December 2003 - cypherpunks-legacy

LIMITED SF BAY AREA INTEREST
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Those of you who know Dana Drenkowski are invited to his 50th birthday party on Saturday. There is some conflict with the monthly Cypherpunks meeting, but you could come late to the party. (It's in Golden Gate Park.) If you would like to attending, let me know as soon as possible. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

update 273 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: >From physnews(a)aip.org Mon Jun 3 17:03:16 1996 Date: Mon, 3 Jun 96 14:06:02 EDT From: physnews(a)aip.org (AIP listserver) Message-Id: <9606031806.AA07182(a)aip.org> To: physnews-mailing(a)aip.org Subject: update 273 PHYSICS NEWS UPDATE The American Institute of Physics Bulletin of Physics News Number 273 May 31, 1996 by Phillip F. Schewe and Ben Stein SCHRODINGER'S CAT-ION: Physicists at NIST (Christopher Monroe, 303-497-7415) have experimentally demonstrated the principles of the famous Schrodinger's cat thought experiment with a single beryllium ion. In a 1935 paper, physicist Erwin Schrodinger proposed the cat paradox: put a cat inside a box, add a container of poison gas which is activated by the decay of a radioactive atom, and close the box. Since the radioactive atom obeys the rules of quantum mechanics and since therefore its state is indeterminate until measured by an outside observer, opening the box and observing the atom (a microscopic quantum system) instantly determines the status of the cat (a decidedly macroscopic, non-quantum concept). The feline is neither alive nor dead until the radioactive atom is measured by an observer. Although this thought experiment is impossible to carry out for a number of reasons, including the fact that the quantum properties of a system tend to wash out in an object made of many atoms and molecules such as a cat, the NIST physicists have demonstrated the basic principles using a single beryllium ion. The researchers trap the ion with nonuniform electric fields and cool it to a near standstill. Laser pulses then cause the ion to oscillate as a combination of wavepackets representing two different electronic states. Additional laser pulses push apart the two wavepackets to separations of as much as 80 nanometers, a mesocopic-size scale far bigger than the normal spatial extent of the ion. So in this version of Schrodinger's cat, the ion's electronic state (a quantum property) is linked to (or "entangled" with) a mesocopic-scale position (a non-quantum property). By applying subsequent pulses that bring together the wavepackets, the researchers detected interference patterns which provided evidence of the original separation. Measurements of Schrodinger cat's states can provide information on how quantum properties wane with the amount of physical separation between quantum states. (C. Monroe et al., Science, 24 May 1996.) SUPERCONDUCTING TUNNEL JUNCTIONS (STJ), under development as efficient detectors of x rays, can now also be used as single-photon detectors at visible wavelengths. In this regard they will be welcomed by astronomers who increasingly record incoming light with charge-coupled device (CCD) arrays. In contrast to the silicon-based CCDs, which are insensitive to a photon's energy (one photon engenders one electron in the detector), the niobium-based STJ's do discriminate as to energy (one photon, depending on its energy, can generate thousands of electrons). Determining a photon's energy would allow astronomers to forego filters, which lower the detector's overall efficiency. A STJ device developed by an Oxford-Cambridge-European Space Agency (Netherlands) collaboration can detect light in the wavelength range 200-500 nm with a spectral resolution of 45 nm (this should improve to 20 nm or better). The STJ can also determine the photon's time of arrival at the millisecond level, a property the would be handy for studying fast astronomical processes such as pulsars. (A. Peacock et al., Nature, 9 May 1996.) PHYSICS BACHELOR'S DEGREES. Here are some highlights from a new AIP report on 1994 degree recipients in the U.S.---the annual number of degrees continues to decline slightly; more fresh graduates are looking for jobs rather than heading for graduate school; for those going on in their studies 89% receive financial support; women constitute 17% of the degree recipients; median starting salary was $27,000. (Patrick Mulvey, 301-209-3076.)

1 0

[SF Bay Area] Steganography -- Peter Wayner Ph.D.
by stevenw＠best.com 17 Dec '03

17 Dec '03

Seen on the net: AN EVENT AT COMPUTER LITERACY BOOKSHOPS ---------------------------------------------------------------------- CAN SECRETS BE STOPPED? ---------------------------------------------------------------------- A free presentation by Peter Wayner Ph.D. Date: Wednesday, June 19, 1996 Time: 6:30 p.m. - 8:00 p.m. Location: Computer Literacy Bookshops 2590 North First Street (at Trimble) San Jose (408) 435-1118 "Steganography" is the art and science of making information disappear. If you don't know where it is, you won't even know it exists. If you can't find it, you can't censor it. Dr. Wayner will explore some of the basic ways that people are hiding information by making it look like something else; such as innocent ramblings or flames from a newsgroup or background noise in a digitized image or sound file. Dr. Peter Wayner has a Ph.D. in Computer Science. He has worked at Xerox PARC and consulted widely on various topics, including computer security. His writing has appeared in popular fora like "BYTE" magazine and the "New York Times". He is the author of "Agents Unleashed: A Public Domain Look at Agent Technology" and "Digital Cash: Commerce on the Net" and "Disappearing Cryptography". DID YOU KNOW THAT OUR EVENTS ARE ALSO POSTED ON OUR WEB PAGE? http://www.clbooks.com/ Stay tuned. There are more events to come. July 23 Programming Windows 95 with MFC by Jeff Prosise Events at our stores are always free. Have suggestions about event topics? Email them to: eventca_info(a)clbooks.com ------------------------------------------------------------------------ If you would like to receive e-mail announcements for upcoming store events, simply write to: events_ca-request(a)clbooks.com (for events held at our California stores) events_va-request(a)clbooks.com (for events held at our Virginia store) ------------------------------------------------------------------------ If you have signed up for email announcements but have not received any, or wish to be removed from this list, please contact us. We add names by request only. **************************************************** Computer Literacy Bookshops, Inc. Cherrie C. Chiu eventinfo_ca(a)clbooks.com (408) 435-5015 x116 ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

Re: Security of PGP if Secret Key Available?
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02.36 AM 6/3/96 -0500, Robert A. Hayden wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >About once a week we get some lame-o flame bait posted to >alt.security.pgp or this mailing list or somewhere abotu some hole in >PGP. We further say with fairly good reliability that they are bogus, >get a light chuckle, and then go back to dealing with the real issues. > >However, I got to wondering about the security of PGP assuming somebody >trying to read my PGPed stuff has my 1024-bit secret key. ie, if I have >it on my personal computer, and somebody gets my secret key, how much >less robust has PGP just become, and what are appropriate and reasonable >steps to take to protect this weakness? > >Thanks > > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 >Comment: PGP Signed with PineSign 2.2 > >iQCVAwUBMbJ5xTokqlyVGmCFAQGcAgQAvjFdZ+YLdQGxDHcT+GOwP82BSwiTYlaQ >F9RV8L+radCK/SyeLnEtoodkKVqpcsItIQ/JJ44FOAmnsBLljuWqbhZMl8G8+uCB >pcpkXpre83CwoM6qDKkCEyqCiMxq857ioCoqb+WRNJYbb++muVBDHADVzGoGOjLg >cvIMxnnXF3c= >=tnTb >-----END PGP SIGNATURE----- Once your secret key has been compromised, then all that prevents a Bad Guy from reading your message is your secret key passphrase. (I believe that, aside from grabbing keystrokes a la TEMPEST, the only way to get this passphrase is by brute-forcing it, or maybe searching your house for the little piece of paper that you may have written it on.) I have seen equations which claim to compute the security of your passphrase and also passphrase generators - I don't know if either are any good, though. - ------------------------------------------------------------------------------- David Rosoff (nihongo o chiisaku dekimasu) drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. - --- "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbTCmBguzHDTdpL5AQEH4gP/TT3myaSislU3En4xwaB2cWmYhCItlhL/ nhLZM4uxOHv87zsHjYIBrHEHxVHnYOaH/Kd7zSRPRB0ArTDIMP/ZtYISMUNhfSd2 bX+LNdASX9rbiD1Vfcvb/vw6nKlfvdz2WoeeTE/yqSeHjnE7+izEX4Xi/9mHB4s/ N9DDK16kgi4= =snQo -----END PGP SIGNATURE-----

1 0

Re: Java
by Deranged Mutant 17 Dec '03

17 Dec '03

I'll add a few comments about the "Java hype monster"... it seems a good way for people to make money off of computing in ways they haven't before (and in ways which probably won't work anyhow). A lot of the Java hype has been how one only needs a "network appliance" that logs in and uses remote applets which are instantly updated. Less risk of software piracy, more phone bills and network membership fees, of course. (Nevermind other risks added in this sort of system). It seems like a kind of cable-tv-for-the-internet. People will join a service that provides an array of applications. Network membership fees and phonebills... or maybe they'll use cable modems and it will be included with the cable bill on their JavaVision (tm) boxes? On the plud side, though: C never did standardize graphical interfaces. Notice most of the demos in the JDK are graphical? Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

hacked version of PGP - win95 long filenames
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I suffer from the great misfortune of a dos computer, and despite my anti-micro$oft efforts, I still am stuck, most of the time, with Windows 95. This OS assigns long filenames (the sensible kind, that is) to the old-style eight-character and three-character separated by a dot. However, they did it in such a way that old filenames still work. So if I have a file I want to encrypt, PGP will mess up this system. oldname.txt -> oldname.asc This is the normal way PGP would encrypt. However, f I have assigned the oldname.txt file a new file name under the win95 system, it will look something like this. "Old File" (oldfil~1.txt) This conforms with the new scheme. If I PGP encrypt, this happens: oldfil~1.txt -> oldfil~1.asc Thus, the new filename is lost, both for the ciphered file, and for the file once I decrypt. Is there a way (aside from not using long filenames) such as a hacked version of PGP that has a workaround for this problem? Also, is this an issue on the list of improvements for future official versions of PGP? =============================================================================== David Rosoff (nihongo o chiisaku dekimasu) -------------> drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu or get from keyservers pub 1024/D37692F9 1995/07/01 David Rosoff <drosoff(a)arc.unm.edu> Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 I accept anonymous mail. If I didn't sign it, you don't know I wrote it. === "Made weak by time and fate, but strong in will / To strive, to seek, to find-- and not to yield." <---- "Ulysses", by Alfred, Lord Tennyson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMbTExRguzHDTdpL5AQGo5QP/QqZw0PLK5/jNY42nbJ/VRrAj8g62FK7q zxWMVbindqQZaOYRtNVHy28rzjkBy+ybzhWetmLgny4f2zdUFkTf5OgZ0r27oOGQ 93VmAK8FoMTBhtje3y4OjWc2uqqHWSYkhjZVYWVCxVcFL1GA6FMkIs8pnzqb5Ohy ShWTgpaV6OM= =SLEx -----END PGP SIGNATURE-----

1 0

Re: NYT on NTT/RSA Chips
by jim bell 17 Dec '03

17 Dec '03

At 08:53 PM 6/4/96 -0400, Ted Garrett wrote: >At 09:12 AM 6/4/96 -0800, someone claiming to be <jimbell(a)pacifier.com> wrote: > >>Maybe it's just me, but the solution to NTT's problem is obvious. Even >>assuming that the export of this software would be against the law, why >>doesn't somebody simply violate that law? RSA would publish that software, >>possibly encrypted with NTT's public key, on a public system protected >>against direct export. "Somebody" would download it, write it to a floppy >(...) >>As far as I know, there is nothing wrong with NTT using this software even >>if it is assumed to have been exported illegally. Obviously, NTT won't >>_ask_ for somebody to do this, because then the government will claim it was >>all a conspiracy, but that doesn't prevent NTT from being the beneficiary of >>somebody else's activities. > >What is wrong with this is that, because RSA did not, in practice deliver >the software to NTT, they can have no expectation of payment. No, the copyright is still valid, and NTT couldn't use the software without appropriate payment. > Thus begins >a trumped up lawsuit in international court, and it will eventually cost >RSA more to collect on the sale than the sale was worth. As many rock-solid >implementations of the RSA algorithms as are out there, all NTT has to do >is go to an FTP site in the netherlands. Done deal. But what about the >copyrights (which are still unclear) and the US patents? NTT would not be >able to market their system in the US without losing face. The purpose of the strategem I described is NOT intended to allow NTT to use software without paying. NTT and RSA are probably on very friendly terms, anyway. The purpose is to compartmentalize the illegality to an unidentifiable person, allowing NTT to use the software without having violated any law. Jim Bell jimbell(a)pacifier.com

1 0

Richard Stallman on RSA, Zimmermann, crypto
by Declan McCullagh 17 Dec '03

17 Dec '03

Richard's comments below are very much worth reading. Also check out the following URLs for back fight-censorship messages about the RSA/Zimmermann conflict... MIT's Seth Finkelstein on RSA/Zimmermann history: http://fight-censorship.dementia.org/dl?num=639 Background on RSA's involvement with recent crypto legislation: http://fight-censorship.dementia.org/dl?num=1613 http://fight-censorship.dementia.org/dl?num=1614 http://fight-censorship.dementia.org/dl?num=2282 -Declan ---------- Forwarded message ---------- Date: Tue, 4 Jun 1996 20:18:05 -0400 From: Richard Stallman <rms(a)gnu.ai.mit.edu> To: declan(a)well.com Cc: rms(a)gnu.ai.mit.edu Subject: Re: FW: CWD--Crypto Gets A Nuke (fwd) As an opponent of Clipper--I debated Dorothy Denning on NPR once--I was glad to read about the new Japanese encryption chip. But that chip is not the right solution for most people who want to use encryption. For example, I'm considering using digital signatures. I don't need the high power that requires special expensive hardware, and I would rather not have to buy it. What I would really like is free software, which I can run on an ordinary PC, to do the job. Unfortunately, there isn't any. RSA Inc. made sure of that. Zimmermann initially intended to release PGP as free software. But RSA Inc threatened him with a patent suit, and forced him to change the distribution terms. Now PGP in the US uses RSAREF, which is restricted by a patent license to non-commercial use only. In other words, only hobbyists and academics can use it. There is a commercial version which is proprietary software, and apparently not many people want it badly enough to buy it. The version of PGP used outside the US is free software, but if you use it within the US, RSA Inc. can sue you. This is very bad for people who would like to use PGP. But it is worse than that. It affects the political battle too. PGP had a chance to create a constituency of Americans who demand the right to use encryption. If PGP had been allowed for use in business, not just by hobbyists, we would have far more Americans who care enough to fight against Clipper--and they would include businesses which have the funds to influence legislators. RSA Inc. prevented this from happening, and did so for no reason except money. Bidzos and Rivest would like to present themselves as the defenders of our freedom to use encryption. And it is true, they would like us to be able to use encryption, as long as we are required to pay them for doing so. But when they had the choice of letting us use encryption freely or stamping it out, they chose the latter. I hope you won't portray them as heroes.

1 0

Re: How can you protect a remailer's keys?
by loki＠infonex.com 17 Dec '03

17 Dec '03

The best solution I could come up with (and was willing to write and use) is to specify the passphrase on the command line argument to the compiler make solaris -DPASS="foozooblue" -Lance At 11:55 PM 6/1/96, Bill Stewart wrote: >Encryption is critical for protecting against traffic analysis, >but it's tough to protect a remailer's keys. Unlike regular email, >where you can type the key in as you read it, remailers need to >run automatically once you set them up. Some of the choices are: >- leave it around in plaintext with only Unix file protections > (Ghio2 works this way - does Mixmaster? My ghio2 version has it > compiled into the binary, and I try to delete it from source.) >- type it in to a long-running remailer process > (with human intervention to start) >- SSL-based remailers, where the web server handles crypto on > a per-machine basis instead of per-remailer >- use unauthenticated Diffie-Hellman (either hanging off > a TCP port somewhere instead of mail, or > 3 pieces of email) >- off-line or off-site remailer such as a POP3 winsock remailer > that makes it Somebody Else's Problem, and separates > the remailer's public interface from the working parts >- human intervention on every message (which may not be totally > worthless for moderated news postings, if you want to > take that approach to spam prevention.) > >Anybody have any other approaches? These are mostly weak, >annoying, or both. > > ># Thanks; Bill ># Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com ># http://www.idiom.com/~wcs ># Rescind Authority! ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: Electronic Signature Act Of 1996
by Deranged Mutant 17 Dec '03

17 Dec '03

On 4 Jun 96 at 10:33, Ben Holiday wrote: > Florida now recognizes electronic signatures as legal and binding. In > other words - its okay to sign it by modem. > > The electronic Signature Act of 1996 passed the Legislature unanimously > and became law Friday. The law does not specify how an electronic document > must be signed, but it probably will mean coding the text and typed > signature so they cannot be changed by anyone other than the writer. [..] I've seen some legal arguments that an email message that reads "Bob, Sounds good--it's a deal. --Alice" can in some circumstances be as binding as an oral contract or a scribbled note, which is not meaningless though not as strong as a legal signed contract. As long as one can show Alice *did* write that, that it referred to a specific deal, etc. etc., it holds some legal weight. But I'm no lawyer, and one should never trust legal advice form Usenet or the c'punks list. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0