December 2003 - cypherpunks-legacy

Re: A Challenge (perhaps!)
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

Mike McNally writes: > > >I know it doesn't exercise key technology and relies on the secrecy of the > > >algorithm (which from my very limited knowledge on cryptography I think makes > > >it almost doomed from the start (?))... >The way I like to think of such a scheme is to consider the secret >algorithm itself to be the key, .... This seems to me to be a perfectly valid point of view. One absolute requirement of any decent cryptosystem is that weak keys be vanishingly rare. This can be done if almost all keys are strong or if a simple procedure can be found to identify and eliminate weak keys. Another absolute requirement is the ability to change keys. It is also useful to be able to negotiate keys using procedures like Diffie-Helman key exchange. Your suggested viewpoint shows very clearly why systems that depend on secret algorithm are often quite bad. If you have the resources to adequately evaluate an algorithm yourself, (like the NSA does) you might gain some security by keeping your algorithm secret. Even then, you would want a system that allowed you to change effectively. My personal guess is that an algorithm that can generate novel, secure ciphers is beyond the power of any human agency, and will be for a long time. Incidentally, since the "original poster's friend" knows the algorithm, and every person that ever uses this cipher will have a copy of it, why should I trust this cipher? None of the other users know me, so they should never let me hack^h^hve a copy. So, even if they have found a secure system, (which experience says is very doubtful) I couldn't possibly have any interest in it. Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

DEP_tot
by John Young 17 Dec '03

17 Dec '03

2-23-96. TWP: "CIA Defends Rule on Use Of Reporters." In the face of growing criticism from American news organizations, CIA Director John M. Deutch yesterday insisted he would not rule out employing American journalists in secret intelligence operations where American lives are at stake or a weapon of mass destruction might be used. 2-23-96. NYT: "C.I.A. Chief Defends Secrecy, in Spending and Spying, to Senate." The DCI said today that the secret budget for spying might be made public, and he defended a longstanding policy allowing clandestine officers to pose as reporters or to use journalists as informers. Posing as a reporter is an ideal cover for a spy, since both jobs require traveling to out-of-the-way places and prying out secrets. DEP_tot For Deep Throat Scowcroft parallels to the CoFR report on the future of intelligence see the ISD recommendations to the Presidential Commission on intelligence: http://sfswww.georgetown.edu/sfs/programs/isd/files/intell.htm

1 0

REM_ote
by John Young 17 Dec '03

17 Dec '03

2-23-96. WSJ: "H-P Acquires Most of Internet Security Firm." SecureWare technology is used by the Pentagon to safeguard transmission of military secrets. The firm's team of about 40 programmers is "a substantial fraction of the hired guns available in the on-line security world" who snake oil an extra virgin security that not even hackers can cross. Hackers would question that; they have a remarkable history of eventually figuring out ways to get past advances in faked chastity. "Netscape Will Issue Fix for Flaw Found In Browser System." The company confirmed that Princeton researchers found a security flaw in the "applets" created with Java, but said the flaw was minor and that the company will issue a software fix for it next week. Jeff Treuhaft said exploiting the flaw would require extremely skilled hacking. Marianne Mueller, Java security engineer, also said the chances of such hacking occurring are "remote." REM_ote

6 7

Re: Look, a chain letter :-)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:55 AM 2/23/96 -0500, Dr. Dimitri Vulis wrote: >I received a curious mimetic e-mail. The cypherpunks relevance is: will we >or will we not bring down the White House server? :-) This struck me as a mailbomb attack, which I would rather not particpate in. However, I have a letter on the CDA I want to send to the president. It might turn out that it is ready to send on Feb 29. :-) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Ascom Tech License for IDEA
by Mark Aldrich 17 Dec '03

17 Dec '03

The following is a statement from David Barnhart, PGP Product Manager from ViaCrypt, regarding Ascom Tech's position on licensing IDEA: "In the US, ViaCrypt pays the royalties to Ascom for every copy of ViaCrypt PGP shipped. Users of ViaCrypt PGP have nothing to worry about. Personal users of MIT PGP in the US also have nothing to worry about because Ascom's published position deals with 'commercial use'. The only people who need to do anything are people overseas using PGP 2.6i or 2.6ui in their businesses. They need to license IDEA from Ascom." ------------------------------------------------------------------------- |So, I went walking through the street. |Mark Aldrich | |I saw you strung up in a tree. |GRCI INFOSEC Engineering | |A woman knelt there, said to me, |maldrich(a)grci.com | |Hold your tongue, man, hold your tongue. |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

2 1

Re: TIS--Building in Big Brother for a Better Tommorrow
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Feb 23, 1996 00:19:15, '"P.J. Ponder" <ponder(a)wane-leon-mail.scri.fsu.edu>' wrote: > >Steve Walker wrote to John Young: > >(large piece snipped; good stuff though.) > >+ Suppose the U.S. government had never thought of placing >export controls on cryptography... > >We would now have widespread use of encryption, both >domestically and worldwide; we would be in a state of >"Utopia," with widespread availability of cryptography >with unlimited key lengths. But, once in this state, we >will face situations where we need a file that had been >encrypted by an associate who is unavailable (illness, >traffic jam, or change of jobs). We will then realize >that we must have some systematic way to recover our >encrypted information when the keys are unavailable. > The exchange of information among many trusted people all located in the same geographical location (or with regular reliable couriers travelling to different locations) is the ideal situation for *private* not public key crypto. In such circumstances one uses, e.g. IDEA, not PGP. End of corporate problem. End of "worry" about problems with PGP. --tallpaul

1 0

Re: REM_ote
by John Young 17 Dec '03

17 Dec '03

Oops, Jeff, for the fun mirror; gotta watch these pseudo-random walks, what with all the Net security deals favorably affecting more and more c'punks. BTW, the full REM_ote package includes articles by The Wash Post and Fin Times, each of which have slightly different descriptions of your clearly respected, and valuable!, company. And another BTW, I hope you got a respectable slice of the buyout pie. If so, keep in mind as you consider where to dispose of your new hard-earned wealth that I design extra virgin fancy houses to camouflage impenetrable, and not-at-all cheesy, Swiss vaults.

1 0

opps, sorry about that last post
by Ray Cromwell 17 Dec '03

17 Dec '03

I'm not really unsubscribing, I'm moving to a new host. Sorry about the noise. -Ray

1 0

Remailers, Feb
by Bruce Baugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've just finished my monthly round of type I remailer testing. This test doesn't include remailers announced after I started; they'll be inclued next month. (Also coming in March will be tests of at least one other nym server.) As in January, I sent posts from my PPP account here (at Aracnet, this time, rather than Teleport) through a given remailer to an account at alpha.c2.org, then back through the remailer to me. This is, by design, a very different sort of test than remailer pinging and the like; in the number of hops and chances for things to go wrong, I think it reflects actual usage much more closely. Trip time is the interval from being posted to mail.aracnet.com to arriving in my mailbox there. All times are given in hours:minutes. Posts were made at all times of day. Unsurprisingly, those made late at night (particularly in the midnight-to-6 am range) returned most quickly. I've included the January figures for comparison persons. I remain curious about the differences and eager to find an explanation. REMAILER FAILURES AVERAGE MINIMUM MAXIMUM hfinney(a)shell.portal.com February 00 00:45 00:35 01:00 January 00 00:08 00:02 00:38 hal(a)alumni.caltech.edu February 00 00:46 00:35 01:00 January 00 00:09 00:06 00:12 homer(a)rahul.net February 00 00:50 00:37 01:08 January 00 00:06 00:03 00:14 remailer(a)utopia.hacktic.nl February 00 01:10 00:47 02:03 January 00 00:19 00:03 01:20 remailer(a)tjava.com February 00 001:47 00:26 05:26 January not tested mix(a)zifi.genetics.utah.edu February 00 01:56 00:31 03:35 January not tested remailer(a)replay.com February 00 03:00 00:51 07:45 January 01 00:31 00:13 01:14 remailer(a)mockingbird.alias.net February 00 03:29 00:56 06:35 January not tested mixmaster(a)vishnu.alias.net February 00 04:29 00:40 11:27 January 00 00:56 00:23 02:38 mix(a)remail.gondolin.org February 00 06:30 00:40 12:52 January 08 11:37 03:58 18:36 mixmaster(a)remailer.obscura.com February 00 06:53 00:55 13:25 January 00 02:36 00:23 06:55 remailer(a)extropia.wimsey.com February 00 09:15 01:35 23:50 January 08 01:46 01:19 02:13 amnesia(a)chardos.connix.com February 10 January 10 pamphlet(a)idiom.com February 10 January not tested remail(a)c2.org February 10 January 02 00:52 00:14 03:00 remailer(a)bi-node.zerberus.de February 10 January 00 07:43 00:15 19:54 Mailers reported as down with no expectation of returning: hroller(a)c2.org remailer(a)armadillo.com Mailers reported as down with some expectation of returning: remailer(a)valhalla.phoenix.net / wmono(a)spook.alias.net I'd particularly like to thank the remailer operations who (mostly in private mail) answered a number of questions of mine. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMS02wn3AXR8sjiylAQEd/gfMD4FdgFNMh69P6nd4xdcPogD26zMi5RwQ JfraMZqG75ezMq4Z5kr1v5j77vNZZ2Bka5T0mR76TqYSPDzKGturPJNY1bSd7Cbn xUdpee43uo09+QdVpR/IGPKKjxH8qUhJC4X2WvHDlfTdNRCjItIQF2gkBJPRmknJ OCnHku/bMBs7sr+7OsQyMwvfQrkxpu3Wh/LYV/+U0vEWnCzFupOHQ9nnu+JSCaUu naFYlqP6w0Ywl6qeTAvRJPgx+PfVDk4B0WZHnXFi1p9IMDaQ7FysxH1pc2mPkURR M+rwz1ElfCMoMB4JiF5Y3r1aZAf9ES2HLz1sTcueji2S/g== =O4Sc -----END PGP SIGNATURE----- -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

Re: Remailers, Feb
by Bruce Baugh 17 Dec '03

17 Dec '03

At 11:07 PM 2/22/96 -0500, Bryan Strawser <bstrawse(a)copper.ucs.indiana.edu> wrote: >The differences here are because gondolin.org had serious DNS problems >in January that caused alot of mail to be bounced. Those problems were >rectified.. hence our traffic flows now... Thank you, Bryan! This is _precisely_ the kind of info I'm interested in. >The latency differences are normal for gondolin because we are not on the >net, we get our mail via UUCP one hop away from the internet itself. >Since our polling is fairly irregular, our latency will move up and down >from month to month. Makes sense. And I don't particularly care about variability as long as I have a sense of the boundaries. Which my tests define for me. :-) -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0