December 2003 - cypherpunks-legacy

shellback.com remailer PGP test
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've gotten PGP functionality added (I *think*!) to the RemailerBot software, and would like to ask folks to send a PGP-encrypted message or two to remailer(a)shellback.com Here's the public key for it... - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzE0kfEAAAEEALf5sIOqMfEAFi3geJ6aofyaCRy1ZJt8D91QBqPPeU1X3ond BoIcEcfaMf7s3cOBaiEl7rKFMYqEpL08G7FFelQxc1WRvsR5XtTN+xFB3j0RPNON vMxju5j6anjPVb2RMnowSYqNKUWIEYd4Soa7L+ZWpaHgLSGkhb6Ex2tu6LdpAAUR tCFSZW1haWxlciA8cmVtYWlsZXJAc2hlbGxiYWNrLmNvbT6JAJUDBRAxNJK/xWtO /Jg7MBkBAfiVBACk6dDtebwemmY2+nxK+WD46a0Uj/lwpXLGzJvixdYGo4mwYG2/ LUw/23xBNxLIvPCFR8Qvt9zguyPdMWAp07I64ZlL6yv9Co3DETtTLB8wBdPce6Wx CLswIWAQ3MSLOmgVB35TzOYrYf5RzYtNKktCl3YDa9mxV4sug9xAx5uxvw== =9EvL - -----END PGP PUBLIC KEY BLOCK----- Many thanks..... Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVbN2MVrTvyYOzAZAQHi6QP+L+weAV1HrfNRNYgBjbcsSpcFpxa2yXoY hXvzgooGJHFNT3CfqaDt68InoF58Y4CrMTpsg7YgL5SqKTLqm9gqNk5bT9krN+K8 KonCbd4uH4MVo2HQOhQdCMTyoVu6oCXVbBWO8Q3ltl5q+o4rxgG5BDs0IBrGWd8J yIdjYPNjPVo= =dbJR -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: CDA Court Challenge: Day #2 (fwd)
by Vincent Cate 17 Dec '03

17 Dec '03

Declan: > I suggested to our attorney, Chris Hansen from the ACLU, that he > clarify what percentage of newsgroups were moderated. On redirect, > Hansen posed that question to Donna Hoffman of Vanderbilt University. > She replied that most newsgroups are unmoderated. Later, Bradner of > Harvard University added that moderated newsgroups amount to less > than 10 percent of the total. Another point is that the readers decide which moderated groups and mailing lists they like. If a moderator is no good people read other groups. A good question might be "Is it the free market, or a government commission, or Internet authority, that determines who gets to be a moderator?" And then maybe, "Could anyone just make a newsgroup or mailing list and be a moderator?" And maybe, "In the future when it is easier to pay for information on the Internet, is it reasonable to expect the amount of effort that goes into editing and moderating to increase?" The key point that the free market provides editing when needed. The several companies that provide browsers that censor things for kids is the free market "supply" to the "demand" of parents not wanting their kids to see things. If the government really just must get involved, it could subsidize these companies or this type of product. :-) - Vince vince(a)offshore.com.ai PS Some of us even go through the trouble to write a check and mail it in order to get an edited version of cypherpunks called cp-lite. :-)

1 0

DESCRIBE
by suyama＠open.tjsys.co.jp 17 Dec '03

17 Dec '03

undescribe cypherpunks(a)toad.com suyama(a)open.tjsys.co.jp --- $@"!(B $@ElpJs%7%9%F%`!J3t!K%*!<%W%s%7%9%F%`K\It(B $@"!(B $@%*!<%W%s%M%C%H;v6HIt(B $@%*!<%W%s%M%C%H;Y1g5;=QIt(B $@"!(B $@"!(B $@?\;3(B $@IRCK(B $@!J(BE-Mail:suyama@open.tjsys.co.jp$@!K(B $@"!(B $@"!(B TEL 044-246-8477 FAX 044-246-8134

1 0

Why and how people work for free on "challenges"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:56 AM 3/25/96, Black Unicorn wrote: >I think, should you have the right attitude, many people here will be >happy to review your source code, given some pre-conditions. Mr. May >summed these up quite well only days ago in the IDG (or whatever) >snakeoil thread. I would suggest you take a gander at his post on the >subject. Briefly, (and I hope I'm not butchering his points to >bitterly), he indicated that unless you had hit on most of the basic >source material to begin with (applied cryptography for example), and >really knew a bit about the subject, most people wouldn't much care to >pay attention to you. > >I think, however, that if you know your stuff, and you release the source >code to the list, many people here will be open minded enough to take a >good look, give you some pointers, perhaps even improve your work. While I'm certainly no expert in cryptanalysis, the situation with "Can you break this?" challenges is a special case--and an important one--of challenges in general. To cut to the chase, why do challenges work at all? And under what circumstances? A challenge that grabs the attention of key people can result in vastly more effort being put into a task than could be effectively marshalled almost any other way. An example will make this clearer: human-powered flight. A challenge prize was offered for the first human-powered flight around some particular set of pylons...I don't recall the details, but it was heavily publicized some years back. Vast amounts of effort were put into this. Flight, like cryptanalysis, has long been a fairly ideal area for such challenges. But, like crypto, there are some things that work for such challenges (and some things that don't). * the challenge should come from a reputable group or individual (casual challenges of the "I dare you" sort thus get winnowed out) * the challenge should involve something "interesting"....first solo flight across the Atlantic, first human-powered flight, etc. * the challenge needs to come at the right time. There would be little interest, for example, in a challenge about the first fusion-powered flight (excluding solar-powered, which was a challenge). There is, for example, likely to be little or no interest if I pose this challenge: "I challenge any of you to fly from San Francisco to Canberra to Taipei and back to San Francisco without once saying a single word." The challenge needs to arouse wide interest. In crypto, there have been _many_ challenges which basically meet the sorts of criteria I listed. Ralph Merkle offered a prize for anyone who could break the knapsack algorithm (iterated, or somesuch...cf. Schneier etc. for details). This was already an important issue, so the challenge was taken seriously. Shamir ultimately claimed the prize. Later prizes followed a similar trend. And there were challenges by Rivest, involving RSA, which an MIT team ultimately broke (RSA-129). Our own Derek Atkins was involved (and he may be able to say more about why RSA challenges are more interesting to students and faculty than are mere "Here's my new cipher" challenges. And the CIA even has a challenge involving a statue or seal outside its Langley headquarters building. Not to mention the Beale Cipher. So, a reasonable challenge will likely generate a lot of free effort. Even a $1000 prize, if combined with other factors, will draw attention. The prize itself is not important; it is the defining of precise conditions for success that is important and interesting. The recent "I challenge Cypherpunks to break our unbreakable system" challenge from Snake Oil Associates failed on several grounds. There was no real evidence the algorithm was "interesting," there was no evidence the folks at SOA were competent and worth going up against, the conditions of the challenge were suspect, and there was no substantive prize making effort potentially rewarding. (The offered to sell the company for $1 to whomever broke their system, but now seem to have reneged, predictably enough.) Even so, a couple of Cypherpunks analyzed their system (parts of which were secret, usually another killer for effective challenges!). In less than a day, a crack was reported. (The motive here was yet another one, not listed above. Namely, the desire to go "gunning" for the incompetent newbies and cretins.) So, well-planned challenges can be effective. Naive and puerile challenges of the sort "I dare you to break this! I double-dog dare you to!" are rarely treated seriously. Not too surprising. Bayesian statistics says that someone we've never heard from before is unlikely to be producing a new cipher which is interesing enough to try to break. A new cipher from Rivest or the like would of course be somewhat more likely to be analyzed (though even these ciphers are rarely analyzed directly). >Take a look at Mr. May's cyphermonicon, (anyone have the URL/FTP handy >for our new friend?) The URL I like is http://www.oberlin.edu/~brchkind/cyphernomicon/. Though, as I have noted in other threads, I have very little if anything on "cryptanalysis" per se. Modern ciphers are just not very amenable to attacks via conventional cryptanalysis. (And symmetric-key ciphers are really, really old news.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: RISKS: Princeton discovers another Netscape security flaw
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

ses @ tipper.oit.unc.edu (Simon Spero wrote: >A pound to a bucket of ferrets this is another visit from our good friends >Capt. Overrun and the static buffers, in which case it's more an indictment >of C So? I agree that it's essentially impossible to write reliable code in C, just as in assembly language. Actually, it's easier in assembly language because then you KNOW you have to do all the work yourself, while C misleads you into thinking it does some of the work for you when in fact it does not. That doesn't affect the point at all, though. The job of doing something like what Java claims to do correctly is basically equivalent to the job of creating an A2 grade operating system. (Don't bother looking for any, as far as I know the designation A2 doesn't even exist anymore because it is still beyond the state of the art. It means "verified implementation", i.e., the implementation -- not just the design as in in A1 -- is provably correct. Note that a strict interpretation of this would involve holding not just the code itself but also the tools that act on it -- like compilers, and microcode in machines that have it -- to A2 standards. If you wonder why, consider the famous Unix login hack from many years ago that involved a hack in the C compiler.) paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "The only purpose for which power can be rightfully exercised over ! any member of a civilized community, against his will, is to prevent ! harm to others. His own good, either physical or moral, is not ! a sufficient warrant." -- John Stuart Mill, "On Liberty" 1859

3 2

signing && emacs?
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Has anyone considered adding a PGP signature to emacs local ``eval'' or hook variables? It'd sure be nice to have Emacs just load up a file without asking me if I trust the author. -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software | Crynwr Software sells packet driver support | PGP ok 11 Grant St. | +1 315 268 1925 voice | If you would seek peace, Potsdam, NY 13676 | +1 315 268 9201 FAX | first seek freedom

1 0

RE: ITAR double standards?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:54 AM 3/26/96, blanc wrote: >From: Timothy C. May > >>You're a felon? For real? >> > >Yes. >................................................................. > >Ah, yes - Tim the Indecent, vis-a-vis X-onomous signatures. >Sheut. I thought maybe you'd done something really interesting. > Oh, I may have done some pretty juicy things that are felonies in some states (maybe even states I was living in at the time)...plus I know a whole lot of folks who feloniously violate our nation's "dietary laws" nearly every day (eating the wrong things seems to be the common denominator). Similarly, various popular sexual practices--even some mentioned favorably in the Bible--are felonies in many U.S. states. I've kept the CP list copied on my replies to Blanc because it makes a larger point: every time the nation felonizes a new set of common behaviors, it risks making more and more people felons and thus reduces respect for the law (the real law, about real crimes). This happened during Prohibition (for you foreigners, this was America's experiment with outlawing alcohol consumption), when the law was flouted by even cops and elected officials (in "speakeasies") and when the La Cosa Nostra really got its big boost. Not being one who worries about his standing amongst "the neighbors," I casually mentioned to one of them that I doubted I'd have to serve on jury duty, due to being a felon. He looked appropriately surprised; I haven't bothered to tell him that while I'm indeed a felon under the Communications Decency Act (Fuck Exon), I haven't yet been charged nor have I been convicted. (One is a felon when one has committed a felony....look it up. One is a _convicted_ felon when one has been convicted. But the felony has still happened.) The dictionary doesn't make it clear what happens to the status of a felony when the law is changed and the act is no longer a felony. (If the CDA is overturned, then I guess my actions in saying "Fuck Exon" will no longer be felonies. But as it stands now, they are indeed felony vioations of the CDA. Hence, I am a felon.) --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

1 0

Re: LIST OF SHAME VOLUNTEERS
by jim bell 17 Dec '03

17 Dec '03

At 01:22 AM 3/25/96 -0500, Declan B. McCullagh wrote: >E. Clark writes: >> I neither like nor trust the bill and, after the Digital Telephony >> Bill and its manner of passage, my trust in the good senator is zero. > >I spoke to a couple folks about this at the CDA hearings in Philadelphia >last week. Word on the streets from those who would know is that the >Leahy Bill has NOT A CHANCE IN HELL of passing, and so is worth >supporting to raise awareness of crypto. This is a dangerous position to take. Many people have killed themselves, accidentally, thinking "the gun isn't loaded!" This said, I see nothing wrong with fixing and improving the bill and only then supporting it. >After DT and Clipper, it's our chance to put Clinton and the DoJ on the >defensive for a change. If the Leahy bill "has not a chance in hell" of passing, then what's wrong with CORRECTING it. Given this assessment,I doubt whether such changes would reduce its chances. BTW, remember that one of the reasons its chances are rated as "not a chance in hell" is that the two constituencies who might normally support this bill, the crypto/software businesses and ourselves, see its promises as being weak and its negatives as being large. Without them, who else is there to support it? Jim Bell jimbell(a)pacifier.com

2 1

signature appl tested by IRS / PR today
by CA20007＠aol.com 17 Dec '03

17 Dec '03

Today, on Monday, March 25th, in New York, a British company, Peripheral Vision Ltd., is demonstrating their technology for recording signatures electronically. The company is also launching a subsidiary called PenOp Inc. today. Their product is a plug-in for Netscape. users use a wacom board or its equivalent for writing actual signatures. IRS is testing the system for verifying signatures at a number of test sites.

4 3

Phil Zimmermann Interview online...
by RUSSELLDH＠aol.com 17 Dec '03

17 Dec '03

I don't recall seeing this previously on the list. The interview itself is pretty lightweight - intended for a rather broad audience - but it's the sort of thing we could use more of (that is, good positive pro-crypto publicity). original message goes here ---> Hi! On February 2nd, 1996 I interviewed Phil Zimmermann and have transcribed that interview and placed it on the Web. It is located at: http://www.animatedsoftware.com/hightech/philspgp.htm I hope you find it interesting. If you would like to add a link to it please let us know. By the way, I enjoyed visiting your home page, where I got your email address. Thanks, Russell Hoffman http://www.animatedsoftware.com --- David Smith, Intellecutal Terrorist http://www.midwest.net/scribers/dsmith/

1 0