December 2003 - cypherpunks-legacy

Re:
by Arun Mehta 17 Dec '03

17 Dec '03

At 18:10 17/07/96 -0700, someone via anonymous-remailer(a)shell.portal.com wrote: >Does anyone know how to tanslate PGP into Burmese? I've been talking to human rights people here -- we certainly plan to translate into one or more Indian languages, and perhaps soon there will be action at an Asian level as well. Is this an urgent requirement? If so, I can try to arrange. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/

1 0

Re: Crypto 96
by Deranged Mutant 17 Dec '03

17 Dec '03

On 17 Jul 96 at 16:45, Hal wrote: > Crypto 96 is coming up in about a month. This looks like a more > interesting program than last year, IMO. According to the preliminary [..] > Key-Schedule Cryptanalysis of IDEA, G-DES, GOST, SAFER, and Triple-DES > John Kelsey, Counterpane Systems, USA > Bruce Schneier, Counterpane Systems, USA > David Wagner, Univ. California at Berkeley, USA > > There are actually several cryptanalysis type papers for which > I can't tell from the title whether they will be big new > results or not. Anybody know what "key schedule" cryptanalysis > is? The way a key is transformed into a larger key or S-box. I assume cryptanalysis of these means that there may be weaknesses which can be exploited. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Encrypted files in terror case
by Joe Thomas 17 Dec '03

17 Dec '03

Excerpts from a N.Y. Times News Service piece available at http://www.nando.net/newsroom/ntn/info/071896/info12_18308.html : NEW YORK (Jul 18, 1996 02:00 a.m. EDT) -- In the seven weeks since the trial of Ramzi Ahmed Yousef began, the case, charging a plot to blow American jumbo jets out of the sky, has come to hinge on one off-white laptop computer. [Most of the story, dealing with the defense contention that Philipine police altered files on the laptop, deleted.] Several witnesses reported that some computer files were in code, part of which the police could not decipher. Last week, after the jury adjourned for lunch, Duffy [the judge in the case] prodded the defense to point out that encoding files was not unusual and that some software programs offer such an option. "I don't want the jury to think that encryption is something that only bad guys do," Duffy said.

1 0

RE: Cypherpunks and Toad.com
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

root@HellSpawn wrote: >I'd like to put the words > >Cypherpunks(a)toad.com > >On a tee-shirt. Is cypherpunks, toad.com, or the combination thereof >copyrighted or trademarked or otherwise limited for use? Not that I know of, and you are of course free to do anything you want, but I urge you to leave off the "@toad.com" to prevent clueless subscription requests/noise. There are a number of cpunk tshirts already, one of which contains TCM's sigfile, so the word is likely not copyrighted???

2 1

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Robin Powell 17 Dec '03

17 Dec '03

>>>>> In article <1.5.4.32.19960718150222.0030bf9c(a)giasdl01.vsnl.net.in>, Arun Mehta <amehta(a)giasdl01.vsnl.net.in> writes: > In response to my question about how I might use PGPfone without my ISP knowing, > At 10:52 16/07/96 -0400, Robin Powell wrote: >> >> Hmm... This looks like a _really_ good place for stego. Granted, you >> might get a significant slow down, but it might be worth it depending >> on your needs. > Wouldn't that be very, very slow? It would suffice if I could > have the ISP think that the packets were for irc, or something > else they allow... I actually wasn't reffering to your particular situation so much as a general comment. Having a game of nettrek with encrypted voice in the unused packets would be _very_ secure, I should think... -Robin

1 0

Re: Responding to Pre-dawn Unannounced Ninja Raids
by law＠Samoa.org 17 Dec '03

17 Dec '03

I prefer to keep a large jar of marbles available in the entry room, aoupled with a hard floor, it makes it a bit tricky for an entry team towork properly.. You can probably check out your local crack house for tips on preventing forced entry..there seems to be a constant race between LEO entry tactics and what the drug dealer do to defend themselves.. I might also suggest that you check out Bo Gritz'z SPIKE phase 8 video tape http://www.bogritz.com/products8.html "Perhaps one of most exciting phases and controversial. In Phase 8 you learn Close Quarters Combat (CQC). You'll learn how to identify friend or foe so that you don't shoot a friend. You'll also learn how to clear a room safely and identify a terrorist and hostage." SPIKE 8 also has a good section on room defense. but then who am I to talk. bob's lawyer Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Re: US versions of Netscape now available
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [I've wanted, and tried (honest!) to stay out of this emerging flamewar, but David Sternlight <david(a)sternlight.com> wrote: <...> >It doesn't "leak overseas" as if there were some regrettable lapse in the >plumbing. Someone has to commit a felony violation of Federal law. Also known as "civil disobedience," a dangerous concept which is probably being taught today in civics classes in highschools across the nation. [HORRORS!] On a more serious note, I think that the requirements on the Netscape download page might actually be a "Good Thing," since they expose the public, in an election year, to the info-lust of the GAK crowd in a way that cypherpunks alone never could. I, too, wish that "my life as an arms trafficker," or the CJR book/t-shirt requests, or some of the wilder stuff like Vince's export-a-cryptosystem-to-Anguilla page were linked to Netscape's page discussing ITAR requirements, but I fully understand that Netscape is a business and that they must deal, on a continuing basis, with the government. The government officials whose jobs depend on stupid regs. can be rather humor-impaired. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "It is long past time to end the laughable presumption that voters who can easily cope with the choices offered at Burger King are somehow 'confused' by more than two choices at the voting booth." -- me Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, the "Pennies For Perot" page. Keep billionaires off welfare! ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMe5TwW1lp8bpvW01AQFbpgP/aic2ShJ5N09eVJLxZAUfkP1FsNlNRdFY MNgLvE8+0PnlLoXA2Js5HVo7Zad7URYrtwrSG2C7MwPcs6zwXgxLT6pf+oCg05/m fqaGbc/bWFLTyJDV/+BNEZCWRXPr19FvHv+0NNEVYbQ81IuQsLIgBf/E3g2KXD6X Ma44rCMPTFU= =JR+d -----END PGP SIGNATURE-----

1 0

Re: "address verification databases"? (was: Netscape download...)
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

So... I just have to know someone's name and phone number in the US? Ryan ---------- Previous Message ---------- To: tcmay cc: cypherpunks From: jsw @ netscape.com (Jeff Weinstein) @ smtp Date: 07/18/96 12:47:22 AM Subject: Re: "address verification databases"? (was: Netscape download...) Timothy C. May wrote: > > At 9:45 PM 7/17/96, Jeff Weinstein wrote: > > > Because we have not yet been able to obtain the address verification > >databases that we need for Canada. There is someone working on > >tracking this down right now. When we get the proper database we > >will add access to canada. > > > > --Jeff > > Jeff, can you tell us anything more about what these "address verification > databases" are? > > For example, are they derived from government sources? Census data? (Naw, > can't be, for at least two obvious reasons). Voting records? (Naw.) Credit > card purchases? (??) Our database was obtained from American Business Information. They make those CDROMs with 11 million business names and addresses, and other such products. There is a link to their web page from our US download page. > While I can imagine various commercial firms have indicators that a "T. > Christopher May" once lived in Rio Del Mar (the name of a town I lived in, > though not an official "Postal Service" address), I really find it odd > that, for example, there would be any database that could "parse" the > informal information people provide (absent a well-defined set of addresses > and precise spellings). > > In case I'm not making myself clear, there are no "official" addresses of > persons in the U.S! Not even the tax system requires registration of all > persons and specific addresses. This has come up in several "voter's > rights" cases, where persons with no fixed address were nevertheless able > to vote. If I, T.C. May, say my address is Moonbeam Trailer Park, who's to > say it's not? Maybe it's where I'm staying with a girlfriend, maybe it's > where I get my mail, maybe it's my spiritual home. And yet just which > "address verification database" could possibly confirm that I live in (or > get my mail at the Moonbeam Trailer Park at this exact moment? Absent any > laws clearly defining what one's official name is, official phone number > is, official zip code is, official address is, etc., just about anything we > choose to put down on the Web form is kosher. Our verification software does not check that the person whose name is entered in the form lives at the address entered in the form. We do verify some parts of the information entered. Things like is the state code one of the 50 states, does the zip code match the state, etc. (NOTE - these may not be the exact checks implemented currently. I have not examined the code myself, but these are the types of checks being done.) > At least the MIT system was based on ISP domain names, crude as this is, > and not on putative names and residential or business addresses. We also screen out based on domain names. > Anyway, I don't know if Netscape is rejecting the information I'm providing > them, as I've been unable to get through in roughly 30 connect attempts. We will be increasing capacity soon. The demand is very high. It costs us real dollars to buy hardware and T3 lines to allow people to download the software for free. > But I'm still curious about what these "address verification databases." > Sounds ominous to me. I'm sorry that my choice of words disturbed you. I hope my explanation will allay at least some of your fears. There are many people here (including Jim Barksdale) who are very concerned about maintaining personal privacy. Certainly if we could we would make the US versions of our software available in the same way that we currently make the export versions available. At least people now have the choice of obtaining the US version over the internet. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Re: Making encoding out of an authentication cipher
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: EVERHART(a)Arisia.GCE.Com, cypherpunks(a)toad.com Date: Thu Jul 18 12:44:15 1996 > Suppose you have a secure hash function H(msg) that delivers a random > long period set of hash bits for msg, which is computationally infeasible > to invert and such that the value of H(msg) depends very sensitively on > all bits of msg. These things are used for authentication and tend to > be > all over the world. > > Now suppose I have a key and apply the following transform, where "+" > will mean binary exclusive OR. > > Cipher: > H(key) + M(1) = C(1) > H(key+M(1)) + M(2) = C(2) > H(key+M(2)) + M(3) = C(3) > > and so on where M(n) is the message and C is the enciphered message. > > Decipher: > > H(key) + C(1) = M(1) > H(key+M(1)) + C(2) = M(2) > H(key+M(2)) + C(3) = M(3) > > and so on. > > If the hash function is cryptographically strong, is this or is this > not > a strong cipher? Are there fast hash functions around? > This, along with several other methods (Karn, Luby-Rackoff and MDC are some others) have been suggested in order to convert a hash function into and encryption algorithm. And while the method you suggest has not been broken (at least to my knowledge) there are at least two major problems: 1. It is slow. This method would appear to be approximately the speed of MDC. And MDC (using SHA, what appears to be the most secure hash) is (very roughly) 5 times slower than Blowfish and 3 times slower than IDEA. And although MDC is faster than 3DES in software, 3DES could easily outpace MDC in hardware. 2. (To directly quote Bruce Schneier from Applied Cryptography, page 353) "While these constructions can be secure, they depend on the choice of the underlying hash function. A good one-way hash function doesn't necessarily make a secure encryption algorithm. Cryptographic requirements are different. For example, linear cryptoanalysis is not a viable attack against one-way hash functions, but works against encryption algorithms." (Any typos are mine.) - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMe5p4uSLhCBkWOspAQFzLQf+J7VGyboBIb4/x2uT3ACs/xgMP11EnggF 6xnrT/TalqJofF1KcEGa3+DgfRRSAn0lxe2jGnLRCAj85zNwXNBy6V4A9pr/0Ldg lD0aHpDFBRXZngqHtCANce8OJvC/EwPbotOuFR+V2vwrB7CHD+4XlNxcfcWDZN7i /ffD6YdUnOpKtvj5ElmPmbOfODC10XD35nRbu1NMurmJQESA14Ohzk9KhRzVkNtv pYkwcCqkR2kWGnWSkew9Zfw4U+IOdFiwb9etgiOEl86hM38cK1SM1RxArEfW3vIw k2EM6o/rF4OIiDUYlJ3STxYAn7kAnOQ6PeYeUu48WmX1Y3q05qmFrQ== =Hj2r -----END PGP SIGNATURE-----

1 0

Re: US versions of Netscape now available
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:35 AM 7/17/96 -0700, Yap Remailer wrote: >Have you heard any reports of anyone successfully downloading it >period? Netscape always times out in the middle of a download. I >think the server is so overloaded that it's actually impossible to >download the software. Yep. Got it just after the announcement. Came through fine. (After that, i could not get it to download anything, but the first try worked fine.) Sounde like it is overloaded. (Of course, since it is mentioned on their homepage and they only have one machine serving it, what do you expect?) >I sure wish there were an ftp site overseas somewhere, then I could >actually get the damned thing. Give it a week and i am sure that someone will have it available. Something announced this far and wide will manage to leak out somewhere... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0