December 2003 - cypherpunks-legacy

No Subject
by Black Unicorn 17 Dec '03

17 Dec '03

> On Sat, 30 Mar 1996, Dr. Dimitri Vulis wrote: > > > Black Unicorn <unicorn(a)schloss.li> writes: > > > > > On Fri, 29 Mar 1996, jim bell wrote: > > > > > > > > >Anyone who knows me knows I spend all my days end arounding the > > > > >U.S. government. > > > > > > > > Explains a lot! You _are_ paid for this. In an earlier era, you > > > > would have gladly run the ovens at Auschwitz if you'd gotten paid > > > > for it. would have gladly run the ovens at Auschwitz if you'd > > > > gotten paid for it. > > > > > > You're way out of line here. > > > I expect an apology. > > > > Consider the above in context. Would you be willing to run the ovens/gas > > chambers if you were exterminating U.S. government employees/contractors? > > No, I would not. That's the difference between me and you- er... Mr. Bell. . Finally, Lance blew his nym. I'd love to hear the rationale behind this. . So, do you think that I'm Jim Bell's tentacle or that he's my tentacle? Does it make a difference? > > "The final solution to the IRS/BATF problem." :-) . And what if you were "processing" U.S. Congressmen? I find this entire line of conversation revolting. I also don't find it very surprising given the sources/source. . --- . Dr. Dimitri Vulis . Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Re: [NOISE] Cable-TV-Piracy-Punks
by Randy Catoe 17 Dec '03

17 Dec '03

>"Perry E. Metzger" <perry(a)piermont.com> writes: > > > Or to people with access to scanning microscopy techniques > > like STMs or AFMs. I suspect that there are lots of > > techniques that can be successfully used. It used to be that > > using them required the sort of facilities only available at > > a large semiconductor manufacturer, but now I suspect that > > it would be easy for a student at a major university, and > > probably less easy, but still perfectly feasible, for a > > person working at home with lots of sophisticated but fairly > > available equipment like STMs. > The proof would be in the pudding, would it not? Are their documented cases of smartcard scavenging?

2 1

Spy Dupe
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Has this dupe russe tale appeared in the US? Or brags of cutting edge XX-equipment duping global buyers? ----- The Sunday Times (UK) 31 March 1996 Spy in the copier gave CIA its coup by James Adams Washington A tiny camera hidden in a photocopier in the Soviet embassy in Washington provided America with one of the greatest intelligence coups of the cold war, it emerged last week. The camera, planted by the CIA in the early 1960s, provided a treasure trove of intelligence, with access to virtually every document copied by the Russians for most of the decade. The CIA was exploiting a Russian bureaucratic obsession with documents: in 1963, word got out that embassy staff were fed up with copying documents by hand and had approached Xerox to rent a photocopier. American spies went to work. Ray Zoppoth, one of Xerox's engineering experts, hit upon the idea of installing a camera opposite the photocopier's mirror. It was activated automatically when the document scanning light came on. The coup could hardly have come at a better time for the CIA. The Cuban missile crisis had plunged American-Soviet relations into one of their darkest periods. The CIA, embarrassed over the way the Soviets had been able to move missiles into Cuba, was determined to improve its intelligence capability. One problem was how to retrieve the camera's film at regular intervals. Xerox prided itself on the reliability of its early machines but it sent a maintenance man regularly to the embassy to collect the film. Later Zoppoth invented an even smaller camera that could be disguised as a tool. Over the next six years the camera was installed in photocopiers at other embassies of hostile and friendly countries. "Xerox copiers had become part of every office system and no foreign embassy was immune to possible spying," said Zoppoth. The operation was halted only in 1969, when an American chemical company tried to bug the photocopier of a rival firm to steal patented designs. The publicity surrounding the case alerted the Russians and they stopped photocopying their secret documents. --

1 0

[ITAR/POLITICS] rsa-in-3-lines-of-perl just shrunk!!
by Adam Back 17 Dec '03

17 Dec '03

Sorry to contribute to the simply awesome noise to signal ratio here lately (hopefully the subject tag should help those not interested in politics), but... [if you don't know what I'm talking about, see http://www.dcs.ex.ac.uk/~aba/rsa/ for a combined perl hack and ITAR violation] Due mainly to a couple of insights donated by someone who was introduced to the code via a friends `munition' T-shirt... he started the ball rolling again... it shrunk from: #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) to: #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/) (Actually it's not quite as impressive as it might look at first glance because the old version included the comment "-export-a- crypto-system-sig -RSA-3-lines-PERL", so the new one should really be compared against: #!/bin/perl -s $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) ) but it's still a whole 31 bytes shorter, and it now really is in 3 lines of perl rather than cheating and not counting the #!/bin/perl line. (Several people took me to task on that one). I won't consume list bandwidth describing exactly how the new one works, and the arcane perl and dc hackery that went into it, as I have described it all in excruciating detail on: http://www.dcs.ex.ac.uk/~aba/rsa/story.html I really wasn't expecting to see it shortened any further. There goes all those T-shirts, outdated, my sincere apologies to Richard White also, whose tattoo was featured in the April issue of Wired (at least the UK edition, the US one too?), Oh yeah, and if you can see any ways to shorten it, please tell me! (Perl5 specifics not allowed, there is already a shorter p5 specific version but it's got to be as portable as possible). Adam ps I now have a reasonable stock of T-shirts again after the prolonged hiatus of my printer, who finally delivered the 2nd batch. -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Electronic locksmiths are watching you (Belgium's ban onPGP)
by jim bell 17 Dec '03

17 Dec '03

At 11:22 AM 3/31/96 -0500, Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Dave Del Torto <ddt(a)lsd.com> wrote: > >>At 1:25 am 3/30/96, jim bell wrote: >>>We should be particularly suspicious of any hint of a pan-European ban or >>>control of encryption, because that is exactly the kind of development that >>>could usher in a secretly-negotiated treaty that might be argued to be >>>binding on the public. [elided] > >>Cypherpunks like Jim need to keep doing their homework before they make >>such quasi-factual statements. > > >Jim seems to analyse a situation in terms of broad principles, >while Dave seems to focus more on specifics that would disprove Jim. > >I agree with the Dave's last phrase in the sense that our models of reality >should indeed be rooted in reality. I hope by now you've seen my reply about the treaty issue. I wasn't particularly focussing on the question of what Europe will do qua Europe, but how the treaty issue could be abused in the US. Here is the section of the US Constitution which is relevant, and which I mentioned by reference before: Article VI ... This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the land; and the Judges in every State shall be bound thereby, any Thing in the Constituion or Laws of any State to the Contrary notwithstanding. ... I do not believe that this section was intended to mean that the _citizens_ of the US are bound by treaty obligations; That would be illogical, treaties are agreements between governments. Treaties are inherently intended to govern relations with foreign countries, not legal or political circumstances within a particular country. Treaties may AFFECT citizens, such as extradition treaties, immigration/emigration treaties, and passport requirements, but the citizen doesn't "agree" with them. That's evidenced by the fact that treaties are ratified by only the US Senate, the body with two Senators from each state. (The House has proportional representation, based on the population of each state.) The intent, I suggest, was that treaties were supposed to be interpreted as applying to the country, while laws applied to the individual. (Since you're Canadian, and for other non-US readers, I should point out that when the US Constitution was being drafted and debated, citizens were strongly loyal to their state, not the country as a whole, and there was a debate concerning how the representation in the Federal legislature should be divvied up. Obviously, large states wanted proportional representation, small states wanted "n-votes-per-state." The compromise was to have two houses, one of each kind of system. (House=proportional, Senate=2 votes per state.)) Laws have to be passed by both houses to become valid; treaties, on the other hand, only need to be ratified by the Senate. In any case, since laws can be declared unconstitutional I think it's implicit that there can be such a thing as an "unconstitutional treaty," or at least one if declared to be binding on the citizens would be in violation of the Constitution. If, for example, the US government decided that it wanted to take away free speech rights from its citizens, to name an obviously fantastic example, it could arguably write a treaty with, say, Mexico, "agreeing" that free-speech rights will not apply to the citizens of each country. While in practice such an extreme example would never fly and would not be tested (fortunately!) I have read that this section is opportunistically interpreted as if a treaty can be assumed to bind the citizens and not merely the government. I believe there was a treaty in the middle 1960's called something like "Single Issue Treaty on Narcotics" which led directly to a massive re-write of the drug laws in the US. In view of the fact that today, probably 70% of the inmates in US prisons are there on drug charges, it is obvious that this treaty had a long-lasting internal effect, far beyond what a person might have expected at the time. Whether or not this interpretation could still work in today's changed political climate, I don't know, but it's obvious that portions of the US government would dearly love to control encryption in particular and communications in general. Since telecommunications is one of those subjects that is covered by past treaties, and can be expected to be covered by future ones, I believe that American citizens need to be particularly concerned about the government sneaking in laws in the "back door," made by treaty, as opposed to the "front door", made by both the House and Senate and subject to Presidential veto. (Not that I have much respect for the latter, either, but that system is a bit easier to control.) If anything, I think there needs to be an explicit prohibition written into law prohibiting the enforcement of anti-crypto treaty terms on the citizens, or even better a law requiring that all future telecommunications treaties to which the US is a party not contain any regulations or restrictions on crypto. But I'm not hopeful about this. >But considering that in most european country, you are recognized guilty >unless proven innocent, it is only non-contradictory to arrive at Jim's >conclusions. The basic psycho-epistemology at work there is implying that. There is probably much about Europe which is superior to the US, but they do have a problem with social and political stratification given their long history. Jim Bell jimbell(a)pacifier.com

2 1

Re: Witch Hunts
by tcmay＠got.net 17 Dec '03

17 Dec '03

Bruce Zambini wrote: >It is also worth noting that the original Detweiller, in a sense, played >De Sade to Tim May's Rousseau, in that he used an unorthodox, but >effective, critical technique. (This is, in fact, one reading of De I don't buy this. If you consult the archives, circa the fall of 1993, you'll find that while Detweiler/S.Boxx/etc. repeatedly begged me to engage him in debate, I declined. So, what was the "effective" part? I thought his insults, rants, forgeries, screams, shouts, and general gibbering detracted from his real points, such as they were. I'm beginning to think there must be a personality type or behavioral pattern at work here. Others in recent months have also had their ideas buried in a stream of insults, rants, and CAPITAL LETTERS! The pattern seems to be the same, though I doubt any of them are Detweiler. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: [NOISE] Cable-TV-Piracy-Punks
by tcmay＠got.net 17 Dec '03

17 Dec '03

thus demonstrating that the system had only moderate security. Enough security to stop an attacker from attacking a specific instance of the chip, but enough ^ not security to prevent attacks completely.

1 0

Re: SQUID's (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > > Apparently you are grossly unfamiliar with the > > characteristics and capabilities of SQUID's. To help you > > catch up... > > Actually, I am quite familiar with Superconducting Quantum > Interference Devices and the one existing commercial application > of the technology, a magnetometer probe containing a liquid > nitrogen cooled SQUID chip at its tip. There are several commercial probes available, not a single source as you claim. The Air Force has used them in experimental fighter programs for several years allowing hands-off flying (in a simulator) with quite good results. Quite a few neurophysiologists use them along with NMR to map the neuronal activity of the human brain on a neuron by neuron basis. The folks who make the various flavors of super-conducting wire use them to test for imperfections in the product. I sugest that your familiarity with the SQUID technology might be a little dated. Take the time to contact Conductus. > > [Biography of Mr. Squid deleted] > > I will still laugh at suggestions that Mr. Squid can remotely > read the EEPROM in my smart card, however. I didn't make that assertion. I clearly offered it as a source of education and entertainment. I even went so far as to specificaly predicate my recital with this caveat. While Mr. SQUID might be able to do it, the other commercial probes out there would have no problem from reading your smart card on a transistor by transistor state if that is what were required.

1 0

Tamper-Resistance in VLSI
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:06 AM 4/1/96, Mike Duvos wrote: >However, I will observe that whenever technology is put forth for >criticism on this list, there are always a few people who insist >upon maintaining that anything can be easily defeated. > >"All you have to do is <blank>" they exclaim, where <blank> may >be replaced by "Quantum Factoring", "SQUIDs", "Scanning Tunneling >Microscopy", "NP=P", "The EPR Effect", "Nanomachines", or some >other exotic notion which would be lucky if it had even achieved >a laboratory demonstration under carefully controlled conditions >much less a practical application to the problem in question. > >Common to all such claims is a gross underappreciation of the >engineering difficulties involved, in this case those related to >reading logic states buried in a densely integrated digital >device without destroying them. Something that isn't easy to do >even if the device has been designed specifically for the purpose >of permitting such observation in a laboratory environment. While I agree that reverse-engineering/analyzing the internal states of VLSI devices is much harder than some are claiming, it is not the case that a chip must have been designed with this in mind for it to be possible. When, then, is it possible, and when is it not? There is no simple answer; I'd have to look closely at the device, its packaging, how many layers of metal are involved, the size of the target node to be measured, and a raft of other things. >Such distractions, unfortunately, are why good physics rarely >gets discussed in sci.physics, and why discussions on this list >about nuclear bomb design, tampering, and hacking frequently take >off in the crackpot direction. > >The bad eventually drives out the good, and few of the competent >posters are going to continue to comment on a thread which has >degenerated into the "You don't know anything. Mr. Squid can >read your smart card and your brain waves too" level of >interaction. Well, this is my third post tonight on this thread. I admit that it has little to do with practical list issue (but then, what really does?). Howvever, this happens to be an area of primary expertise for me (device physics, voltage contrast, SQUIDs, sensing small charges, and tamper-resistance), so I'm making comments to correct the various misapprehensions here. As to tamper-resistance, there is some exciting work being done on "fingerprinting" of chips, some of which has been publically presented. I'm under an NDA on some of this, but I can say that the cost of reverse-engineering a smart card chip or satellite decoder chip is about to take a quantum leap upward. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: [NOISE] Cable-TV-Piracy-Punks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:56 PM 3/31/96, Randy Catoe wrote: >>"Perry E. Metzger" <perry(a)piermont.com> writes: >> >> > Or to people with access to scanning microscopy techniques >> > like STMs or AFMs. I suspect that there are lots of >> > techniques that can be successfully used. It used to be that >> > using them required the sort of facilities only available at >> > a large semiconductor manufacturer, but now I suspect that >> > it would be easy for a student at a major university, and >> > probably less easy, but still perfectly feasible, for a >> > person working at home with lots of sophisticated but fairly >> > available equipment like STMs. >> >The proof would be in the pudding, would it not? Are their >documented cases of smartcard scavenging? Intel produced an "encrypted EPROM," for use in coin-op game machines and in similar applications, in the early 80s. My voltage contrast lab was able to use our machine (which I invented and my group then developed and deployed to major sites within Intel) to read the internal data streams out from internal nodes, thus demonstrating that the system had only moderate security. Enough security to stop an attacker from attacking a specific instance of the chip, but enough security to prevent attacks completely. Does this qualify as a documented case, coming as it does directly from the guy who lead such a scavenging attack? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0