December 2003 - cypherpunks-legacy

Re: Stego - images and sounds
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sasha1(a)netcom.com" "Alexander 'Sasha' Chislenko" 9-MAR-1996 22:59:54.01 >At 12:19 PM 3/8/96 -0800, Jim McCoy <mccoy(a)communities.com> wrote: >> >>Provided the bits are random in the way that they should be... The low-order >>bits in such files were chosen by implementors of stego programs because >>modification would not be noticed by the person viewing or listening to >>the file, not necessarily because there was actually randomness at this >>level which could be replaced. Does anyone know of a survey of images or >>sound files which tested the statistical randomness of these bits? They >>may not be as random as people think they are. >> > This should depend on how the image/sound was obtained, though I am pretty >sure in most cases there would be easily detectable patterns. They would >be the strongest in software-generated files, smaller in good reproductions >of precise recordings, and very small in noisy recordings. In all cases, >the number of lower bits used for stego-messages may be chosen lower than >the existing noise of the signal. Changing all lower bits in a good >rendered image may still be unnoticeable for the human viewer, but really >easy to detect to a program. Unless the picture, sound, whatever has a periodic function, the LSB ought to have an approximately random distribution (barring all 0's and all 1's, for full color saturation). The periodic function part could be a problem. -Allen

1 0

The Future of Electronic Commerce
by John Young 17 Dec '03

17 Dec '03

"The Future of Electronic Commerce," released March 11 by The Aspen Institute's Communications and Society Program, describes the new economics of transacting business in cyberspace, from consumer privacy to potential advantages for entrepreneurs. The 270 kb report in .PDF format is available at: http://www.aspeninst.org.

1 0

re: Video resolution
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:14 AM 3/11/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >Note: this refers to the IBM PC & clones only > >> The point is that they do a lousy job on dithering. So does Microsoft >> explorer. They probably purchased the identical code from some clot. >Have been watching this go back and forth & get further from the original >question as usual. I suspect that if the original poster looks in her/his/ >its/other SYSTEM.INI file, the line "display.drv=vga.drv" will be found in >the [boot] section. This is the default 16 color driver installed by >Windows to be compatible with every 256k 640x480 VGA card. And I also remembered to turn the computer on. I can assure you that I know how many colors my screen supports, and I have numerous dithering programs on my computer, two of them written by me. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: TWP on Crypto Keys
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Somebody posted this editorial this morning, that includes the following passage: > The Washington Post, March 11, 1996, p. A18. > > Security and Software [Editorial] ... > > Legislation introduced this month in both the House and the > Senate would ease the export restrictions while attempting > to meet some of the government's security concerns. Code > makers would deposit a "spare key" to any exported > encryption software with a trusted third-party agency... Now, I thought that the bills did no such thing. How could The Washington Post get this so wrong? As I understand it, the bills do not in any way tie export to key escrow. They mention key escrow only to the extent that they specify that it is illegal to disclose the keys. Why would the paper get this cockeyed? Is it just a screwup, or are they pushing for a change? thad -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0

Re: Leahy and Mrs. Bemmis (now that's a subject line)
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 11:24 AM 3/11/96 -0500, A. Padgett Peterson P.E. Information Security wrote: > At the same time am pragmatic enough to accept the idea that it will have > no effect unless it passes and to be passed today it must have something > like the criminalization statement. I am glad to hear that the bill can be easily stopped. I think we should do something to kill it right away. The only good thing the bill does is give big companies the same power that most of us now possess -- the power to export crypto and get away with it. A good thing, a very good thing, but small change compared to the important individual liberties that the bill lightly discards. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Remailer passphrases
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:16 PM 3/11/96 -0500, "Mark M." <markm(a)voicenet.com> wrote: >On Mon, 11 Mar 1996, Gary Howland wrote: >> The only disadvantage of this is that the remailer cannot be rebooted >> without a passphrase being entered, but then there are ways around this >> (entering the passphrase remotely over a secure link etc., or more >> sophisticated 'remote authorisation' systems). >> >> The advantage of this is that the password is never on the disk, >> only in memory (which will take serious (read "expensive") to extract). > >I don't know that it would be that expensive. If someone was able to gain >root access to the system, something like "strings /dev/kmem" could narrow >the search for the passphrase down significantly. Except for special multi-level secure operating systems, and maybe some fancy capability-based systems, any operating system is going to let some administrator poke around in memory and on the disk, and if there's information anywhere on the machine, it can be gotten by the presevering privileged person. However, keeping the data off the disk is a very good start, and RAM-grubbers are far tougher to run on good OSs than disk-grubbers. Since the remailer has to decrypt data sent to it, it needs the password. The alternative to keeping the data in RAM or on disk is to keep it on some board or box hanging of a comm port or bus, such as a spare PC on RS232 running just a remailer application, or a decently self-protecting smart card in a PCM-CIA slot. To be really effective, it needs to be running the remailer application as well as just crypto; otherwise it might be possible to trick the card into decrypting arbitrary data for you or letting you snoop the remailer. On the other hand, if you're not that paranoid, and just want to do crypto on a card anyway, Matt Blaze did some interesting protocols for fast decryption with a CPU assisting a slow smartcard; they're on ftp://research.att.com/dist/mab/card_cipher.ps M. Blaze, "High-Bandwidth Encryption with Low-Bandwidth Smartcards." January 18, 1995. PostScript pre-print, to appear. >Of course one could obfuscate the passphrase by XOR'ing it with 0x80, > but that's only security through obscurity. You could be a bit more obscure than that if you wanted :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: Do you feel lucky, punk?
by medea＠alpha.c2.org 17 Dec '03

17 Dec '03

At 04:02 PM 3/11/96 jim bell scribbled: > >Again, you give no specific examples. And what is "twisted >rhetoric", at least as you've used it here? > >>but you don't seem to know the difference between dicta and holdings. > >I didn't use either term. Neither did George Will. You don't know what you're talking about - it's as simple as that. When someone points out to you the error of your ways using terms you're not familiar with, then display that at least one brain cell is working and look up the terms. Your response that you don't use them is childish. Was it meant to imply that you and George Will have formed a *Proud to be Stupid* club? <end of off-topic flame but deemed it necessary> Medea ============================================================ +++++++++++++++++++++++++++++++++++++++++++++++++++ + |---------------------------------------------| + + | The mind is its own place, and of itself | + + | Can make a heaven of hell, a hell of heaven | + + |---------------------------------------------| + +++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: Cryptographers against cryptography
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:35 AM 3/11/96 -0800, you wrote: >This is the second in a regular series of postings to expose >cryptographers and cypherpunks who are either lying to us or >making a very serious mistake in there judgement. ..... >B. Schneier: bs208(a)newton.cam.ac.uk, schneier(a)counterpane.com >M. Blaze: mab(a)crypto.com, mab(a)research.att.com >J. Bizdos: jim(a)rsa.com >S. Safaddar: shabbir(a)vtw.org >D. Weinstein: djw(a)vplus.com >P.. Peterson: padgett(a)hobbes.orl.mmc.com >B. Stewart: stewarts(a)ix.netcom.com Oh, boy, now I'm a Tentacle Again! But at least I can spell.... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: A lengthy preliminary analysis of the Leahy bill.
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 12:26 PM 3/11/96 -0500, Peter D. Junger wrote: > (4) the authority and ability of investigative and law enforcement > officers to access and decipher, in a timely manner and as provided > by law, wire and electronic communications necessary to provide for > public safety and national security should also be preserved; This provision of the bill makes the entire bill a worthless pile of repressive shit, despite all the pious good intentions in the rest of the bill. A little constitutional history: The supreme court used to rule that congress could not delegate its own power to bureaucrats, as this violated the principle of rule of law. Thus congress could pass a law than in a certain situation you had to do such and such, or refrain from doing so and so, but it could not pass a law that in a certain situation you had to do whatever some bureaucrat told you to do, because that would violate separation of powers and the principle of the rule of law, not men. Roosevelt threatened to stack the court, the court submitted, and the rule of law in the US was radically diminished. The proposed bill would seem to give bureaucrats the power to set aside the first, fourth, and fifth amendments, at whim. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Cryptographers against cryptography
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:23 PM 03/11/96 -0800, Bill Stewart <stewarts(a)ix.netcom.com> wrote: >At 09:35 AM 3/11/96 -0800, you wrote: >>This is the second in a regular series of postings to expose >>cryptographers and cypherpunks who are either lying to us or >>making a very serious mistake in there judgement. >..... >>B. Schneier: bs208(a)newton.cam.ac.uk, schneier(a)counterpane.com >>M. Blaze: mab(a)crypto.com, mab(a)research.att.com >>J. Bizdos: jim(a)rsa.com >>S. Safaddar: shabbir(a)vtw.org >>D. Weinstein: djw(a)vplus.com >>P.. Peterson: padgett(a)hobbes.orl.mmc.com >>B. Stewart: stewarts(a)ix.netcom.com > >Oh, boy, now I'm a Tentacle Again! >But at least I can spell.... Gee, lucky you (not to be confused with Lucky Green :-). Maybe if I study real hard, and practise, and pay attention in school, *I* can make the 7 Worst Enemies List, too! Oh, BOY! As for spelling, I have it on good Authority that your secret is knowing how to operate your spell-checker. Dave "Not even a flagellum, nevermind a tentacle" Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMURc1MVrTvyYOzAZAQEm9AP/XHB/pc3wfkkd9ZoGxduVxxzB4WliFubU PoDWkF0Gt+O1BSFGvqSJWKGaxYeYqvtBHzRLBE0BYh7ot7curdHWL8/7mrnaNCJV /QsHIsYl3JvAp/nZckucWUEzSf1BDnzokeH9v2xpwaxT5cWYvCRQLu0Q25EjfZl3 4PyMemghhbA= =+yQN -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

1 0