December 2003 - cypherpunks-legacy

5th protect password?
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

>> From: Hal <hfinney(a)shell.portal.com> >> I have been quite appalled to read the various analyses on the net (URLs >> not handy, but they have been posted here before I think) which conclude >> that compelled disclosure of a cryptographic pass phrase would probably >> be OK despite the Fifth Amendment. This seems to be an area where there >> is widespread agreement based on recent precedent. >> from: --Tim May >> What about the Fifth Amendment? Scholars are addressing this issue of >> compelled disclosure of cryptographic keys. Note, of course, that diaries, >> business records, papers, and, indeed, the entire contents of a putative >> crime scene are accessible to crime investigators and the legal system. >> (Whether giving up a key constitutes "testifying against one's self" or not >> is undecided, so far as I know. My own inclination is that it will be >> decided to be no different than the key to a locked diary--by itself, it is >> not self-incrimination.) Is this really an issue? I am not an expert, but I just read a Supreme Court case: DOE v. United States, 487 U.S. 201; 108 S. Ct. 2341 (1988) It involved someone who was ordered by the court to consent to the Cayman Islands bank to turn over account records. The Supreme Court said yes, because it is "more like 'be[ing] forced to surrender a key to a strongbox containing incriminating documents' than it is like 'be[ing] compelled to reveal the combination to [petitioner's] wall safe.'" The quote refers to Stevens' dissent, which said: A defendant can be compelled to produce material evidence that is incriminating. Fingerprints, blood samples, voice exemplars, handwriting specimens, or other items of physical evidence may be extracted from a defendant against his will. But can he be compelled to use his mind to assist the prosecution in convicting him of a crime? I think not. He may in some cases be forced to surrender a key to a strongbox containing incriminating documents, but I do not believe he can be compelled to reveal the combination to his wall safe -- by word or deed. I conclude that in a criminal case, all of the supreme court justices agree that a criminal defendant cannot be forced to reveal the combination to a wall safe, or any other information in his mind, by the Fifth Amendment. An escrow agent can presumably be compelled, unless his is accused of a crime, or has a privilege, or is outside jurisdiction. Interestingly, a footnote in the above case said: The Government of the Cayman Islands maintains that a compelled consent, such as the one at issue in this case, is not sufficient to authorize the release of confidential financial records protected by Cayman law. Sounds like the Cayman Islands might be a good place for your key escrow agents. Roger Schlafly

3 2

Add-in encryption module to Netscape
by runner＠asiapac.net 17 Dec '03

17 Dec '03

Hi, Lurking here for quite some time until now a real problem has come up and I need help here. I'm not in the US of A and the Netscape commerce server that my employer recently purchased has only 48bit key (as told by the salesman). My question is whether it is possible to add-in my own security module (RSA) and secondly, how difficult is it? The salesman cannot answer me. Thanks a lot.

5 4

Re:
by jim bell 17 Dec '03

17 Dec '03

At 02:57 PM 4/19/96 -0700, anonymous-remailer(a)shell.portal.com wrote: >Black Unicorn wrote: > >>> >> >> Clever kidnappers make arrangement in advance to deposit this cash with >> willing financial institutions who will hold it for several years before >> mixing it into their cash withdrawl stream. Kidnappers are paid based >> on a subtraction of interest for the period while the cash is undeposited >> and earns no interest for the financial institution, plus a fee. >> >> BCCI was quite notorious for using this method to cool off hot money. >> >> When the money was only mildly hot, it was simply physically transported >> to offshore banks in smaller lots and used for their cash payouts. >> (While riskier, this allowed the payment of interest). >> >> The other option was simply to launder the money through enough >> agitations so that two or three banking secrecy entities were between the >> return of the currency to free circulation and the kidnappers. >> > >christ. > >who the hell is this guy? He's a person whose entire income stream (or most of it, probably) is derived from the misbehavior of government. Jim Bell jimbell(a)pacifier.com

2 1

[NOISE] sign-off instructions
by Dave Del Torto 17 Dec '03

17 Dec '03

[author unknown, fwds elided] Uni, take note... Might make an amusing periodic auto-post to the clueless list. ;) dave ................................. cut here ................................. "HOW TO UNSUBSCRIBE" This is what you need to do. Please read these instructions carefully before beginning. tools needed: one Hammer one scredriver one pair of pliers one heavy-duty pair of wire cutters one bucket of saline water a box of sani-wipes Step #1: Stop payment on any checks that you may have sent to your Internet Service Provider (GOD). Step #2: If GOD is unresponsive and you are still receiving mail from this list, you will need to find the "mailhost". This is a machine usually located in a locked office. Every day around noon, the mailman will deliver a box of diskettes with that day's mail messages, including yours from this list, to this machine. Typically, only a handful of people have keys to the "mailhost". The reason why this machine is locked up is because this is typically the best, fastest, most powerful computer at your facility and the people with keys don't want to share it. If you must, break or pry the door down with one (1) hammer (you did get all the tools needed?). Step #3: Find the ON/OFF switch for this machine. Using the pliers, set the switch to the OFF position by tugging downwards until the disposable plastic switch breaks away from the computer casing. Discard the disposable plastic switch in an environmental-friendly manner. This will alert the mailman to not deliver the diskettes with the messages to the "mailhost" not unlike the little red flag found on mailboxes. This should resolve your mail problem immediately. Step #4: You may experience a recurrence of mail within 72 hours. If this should happen, you will need to disable the "mailhost" once again with more forceful measures. Repeat Step #2. Don't be suprised if there is a sturdier door in place than the one you destroyed previously. This is due to the fact that the "Have Key" clique found out that someone has seen their private stash of computer equipment. Step #5: After you have once again regained entry into the "mailhost" room, open up the back of the "mailhost". There may be a large tv-like device on top of the "mailhost" You will need to remove this first. Take your wire cutters, and cut any cables binding the tv-like device to the "mailhost". Set the tv-like device to the side. With your screwdriver, remove each and every screw that you can find on the "mailhost". Once this is done, the "mailhost" should break away into two or more pieces. Step #5: Find a large box with a fan attached to it. It will be clearly marked with the following labels: "Danger" "High Voltage" "Do not open - no user-servicable parts". Don't worry, these labels are merely in place to satisfy OSHA requirements and you are not in any danger at all. Take the bucket of saline water and pour it into any vents or ports that the large box may have. Any extra water should be poured directly into the computer chassis, be sure to properly soak each and every component. Step #6: In the event of fire (OSHA has been known to be right on occassion), douse any flames with the sani-wipes. This solution is provided without warranty. It is not bio-degradable or fat-free. In the event of sudden death, contact a physician immediately.

1 0

[EVENT] cheap date w/Bob Dole
by Dave Del Torto 17 Dec '03

17 Dec '03

Calling All Cypherpunks: An interesting "special event" just showed up on the radar. Sorry for the noise if you've heard about it already. dave ................................ cut here ................................. "Public Policy Issues Forum on Information Security" (aka "Celebration of 20 years of Public Key Cryptography" 1976-1996) Co-Hosts: Cylink Corporation The Churchill Club Date & Place: Monday, April 29 (6-10 PM) Marriott Hotel, Burlingame (spittin' distance from SF Airport) Dinner: $20 for club members $35 for non-members Menu includes [mad cow] steak dinner and wine Cash bar Speakers include: - James Freeman FBI Special Agent in Charge of the San Francisco Region; on the $100 billion annual loss to U.S. business from industrial espionage. - David Morris Vice President of Cylink; on advanced security systems needed today beyond firewalls which are only partial solutions; five requirements a truly secure information protection system must have. - Senator(s) Larry Pressler (and Bob Dole?*) on new legislation (The Encryption Communications Privacy Act of 1996) to loosen restrictions on strong crypto in the U.S.; need to allow U.S. firms to export long-key-length crypto. [yes, Virginia, _that_ Senator Pressler, the one who made the Bottom Ten list] - Senator Conrad Burns (R/Montana) on his proposed bill (Promotion of Commerce On-Line in the Digital Era) which could include preventing government from becoming an escrow registry bureau. [of CFP96 cowboy-hat voicelink fame] - Congressman Robert Goodlatte on his "Security and Freedom Through Encryption Act" (SAFE) legislation. - Paul Raines Project Manager with the U.S. Postal Service; previewing the USPS Electronic Postmarking System (1st nationwide use of PKC in a consumer-based public service, includes a certificate authority registry). - Whitfield Diffie - Martin Hellman - Ralph Merkle the three inventors/original patent-holders in the field of Public Key Cryptography on a panel discussing the future of cryptography, 3DES and "other issues." __________ If you're planning on being hungry on 29 April, get more info or RSVP and reserve a seat by calling: The Churchill Club 2323 South Bascom Ave Campbell CA 95008 408.371.4460 voice - ask for Lisa (try pressing #0 at the menu) 408-371-4180 fax There's a suggestion that you _could_ pay by sending your credit card info over the net (ironically, I see no public key being provided, but that's AOL for you...). For the foolhardy, the address is: <chrchllclb(a)aol.com> Alternatively, you can send it to <kmitnick(a)ax.netcom.com> or <donations(a)lsd.com> ;) __________ Notes: * Sen. Dole hasn't confirmed yet, but he's co-sponsor of the Encryption Communications Privacy Act, so if there are no high-visibility Senate votes or major campaign babies to kiss on-camera, chances are he'll paint a target on his back and kick it with us. The speakers alledgely include representatives from all three Congressional legislation groups. Expect the Press to attend. Other confirmations are still coming in from additional participants. For the price of a Van Halen ticket, this should be worth a giggle or two.

1 0

Dictionary searching code
by Adam Shostack 17 Dec '03

17 Dec '03

Does anyone have some code that will search a dictionary, and tell me *quickly* if an arbitrary chunk of text is in the dictionary? Pre-indexing steps are fine, as is using big chunks of disk for hash tables. The point of course, is to check arbitrary possible plaintext that a test decryption produces. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

4 3

Re: Baby-Food Bombing and highly selective quoting
by jim bell 17 Dec '03

17 Dec '03

At 04:45 PM 4/19/96 -0700, Rich Graves wrote: >On Thu, 18 Apr 1996, some anonymous FUDder sent us this: > > http://thomas.loc.gov/r104/r104s17ap6.html > >I think the following is a permanent URL, but I'm sure you can't make hard >links any deeper: > > http://thomas.loc.gov/cgi-bin/query/z?r104:S17AP6-332: > >Also note that this speech concerns an amendment to S735 that FAILED. >I.e., the language for which the esteemed [snort] Mr. Biden is arguing IS >NOT IN THE BILL AS PASSED BY THE SENATE. > >>[...] >> As some people tell >> it, you would think the FBI and BATF and the local and State police >> are tapping our phones left and right, that they are riding down the >> streets in vans with electronic devices eavesdropping into our >> windows and houses--which they have the capacity to do, by the way. > >Mr. Biden's next sentence, which either Mr. Thompson or the anonymous >forwarder conveniently left out, is "But that is just not the way it >works." Here's a question, however: What, exactly, stands between the way it is supposedly done, today, and wiretapping with none of these "protections." I see nothing in the Constitution which mandates them, at least explicitly, which suggests that the thugs might simply decide, tomorrow, that they are not really necessary after all. Is it possible that the only reason these protections are in place is to provide a window-dressing of caution, to ensure that the disgust of the public doesn't get too great? And another question I've never seen a satisfactory answer for: Why is there not an automatic policy to inform the person tapped, at least after the tap is removed, analogous to the level of information the victim of a search warrant normally gets? Jim Bell jimbell(a)Pacifier.com

2 1

Re: Dictionary searching code
by attila 17 Dec '03

17 Dec '03

** Reply to note from Adam Shostack <adam(a)lighthouse.homeport.org> 04/19/96 8:02pm -0500 = = = Does anyone have some code that will search a dictionary, and = tell me *quickly* if an arbitrary chunk of text is in the dictionary? = Pre-indexing steps are fine, as is using big chunks of disk for hash = tables. The point of course, is to check arbitrary possible plaintext = that a test decryption produces. = for this purpose, the OLD unix code starting with V6 20 years ago has a speller with a fairly comprehensive dictionary. The code is small. about 15 years ago I broke it out and rewrote it as linkable libraries to handle multiple dictionaries. I know I have the code somewhere --probably on MIPS 2000 tape or Sun 3 tape... the code also contains excellent prefix/suffix codes, etc. I do not remember spending a great deal of time doing the conversion, and it was straighforward to convert it to a callable library (or even a .dll). attila -- Obscenity is a crutch for inarticulate motherfuckers. Fuck the CDA! cc: Cypherpunks <cypherpunks(a)toad.com>

1 0

Re: Dictionary searching code
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:02 PM 4/19/96 -0500, Adam Shostack wrote: > Does anyone have some code that will search a dictionary, and >tell me *quickly* if an arbitrary chunk of text is in the dictionary? >Pre-indexing steps are fine, as is using big chunks of disk for hash >tables. The point of course, is to check arbitrary possible plaintext >that a test decryption produces. This application sounds perfect for Bloom filters. The basic idea of a Bloom filter is to build a database by taking each word in the dictionary and hashing with N different hashes. The hashes do not need to by cryptographically secure, but they do need to be good hashes, XOR doesn't make it. You use those hashes as bit offsets in a giant bit map, which is the database. When building the database you turn on the bits at each of these N locations. When accessing the database, you hash the chunk of text with the same hashes, and then test the bits in the database at those offsets. If any of the bits are zero, then the chunk of text is not in the dictionary. The failure mode is to say something is in the dictionary when it isn't. If half the bits in the database are on, then the probability of failure is 2**(-N), so if N==10, then the failure rate is 1 in 1024. If empirically, you get a higher failure rate, check the quality of your hashes. For cryptanalysis, I might pick a higher N and eyeball check for failures. Say you want 1 in a million failure rate, and have an 80,000 word dictionary. You need a 20 * 80,000 * 2 bit database, which is 400,000 bytes. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Welcome to clueless
by Majordomo＠c2.org 17 Dec '03

17 Dec '03

-- Welcome to the clueless mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)c2.org" with the following command in the body of your email message: unsubscribe clueless cypherpunks(a)toad.com Here's the general information for the list you've subscribed to, in case you don't already have it: #### No info available for clueless.

1 0