December 2003 - cypherpunks-legacy

Bad Signatures
by geoff＠commtouch.co.il 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Jun 22 18:22:50 1996 On Fri, 21 Jun 1996 10:15:13 "Travis J.I. Corcoran" wrote: > I use a lisp package for emacs that I wrote to automatically verify > signatures on incoming mail, so I already see the 10% of messages > which are improperly signed displayed in a red "bad signature" > font. Thus, I'd have no need of this service. > > Further, it makes philisophical/political sense to me to have > verification distributed. Every node should be doing it's own > security. I am not convinced. For a mailing list it makes sense for all members to be aware of message integrity problems. Not all cypherpunks have your lisp package or Pronto Secure which make signature verification of the 10-20 pgp signed messages per day on the list a non trivial task. I also like the idea that cpunks provides as a byproduct a platform for developers to test and debug their security products. We really should be getting the bugs out of plain text signatures. You cannot expect Joe User to differentiate between an intruder and a gateway massaging the message. Geoff Klein Pronto Secure Product Manager -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMcwPzkLv5OMYFK1FAQH8tgP/Y/Qai5TQj45CGk7U9OdF5BrdycyQpKuE UfAnlFut/LmgumyiM2wuy6+CPv8mPITAp375rNVx9UxvyRj8Gv8MFfEEuwVFZpNb WbiWvl2yPBCV/ZBlEdmXJUPhfYto3FFjZX6AwKTMXgHd1j7uW3pBGSW24McEjM2I aBQ1iDbLUY0= =Igm9 -----END PGP SIGNATURE-----

2 1

Re: Federal Key Registration Agency
by jim bell 17 Dec '03

17 Dec '03

At 12:09 AM 6/22/96 -0700, Bill Stewart wrote: >Actually, it may even be low - Cray-type supercomputers aren't particularly >designed for the bit-twiddling you need to do DES well. An application- >specific cracking machine can do it several orders of magnitude faster >for a smaller amount of money. Wiener's design was two orders of magnitude >more cost-effective than the two previous designs (Peter Wayner's content- >addressible-memory design and somebody-from-DEC's GaAs chip design were >both about $50M for a 1-day crack), and those were substantial breakthroughs >when they came out. It would be foolish to use GaAs to build a DES-cracker. If there's one thing we've learned from the fact that microcomputers have "won" against mainframes, and massively-parallel computers have "won" against super-speed scalars, it is that it is much, much cheaper to build 10 transistors of speed "1", than 1 transistor at speed "10." Presumably, they can get the same amount of work done. The main thing that kept vector (parallel) machines back in the 70's and 80's was the problem of subdividing programming tasks into hundreds or thousands of such tasks, suitable for such a machine. That "problem" is no problem at all for DES cracking, since trying large numbers of codes is inherently a decomposable problem. It seems likely that the most economical solution would be to build the cracker on a not-quite state-of-the-art fab, say a 0.5 micron facility, purchased from some semiconductor company who has one too many old fabs. The costs of the hardware would be amortized already, and the product would be sufficiently fast to help minimize the parallelism required. Jim Bell jimbell(a)pacifier.com

1 0

IAG: "Non-violent demonstrations" planned after Net-attacks
by Declan McCullagh 17 Dec '03

17 Dec '03

I subscribed to the IAG list and there's not much (or anything) happening on it so far, but the idea has potential. Here's how to join if you're interested. -Declan // declan(a)eff.org // I do not represent the EFF // declan(a)well.com // ---------- Forwarded message ---------- Date: Fri, 21 Jun 1996 11:13:57 -0700 (PDT) From: Marilyn Davis <madavis(a)deliberate.com> To: iag(a)deliberate.com Subject: For forwarding: IAG Invitation Alabama, Australia, Belgium, California, China, Connecticut, Florida, France, Georgia, Germany, Illinois, India, Indonesia, Italy, Jordan, Kansas, Malaysia, Maryland, Massachusetts, Montana, New Jersey, New York, Oklahoma, Oregon, Pennsylvania, Russia, Saudi Arabia, Singapore, South Korea, Sweden, Turkey, United Arab Emirates, U.S., Viet Nam, Virginia, and Washington. ** INTERNET UNDER ATTACK BY LOCAL AND NATIONAL GOVERNMENTS EVERYWHERE ** Fight Back!! Join the Internet Action Group gathering now on the email list: iag(a)deliberate.com. We will organize simultaneous local non-violent demonstrations at coordinated sites around the world in response to local and national attacks on the internet. Our list has new technology for polling ourselves so we can plan our actions democratically. To join the IAG, send a message to majordomo(a)deliberate.com. Your message should say: subscribe iag This initialization of the IAG is the democratic decision of the cyber-rights list, cr(a)deliberate.com. To join this group or to communicate with us, your message to majordomo(a)deliberate.com should say "subscribe cr". <Please circulate widely.>

1 0

Re: Bad Signatures
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:12 PM 6/22/96, geoff wrote: >I am not convinced. For a mailing list it makes sense for all members >to be aware of message integrity problems. Not all cypherpunks have >your lisp package or Pronto Secure which make signature verification of >the 10-20 pgp signed messages per day on the list a non trivial task. > >I also like the idea that cpunks provides as a byproduct a platform for >developers to test and debug their security products. We really should >be getting the bugs out of plain text signatures. You cannot expect Joe >User to differentiate between an intruder and a gateway massaging the >message. > >Geoff Klein >Pronto Secure Product Manager Trusting others to perform cryptographic functions (encryption, decrytion, signing, signature verification, etc.) is counter to the usual notions of security. Of course, people are free to ask others to do cryptographic functions for them, to tell them which signatures are valid, and which are not. It's a free society, after all. However, I think there's already enough traffic on this list without having "bounce" messages chastising folks for having signatures that for one reason or another failed their tests. (Could be munging at _their_ end, for example.) Those who want to compile lists of "bad signatures," as determined by their tests, could include a pointer to a URL at their site which says something like "A list of suspected bad or improperly-formed signatures may be found at hyyp://www.key-trust.org" This heads off having a message with a bad sig generating N more messages to the list announcing some conclusion or another about the sig. Not something we need. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Bad Signatures
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:12 6/22/96, geoff wrote: >> Further, it makes philisophical/political sense to me to have >> verification distributed. Every node should be doing it's own >> security. > >I am not convinced. For a mailing list it makes sense for all members >to be aware of message integrity problems. Not all cypherpunks have >your lisp package or Pronto Secure which make signature verification of >the 10-20 pgp signed messages per day on the list a non trivial task. If you think about the issue in more detail, you will realize that having a third party do signature verification is no more useful than having a third party do your encryption for you. In other words, not only is it not useful, it is downright dangerous, since it provides you with a false sense of security. If someone wishes to bounce messages that don't verify back to the originator, great. But please do not further add to list traffic by bouncing these messages to the list. Thanks, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Disclaimer: My opinions are my own.

1 0

Practical Solutions at USENIX SECURITY Symposium
by Cynthia Deno 17 Dec '03

17 Dec '03

If you are responsible for your company's computer security, you may want to attend the 6th USENIX Security Symposium - Focusing on Applications of Cryptography, in San Jose, CA, July 22-25, 1996. There will be refereed papers, invited talks, BoFs, and Vendor Exhibits. Tutorial speakers include Ed DeHard, CERT; Dan Geer, Open Market; Jon Rochlis, BBN Planet; Marcus Ranum, V-One; Matt Bishop, UC Davis; and Bruce Schneier, Counterpane Systems. For detailed information, please visit our Web site: http://www.usenix.org, or send email to: conference(a)usenix.org. /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/- | Cynthia Deno | USENIX | | Tel: 408 335 9445 | The UNIX and Advanced Computing Systems | | Fax: 408 335 5327 | Technical and Professional Association | | cynthia(a)USENIX.org | | | Check out USENIX on the Net..........http://www.USENIX.org | /-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-

1 0

Programmers and Hackers v/v Patents, Intellectual Property, etc.
by attila 17 Dec '03

17 Dec '03

Addressed to: Bill Stewart <stewarts(a)ix.netcom.com> Paul Penrod <furballs(a)netcom.com> Cypherpunks <cypherpunks(a)toad.com> ** Reply to note from Bill Stewart <stewarts(a)ix.netcom.com> 06/22/96 01:20am -0700 = At 02:57 PM 6/21/96 GMT, attila <attila(a)primenet.com> wrote: = = > personally, I think RSA has been most generous in their = > licensing: a personal use license of the basic algorithm is free. = > How do you suppose PGP really exists? it's free! RSA has done = > more to advance cryptography with this policy than any other in many = > years. the political and public relations benefits to our rights = > to cryptography and the public relations bonanza for public = > awareness is not even estimable, let alone measurable. The Federal = > persecution of Phil Zimmerman was a PR bonanza and a rallying cry. = = One of the main reasons that PKP let people use RSAREF free was that, = mostly through PGP, people were already using it; this lets them both = control the market to the extent that they can as well as letting = free-software writers advance the state of the art and make commercial = companies and their markets aware that RSA is the algorithm to use. = absolutely. if you are being "bootlegged" on a basic conceptual patent by a class of users which are impossible to either regulate or litigate (individual users), might as well maximize your advantage --in this case, the combination of the privacy aware and the intense effort of the government to suppress 1,2,4, and 5 combined for a reward of public awareness which would be difficult to attain any other way, particularly for free --I seriously doubt that even saturation advertising time during superbowl would be effctive! (joe sixpack audience)! = > on the other hand, the Free Software group, despite the = > tremendous value to those of us who develop, does nothing to = > protect our basic freedoms, and place the issue before the U.S. = > (and world) forum. = = The League For Programming Freedom, closely intertwined with FSF, = has been lobbying against software patents for a long time. = Maybe it's a losing battle, but they've been one of the prominent = sets of good guys. And then there are heavy-duty GNU supporters, = like Cygnus Support (which makes its money developing and supporting = free software), one of the co-founders of which was John Gilmore.... = free knowledge is a state of mind. free software takes away the "American" work ethic incentive. when a nation state (or state or world, etc) decides to appropriate the work of a class of entreprenuers (say software developers), there will be no more creative productive results; few, if any, programmers will work 14-20 hours per day, 7 days a week for what could be several years unless they are: a) crazy (good possibility); b) deranged (more than a few whom I know fit this class) c) obsessed (goes with the turf) d) hoping to swing on the brass ring (not the gold ring). I never met or hired a "real old-style hacker" programmer who did not fit _ALL_ 4 of the above categories and was not obnoxious as well. It is the same difference which separates real hackers from programmers: a) what languages do hackers use? any, except they do not waste time on x86 b) where do you find hackers? in a (usually rented) place in the Valley (pick one) in a room littered with old newspapers and fast food bags, lit only by the glow of a CRT... c) what's the real difference between hackers and programmers? programmers code; hackers tweak! = But yes, software patents do mostly suck.... = that's the basic idea. the only useful patents are like those owned by RSA which protect a fundamental principal. The rest of softwware success is marketing and intimidating anyone who copies your basic ideas which are protected by intellectual property rights --often more valuable than a patent. The RSA saga was first published in Scientific America in Aug of 1977 --it's been a long, and expensive, road which may yet pan out before the basic patent expires in 2001 or so. attila -- Fuck off, Uncle Sam. Cyberspace is where democracy lives!

1 0

Re: Cash Is Dying
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:10 AM 6/22/96 -0500, snow wrote: >On 21 Jun 1996 nelson(a)crynwr.com wrote: >> Cash is anonymous. > > And will remain as long as it still is. E-cash is a great idea, >and I hope to see it _really_ working soon, but it will not be anonymous >anytime in the forseable future. > > Also, people won't trust it. Not the people that read this list, I >trust some of the people here, and if they say it works, I trust that. Not >just one, but _all_ of the group I trust. No, people like my parents and >other relatives. People smart enough to read the papers, and smart enough >not to trust everything the "experts" say. After hearing some of my friends and aquaintences rant about the little metal strips in money and how it is a conspiracy to see how much cash you have in your pockets from the orbital mind control satelites, I am just waiting to see what they will say about e-cash. Probibly something about the hidden methods the government will force into the protocol to enable them to track each and every transaction. (Better not say that too loud though, or they might get ideas...) You will know that e-cash is here to stay when the conspiracy freaks latch onto it as the next increment of the "Number of the Beast(tm)". > Cash is easy, cash is plentiful, you can hold cash in your hand >and KNOW that you have it. And you do not have to check in with the bank every time you spend it... --- |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

ISAKMP Security Architecture
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Jun 22 14:20:39 1996 Some of the subscribers to this list might be interested in the following URL: http://web.mit.edu/network/isakmp/ciscokmp.html It is a link to Cisco Systems ISAKMP distribution. Cylink and RSA have both announced support of the protocol. Lou Z. Lou Zirko (502)383-2175 Zystems lzirko(a)c2.org "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQEVAwUBMcxHqctPRTNbb5z9AQEGTAf9H+PXHJ1J1c4gfVCqRaRZhI0adRqJAiwk b+B9f8OQMeXcgWiFHtpGtEm5roOQT2qujwjDXLGNKvWCtPbkJvmlbwLgwGkCtykx Ndycy3fjz0oWimCpb+GI2MLPTgs4xMHmMck0TaeVDaxV9+G+GTekOD/jDgNptpxn gmNJbw3Ww84XTUGswLofhBZTikjkhXLgFWv6lx408Yxp65b+XEEneGqGh/k7z9CW BsXFu50y6JN5/aacztWg1krFHXVD8Msw3cqEMQ5YiiKF5lt0VILOxTOLxIURCkim lpTZ9AqDE+2WwVWc3ltumb1kyRKbJQvgcS0i27OHMGlUv0GEk99Trg== =700Q -----END PGP SIGNATURE-----

1 0

Re: Bad Signatures
by Omegaman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: geoff(a)commtouch.co.il > > IMHO Getting message authentication to work correctly should be a > cypherpunk objective. how does posting notifications to the list satisfy that objective? read on.... > Putting something like "Bad Signature Notification" in the subject will > make it quite easy for not-interested readers to killfile. True. But my opinion is that this list isn't the appropriate place for it. Opinions were asked for, that is mine. A separate list maybe... > BTW this is the first time I have sighted the word "veracity" being > used in relation to signatures. Is the term used elsewhere? Could it be > used to separate the integrity property of a signature from its > authenticity property? Oh lord. I don't want to get into semantic hair-splitting. It's the word I chose at the time. It may be the wrong one. Don't read too much into it. To put the issue simply. Bob doesn't like Jane for whatever reason. Jane signs all her messages with PGP. Bob posts false" bad signature notifications" to the list to discredit Jane. Am I to just read Bob's messages and believe the notifications he's posted.? No. I still have to examine Jane's messages myself for signature authenticity. I understand that this is one person who wants to perform this service objectively. But why should I trust his motivations? I still have to do my own individual signature checking to be sure. For this reason, I think the idea accomplishes little. The intentions are good, but I don't see a major benefit. Maybe someone else has another idea or angle.... me -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMcwm5ab3EfJTqNC9AQGl3gP9HD4mhPY6dg69ZaWTeUYEsm+45rDFkgWW mNDbfeudTAgfl6Jdnm+xs0g+yfZcQQUe5g/qBpp0Nk0SRyzzL+mq+U+CJr9GA6Pr Mm3a3JY65mwYqTis1dO4FzHDvmhlN5GaBlQT0HOGPywQZGkMf3IXCGZIDZG7z4lH V6/4Y94A7ho= =paU2 -----END PGP SIGNATURE----- ----------------------------------------------------------------------------------------------- Omegaman <omega(a)bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send E-mail with the "get key" in the "Subject:" field to get my public key ---------------------------------------------------------------------------------------------------------------------

1 0