December 2003 - cypherpunks-legacy

No Subject
by Gary Howland 17 Dec '03

17 Dec '03

CRYPTOGRAPHIC EXTENSIONS FOR JAVA _________________________________________________________________ DESCRIPTION This library contains a suite of cryptographic classes for Java. All of the classes have been implemented in native code for performance reasons, and have been tested on Windows 95, Windows NT and Solaris. Download in source or binary form at http://www.systemics.com/software/ FEATURES All of the following have been implemented using native methods: * BigInteger class (based on code from Eric Young). This class implements arbitrary length integers and some associated mathematical functions. * DES class (based on code from Eric Young) * IDEA class * MD5 class (based on code from RSA Data Security, Inc.) * SHA class (based on code from NIST and Peter C. Gutmann) COPYRIGHT This library includes (or is derived from) software developed by (and owned by) the following: * Peter C. Gutmann * NIST * RSA Data Security, Inc. * Systemics Ltd <http://www.systemics.com/> * Eric Young <eay(a)mincom.oz.au> Also planned for release: * Cryptographic library for Java * PGP library for Java * Cryptographic library for Perl * PGP library for Perl

1 0

remailer@utopia.hacktic.nl down
by Alex de Joode 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Release date: Wednesdag, May 8, 1996 Amsterdam, The Netherlands General announcement, Due to recent events the Hacktic Foundation has decided to discontinue its remailing operations, the remailer that is operated by the Hacktic Foundation will cease to exist May 20th. Please update your reply blocks if you use the above mentioned remailer <remailer(a)utopia.hacktic.nl> for your nym reply block. bEST Regards, -AJ- -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMZCdsVnfdBSNVpE9AQF85wQAuDfE3icuDCzA99biqd9qk6VK8zUEFvEp OgZvqfGD8OxG8ElnFMQk2VMHskUK8QxidO+zKPUZrJNd4eBSiFSNIK7BAox1xMQm hUGTzLEBBGc3Hxg4pYc3Y2A7PDhU7GJusCZmk89zPUI4ouN+CHYQnZ4PMggB1Hmo coambU0vmD4= =ZdIS -----END PGP SIGNATURE-----

5 7

Re: remailer-in-a-box
by Bill Stewart 17 Dec '03

17 Dec '03

>At 3:51 PM 5/7/96, anonymous-remailer(a)shell.portal.com wrote: >>No one answered me. >>What's the best remailer-in-a-box. >>I'd like to run one. I would think people would be falling >>over eachother to tell me. I was running a modified ghio2-based remailer until I shut it down because of spammers. You should be able to get the code off my web page, or send me email and I'll forward it. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

MD5 weaknesses
by Bill Stewart 17 Dec '03

17 Dec '03

Perry Metzger posted a note to coderpunks about >A paper by Hans Dobbertin dated May 2 in private circulation has found >an easy method for generating collisions (not pseudocollisions as was >done in previous work) in the MD5 compression function. I was told >that this was public information. And somebody provided a URL to http://www.cs.ucsd.edu/users/bsy/dobbertin.ps The coderpunks discussion has been titled Re: Favorate flavor of hash? for which I suppose there are alternative interpretations :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

COMMUNITY CONNEXION ANNOUNCES UNCENSORED USENET ACCESS TO THE FRENCH INTERNET COMMUNITY
by sameer＠c2.org 17 Dec '03

17 Dec '03

For Immediate Release - May 9, 1996 Contact: Sameer Parekh 510-601-9777x3 COMMUNITY CONNEXION ANNOUNCES UNCENSORED USENET ACCESS TO THE FRENCH INTERNET COMMUNITY Berkeley, CA - Community ConneXion, Inc., today announced that it will for a limited time offer free Usenet access to anyone in France. The announcement comes in the wake of the arrest of two managers for French Internet service providers. The two managers at WorldNet and FranceNet are being held responsible for the pornographic material distributed on the "alt.binaries" newsgroups. They face up to three years in jail. In response to these arrests, the Association of French Internet Professionals (AFPI) has called for a complete blackout of French newsgroups and many providers in France have cut off news service entirely. Community ConneXion, Inc., has announced free Usenet access to the French in response to the resulting blackout. "'The Internet views censorship as damage, and routes around it,'" said Community ConneXion President Sameer Parekh, quoting a famous saying on the net, "The Internet transcends national boundaries. This promotion makes that fact obvious." Community ConneXion offers full Internet access to its customers, with no content-based restrictions on materials its customers may read or make available on the Internet. During this limited time promotion, people connected to the Internet in France may access a full uncensored Usenet feed merely by pointing their newsreaders at news.c2.net. People in other countries may also get access to a full uncensored Usenet feed by purchasing service from Community ConneXion. Information on how to sign up for service with C2.NET is available at http://www.c2.net/. Community ConneXion, Inc. is the leading provider of privacy on the Internet. Dedicated to uncompromising security, they provide anonymous and pseudonymous Internet services, including secure web services. Information is available at their web site at http://www.c2.net/, or contact Sameer Parekh at 510-601-9777x3.

1 0

hacktic.nl is down!!
by Jim Byrd 17 Dec '03

17 Dec '03

I just heard on IRC channel #scientology from Karen Spaink that hacktic.nl will be down as of 5/20 because of pressure from Scientology. I don't have any more details yet.

3 2

Leahy bill dead?
by jim bell 17 Dec '03

17 Dec '03

Maybe this seems a bit redundant, but is it generally agreed "out there" that the Leahy bill is dead? When originally proposed, the conventional wisdom around here was that the Clinton Maladministration was going to be dead-set against it. (Not a bad guess...) It was also claimed that it couldn't be changed to fix it. (although one of the nyms that claimed this hasn't been seen around here since then...) Since then, most if not all of the people and groups who might otherwise have been in favor of it have, likewise, turned against it. And while the Burns bill isn't totally out of the woods, I assume "we" (the people on the right side of the cryto argument) can all agree that it is at least better than Leahy's booby-trap. So does that spell the end of the Leahy bill? The reason I mention this is because it was my suspicion that, contrary to conventional wisdom, the "anti-crypto" faction designed the Leahy bill to be as anti-crypto as they felt they could pass, including just enough bait to get us to take the hook. Obviously, that tactic failed. However, if I'm right we'll seem some life in the carcass yet. Obviously, this is a highly longshot prediction. "Nobody" is supposed to be for the Leahy bill now. But I'm reminded of the last 20 minutes of the movie, "Terminator"... Jim Bell jimbell(a)pacifier.com

1 0

IP network #s in france
by sameer 17 Dec '03

17 Dec '03

Anyone have a list of all the ip network #s in France? It would be most appreciated. -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.net/ (or login as "guest") sameer(a)c2.net

2 1

ENIGMA
by Carl Ellison 17 Dec '03

17 Dec '03

>From: danmec(a)inet.uni-c.dk >Date: Wed, 08 May 1996 13:05:24 +0200 >Subject: ENIGMA >To: cme(a)ACM.ORG > >X-Personal_name: Rag > >You may be interested in knowing that a 4 rotor U-boot ENIGMA is up for sale >at Sotheby's in London 30th May. > +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: Transitive trust
by Steve Reid 17 Dec '03

17 Dec '03

Submitted for your (dis)approval... -----BEGIN PGP SIGNED MESSAGE----- > And beliefs are in some sense what we are really talking about. There is no > simple scalar quantity called "trust" (at least not one I can imagine), but > different agents will have different beliefs about different things. One > set of beliefs about signatures on keys has a lot of similarities to the > "web of trust." In fact, imagine this "diminishing wavefront of belief" [butchered for brevity] > Can this be more mechanized? Can numbers be attached, and perhaps > propagated? (I mentioned "diminishing wavefront of belief," because > implicit in this viewpoint, inevitably (and rightly, I think), is the > notion that "distant relations" have low probabilities of belief, all other > things being equal. I think we need to make a distinction between belief in identity and trust in competence. Currently, signing a key *only* means that you believe that the person is who they say they are. It should also be possible to state that you believe a person is competent enough to use proper care when signing other keys. Obviously, you wouldn't competence-sign someone's key unless you've known them for quite some time. The "competence web-of-trust" would grow very slowly. This competence-web-of-trust would have to remain tightly-knit, as you wouldn't want to trust anyone more than a couple links down the chain. While the web-of-competence would grow slowly, this small group of people could identity-sign a lot of keys. I know this might sound a bit like a hierarchical structure of trusted people (which it *could* be) it's really more like a web, and anyone could create their own web-of-competence, and the webs could eventually be linked together. Creating a web-of-competence would take a long time, and a lot of effort. But, signing could actually become a paid service, which would give people incentive to gain trust (by being paranoid when it comes to key signing). The most widely trusted people could charge significant amounts of money for the time needed to verify a person's credentials. Of course, there aren't currently many people out there worth paying an arm and a leg to get them to sign your key, but I could see people paying $5-$500 to have their key identity-signed by someone like PRZ. Having a key competence-signed by someone like PRZ would obviously cost a lot more than identity-signing, since it would take a lot more time to gain that much trust. It would not be unlike paying for an education, and with identity-signings being worth $5-$500 or more, it could be a worthwhile investment. Having a key competence-signed by more than one person would increase the value of your key, and once there are a couple good signatures on your key, other people would be more willing to competence-sign it, because there would be less risk involved (risk to their reputation). There would probably have to be more than one level of competence signing. It should be possible to say "I trust this person to use care when identity-signing other keys", and it should also be possible to say "I trust this person to use care when competence-signing other keys". That second type of signature would be *very* valuable, and it would be necessary to have that and possibly even higher levels of trust in order to make the web-of-competance a reasonably large size. When you sign a key, you are placing your reputation on the line, so you must be certain that the level of trust you're placing is appropriate. But what happens when someone goes rogue and ignores credentials, and signs keys of anyone who is willing to pay the price? You would regret signing the rogue person's key. So, IT SHOULD BE POSSIBLE TO REVOKE TRUST, in order to protect your own reputation. PGP currently only allows a person to revoke their own key. Most people would revoke their key if it were stolen, to protect their own reputation. However, some people may be unwilling or unable to revoke their own key, and if you signed that key, your reputation may be affected. Clearly, it should be possible to remove your signature from someone's key. Revoking trust has it's own little problem: Some people might accept cash and sign a key, then revoke the trust in the key, keeping the cash. Easily fixed: the people who have signed the con man's key could revoke the trust in that key, bringing an abrupt end to the con man's key-signing days. What it all comes down to is reputation. Protect your reputation, and you could make a living on your reputation alone. ====================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E6 8C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, IANAL. -- | ====================================================================:) -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQEVAwUBMZEckdtVWdufMXJpAQFSwAgAnhCALlQdfyYJ+Cp3WSXqMiOLG8ubtFJB jUWyXyd3T0u8RxwraIq4emxW4HZZNMBNKet4rZzkA9VqAZ3+p9337jUS6XBuE56V IRLhQy80TyrqwQVpSKXXOmPlZdmhzAF/OJE4LZF4gMh5RIANFTUXzBkVSJ8FsB1C KXjgzk1E+5hdQ0FrwaAc9LIrq6UokhO7pIKb5tlmntXHhtDm+yLpm5QvrCxwnBad 3KlxAtWvQYVQTb5a9bhgnFXVRDjh/lQ1bxncJ1ap1oJP0E6nMfHq282G8UxnrUuY qyksNGJDgWElExzXKntdyqP+bOiIn4jwVyjBcrBZS9V3GxWOPZz4ew== =Z66X -----END PGP SIGNATURE-----

2 2