December 2003 - cypherpunks-legacy

Mixmaster message formats
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was thinking about how Mixmaster needs a separate message format so it can make messages a fixed size and add a packet ID. However, couldn't all this be done with PGP? With PGP, the length of the file being encrypted is encrypted itself, so it would be possible to append random data to the end of the file to make the message a fixed length like Mixmaster. Also, the packet-ID could be implemented by putting a line such as the following in the message: :: Packet-ID: foobar The only other thing that would have to be taken care of is chaining. The way I could see this working is to have a header in the encrypted message that tells the remailer whether it should de-armor the message at the next layer, append random data, then re-armor, and pass it to the next remailer. Am I missing something? - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 "The concept of normalcy is just a conspiracy of the majority" -me -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMYAXxLZc+sv5siulAQG5CwP/Qbgune3sjNyB7Y8xNxNW6hCahtgBNJDk oT+hZHdlmcB6CZXjgDUSczIfAnygS71PBBysB4DJnugluMTMTGfqmgeikXdvL1zt vnwx5xlG0HQeTbVE2+c1uW4uamkdb0MZmNLR06S9M+2i0ROaWzGwNO6WEHqoEL3W qwXZ7zPtId0= =MaO4 -----END PGP SIGNATURE-----

2 1

ROC_poc
by John Young 17 Dec '03

17 Dec '03

4-25-96. WaPo: "Israelis Eye U.S. Laser As Anti-Rocket Defense. Nautilus High-Energy Laser Beam Burns Surface of Weapon." Two months ago, in a test at the White Sands Missile Range in New Mexico, the U.S. Army used the laser to shoot down two Katyusha rockets that earlier had been seized by Israel. The test caught the attention of the aerospace community because it offered evidence of Nautilus's efficacy, especially its new tracking system upgraded with more sophisticated computer software. The laser, beamed at a rocket for only a second or two, disables it by melting its surface, causing it to explode and crash to Earth. "Spy Chief's Grasp Reaches Other Pockets." The Senate intelligence committee yesterday approved a major expansion in power for the director of central intelligence (DCI) by giving the director authority not only over the CIA budget but also over all intelligence spending, most of which currently is controlled by the Pentagon. Such a radical change is likely to run into strong opposition not only from the military services themselves, but also from other congressional committees with Pentagon oversight. ROC_poc

1 0

Capability Security in Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:38 PM 4/25/96 -0700, Simon Spero wrote: >One thing that could be retroactively added to the vm pretty easily would >be the ability to add capability requirements to methods, and have the >class loader automatically generate code to check for those requirements >before executing the body of the method Now there is a statement that makes me sit up and take notice. I certainly havn't thought this subject thru carefully, but to start, I think I would like capabilities to be held by a specific object, so if I give a Java object permission to read a file, that permission is not automatically inherited by other objects, or instances of the same object which use the common method. There would also have to be a technique where capabilities could be passed from object to object to allow subcontracting. Having the capabilities held by objects means that access the objects needs to be controled as well. I notice some items on Hal's list of Java security problems which indicate weaknesses in this area, but it is not clear if they are bugs (which will be fixed) or "features". Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

RE: Mindshare and Java
by Blake Coverett 17 Dec '03

17 Dec '03

> Yes, I had the misfortune to post that skeptical bit at precisely the same > moment that the public press releases were proving me wrong :-( [shrug] Happens to all of us. Sometimes just keeping up on press releases seems to be a full time job. > My source at the PDC indicated that Microsoft was still pushing Visual > Basic, but I'll accept that there's been a change... They are, but not exclusively. They are supporting both JavaScript and VBScript in IE3. For that sort of work I think Basic might be more appropriate anyway. (Added to the fact that they have committed to making the reference source for VBScript available online with a free for whatever you want type of license.) The spin at TechEd last week seemed to be a complete spectrum running C++ -- Java -- VB depending on the desired speed/control vs. easy of development. > Still, integrating Java and Internet browsing into the OS does not bode > well for Netscape. <CRYSTALBALL> My bet is that five years from now Netscape will be remembered as the company that forced MS to give it away for free. </CRYSTALBALL> -Blake (who's keeping all his irons in the fire anyway :-)

1 0

VENONA followup
by John Young 17 Dec '03

17 Dec '03

Last year DCI Deutch said that as part of the new "openness" for intelligence archives and as followup to the release of VENONA documents, a conference was planned on Soviet intelligence attempts to penetrate the USG in the 1940s and 1950s. (See excerpt below.) Has anyone heard more on this conference? ---------- http://www.odci.gov/cia/public_affairs/speeches/dci_speech_71195. html DCI Speech 7/11/95 DCI John M. Deutch at VENONA Press Conference [Snip] Next year we will sponsor a conference on Soviet Intelligence attempts to penetrate the United States government during the 1940s and 1950s and our efforts to counter those efforts. We hope that all scholars will attend, including Russian scholars.

1 0

Re: Golden Key Campaign
by Lou Zirko 17 Dec '03

17 Dec '03

Ok! OK! I expect to get hit for this, but maybe we could set up a graphic on our pages with the "broken Key" from the lower left corner of Netscape to commersate the RSA date. > Date: Thu, 25 Apr 1996 12:08:08 -0700 > From: Hal <hfinney(a)shell.portal.com> > To: cypherpunks(a)toad.com > Subject: Re: Golden Key Campaign > From: frantz(a)netcom.com (Bill Frantz) > > Some people say that the millennium comes on Jan 1, 2000. Others say it > > comes on January 1, 2001. I say it comes on September 20, 2000 when the > > RSA patent expires. > > It is traditional to commemorate big events with annual observances. I > say there's no reason the observances can't predate the event when it is > known in advance. > > So I propose that September 20 be known as Crypto Freedom Day, and an > annual celebration be held on that day. With each year closer to 2000 > the party gets bigger, culminating on the day that the patent actually > expires. We can all run our RSA in three lines of Java that Adam Back > will have prepared, and taste for the first time the freedom which the > rest of the world will have known for the past 17 years. > > Hal > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzFseHQAAAEH/2gtDJSlsDvTo7m+Caj5zKuLO4dVl6L9e4xxFOAqKMtkHDIh 2z6NqqGnAKDai3eDXInBuOTGoyb82pkV7wD7naQDx7bppfwmJNguOPvlrErOZHcA NbAkyXCoKHgDxeXLq0MMcyC8+kBxYNKhMPm17g7tny4DKD+fzat4k3UiSAves6Y7 jLgQwwQ7TLYIGg7iPAsbMTnOF5iP51Ib47Ozjb3suJvJjUOTSUdl4V3e9EHWiniH G6kI1cfOdUmLXIgNZ34utTwwb2H/LhEDYrydmXJG6FfUolAThCwCbTG++Hq7/Ywr BOawFj3BhySTvpp/bSCJt1Mz/eELEq9xwQCaVD0ABRG0G0xvdSBaaXJrbyA8bHpp cmtvQGlzZG4ubmV0PokBFQMFEDFsfBcSr3HBAJpUPQEBRHoH/R+rkuMa9Vw+Civd 5QQM0tBMEPDUa7G2qNLKO0FBmVHoqq+VGeD9X2X+EBld0AwuWvshQfsViG2uBNxk Cr44y+Q0tXByCZqR8snTZG12BtFaCZv51XVieo2ygWQdmNp5DyMEyIOXUByORT2m 2Jx2VngcFt5rpzZLRALqwBDkV00Xcm8MPQzqGq8ZQA3nmExQkdpnSJIJX0irWjDM OueDrn9mBz2NwIZmddShYGUdhRXgpLYPHLMpo2fxE0dXiWkaDlyx47k4MIWaDoF4 nnTXxmEcS98AkT2PfqU4dT3UfZpZnHqkWQ7d4JqvXs9RmmH9K/NyBB+LykOvA1/t W6deAaWJAJUDBRAxbHtD30Eh39zrXZUBAYPsA/0dIEjlSuc8wrX5KJzAhXqUKBbg e3toQJk8RZwm4f80SC2DopEXYdmwAVrhOou7vezeu29mYVunKaDKg5xjnUfVR1WS ZXy54ZfYEG4Zrdi4vJgydb96AwoF3VAYyAbV45XBTfy3ujZjZRxpZS96X7iKk+6l quslrTmMFLhju4vWKw== =wksf -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: US law - World Law - Secret Banking
by Hal 17 Dec '03

17 Dec '03

Another thing Baker said in that report about Japanese crypto policy was interesting. He was talking about key escrow and how he thought the Japanese discussions about it were on the wrong track. Apparently the Japanese idea of key escrow combines it with a government Certification Authority (CA) infrastructure. You get certified keys which you will use in commerce, and these keys are escrowed. (Japan is not showing much enthusiasm for the escrow idea, to Baker's displeasure, but they are discussing it.) Baker's problem was that the keys would be used for signing as well as for encryption. He said that in the U.S. they had been careful to separate these functions in their plans. That's why we have DSS for signatures and Clipper (Capstone, Skipjack, etc.) for encryption. Only the Clipper keys get escrowed. The DSS keys are kept private. The problem with using one set of keys for both functions (as for example when RSA keys are used for both encryption and signing a la PGP) is that the escrow people can not only defeat encryption, they can forge signatures. If escrowed keys were stolen, not only would privacy be lost but also the reliability of signatures. Now at first this seems strange. Why would it be more of a problem that a broken escrow could forge signatures than break privacy? Well, from the corporate point of view it could be a lot worse. When you get a signature on a business document you want to be able to trust it. If a company can hope to get out of a commitment by saying that hackers must have broken in and stolen the keys, the value of digial signatures is much reduced. Privacy, on the other hand, at least from the point of view of someone like Baker, is not as important. His people eavesdropped all the time, and it wasn't that bad. So from his perspective it is reasonable that a possibly insecure escrow system is acceptable for encryption, but not for signatures. And that is apparently a principle behind the US crypto policies as they have unfolded over the last few years. This may shed light on the battle a few years back over whether RSA signatures would be adopted as the digital signature standard rather than the discrete log system which was finally chosen. It also suggests that the government has long realized the difficulties of keeping the escrowed key database secure. Hal

1 0

RE: Mindshare and Java
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:45 AM 4/26/96, Blake Coverett wrote: >> Still, integrating Java and Internet browsing into the OS does not bode >> well for Netscape. > ><CRYSTALBALL> >My bet is that five years from now Netscape will be remembered as the >company that forced MS to give it away for free. ></CRYSTALBALL> > >-Blake (who's keeping all his irons in the fire anyway :-) I tend to agree with Blake on this, as one might expect. Speaking as a longterm Mac user, I certainly feel no compulsion to drop my Mac/Netscape package and switch to Microsoft. Bundling Java in with Windows (which actually was reported as long ago as last Friday, on C/NET's page, http://www.cnet.com/) may be a near-necessity for Microsoft, and for other OS vendors. Apple is also reported to be planning to make its next OS major release, "Copeland," an "Internet-savvy" release. Its "CyberDog" (dumb name) will be bundled with Java as part of Copeland. Metrowerks (the Code Warrior people) is said to be a partner in this. Symantec's "Cafe" JIT compiler for Java is reported to have a 13x speedup over JDK code, and is only slightly slower than compiled C code. Borland is also working on JIT stuff, reportedly for Sun itself. How it all shakes out remains unclear, but I stand by my "mindshare" point of view, that Java is fast-becoming a lingua franca for Web-centric use. (C certainly was, in a different sense, not for cross-platform easy use.) I'll bet, however, that Microsoft will not be "winner-take-all" in this. They're doing some impressively nimble rearrangements of plans, but there is little indication they'll be able to dominate things. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0