing the packet an equal time period before the origination of the packet in the Normal Quantum State. In addition to preventing the emergence of the Emergency Quantum State, it allows, and in fact requires, the packet to be present and read some time before its original transmission time. Copies of the paper are currently circulating only as preprints; the original will be posted on http://www.timenet.net/1998/Physics/~SQuD/Deconstruct.vrml as soon as it becomes available. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 1995: Chat rooms, espresso, and Linux 1996: Exon, melatonin, and Java.

1 0

Re: Why Americans feel no compulsion ...
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:41 PM 4/2/96 -0500, Rabid Wombat wrote: >Yeah, and some americans speak C, and FORTRAN, and FORTH, and ... This discussion is about languages for communications between _humans_ - like ALGOL, and the lambda calculus :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 1995: Chat rooms, espresso, and Linux 1996: Exon, melatonin, and Java.

1 0

Re: (fwd) Russians Break RSA?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:52 PM 4/2/96, Chris Stillson wrote: >at Kryptogorodok, the secret city of Soviet cryptographers >>hidden in the Urals (and first visited by an outsider, Stephen >>Wolfram, only a couple of years ago). >> > > >Nice touch. I worked at Wolfram Research a few years ago, and wolfram >actually was in Russia for a tour. > And based on an actual happening. Wolfram reasoned that the Soviets must've had a "secret city of cryptographers," as they had secret cities for several other kinds of military scientists (rockets, atomic energy, CBW, metallurgy, etc.). He speculated that the U.S. should locate this city and see if the residents needed jobs. And of course several people have speculated that if the "P ?=? NP" ball of wax has been solved by anyone, in secret, the Russians are a good bet, given their strong skills in pure mathematics. (And my choice of Kolmogorov was not just a name made up...) I first floated this April Fool's Day joke two years ago...I figured enough time had passed and enough newcomers had subscribed to make it worth posting again. Wolfram actually saw the copy two years ago and liked it. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0