December 2003 - cypherpunks-legacy

Re: Rumor: DSS Broken?
by timd＠consensus.com 17 Dec '03

17 Dec '03

At 8:32 PM 5/19/96, Bill Stewart wrote: >On the other hand, NIST has been saying that DSS isn't covered by any patents, >which the PKP folks had some very negative, skeptical comments about, >before PKP fell apart; it probably still is covered by the Cylink/Stanford >patents until they expire next year, though it's not covered by RSA. >The patent licensing hassles probably have kept a lot of people from using it, >except for specific sales to the government. Not to mention the Schnorr patent, which is good until 2008. NIST has claimed DSA doesn't infringe upon patents, but they won't necessarily help you in court, let alone indemnify you. I think everyone is using RSA because it's easy, safe and already widely deployed. Since you've got to buy a BSAFE license to do any interesting commercial cryptography anyway, why go through the hassle of another algorithm? Cylink is pushing DSA, however, because with DSA + Diffie-Hellman, you get both encryption and signing, thus providing a similar set of capabilities to RSA. Note, also that a DSA implementation might be usable as to do ElGamal or RSA encryption; I don't know whether generally available commercial / exportable implementations can or not. [Applied Cryptography, 2nd ed., 490-491] - Tim PS - Anyone know what the ASN.1 AlgorithmIDs and public key formats are for DSS? I'd like to add support for DSS X.509 certs to my X.509 library. Even better would be a couple of such certificates so I can test. PPS - Any chance the original rumor surrounded RCA/Hughes' DSS satellite TV system, and not the Digital Signature Standard, and we've all been barking up the wrong tree? Tim Dierks - Software Haruspex - tim(a)dierks.org "That's the trouble with technology. It attracts people who have nothing to say." - Muffey Kibbey, mother [Wall Street Journal, May 10 1996]

1 0

Re: Defeating fingerprints
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sinclai(a)ecf.toronto.edu" "SINCLAIR DOUGLAS N" 18-MAY-1996 04:15:33.26 >Not that random playing with carcinogenic chemicals is a good idea, but... >I've found that if you use just one reagent from epoxy glue, the collagen >in your skin will disolve. You can sculpt it into whatever shape you want, >and it will stay that way for an hour or so. I don't remember if it was >the resin or the hardener though. This was regular 5 minute epoxy. I somehow doubt that the collagen is dissolving. You may be loosening the keratinized dead skin cells and pushing them around, and then they flake off in some length of time (probably speeded up by this treatment). Any signs of redness, etcetera in the skin afterwards? Unusual sensitivity of the fingertips, especially to pain? One thing to keep in mind is that fingerprints aren't just from the whorl pattern that you see. They're also from that the sebaceous (oil) glands in the skin are arranged along those whorls. You need a pretty resistant barrier to stop these. I've been told by the son of a cop that the combination of a pair of latex gloves with a couple layers of cotton gloves stops both the oils and the normal pressure patterns. -Allen

1 0

Virtual machines?
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Hi. Pardon my ignorance, but I had a few questions haunting me since a while. Is there a way to have a remailer de-localize itself and relocalize itself over the internet? For example, could there be several machines around the worlds that, when you send an e-mail to it, is routed to differents physical places of the world depending on where the actual remailer process is actually running? Could there be such a thing as a virtual machine runing a remailer that gets to hop from physical machine to physical machine around the world? Just an idea to avoid jurisdiction problems. Just asking, probably quite futilely... Thanks JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

2 1

Re: Rumor: DSS Broken?
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:05 PM 5/19/96 -0800, Jim Bell wrote: >It should occur to all of us that if the NSA was actually doing the job we >are vastly over-paying them to do, it is THEY who should be finding, >exposing, and correcting these kinds of cryptography faults. They may have; they're just kind of selective in who they expose them to :-) Also, there are expert cryptographers outside the NSA, and outside the US; you might check where Dobbertin lives. And this is a Good Thing. >Another question: If the government provided DSS, and it's now toast, SHA-1 isn't toast; it's MD5 that might be at least a bit crunchy. (The NSA gave us SHA, and later added a correction that appears to make it stronger, unless there's something really subtle and nasty inside.) DSS isn't toast either, though the subliminal-channel stuff makes it necessary to look very carefully at any applications to find out what else is being done with them, which you can't always do. One of the purposes of DSS appears to be that it provides signatures without providing encryption, so the Feds can trust the Public to have it. Except of course that subliminal channels _do_ toast that part of it. On the other hand, NIST has been saying that DSS isn't covered by any patents, which the PKP folks had some very negative, skeptical comments about, before PKP fell apart; it probably still is covered by the Cylink/Stanford patents until they expire next year, though it's not covered by RSA. The patent licensing hassles probably have kept a lot of people from using it, except for specific sales to the government. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 18-MAY-1996 09:07:35.05 >On Thu, 16 May 1996, Bill Stewart wrote: >> ================================================================== >> This message was posted from the anonymous remailer at www.jim.com. >> Send any complaints to webmaster(a)www.jim.com . >> Please don't post any copyrighted material longer than fair use quotations. >> And did you know that Scientology's highly overpriced documents say that >> "<random paragraph quotation>" >> =================================================================== >Once I was more or less done laughing and got off the floor, it occurred >to me that this could provide a revenue stream for anonymous remailers. >You'd charge advertisers sub-pennies for these little trailers. I >understand that Sameer is getting very little Ecash for his >remail/by-www.html, but maybe if he sold advertising space? It's an interesting idea. One wonders if EFF would be interested in such a sponsorship? One could even add, say, an ACLU promotion to the end of messages without getting cash from the ACLU - this might encourage them to give more backing in case of a legal dispute. (You scratch my back, I scratch yours... I'm not meaning to be offensive to the ACLU, BTW.) -Allen

1 0

Re: Sendmail Question (was: SMTP Server for sending to anonymous remailers?)
by John Deters 17 Dec '03

17 Dec '03

At 12:42 PM 5/19/96 -0400, you wrote: >At 12:09 AM 5/19/96 -0700, you wrote: >>If you use popmail (like Eudora), then just tell it the server to use in >>"SMTP Host". >> -Lance >I have been following this with no little interest. Using Eudora Pro when I >attempt to replace host: smtp1.abraxis.com with *SMTP Host*, I receive the >message *Attempting to resolve host: SMTP Host*, and dat's all until I stop >the send command. > >Thanks > >Alec Alec, What he meant was that you should replace the contents of the SMTP server's field with the address of the first remailer in your chain. For example, if I wanted to send this through the Holy Cow remailer, I'd put this in the SMTP server field: haystack(a)holy.cow.net Remember, though, that several things OUT OF YOUR CONTROL have to happen for your mail to be anonymised successfully. First, if you are behind a "firewall" (i.e. doing this at work through your work's net connection) your firewall may be implementing what is known as a "proxy." That means even though you're using the SMTP protocol, you may not be *directly* talking to the SMTP client of the remailer. It may "look" like you're able to SMTP out to whoever you want to send mail, but in reality, the firewall can intercept your request, and "pretend" to be some other SMTP server. It then accepts your outgoing mail, and forwards it to the real destination. Abraxis sells firewalls. Also, your firewall may be configured to not pass SMTP out at all, but rather to require you to send any SMTP traffic directly to it. That means you can not change your SMTP server to anything outside of your local net. In either case, firewalls are certainly capable (and employers within their rights, but that's another useless thread) to log and/or read your mail. Anonymity lost, at least to your employer. Finally, the anonymous remailer may (or may not) have some kind of logging turned on. I don't know why they would (what's the value if they do) but if some law enforcement agency orders them to discreetly monitor traffic, you lose again. Unless you PGP encrypt your mail to the remailers before it leaves your machine for the big bad net, someone else can read it. And, no matter what, persons unknown can tell that your machine sent some message to the remailer. (This is known as "traffic analysis".) Therefore, I'd *highly* recommend not e-mailing anything illegal over the net, remailer or no. -j, annoying, yes. Illegal or harassing, no. -- J. Deters >From Senator C. Burns' Pro-CODE bill, which I support and you can find at: http://www.senate.gov/member/mt/burns/general/billtext.htm " (2) Miniaturization, disturbed computing, and reduced transmission costs make communication via electronic networks a reality." +---------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +---------------------------------------------------------+

1 0

Re: Is Chaum's System Traceable or Untraceable?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:10 AM 5/19/96 -0400, Simon Spero wrote: >> > (On the other hand, I have had a longstanding faith that the system can be >> > made to be both payer- and payee-anonymous. Moneychangers, for example.) .. >This scheme can't be used with the ecash API, and I believe is not looked >on kindly when applying for ecash licences. It makes you a lot more >vulnerable to traffic analysis There are at least two reasons for wanting payee anonymity - general privacy - criminal activities, e.g. ransom, where payee doesn't trust payer. In the latter case, the facts that collaboration is required, special software is needed, and licenses are violated are not really a problem - the Bad Guy can give the payer the code along with the ransom note, and doesn't care about the license. Traffic analysis is a concern, but you're probably not going to collect ransom from the same person on a regular basis, and for blackmail, you can keep changing the payment address, and you're a bit less worried about the payer's location being noticed than if you were collaborating in something like tax evasion. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

5 MINUTE CYPHERPUNKS SURVEY
by Sally D. McMillan 17 Dec '03

17 Dec '03

Hi! Im writing a paper for school on E-commerce and would like to include a brief section on the role of Cypherpunks in E-commerce. If you would, please email me your responses to the following questions. Some of these questions are broad, but please limit your response to each question to 0-100 words. Also, I am NOT attempting to stereotype the Cypherpunks, but am instead interested to learn whether there is a shared view among them. THANKS! PS- PLEASE RESPOND TO MY EMAIL DIRECTLY by FRIDAY, 5/24/96 : 103007.3426(a)compuserve.com 1. Would you call yourself a Cypherpunk? (Y, N, Not Sure) 2. What is the role of Cypherpunks in the DEVELOPMENT of secure E-commerce transactions? 3. What is the role of Cypherpunks in the MAINTENANCE of secure E-commerce transactions? 4. Why do Cypherpunks care about E-commerce? (Please limit to 100 words or fewer.) 5. What is a punk? What is a Cypherpunk? Can you distinguish between those who are up to no good, trying to crack security and those who try to crack security in order to maintain it? Do Cypherpunks, in your opinion, fall into either category? 6. What is the greatest security threat to E-commerce transactions? 7. On a scale of 1-10, how dangerous is it to give your credit card number to a vendor over the internet? (Please provide one number only for this answer.) 8. On a scale of 1-10, how would you rank your own knowledge of E-commerce and related security issues? (Please provide one number only for this answer.) May I quote part of or all of your answers in my paper? Would you like to be referenced by name, email address, or as Anonymous? Please provide pertinent details. THANK YOU FOR FILLING OUT THIS QUESTIONNAIRE! Please forward your responses to me at: 103007.3426(a)compuserve.com

1 0

Re: New Remailer (hidden)
by Bill Stewart 17 Dec '03

17 Dec '03

Cool. I've got a test message going now. Does your remailer accept PGP-encrypted email? It's really critical for high-security applications, at least for first remailer hops, but your key's not on the MIT keyserver. BTW, how do we know you're not a plant? :-) Aside from having an interesting nym, you've probably got the first remailer that makes it difficult to tell who's running it. You could be Sameer, or you could be Louis Freeh, but we don't know. At least folks like Xenon were known to be real people.... Even if you _are_ a plant, of course, we can still use your system, but I'd want to do encrypted email through other remailers on one end or the other. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Why does the state still stand:
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 18-MAY-1996 02:54:47.09 >On the other hand, the government also has enormous "obligations" that keep >it close to bankruptcy. It wouldn't take a great deal of interference in >its ability to collect taxes to put it solidly in the red based on current >receipts. And remember, if the individuals who populate government could be >persuaded that their tenure would be forcibly shortened if they didn't >resign, they wouldn't stick around. Once that cohesiveness of jointly >sucking on the government tit is eliminated, I think they'll cut and run. >These people are working for a fat paycheck and the promise of a retirement >package, and it wouldn't take much convincing to show them that they won't >get either for very long. I'm convinced that's why so many Senators and While quite a lot of people in the government are working just for the paycheck, there are also some idealists - and some who are working for a "power paycheck" rather than a "cash paycheck." I'm willing to bet that that's the case with the NSA and its _general_ opposition to cryptography. You'll have three basic groups: A. Those who are idealists. This can be divided into two categories. 1. Those who idealize the power of government, such as via a devotion to democracy. These oppose cryptography because it weakens the government. 2. Those who are primarily interested in protecting America from everyone else. These promote cryptography, and need to be supported. 3. Those who (stupidly) believe in the US government enough to "just follow orders," as the Nuremberg phrase goes. If you can get the type 2 idealists in power, these will do the right thing. B. Those who want power. These oppose cryptography because they will lose power if it is widely implemented. C. Those who are just there to get a paycheck. These will act in most situations about like an idealist of type 3, but when push comes to shove won't be willing to back it up seriously. I'd appreciate feedback from anyone who's dealt with the intelligence community more than I have (not particularly difficult) to confirm or deny the above classification system, and give some idea as to the proportions within the NSA, government in general, etcetera. -Allen

1 0