December 2003 - cypherpunks-legacy

Announce: WEB OF TRUST keyring
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- March 14, 1996: I announce the first true "web of trust" PGP keyring. Last year, I attempted to create a keyring containing the web of trust. I did so, because I was beginning the process of integrating PGP into my mail and news, and realized that a valid signature did not mean much if I had to reason to trust the key, not to mention that keyrings were approaching 5 megabytes, which drastically slowed down searching through the keyrings. In a web of trust, if A has signed B, then if A is in the keyring, B is added. My project last year, as a result very crude methods I was using, added B if B had signed A. This made for significant numbers of junk keys. I promptly dubbed the keyring the "Web of Nobodies" keyring. There are many people in a much better position than I to do what I have done. My methods are still somewhat crude. I have written, however, a program that will generate the keyring with minimal user intervention, using a seed key as its center. I am considering releasing the source instead of just the keyring. The code is sloppy, the methods crude. I understand that PGP 3.0 will include the capability, so the program is merely a short term solution to a short term problem. If there is a large enough demand for the code, I will probably make it available. (Note: I rely on PGP itself to extract the keys, which takes about 8 hours to process on an HP9000) I would certainly appreciate feedback from anyone who uses the keyring. The master keyring I used was a 9.3 megabyte keyring I obtained from the Norwegian key site at uit.no (sorry bal, but I couldn't find yours). I obtained the keyring in late February. As the seed for the web of trust, I used Derek Atkins's key. I have also inserted the following keys: Pr0duct Cypher (0x97558a1d) CancelMoose[tm] (0x538d56a1) Scamizdat (0x37a541d1) Cypherpunk Enq. (0xaa5f5c9d) Maude X (0x1ead5e8d) Black Unicorn was not inserted due to one key being revoked, and the other unsigned. I couldn't find Alice's key, and figured it wasn't worth the trouble since it's fake anyway. (Or at least that's what the imposter has convinced everyone.) I don't know of any other keys that should have made this list. The keyring is _significantly_ larger than I expected, 2.9 megabytes uncompressed, although still a third the size of the original master. Because of the size, I have also put together a second keyring using stricter parameters. Only keys that were 4 hops from the "center keys" (specifically, 5 keys between itself and Derek Atkins) were included, with the additional constraint that _no_ keys with fewer than two links toward the center (see below) were processed. The resulting keyring was 1 megabyte in size. (Note: the PGP extraction from the "big" keyring took under 30 minutes) The keyrings are named weboftrust.big.pgp.gz and weboftrust.small.pgp.gz respectively. They are both available by anonymous ftp exclusively at ftp.hacktic.nl / utopia.hacktic.nl, in /pub/replay/pub/pgp/pgp-key-ring. C2 did not respond to either of two enquiries. Detached PGP signatures of the .gz files follow: - -----BEGIN PGP MESSAGE----- Version: 2.6.2 iQB1AwUAMUfE3cLa+QKZS485AQHE5gL8DOAkT5s+BzIik5uK+NBW1ithL4DCfmll pqin/4Bhs3LOP7zj11vvufMNGzDvcVonTO9meQEjPL4hanouxizzB7XM6CKidbK+ uAAxLvjkNKuRu1Ci1Tw6jbdd5WdG73us =dXm9 - -----END PGP MESSAGE----- - -----BEGIN PGP MESSAGE----- Version: 2.6.2 iQB1AwUAMUfNKMLa+QKZS485AQG5FgL+Oy62xLT8zMJHpmyFez6uC7UJKFaOAxFB nnWCUOLyp9X9KB+Kasn8Oex4glg1pEMOMB4ZiDT7iVJDuOmm1p07pC3pULmj0+O/ tnNEGbyOpyzeEnAb3vLVvHamzvZ+YPp/ =soxN - -----END PGP MESSAGE----- I have also done some analysis. In the big keyring, there are 2910 keys. The longest trust chain length is 287 keys. The maximum connections any key had was 66. The average "connectivity" among the keys was 4.3. (Hello to my friends at the NSA) In the small keyring, there are 551 keys. The longest trust chain length is, of course, 6 keys. The maximum connections any key had was 68. (I have no explaination for why this is 2 more than the big ring, other than coding changes) The average "connectivity" among the keys was 3.1. For reference, the web of nobodies, built 6 months ago, had 734 connected keys, a max depth of 104, maximum connectivity of 47, and average connectivity of 5.6. For further information, by using the "big" keyring and not processing any keys with fewer than _3_ links back to the "center keys", but with no depth restriction, there are 1348 keys, producing a max chain length of 83 keys. The average connectivity is 4.6. Meaning, there are several people that would be very difficult to spoof. Go meet one of them. In order to prevent loops, I keep track of whether a key had been visited. By incrementing the visited field on a key each time I encountered it (but exploring no further), I was able to roughly gauge how well (versus depth == how close) connected the keys are, relative to the root. I used this number in making the small keyring. I encourage Someone[tm] to start a keyserver servicing only the web of trust. Don don(a)cs.byu.edu Note to the curious: The reason I picked Derek is because I met someone claiming to be Derek who not only gets mail at warlord@mit, but also has control of the key. Hence, I'm merely picking the only key that comes with PGP that I also happen to trust. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMUjUAsLa+QKZS485AQGPCQL/bWRgDsE0QSwEf96aB3X4M+Wan7DGeeab A9NuSpYF6RAm307mFIv7O7iSCcuuRlZmFZh9Bzmh456+8NdbuPSZBEk1+MNjHqmI hhDFidL+IFpjNKItnIFCj1C9aOmyWRuN =NZ0I -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Hello to my friends at the NSA. * This user insured by the Smith, Wesson, & Zimmermann insurance company *

1 0

Re: Cypherpunks reference in Netscape book
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:37 AM 3/15/96 -0800, you wrote: >I'm writing the "Encryption and SSL" chapter for the Netscape products, and >I'm finishing it up with a "Further reading" section that lists >crypto-related books, web sites, and newsgroups. I was thinking of including >a reference to this mailing list. > >Any strong opinions either way? The big problem with the list isn't just signal-to-noise, it's VOLUME VOLUME VOLUME - you don't want somebody to subscribe and get flodded with 100 messages/day without warning. (There's also the problem with newbies sending us mail saying "please send me some anarkist crypt0 warez, d00ds!" If you're going to refer to the list, please mention - the cypherpunks home page is www.csua.berkeley.edu/cypherpunks - you can browse the list with a news reader at nntp.hks.net and with the web at www.hks.net (delayed a bit). - the list is high volume, 50-100 messages/day, - there are lots of readers, 500-1000, who get all the mail sent to the list. - if you want to unsubscribe, send mail to majordomo(a)toad.com, saying help - oh, BTW, if you _do_ want to subscribe, cypherpunks-request(a)toad.com is the canonical location, and majordomo(a)toad.com is the droid. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: Tim's friend's mildly retarded son
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 06:50 PM 3/15/96 +0100, Asgaard wrote: > FDA has a very good reputation This is not correct: The FDA has a thoroughly villainous reputation. Among other things it engages in corruption and extortion. Companies who want their stuff approved hire ex FDA "advisors". There is ample evidence that these advisors do no actual work, the FDA simply knocks back applications that fail to pay large sums to their friends. Indeed one company recently won a court case on this ground. The FDA is famous for grotesque scientific incompetence, (as for example its recent showboating on silicone), for playing to the gallery, for simple extortion, as a court recently found, for corruptly excluding drugs that people who are not well connected wish to sell and for corruptly approving the often identical drugs that people who are well connected wish to sell, and for a callous and light hearted disregard for human lives. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Why escrow? (was Re: How would Leahy bill affect crypto
by jim bell 17 Dec '03

17 Dec '03

At 11:41 PM 3/13/96 -0800, jamesd(a)echeque.com wrote: >At 03:27 PM 3/13/96 -0800, jim bell wrote: > >> There is nothing in Leahy's bill which appears to prohibit the >> escrow agent from informing the key holder of a request/demand for the key; > >On the contrary: See section 2802(c)(4) Ooops! You're right, it's much worse than I thought... This bill is truly a pile of crap.

1 0

BES_ieg
by John Young 17 Dec '03

17 Dec '03

Architectural Record reports in the March issue on "Building Security: Coping With Threats From Bombs to Break-Ins." It shows the parallels of designing to protect vulnerable buildings and the hapless computer systems inside them. It reviews current approaches for "crime prevention through environmental design (CPTED)." And offers a cypherpunkish outlaw-and-disorder survey of besieged corporatism: For Which of the Following Does Your Organization Have Response Plans? Employee theft 90% Bomb threats 85% Fraud 80% Employees bringing weapons to work 79% Fights among employees 76% Robberies 75% Threatening phone calls 72% Verbal threats from employees 69% Employee sabotage 65% Murder threats 60% Civil unrest 53% BES_ieg

1 0

Re: Beat Remote Monitor Snooping?
by Gary Howland 17 Dec '03

17 Dec '03

> At 12:18 AM 3/16/96 GMT, John Lull wrote: > >On Thu, 14 Mar 1996 21:54:10 +0100, Gary Howland wrote: > > > >> NTSC (TV video) modulation is done by phase modulation of the 3.579545 MHz > >> subcarrier. > > > >This is not correct. I'd suggest you go back and re-read your NTSC > > references. Sorry, I didn't write that! I accidentally replied to this mail, but didn't comment on it - must be someone else!

1 0

Re: Venona NSA web page
by Mutant Rob 17 Dec '03

17 Dec '03

1 0

Re: maling list
by David K. Merriman 17 Dec '03

17 Dec '03

At 12:51 AM 03/15/96 +0000, you wrote: >Can you please take me off your mailing list. Thankyou. >firebrd123(a)mail.interconnect.net We can take you off the maling list, or we can take you off the mailing list. Which would you prefer? Of course, you'll still be on our shitlist.... Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: Venona NSA web page
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:42 AM 3/14/96 -0800, Vladimir Z. Nuri wrote: >------- Forwarded Message > >Date: Wed, 13 Mar 1996 06:59:32 -0500 (EST) >From: merkaba(a)styx.ios.com >Subject: VENONA PROJECT (fwd) > > > > >- - ---------- Forwarded message ---------- >Date: Tue, 12 Mar 1996 22:07:24 -0500 >From: Ronald Pearce <ronald(a)cybercomm.net> >To: merkaba(a)styx.ios.com >Subject: VENONA PROJECT > >http://www.nsa.gov:8080/docs/venona/venona.html > >The VENONA Project > >In July 1995 the Intelligence Community ended a 50-year silence regarding >one of cryptology's most splendid successes - the VENONA Project. ... How they did it (from http://www.nsa.gov:8080/docs/venona/memory.html) A word about the VENONA cryptosystems---they should have been impossible to read. They consisted of a code book in which letters, words, and phrases were equated to numbers. So a code clerk would take a plain text message and encode the message using numbers from the codebook. This would have presented a significant challenge itself depending on how long the code book was used. However, the messages were further modified, in other words double-encrypted, by use of a one time pad. The use of a one time pad effectively randomizes the code and renders it unreadable. The key to the VENONA success was that mistakes were made in the construction and use of the one time pads---a fact that was discovered only through brute force and analysis of the message traffic. (http://www.nsa.gov:8080/docs/venona/monographs/monograph-2.html) ... One-time pads used properly only once are unbreakable; however, the KGB's cryptographic material manufacturing center in the Soviet Union apparently reused some of the pages from one-time pads. This provided Arlington Hall with an opening. Very few of the 1942 KGB messages were able to be solved because there was very little duplication of one-time pad pages in those messages. The situation was more favorable in 1943, even more so in 1944, and the success rate improved accordingly. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: FCC-type Regulation of Cyberspace
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:59 AM 3/15/96, Bill Frantz wrote: >At 9:26 PM 3/14/96 -0800, Timothy C. May wrote: >>Mr. Frantz, unless you can prove your claims here, forthwith, I must inform >>you that they are in violation of the Truth in Speech Act of 1996. Please >>retract them, now. > >Political speech, not commercial speech. The act doesn't apply or is >unconstitutional. I recognize no such distinction, and neither does--in my reading--the First Amendment. The First doesn't say, "Congress shall make no law...except for commercial speech...and except for religious speech...and except for insulting speech...." It said, simply, "Congress shall make no law..." (Before Bill jumps in and points out that he said nothing about religious, insulting, etc. forms of speech, I added those because it underscores just what "Congress shall make no law" means.) The issue of _fraudulent claims_ is presumably a main reason for those who think commercial speech is "different" from ordinary speech. Fraud is tough to control through legislation without severely limiting free speech. For example, if a Jehovah's Witness comes to my door and tells me all the wonderful things that will happen if I convert, is this fraud? Before one says this is "noncommercial," more fortunes have been lost or given away to Moonies, Christians, and other cults than all the financial scams in history. If a recruit to the Unification Church "is led to believe" that she will find salvation in the bosom of the Church if she donates her inheritance, is this fraud? Personally, while I view all religions as basically fraudulent, liberal societies have accepted the view that it's best that the State not seek to determine which claims are true, that "caveat emptor" should be the rule. The same caveat emptor view is the basic rationale for the First Amendment. It is recognized that free speech will inevitably cause some people to make bad decisions, to make bad investments (such as in the canonical case of an investment advisor giving advice that turns out to be flaky), and so on. "Don't believe everything you hear" is the operative phrase. Again, I see no distinction between commercial and other forms of speech. If a contract is involved, then civil law is the way to handle this. (As it might be with religious speech, where someone is told contractually that if they give $10,000 to the church their blindness will be cured. Key to a contract must be a testable set of results.) The First is under constant attack by people who claim that some type of speech is "not covered" by the First, or that other clauses of the Constitution give the State authority to regulate speech, or that the Founders did not "intend" for certain types of speech to be protected. The "campaign reformers" want limits placed on how much speech a candidate may issue (or how much speech people like me, as a volunteer or PAC, can issue). The medical protectionists want the speech of quacks, midwives, and other non-union members suppressed. And the arguments about "commercial speech" could mean broad limits on speech. >>Do you see the problem? > >Of course. Why do you think I said (in the 4th paragraph which you didn't >quote) (ZING :-) ): Touche. >BTW - I consider non-free markets, produced primarily by oligarchic >combines of large organizations to be a major impediment to removing >government influence from the economic system. Easing market entry is one >way to reduce the power of these oligarchic combines. I don't want to just >trade elected government oppression for unelected corporate oppression. To >put it bluntly, to suppress the 19th century coal mining strikes, the >companies hired the Pinkertons. I don't see a whole lot of difference >between this kind of private enterprise transaction, and Ruby Ridge. But this is direct violence. Libertarians don't condone this. Using episodes of such violence, by any side, as an argument against free markets is just an appeal to emotion. (I'm of course not saying we will ever be free of people initiating the use of force.) As for "oligarchic combines," certainly much larger and more concentrated examples may be found in Microsoft and Intel, which currently have about 80% apiece of their respective markets. Not to many Pinkerton guards forcing we Mac users to switch to Microsoft and Intel.... --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0