December 2003 - cypherpunks-legacy

RC4 improvement idea
by Jack Mott 17 Dec '03

17 Dec '03

I got a paper from the cryptography technical report server "http://www.itribe.net/CTRS/" about a weak class of RC4 keys. The report said that with some keys, it was possible to predict what some parts of the State-Box would be. I was thinking of a way to fix this, and had this idea: do some sort of hashing function with the key that derives a number between 55 and 500 or something like that, then scrabmle the S-box that many times. In this way, the chances that the State-Box will have any correlation becomes extremely small. I think it is 1/125 to begin with anyway, so this would make it around 1/(125*NumPasses). And since the exact number of passes is a function of the key, the cracker won't know how many times it went through. I tried this out and having 1000s of passes doesn't effect the randomness of the state-box in any negative way, possibly it makes it more random? If anyone has any thoughts I'd love to hear them. -- thecrow(a)iconn.net "It can't rain all the time"

1 0

Re: Blue Water spooks
by nyap＠mailhub.garban.com 17 Dec '03

17 Dec '03

> Have the Chinese turned their thought towards cryptography, > or cryptanalysis yet? If so, I suspect the answer is > yes, If not, then the answer is a definate No. > > The Chinese Intelligence Service traditionally has > not looked outward, preferring to ply its trade domestically. > That said, the earliest extant text on espionage is Chinese. In addition, (if I remember correctly from _The Puzzle Palace_), a person who was heavily initially involved in the formation of NSA also helped establishing the Chinese Intelligence Service. Also from the same book, in the US has set up, with Chinese approval, a sigint shop within China. This was done to sigint the Russians. With the tensions between the US and China now, I'm not sure whether they closed shop or not.

1 0

"Contempt" charges likely to increase
by tcmay＠got.net 17 Dec '03

17 Dec '03

I almost titled this thread "'Contempt' charges likely to increase in popularity," but I felt the "popularity" would draw comment. By "popularity" I mean amongst judges and law enforcement. Many of the proposals here and in related discussions of offshore asset protection posit the following situations: * Alice places a copy of her key, or secret-shared parts of her key, in a location not reachable by subpoena. (This might be via strong crypto, a la mixes and pools, or just in a jurisdiction which historically and typically does not honor U.S. subpoenas.) * Alice deposits some fraction of her assets in accounts in jurisdictions which are friendly to such purposes. (Either "tax havens" or "asset protection havens," such as are described in various books and seminars.) * Alice receives information from a witness or source in a criminal case. She declines to say who this source is. Depending on the "shield laws" (about which I'm no expert), she may be held in contempt unless she reveals this information. (Side Note: I don't believe the law should make the distinction it has made between, say, Alice B. Toklas, Reporter for the "Washington Post," and Tim May, reporter for the "Cypherpunks" list; the law seems to create a distinction between "the press" and the rest of us. On what basis?) * Alice places her child in the hands of someone known only to her, e.g., to prevent the child from being given visitation rights by a spouse. (This last example is of a real one, based on the Rebecca Morgan case. The other examples are real, too, though not necessarily associated with a particular case.) In these cases, Alice has a secret of some sort and says "nyah nyah nyah" to those seeking the secret. With strong crypto, such situations are likely to become more common. The courts know that Alice can in fact retrieve the secrets, the funds, the child...and the courts know that only a "contempt of court" decree will serve as the lever to pry out this retrieval. What about the Fifth Amendment? Scholars are addressing this issue of compelled disclosure of cryptographic keys. Note, of course, that diaries, business records, papers, and, indeed, the entire contents of a putative crime scene are accessible to crime investigators and the legal system. (Whether giving up a key constitutes "testifying against one's self" or not is undecided, so far as I know. My own inclination is that it will be decided to be no different than the key to a locked diary--by itself, it is not self-incrimination.) That the key is _stored_ someplace else (the escrow agent, either in the country or outside the country) makes the "cannot be compelled to testify against one's self" interpretation even more of a reach, in my non-lawyer opinion. So, I see a rise in the use of "contempt" charges. Contempt charges have a kind of time limit, in practice, and there is a common interpretation that a person may be jailed on contempt charges so long as there is likelihood that she will eventually reveal the information sought. (Reporters have been jailed for more than six months, and I recall that Rebecca Morgan was jailed for a couple of years for refusing to tell the court the whereabouts of her daughter...) In short, "If you can retrieve the information or assets we order you to, and don't, then you'll be held in contempt of court until you do." If the secrets or assets _cannot_ be retrieved--a scenario which is possible, if the protocol is so written (clauses for court action)--then contempt charges are meaningless and would not stand, IMNALO. Legal students out there might find that specializing in this area of law brings in more clients in the coming decades. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

rc4 weak keys fix?
by Jack Mott 17 Dec '03

17 Dec '03

I got a paper from the cryptography technical report server "http://www.itribe.net/CTRS/" about a weak class of RC4 keys. The report said that with some keys, it was possible to predict what some parts of the State-Box would be. I was thinking of a way to fix this, and had this idea: do some sort of hashing function with the key that derives a number between 55 and 500 or something like that, then scrabmle the S-box that many times. In this way, the chances that the State-Box will have any correlation becomes extremely small. I think it is 1/125 to begin with anyway, so this would make it around 1/(125*NumPasses). And since the exact number of passes is a function of the key, the cracker won't know how many times it went through. I tried this out and having 1000s of passes doesn't effect the randomness of the state-box in any negative way, possibly it makes it more random? If anyone has any thoughts I'd love to hear them. -- thecrow(a)iconn.net "It can't rain all the time"

1 0

Re: unsubscrive * Peter.Posch@koeln.netsurf.de
by David Loysen 17 Dec '03

17 Dec '03

At 02:33 PM 4/4/96 -0500, you wrote: >On Thu, 4 Apr 1996, Peter N. Posch wrote: > >> unsubscrive * Peter.Posch(a)koeln.netsurf.de > >Why don't we just patch Majordomo to recognize "unsubscrive", >"unsuscribe", "unscribe," and "take me off this fucking list" as all being >equal to "unsubscribe"? > If these people had sent their messages to majordomo that would work.

1 0

Re: "Contempt" charges likely to increase
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:57 AM 4/5/96 -0800, Timothy C. May wrote: >So, I see a rise in the use of "contempt" charges. Contempt charges have a >kind of time limit, in practice, and there is a common interpretation that >a person may be jailed on contempt charges so long as there is likelihood >that she will eventually reveal the information sought. (Reporters have >been jailed for more than six months, and I recall that Rebecca Morgan was >jailed for a couple of years for refusing to tell the court the whereabouts >of her daughter...) Hence the proper approach which is to constantly demonstrate your contempt for the court. Daily (hourly) phone calls, faxes, email, physical letters going on in boring detail all the reasons that you have for never purging yourself of the contempt. Logically, that should shorten your imprisonment but in practice... Obviously offshore key escrow facilities should have provisions similar to those in Foreign Asset Protection Trusts (FAPS). For example (from a recent non-fiction work on FAPTs written by one of the greatest minds of his generation): ******************* Duress Provisions The trust document should also contain language that basically says, "The Trustees should not obey any instructions that anyone else gives them under the orders of any court that has no jurisdiction over them." You see, a foreign-based trust is not under the jurisdiction of a court in any other country. A court can only order people to do things if it has them under its physical control. For example, a German court cannot send the police to Bermuda or to the Channel Islands to force your trust's trustees to transfer trust assets to the court for payment to creditors. What creditors in a German court will try to do in such cases is to find someone in their jurisdiction who has some powers over the trust. They then order this person to direct the Trustees to cough up the trust assets. A duress clause frees the Trustees from any obligation to obey instructions caused by orders from a German court. It is a powerful method of protecting your trust from the asset grabbers. But, you may ask, "What if a persistent creditor manages through some miracle to get an order against the trustees from a court in the foreign jurisdiction where the trust is located? That's easy. You include "flight provisions" in your trust. Flight Provisions You know that German courts or those of any other country will have no jurisdiction over your offshore trust assets. But what do you do if a really dedicated creditor tries to pursue your trust in the courts of the trust's home jurisdiction. Flight provisions take care of this situation. These provisions will require that the location (situs) of either the trust or the trust assets (or both) be changed automatically, in the event that creditors move against your trust in its home location. So even if they do manage to get a court order against your trust, the trust will have been moved to another jurisdiction. Your creditors will have to start all over again. It is important to realize that having a "flight" clause in your trust is no guarantee that the trust will successfully escape. The trust and its assets must be moved in time. It is possible that the trustees will fail to act in time and your trust may be frozen in its foreign jurisdiction. These provisions do add an additional layer of protection, however. If you do run into financial problems, you may move your trust in advance of need -- before any lawsuits are filed. You can also protect yourself further if your investments are physically located in a third jurisdiction -- neither in your country of residence nor in the trust jurisdiction. Trustee Switching Provisions In addition to moving the trust itself, you may also want or need to change Trustees. Trustee switching provisions give power to both the Trustee and the Trust Protector to remove Trustees and name new Trustees. For example, if Trustees in one country come under court order to relinquish the trust's assets, those Trustees can be removed and replaced with new Trustees, who are not affected by the court order. ********************** DCF

1 0

MPI10.ZIP RELEASED
by dave.hodgins＠westonia.com 17 Dec '03

17 Dec '03

ÛßßßßßßßßÛ Original From: DAVE HODGINS Û CARBON Û To: ALL Û COPY Û Date/Number: 04/05/96 - Not Yet Posted ÛÜÜÜÜÜÜÜÜÛ On: WESTONIA - 2513 - Public-Key Encryption and Distribution Echo ----------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- I've written an interface for dos based mail programs and pgp. The interface provides menu selection for various pgp functions likely to be used when writing email, and selection of keys to be used, from a list of the keys in your keyring. The program is similar in function to John Schofield's ez-pgp. The program has been tested under win95, and dos 6.22. I'm uploading the file to the westonia bbs, and will email a copy to anyone who requests it. Regards, Dave Hodgins. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMWWnkIs+asmeZwNpAQGyEwf/YGWfkuWVcEzISpnin3z24WJyqzq0e48B VZihLsKsdJ+BL+VNvBoejvpIxEZM2dq2VyycrKFks7TK8HSjUlcCiv4prSGUQqsB K1PKdJPpUyT6f1EHdHz3UllBeIGjR8mjgmGRV86ezUC+Y2lHmWvqlWT1YlHPwIwp 1LnQL9aIzFkz1WaFvzC9O19dzKqT+FMIMS2QtVarHCcbWlmWYwgRuPihNngciXKs tKChLjeh88/DlItGm8dhu2iPoGzb4LpPDBuUrJZB5hPxaBJjdgugiNE/CY+Z9Fhj E02Ji2ZraFrXi6nOCCNnIq97PHf/aZlDn9CrSZyOLBkO2hx7WXdUnQ== =8osk -----END PGP SIGNATURE----- cc: ALL in 5711 on WESTONIA CYPHERPUNKS(a)TOAD.COM in 0001 on WESTONIA --- þ RM 1.31 0820 þ Internet:Dave.Hodgins@Westonia.com Rime->1347 Fido 1:250/636

1 0

[OFF-TOPIC] Re: Fwd: Anonymous code name allocated.
by Peter Trei 17 Dec '03

17 Dec '03

> From: JonWienke(a)aol.com [I know this is off-topic for coderpunks, but some of the discussion is happening here] > [The following has been censored to protect the guilty.] > > >Subj: Anonymous code name allocated. > >Date: 96-04-02 23:37:10 EST > >From: daemon(a)anon.penet.fi (System Daemon) > >To: jonwienke(a)aol.com > > > >You have sent a message using the anon.penet.fi anonymous forwarding > service. > >You have been allocated the code name anXXXXXX. > >You can be reached anonymously using the address > >anXXXXXX(a)anon.penet.fi. > > > >If you want to use a nickname, please send a message to > >nick(a)anon.penet.fi, with a Subject: field containing your nickname. > > > >For instructions, send a message to help(a)anon.penet.fi. > > I tried sending a test message to the address indicated, and received it back > a day later, so sending email to this address does reach me. The funny part > is that I have never (to my knowledge) had any communication with > anon.penet.fi prior to receiving this email. > > Questions: > 1. How do I use this to SEND messages anonymously? Having an email address > with no obvious link to my identity is cool, but I would like to be able to > send as well as receive. I sent email to help(a)anon.penet.fi, but have > received no response yet. > > 2. Why was I chosen for this? How did anon.penet.fi find out my email > address? Is the NSA trying to lull me into a false sense of security in the > hope that I will use this account to violate ITAR? > > 3. Has anyone else on this list received unsolicited remailer accounts? > > Jonathan Wienke > --------------------- > Forwarded message: > From: daemon(a)anon.penet.fi (System Daemon) > To: jonwienke(a)aol.com > Date: 96-04-02 23:37:10 EST > > You have sent a message using the anon.penet.fi anonymous forwarding service. > You have been allocated the code name an573530. > You can be reached anonymously using the address > an573530(a)anon.penet.fi. > > If you want to use a nickname, please send a message to > nick(a)anon.penet.fi, with a Subject: field containing your nickname. > > For instructions, send a message to help(a)anon.penet.fi. While I'm not up on all of the wrinkles, I've seen this reported as an attack on the penet anonymous mail forwarder and news poster. An attacker forges email in your name, requesting an anon-id. The server creates one, and sends the report both to you, and to the attacker's address. If you try posting thru the penet server, the post gets anonymized using the anon-id the attacker created. The attacker can now link the anonymized post to your True Name. If you ever intend to use the penet anon server, you should write to the server administrator, requesting to have the id the attacker created deleted, and the create a new one, with password protection. (I don't use penet, so I don't know the details). Peter Trei ptrei(a)acm.org

1 0

unsubscrive
by robalo 17 Dec '03

17 Dec '03

unsubscrive * robalo(a)elogica.com.br unsubscrive * robalo(a)elogica.com.br unsubscrive * robalo(a)elogica.com.br

1 0

PICS required by law
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

What was I saying a while back about mandatory PICS through liability? As I recall, various people such as TCMay were saying that it wouldn't happen. Looks like I need to get out that article against PICS that I was working on and rewrite it a bit. I would remind people that PICS allows parents (or whoever else is holding the reins, such as an ISP - or the Chinese firewall) to filter on such content as material (including scientific studies) stating that a given illegal drug is not as harmful as some would claim, any idea futures market - even a simulated one, on homosexual content separately from heterosexual, and against criticisms of religions (such as Scientology). To their credit, the ACLU (in the CDA court case) has stated that they will not put a PICS rating on their web site, even if it contains "indecent" or allegedly "harmful to minors" material. I agree strongly with their position. -Allen Computer underground Digest Wed Mar 27, 1996 Volume 8 : Issue 25 ISSN 1004-042X [...] Date: Thu, 14 Mar 1996 11:47:33 -0800 From: telstar(a)WIRED.COM(--Todd Lappin-->) Subject: File 1--CONGRESS: Online Parental Control Act of 1996 [...] Maintains the Communications Act of 1934's legal defenses against liability for people who choose to give parents technology that: 1) blocks or restricts access to online materials deemed obscene or harmful to minors, and 2) restricts access to such materials through adult access codes or credit card numbers; Adds two new defenses: 1) the use of labeling or segregating systems to restrict access to online materials, such as systems developed using the standards designed by the Platform for Internet Content Selection project (PICS), and 2) the use of other systems that serve the same function of the other defenses if they are as reasonable, effective, and appropriate as blocking, adult access code, and labeling technologies; and Protects providers or users of interactive computer services, information content providers, and access software providers from civil or criminal liability under state law for making available to minors materials that are indecent or harmful to minors if they take actions to qualify for the defenses mentioned above. [...] PICS is a cross-industry working group assembled under the auspices of MIT's World Wide Web Consortium to develop an easy-to-use content labeling and selection platform that empowers people worldwide to selectively control online content they receive through personal computers. The Recreational Software Advisory Council recently announced that it will soon implement a detailed voluntary ratings system, using PICS standards, that will let computer users filter out varying degrees of sex, violence, nudity, and foul language. Companies and groups supporting PICS include Apple, America Online, AT&T, the Center for Democracy and Technology, CompuServe, IBM, France Telecom, Prodigy, Providence Systems/Parental Guidance, Surf Watch Software, and Time Warner Pathfinder.

2 1