December 2003 - cypherpunks-legacy

Again, disappointed in Gingrich
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Again, I'm disappointed in Gingrich. This amplifies the earlier comments. -Allen >Clinton, congressional leaders to meet on terrorism > _(c) Copyright 1996 Nando.net_ > Associated Press [...] > Gingrich, interviewed on NBC's "Meet the Press," said, "I think that > we should have a provision that allows us to recognize that we now > live in the age of the cellular telephone and allows us to track an > individual person" He said the taggant requirement was "a > possibility."

2 1

POLL
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, The electronic newsletter put out by the TV show, C-NET Central, had this item in the most recent issue: ------------------------------------------------------------------ 5. "YOUR TURN": SHOULD YOU BE ABLE TO READ BOMB-MAKING INFO? The United States and seven other governments are moving to "felonize" distribution of bomb-making information on the Net and other electronic media. Yet censorship of the Net was recently dealt a double blow by twin defeats of the Communications Decency Act. Is this strictly a free speech issue? Or is there a difference in your mind between pictures of naked people and blueprints for a pipe bomb? And can the Net know the difference? To contribute your opinion, phone CNET at 415/395-7805, enter extension 5400, and leave a message. We'll listen to the responses and broadcast some of the best on CNET radio. Each week Digital Dispatch brings you the new "your turn" question, and each Wednesday you can hear the responses to the previous week's question on CNET radio: http://www.cnet.com/Content/Radio/ ----------------------------------------------------------------- Some of you may have a comment about this subject. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Tolerance
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:46 PM 8/1/96, Chris Adams wrote: >Just a comment to all of the 'true libertarians' out there, especially >the "defend to the death" types: How many of you defended Mr. >Sternlight's recent membership? > I certainly did, as you all know. But, to clear things up, I don't think I've ever in my life uttered the phrase "defend to my death your right...." (I don't think asking the 1000+ members of this list to say one way or another is a good idea.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Cracking RC4/40 for massive wiretapps
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:13 AM 7/30/96 -0700, frantz(a)netcom.com (Bill Frantz) mused paranoidly: >I combine the above with Whit Diffie's observation that, while crypto users >are interested in the security of *each* message, organizations which >monitor communications want to read *every* message. A TLA interested in >monitoring communications would need to crack RC4-40 much faster than >1/week. When we discussed using FPGA machines to crack RC4/40 last year, someone calculated the cost of cracking a message at 8 cents if you're doing enough to amortize your machine, and Eric had designed a system that should be able to crack it in about 15 minutes for $25-50K. The two basic search approaches are to take a cyphertext and decrypt it trying many keys to see if you get a likely plaintext, or to take known plaintext and encrypt with many keys to see if you match the cyphertext. But those designs are for one-at-a-time cracks. An interesting question is whether you can speed up performance substantially by cracking multiple messages at once. For instance, if you've got known plaintext, such as a standard header format saying "FooVoice" or "BEGIN DSA-SIGNED..", you can try many keys and compare them with _many_ cyphertexts, which may not slow down the FPGA very much. Also, even for unknown-plaintext, since key scheduling is a relatively slow part of RC4/40, you can split the key-schedule and the block-encryption phases, feeding one keyschedule output to multiple decrypt-and-compare sessions in parallel. So the cost per victim of cracking many sessions may be much lower. >Now expensive specialized cracking equipment can certainly speed up the >process, but there may be a better way. If cryptanalysis of RC4 yields >techniques which make the process much easier, then it is the ideal cypher >to certify for export. >The paranoid conclusion is that there is a significant weakness in RC4. Just keeping the key length down to 40 bits on a fast cypher is a good start. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # Dispel Authority!

3 2

Re: Freeh slimes again: Digital Telephony costs $2 billion now ...
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:58 PM 8/1/96, Ernest Hua wrote: >Louis Freeh is now asking the Congress for $2 billion to fund >Digital Telephony. Yes, that is FOUR TIMES what he said it >would cost the taxpayers to give up their own privacy. Score >one for the cynics who said $500 million was not enough. And when this $2 B is defeated by encryption, look for dramatic, drastic, and draconian restrictions on crypto. (With the Internet Phone deals--even Intel is entering the market--why are there no widespread uses of PGP or S/MIME? Yes, I know about about PGPhone, and also the Nautilus product, but none seem to be used by anyone I know. Maybe we should spend some time talking about the practical realities of these tools.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Jewell is the Militia Bomber!!!!
by JonWienk＠ix.netcom.com 17 Dec '03

17 Dec '03

On Thu, 01 Aug 1996, Gary Howland <gary(a)systemics.com> wrote: >jim bell wrote: >> >> At 07:49 PM 7/31/96 -0700, Timothy C. May wrote: >> > >> >2. They found a _shotgun_ in his cabin. >> >> No, no, Tim. The proper way to deliver this to a TV audience is, "They >> found an ARSENAL in his COMPOUND!" > >Alternatively, describe the shotgun as a 50 caliber cannon. > >Gary [snip] Actually, a 12-gage shotgun is approximately .73 caliber. Maybe it was a 16-gage? BTW, many "real terrorist incidents" are acknowledged by the group committing them, so that they will win support for their "cause," or notoriety, or whatever other gratification their sick minds might derive from carnage. The fact that no one has claimed responsibility for the bombing skews the perpetrator probabilities more toward a single disturbed individual or a Reichstag rehash. Ernest Hua (hua(a)chromatic.com) wrote: >: How does one verify that an IP address is coming from a U.S. site? >: How do most FTP site (e.g. those which carry crypto) determine the >: origins of a connection? >What's the use ? It makes it only nominally more difficult to access >an US crypto site, one needs first to esthablish an US beachhead ie. >open an US account, and ftp the eleet crypto warez using the newly >created US account as an intermediary. >So the next step will be a tag that a user is an 'alien' ? [snip] The chupa-cabras, Grays, and the Art Bell Fan Club would file an EEOC class-action lawsuit, citing preferential treatment for beings that "the average citizen" actually BELIEVES in. More lawyer-bait. Jonathan Wienke "1935 will go down in history! For the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future!" --Adolf Hitler "46. The U.S. government declares a ban on the possession, sale, transportation, and transfer of all non-sporting firearms. ...Consider the following statement: I would fire upon U.S. citizens who refuse or resist confiscation of firearms banned by the U.S. government." --The 29 Palms Combat Arms Survey http://www.ksfo560.com/Personalities/Palms.htm 1935 Germany = 1996 U.S.? Key fingerprint = 30 F9 85 7F D2 75 4B C6 BC 79 87 3D 99 21 50 CB

1 0

algorithms for verifying U.S. IP address ...
by Ernest Hua 17 Dec '03

17 Dec '03

How does one verify that an IP address is coming from a U.S. site? How do most FTP site (e.g. those which carry crypto) determine the origins of a connection? It seems to me that if the NSA/DoS is serious about keeping crypto strong for U.S. internal use, then they would help establish a method for U.S.-only interchange of this sort of software. It is clear, however, that they do NOT have an interest in helping with this identification effort as it will thwart their own efforts at tapping U.S. (er ... oh gee ... they're NOT suppose to do that, right? okay, they must not be doing it then ...) Ern

2 1

Re: Is 1024-bit PGP key enough?
by Anonymous User 17 Dec '03

17 Dec '03

> But the original author also needs to step back and understand his > security needs. In particular, if you're trying to protect your > information against an enemy who is willing to spend $10B to get it, > they'll have a lot of options other than hiding in a back room with some > cracking equipment. Would you be willing to sell them the information > you're trying to protect for (say) 10% of that $10B? Would your partner? > Your wife? The idea is simple. Since it is easy to increase the size of the pgp key -- certainly easier than improving my wife -- it is not uneconomical to be a little overly paranoid over the size of my key. All it costs me is a couple of seconds of CPU time!

1 0

South Florida Cypherpunks Meeting
by Joey Grasty 17 Dec '03

17 Dec '03

Y'all: The South Florida Cypherpunks will meet at Hops Grill & Bar in Boynton Beach, FL on Saturday, August 17 at 2:00 PM. As always, our meeting place is at a microbrewery, and this one has some very fine brews. In addition, the Cypherpunks Brewmaster, Jim Ray, is brewing up a special "summer dark" brew for the meeting. We will enjoy his swill^H^H^H^H^Hfine beer at my house following the meeting.* I'll post directions to Hops as we get closer to the meeting time and put a map on my web page at: http://www.c2.net/~winsock/ Please send me a note if you plan to attend so that I can alert the NSA^H^H^Hrestaurant on how many will attend. Send me your key and fingerprint for keysigning if it hasn't been signed by any subversives^H^H^H^H^H^H^H^H^Hcypherpunks before. * All joking aside, Jim is a very fine brewmaster. I just wish he'd spend a few bucks and ferment in something other than 2 liter coke bottles that explode in someone's truck... Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

1 0

Re: The "Secure" version of Netscape for Linux is *NOT*
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:25 PM 8/1/96 -0700, Tom Weinstein wrote: >Alan Olsen wrote: >> >> I just installed the "secure" version of Netscape off of the "US Only" >> download site. >> >> Seems that it is actualy the international version and not the 128 bit >> version. > >What makes you think you got the export version? > >Here's one way to find out. If you look in the Security Preferences >panel under the Options menu, there are two "Configure" buttons for >configuring what ciphers are enabled for SSL 2 and SSL 3. The domestic >version supports a greater variety of options, including triple DES. I connected to my site running Stronghold 1.3b1. Only got 40 bit encryption. I then connected to Netscape's Store site. Only got 40 bit encryption. I checked the info box (or about box, I don't remember which) for the connection and it claimed to be running the "exportable" version. (The Win95 version connects properly to both sites with no tweaking needed.) I will double check, but neither site would connect with 128 bits straight out of the tar file. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0