December 2003 - cypherpunks-legacy

Re: Duress
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:49 PM 03/3/96 EST, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >"A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> writes: >> Those of you who follow FIREWALLS may recall that I premote the use of >> "minefields" on networks, machines that should never be accessed and will >> trigger an alarm/response on any access. >> >> Some years ago I wrote a spec for cryptographic securing of notebooks/ >> E-Mail that included a "duress" capability: a "password" that, when >> entered would appear to be properly accepted but would report an error >> on retrieval. Optional was to be overwriting of any material whose access >> was attempted. > >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. > Many (if not most) alarm companies make the duress code the *reverse* of the normal code. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTlEzsVrTvyYOzAZAQG9sAQAjfAQP6pEReh/vzx/dsJKU987FOMbqWgV Ik/NtzW7fRRzVYmruribT1ZtPQAcPTkdORZC22xHvk82E/m9Awv9q6Zhkbd29/TQ kcLQ42G3ddcUMA7EWtWtP231tofnyQtM5M7KRdIkKyT7oZdyXgjP42mysjGNDHAy wv2VcfiPwPQ= =fc6C -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

2 1

Re: NYT login
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just Rich wrote: > > Rumour has it that there might be a cpunks/cpunks (cypherpunks was taken). This brings up an interesting prtoblem which I have been trying to solve. How can we fund content providers on the Web while not compromising privacy? Early on I targeted political and governmental sites as likely users of the Web. This also reflected a personal belief that I have in open government. What I did not anticipate was the speed with which the mainstream press started appearing on the Web. In part this was due to the Whitehouse server which has legitimized the Web in many corporated boardrooms. There is a problem though, nobody has a fully convincing revenue model yet. This will have to chage if sites like the NYT are going to stay online. Ideally I would like these sites to be free to the readers because it helps break down international chauvnism and petty minded nationalism. I believe that the significant number of trans-national relationships forged over the internet have lead to a significant shift in support for French Nuclear testing for example. Ten years ago many French supported terrorism such as the sinking of the Rainbow warrior in persuit of this policy, this time round there has been much less support for the government posistion. The challenge therefore is to find a means by which NYT etc can pay their staffs. Advertising is an obvious mechanism but here there is a problem. Advertisers need to know what they are receiving by way of value for money. Don't believe the stories of $50K per month advertising charges, many of these prices are very heavily discounted. $50K is what advertisers are willing to pay once they know for sure the Web works for them. If we apply traditional advertising logic it would be necessary to use very intrusive methods to discover how effective the Web is. This is not necessarily the case on the Web since it is an interactive medium. As Jock Gill pointed out at a recent conference we organised, instead of targetting customers the Web permits a participatory process which may be far more profitable for big name brands, allowing them to establish the high value long term relationships they really want. So the question is how can we square the circle? I have no problem telling the NYT's advertisers that NYT have a reader who is in the high tech goodies purchasingcategory. I have a serious problem allowing the government to know that I read the NYT, remember that in many countries that could lead to getting you arrested. I also think we need to be cautious about comapnies collecting similar information. Imagine for a moment that the US elected a fascist president opposed to "left wing intellectuals". It would be a bad thing if he could obtain a list of likely left wing intellectuals compiled from readership of various magazines, visiting of left wing Web sites etc. This is a live issue in Holland where no phone records are kept because stored records were used by the NAZIs when they were invaded to find out who was talking to whom. Some Ideas I had: 1) An anonymous session identifier generated by the browser constructed in a cryptographically secure manner so as to prevent linkage across sites. This would allow NYTs to find out that a reader had moved from the sports section to the politics section within the site but not to track them from the NYT to Time Warner. 2) A privacy code of conduct. Sites adhering to this code would be alowed to display a trademarked icon on their pages. This code would cover items such as not selling log files not maintaining online records of identity. There are many people who are willing to put in the effort to make the Web a place where people can interact in privacy. I know very senior people in very large companies who are as concerned as many cypherpunks on this issue. The point is that we need to come up with a scheme which addresses their legitimate business needs and protects privacy. Otherwise the market will decide and it does not care much about privacy. I have written up some working drafts. You can get them from the IETF in ascii text or via the web as W3c working drafts http://w3.org/ Phill Hallam-Baker - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMToQuyoZzwIn1bdtAQFSZgGAwMeBfDr4g3yBclG08m6f8K2Ml1Gv07i1 L5wybpz4/8o4Gy7/P3UUP+82IcEpgGrl =hUU/ -----END PGP SIGNATURE-----

4 3

Re: A brief comparison of email encryption protocols
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:01 AM 2/29/96 -0800, Laurence Lundblade <lgl(a)qualcomm.com> wrote: .....CME wrote.... >>Like X.509, my certs have an Issuing-name and a Subject-name -- but >>they're both cryptographic hashes of public keys. You can take a portion >>of those hashes [e.g., low order 12 bits] and use it to index a hash table >>of certificates or keys. The cert is more general than X.509 -- that is, ...... >Isn't using a hash as the identifier replicating the key distribution >problem that PGP has or are you including some other data that can be used >to look up the cert? I think a problem occurs when you have 20 billion of >these certs (two for every person in the year 2010 or such). A simple hash >into a table isn't going to cut it because you a single database (with >replication?) isn't going to be possible. Some hierarchical lookup like >DNS is going to be needed. The look ups are needed to check for revocation. There's a name collision on the word "hash" here. Carl was using both hashes in the same sentence. A "cryptographic hash" is a strongly one-way mapping from an input string (in this case a public key) to a number. A hash table is a data structure that uses a mapping from an input string to a number to decide where to put things. An MD5 cryptographic hash function used on PGP public keys (e.g. to get the fingerprint) is 64 bits long, so there may be a few collisions if there are 2**34 keys out there; if things scale to that point, PGP 4.1.3 need to use SHA for fingerprints instead (or in addition). Carl is proposing using a hash table (indexed by a hash-table hash of the cryptographic hash) to store public keys; that's a separate problem, though of course if you want to store 20 billion keys in one place, there are better data structures than simple hash tables. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Netcom and Credit Cards
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: > > The "credit card numbers were stolen" point, that I believe Ed Carp was > > referring to, had to do with the Mitnick affair, and is very old news. > > The fact that they had been stolen was mentioned in an edition of 2600 > 6 months before the Mitnick saga. Netcom had been told about the > security breaches many times, but refused to acknowledge that their > site was insecure. It was this arrogance that pissed people off > more than their insecurity. As someone who was involved in the recent iKP / SEPP /STT / --> SET event I would like to point out that it was the storage of CC numbers in databases connected to the Internet which was the primary concern of credit card companies. Sending credit card numbers across the internet in the clear was to an extent a side issue. Clearly if the merchant was nopt going to be able to store the number the number would have to not be received in cleartext by the merchant. Phill - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMToR2yoZzwIn1bdtAQEBDAF+Mgb3VluBwhqkjIgPCJ5YurkDWWm9MRwg RJoqXdalTBmM20ldY5qddiuTGoxni4ac =9L/X -----END PGP SIGNATURE-----

1 0

Request Comments: Transpose/XOR Hash
by Olcay Cirit 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi! I'm working on a cipher that utilizes Cipher Block Chaining and One-way hashing to create a sequence of pseudo-random numbers to XOR against a plaintext. I'd like to know if anyone has comments regarding the hash method I came up with. It is a combination of Transposition and XORing. Basically, it works like this: Let's say K is the 8 character key that will be hashed. There are two binary accumulators M and L, which store the Most and Least significant bits in each byte of K. After M and L are both 8 bits long, they are XORed together and the resulting value replaces byte N in the Key. This is repeated 8 times, and each time, N is incremented by one. Any thoughts, comments? -olcay - -- "For he who lives more lives than one, |) Olcay Cirit -- olcay(a)libtech.com more deaths than one must die" (| http://www.libtech.com/olo2.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTpumyoZzwIn1bdtAQHnqAGA2CzuLVpiPdRQ84MuC8aBxy7vcIZsujLr 85hGcVoknfAujjXFoy7KOxGQrZt3RorK =jQ7w -----END PGP SIGNATURE-----

2 1

(Fwd) Gov't run anon servers
by James Caldwell 17 Dec '03

17 Dec '03

This states that some anonymous remailers are run by various gov't and that encryption keys up to 1000 bits are crackable. Whether this is true or disinformation, you are using a 1024 bit key and all your messages through anonymous remailers are encrypted aren't they? Also note that while later versions of PGP are capable of larger keys, that these versions of PGP are not known to be secure. PGP 2.3a is the last version released prior to gov't interference. PGP 2.3a will do 1264 bit keys if you enter 1264 in the box instead of the number it askes for when if asks for the type of key security you want. ------- Forwarded Message Follows ------- alt.privacy.anon-server,alt.anonymous.messages,alt.anonymous, talk.politics.crypto,alt.politics.org.covert,alt.politics.org.nsa,alt.politics.datahighway, alt.culture.internet,alt.culture.usenet,alt.cyberspace,alt.conspiracy From: an366601(a)anon.penet.fi (** CRAM **) Date: Sun, 3 Mar 1996 13:15:55 UTC Subject: Strassman & Marlow comment on NSA/remailers Forwarded message: >From ausman(a)wired.com Tue Feb 6 01:42:13 1996 Message-Id: <199602060109.RAA09056(a)wired.com> To: sameer(a)CSUA.Berkeley.EDU Subject: has this been on cypherpunks? Date: Mon, 05 Feb 1996 17:09:17 -0800 From: Jim Ausman <ausman(a)wired.com> Received: (from daemon@localhost) by wired.com (8.7.3/8.7.3) id QAA27559 for pork-list; Mon, 5 Feb 1996 16:13:51 -0800 (PST) Received: from [204.62.132.47] (mckinley.wired.com [204.62.132.47]) by wired.com (8.7.3/8.7.3) with SMTP id QAA27543 for <pork>; Mon, 5 Feb 1996 16:13:43 -0800 (PST) Message-Id: <v0213050bad3c4c88b88d(a)[204.62.132.47]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Mon, 5 Feb 1996 16:14:37 -0800 To: pork(a)wired.com From: kate(a)hotwired.com (Kate McKinley) Subject: CIA and you Sender: owner-pork(a)hotwired.com Precedence: bulk Status: O >Sorry to send this through the "help email address" but I couldn't find >your news email address. >I attended last weeks "Information, National Policies, and International >Infrastructure" Symposium at Harvard Law School, organized by the Global >Information Infrastructure Commission, the Kennedy School and the >Institute for Information Technology Law & Policy of Harvard Law School. >During the presentation by Paul Strassmann, National Defense University >and William Marlow, Science Applications International Corporation, >entitled "Anonymous Remailers as Risk-Free International Infoterrorists" >the questions was raised from audience (Professor Chaarles Nesson, >Harvard LAw School) - in a rather extended debate - whether the CIA and >similar government agencies are involved in running anonymous remailers >as this would be a perfect target to scan possibly illegal messages. >Both presenters explicitly acknowledged that a number of anonymous >remnailers in the US are run by government agencies scanning traffic. >Marlow said that the government runs at least a dozen remailers and that >the most popular remailers in France and Germany are run by the >respective government agencies in these countries. In addition they >mentioned that the NSA has successfully developed systems to break >encrypted messages below 1000 bit of key length and strongly suggested >to use at least 1024 bit keys. They said that they semselves use 1024 >bit keys. >I ask Marlos afterwards if these comments were off or on record, he >paused then said that he can be quoted. >So I thought I pass that on. It seems interesting enough, don't you >think? >Best >Viktor Mayer-Schoenberger >Information Law Project >Austrian Institute for Legal Policy Kate McKinley kate(a)hotwired.com CAVE CANUM \ \ \ \ \ \ \ \ \ | / / / / / / / / / / _______ ________ _____ _____ _____ /// \\\ ||| \\\ /// \\\ |||\\\///||| ||| ~~ ||| /// ||| ||| ||| \\// ||| ||| __ |||~~~\\\ |||~~~||| ||| ~~ ||| \\\ /// ||| \\\ ||| ||| ||| ||| ~~~~~~~ ~~~ ~~~ ~~~ ~~~ ~~~ ~~~ / / / / / / / / / | \ \ \ \ \ \ \ \ \ \ C y b e r s p a t i a l R e a l i t y A d v a n c e m e n t M o v e m e n t --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi Yet she became more and more promiscuous as she recalled the days of her youth, when she was a prostitute in Egypt. There she lusted after her lovers, whose genitals were like those of donkeys and whose emissions were like that of horses. So you longed for the lewdness of your youth, when in Egypt your bosom was caressed and your young breasts fondled. Ezekiel 23:19-21 Fight the Communications Decency Act or suffer not being able to transmit the Bible online. http://www.cdt.org/ I like cats, probably more than I should. They are cute, cuddly and kill things and then lay them at my feet in tribute.

1 0

Any Ideas??
by electro 17 Dec '03

17 Dec '03

Hello im new to this mailing list and I have seen alot of talk about re-mailers. I run my schools netconnection (it was just a Win 3.11 Computer before i got there) And I have installed Linux 1.2.8 (Slackware 2.3) (T-1 Connect!!!) I want to setup as mutch anonmized stuff (It whould all be free) that I can find. I have wrote shell scripts that let you ftp stuff and then download it by zmodem. But i havent benable to find WWW Baised Remailer Software or The software that anon.pennet.fi uses (not sure the name for it) If you have any ideas, or Places where I can find this software. Please e-mail me

1 0

Leslie Fish address?
by mlove＠olywa.net 17 Dec '03

17 Dec '03

Do you know of an e-mail address for Leslie Fish? m

2 1

Re: Duress
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:49 PM 3/3/96 -0500, Dr. Dimitri Vulis wrote: >As a side remark, every burglar alarm connected to a phone that I've ever seen >has this feature: a code that one can type under duress that will both turn >off the alarm and call for help. I wonder how many users will remember this >code when under duress. The air-transport system has had a Hijack transponder code for years. The pilot dials it into the air traffic system radar transponder when the plane is hijacked. However there is a problem. One of the private pilot magazines reported that a small plane operator used the code (because his airplane was, in fact, being hijacked). When he landed the airplane, it was surrounded by LEA, and in the ensuing gun battle, everyone on the airplane died. The went on to say that the safety of the passengers and airplane are the pilot's primary responsibility and that pilots should consider this incident when deciding to use the code. Duress codes need to be designed to minimized the chance of such responses when they are used. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

4 4

Re: Crypto Export Legislation?
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I took a look at the text of the bill. There was a line in it making it a crime to use crypto in a way that obstructs a federal investigation. While understandable, this is too vague... it could easily be interpreted (IMO) as any strong crypto without escrow of some kind. Anyone else feel this way about that line in the bill? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTorUyoZzwIn1bdtAQEWJgGA1KdA1HtbX9L0U22rBLKFouIQHQniAdA3 lvimml/i+Z/KmYSmHGqkGBwCb1hAfSxc =E2ZA -----END PGP SIGNATURE-----

1 0