December 2003 - cypherpunks-legacy

Re: Responding to Pre-dawn Unannounced Ninja Raids
by law＠Samoa.org 17 Dec '03

17 Dec '03

I prefer to keep a large jar of marbles available in the entry room, aoupled with a hard floor, it makes it a bit tricky for an entry team towork properly.. You can probably check out your local crack house for tips on preventing forced entry..there seems to be a constant race between LEO entry tactics and what the drug dealer do to defend themselves.. I might also suggest that you check out Bo Gritz'z SPIKE phase 8 video tape http://www.bogritz.com/products8.html "Perhaps one of most exciting phases and controversial. In Phase 8 you learn Close Quarters Combat (CQC). You'll learn how to identify friend or foe so that you don't shoot a friend. You'll also learn how to clear a room safely and identify a terrorist and hostage." SPIKE 8 also has a good section on room defense. but then who am I to talk. bob's lawyer Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Re: US versions of Netscape now available
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [I've wanted, and tried (honest!) to stay out of this emerging flamewar, but David Sternlight <david(a)sternlight.com> wrote: <...> >It doesn't "leak overseas" as if there were some regrettable lapse in the >plumbing. Someone has to commit a felony violation of Federal law. Also known as "civil disobedience," a dangerous concept which is probably being taught today in civics classes in highschools across the nation. [HORRORS!] On a more serious note, I think that the requirements on the Netscape download page might actually be a "Good Thing," since they expose the public, in an election year, to the info-lust of the GAK crowd in a way that cypherpunks alone never could. I, too, wish that "my life as an arms trafficker," or the CJR book/t-shirt requests, or some of the wilder stuff like Vince's export-a-cryptosystem-to-Anguilla page were linked to Netscape's page discussing ITAR requirements, but I fully understand that Netscape is a business and that they must deal, on a continuing basis, with the government. The government officials whose jobs depend on stupid regs. can be rather humor-impaired. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "It is long past time to end the laughable presumption that voters who can easily cope with the choices offered at Burger King are somehow 'confused' by more than two choices at the voting booth." -- me Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, the "Pennies For Perot" page. Keep billionaires off welfare! ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMe5TwW1lp8bpvW01AQFbpgP/aic2ShJ5N09eVJLxZAUfkP1FsNlNRdFY MNgLvE8+0PnlLoXA2Js5HVo7Zad7URYrtwrSG2C7MwPcs6zwXgxLT6pf+oCg05/m fqaGbc/bWFLTyJDV/+BNEZCWRXPr19FvHv+0NNEVYbQ81IuQsLIgBf/E3g2KXD6X Ma44rCMPTFU= =JR+d -----END PGP SIGNATURE-----

1 0

RE: Cypherpunks and Toad.com
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

root@HellSpawn wrote: >I'd like to put the words > >Cypherpunks(a)toad.com > >On a tee-shirt. Is cypherpunks, toad.com, or the combination thereof >copyrighted or trademarked or otherwise limited for use? Not that I know of, and you are of course free to do anything you want, but I urge you to leave off the "@toad.com" to prevent clueless subscription requests/noise. There are a number of cpunk tshirts already, one of which contains TCM's sigfile, so the word is likely not copyrighted???

2 1

Re: Making encoding out of an authentication cipher
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: EVERHART(a)Arisia.GCE.Com, cypherpunks(a)toad.com Date: Thu Jul 18 12:44:15 1996 > Suppose you have a secure hash function H(msg) that delivers a random > long period set of hash bits for msg, which is computationally infeasible > to invert and such that the value of H(msg) depends very sensitively on > all bits of msg. These things are used for authentication and tend to > be > all over the world. > > Now suppose I have a key and apply the following transform, where "+" > will mean binary exclusive OR. > > Cipher: > H(key) + M(1) = C(1) > H(key+M(1)) + M(2) = C(2) > H(key+M(2)) + M(3) = C(3) > > and so on where M(n) is the message and C is the enciphered message. > > Decipher: > > H(key) + C(1) = M(1) > H(key+M(1)) + C(2) = M(2) > H(key+M(2)) + C(3) = M(3) > > and so on. > > If the hash function is cryptographically strong, is this or is this > not > a strong cipher? Are there fast hash functions around? > This, along with several other methods (Karn, Luby-Rackoff and MDC are some others) have been suggested in order to convert a hash function into and encryption algorithm. And while the method you suggest has not been broken (at least to my knowledge) there are at least two major problems: 1. It is slow. This method would appear to be approximately the speed of MDC. And MDC (using SHA, what appears to be the most secure hash) is (very roughly) 5 times slower than Blowfish and 3 times slower than IDEA. And although MDC is faster than 3DES in software, 3DES could easily outpace MDC in hardware. 2. (To directly quote Bruce Schneier from Applied Cryptography, page 353) "While these constructions can be secure, they depend on the choice of the underlying hash function. A good one-way hash function doesn't necessarily make a secure encryption algorithm. Cryptographic requirements are different. For example, linear cryptoanalysis is not a viable attack against one-way hash functions, but works against encryption algorithms." (Any typos are mine.) - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMe5p4uSLhCBkWOspAQFzLQf+J7VGyboBIb4/x2uT3ACs/xgMP11EnggF 6xnrT/TalqJofF1KcEGa3+DgfRRSAn0lxe2jGnLRCAj85zNwXNBy6V4A9pr/0Ldg lD0aHpDFBRXZngqHtCANce8OJvC/EwPbotOuFR+V2vwrB7CHD+4XlNxcfcWDZN7i /ffD6YdUnOpKtvj5ElmPmbOfODC10XD35nRbu1NMurmJQESA14Ohzk9KhRzVkNtv pYkwcCqkR2kWGnWSkew9Zfw4U+IOdFiwb9etgiOEl86hM38cK1SM1RxArEfW3vIw k2EM6o/rF4OIiDUYlJ3STxYAn7kAnOQ6PeYeUu48WmX1Y3q05qmFrQ== =Hj2r -----END PGP SIGNATURE-----

1 0

Re: US versions of Netscape now available
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:35 AM 7/17/96 -0700, Yap Remailer wrote: >Have you heard any reports of anyone successfully downloading it >period? Netscape always times out in the middle of a download. I >think the server is so overloaded that it's actually impossible to >download the software. Yep. Got it just after the announcement. Came through fine. (After that, i could not get it to download anything, but the first try worked fine.) Sounde like it is overloaded. (Of course, since it is mentioned on their homepage and they only have one machine serving it, what do you expect?) >I sure wish there were an ftp site overseas somewhere, then I could >actually get the damned thing. Give it a week and i am sure that someone will have it available. Something announced this far and wide will manage to leak out somewhere... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: #E-CASH: PRODUCT OR SERVICE?
by Steven Seyffert 17 Dec '03

17 Dec '03

Part of original message below Well Stig, the world is getting crazier by the second..... What about the dutch man that made a trademark out of the name 'Route 66' combined with the highway sign. He got it and now has a nice swimming pool.........of about 100 meters long.......and it's heated! -- ________________________________________________________________________ Steven Seyffert Webmaster at http://www.sale.nl/ Korenbloemstraat 17 3551 GM, Utrecht Utrecht, the Netherlands +31 (0)30-2441251 webmaster(a)sale.nl private: steven(a)knoware.nl ---------- : From: Stig <stig(a)hackvan.com> : To: cypherpunks(a)toad.com : Subject: Re: #E-CASH: PRODUCT OR SERVICE? : Date: woensdag 17 juli 1996 5:00 : : > btw: I'm surprised DigiCash didn't file for a European Trademark, : > but opted for Benelux and US protection. : : Perhaps this has already been voiced on the main list (I get a filtered : helping or two of cypherpunks), but *I'm* surprised that such a generic name : as 'Ecash' was granted trademark status anywhere. : : It's like giving Microsoft a trademark on the term 'Email'... It's nuts! : Was the term ecash not in use before DigiCash showed up on the scene? : : Stig : : :

1 0

Steganography
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on steganography in the past few days. I've been thinking about the subject so here is a list of my random thoughts: 1. Steganography "standard": Current steganography software relies almost totally on security through obscurity. The problem with such an approach is that there is no standard way to extract data from .gif or .jpg files. If two people want to communicate using stego, they have to have some secure channel through which they could negotiate a protocol that could extract information from data files. This brings up the same Catch-22 situation that exists with conventional cryptography. My idea is that there should be some common, well-known way to de-stego data files. This really doesn't weaken the security of any stego software because if strong crypto that doesn't append any headers on to the message is used in conjunction with stego software, then the output of a stego program would just appear to be random garbage. There would be no way for the feds to prove that the random data was encrypted. I don't know much about graphic and sound file formats, but I think that in most cases the least-significant bit of a graphics or sound file should be pretty random anyway. 2. Recognizing stegoed data: Another problem with stegonography is that while many programs use some kind of identifying header so the recipient can tell whether the file contains hidden information or not, this also allows a snooper to determine the same thing. I think that the ability for the recipient to identify whether the data is stegoed or not is important. So I came up with the idea of using a MAC keyed with the session key used to encrypt the hidden data for checking if the picture contains stegoed data. With this approach, an attacker would not be able to verify if a file contained hidden data or not since the session key would be encrypted with the recipient's public key. 3. Message pools: With steganography more widespread, the use of message pools becomes a lot more interesting. People could communicate anonymously using one of the alt.binaries.* groups with everyone else reading the group completely oblivious to this fact. The posts would be pictures that would decode normally, but only the recipient would be able to decrypt the hidden data. Since the binaries newsgroups are among the most popular on the Usenet, reading one of the binaries newsgroups would draw less suspicion then reading alt.anonymous.messages. I don't know how reliable some of the binaries groups are since many NNTP servers don't carry them or expire the articles early, but since cross-posting seems to be fairly common on those newsgroups anyway, a cross-posted file with stegoed data would have a good chance of reaching the recipient. - -- Mark PGP encrypted mail prefered Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMe6OdLZc+sv5siulAQHMOAP/Yv6SLWY/CCXzXj/91q0hh2M3oVjMr7a6 RBEKCaExosbjJojoTlM9epyzO/gC4jrAj+3IIeciPLHyJPgF2CJmW3NU4bRHPls5 d2kEUPCIc/mLVcbieEC4OO7QlYeFY0vIBn+y1CO3V0kLN20N6Y3845p4a7BY6Wa+ u7dE12QbZLc= =8xQ7 -----END PGP SIGNATURE-----

1 0

Mac Crypto/ internet commerce workshop , sept 5-6, cupertino..
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

The Mac Crypto / Internet commerce workshop,( gathering, conference) will happen...YES (if more like machack than anything else.) The dates will be Sept 5/6, Here in Cupertino, CA at Apple. In addition I will also host the Aug (late) or Sept Cypher-punks meeting one of those nights too. My goals are: 1) to provide a vehicle to educate any and all Apple employees and Developers who are responsible for apple's future on the internet about what is going on in the Internet commerce world. 2) To provide a forum where developers can work together to create internet commerce producs for the Macintosh platform. I am responding to the copious feedback that I have recieved from developers both at WWDC and MacHack, through the various mailing lists that I run (Mac-crypto, net-thinkers etc) and through personal contacts. >>>>>>>> I am looking for folks to talk, papers etc.. <<<<<<<<< The (real) prelminary agenda goes something like: (day one) Introductions and overviews: 1) Introduction to crypto technology, what is it who are the players. 2) Introduction to electronic commerce (Finacial cryptograpy), e-cash, e-checks, digital bearer bonds, etc. 3) How to use this technology today, where is the oppertunities. 4) What needs to be done on the Mac, oppertnunites. (day two) Tech stuff. 1) Random number generation on the Mac, (the key to strong crypto) 2) Password management and the Mac (How to get something better than the Powertalk keychain) 3) Optimizing crypto on the PPC. 4) How to write a OT network server that will give you the performance required for transacting business. remember this is a totatly grass-roots thing, but we are gathering momentum. Look at how effective Internet-config is on the Mac. The conference will materialize more in August, consider this an official anouncement. So book your air tickets, while they are cheap.. (bring a parachute?) be there, aloha! Vinnie Moscaritolo Developer Tech Support http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

RE: Responding to Pre-dawn Unannounced Ninja Raids
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

At 4:13 AM on 96/07/18 Timothy C. May wrote: >It's a mark of what has gone wrong with this country that >ordinary citizens actually fear the midnight raids, the no-knock >searches, the "threat suppression" by ninjas. I recommend an article sub-titled: Fourteen ways of looking at a blackshirt. I've excerpted particularily relevant pieces below. Eternal Fascism by Umberto Eco New York Review of Books (June 22, 1995) In spite of some fuziness regarding the difference between various historical forms of fascism, I think it is possible to outline a list of features that are typical of what I would like to call Ur-Fascism, or Eternal Fascism. These features cannot be organized into a system; any of them contradict each other, and are also typical of other kinds of despotism or fanaticism. But it is enough that one of them to be present to allow fascism to coagulate around it. [...] 3. Irrationalism also depends on the cult of action for action's sake. Action being beuatiful in itself, it must be taken before, or without, reflection. Thinking is a form of emasculation. [...] 4. The critical spirit makes distinctions, and to distinguish is a sign of modernism. In modern culture the scientific community praises disagreement as a way to improve knowledge. For Ur-Fascism, disagreement is treason. 5. Besides, disagreement is a sign of diversity. Ur-Fascism grows up and seeks consensus by exploiting and exacerbating the natural fear of difference. The first appeal of a fascist or prematurely fascist movement is an appeal against the intruders. Thus Ur-Fascism is racist by definition. 6. Ur-Fascism derive from individual or social frustration. [...] 11. In such a perspective everybody is educated to become a hero. In every mythology the hero is an exceptional being, but in Ur-Fascist ideology heroism is the norm. This cult of heroism is strictly linked with the cult of death. It is not by chance that a motto of the Spanish Falangists was Viva la Muerte ("Long Live Death!"). In nonfascist societies, the lay public is told that death is unpleasant but must be faced with dignity; believers are told that it is the painful way to reach a supernatural hapiness. By contrast, the Ur-Fascist hero craves heroic death, advertised as the best reward for a heroic life. The Ur-Fascist hero is impatient to die. In his impatience, he more frequently sends other people to death. [...] Franklin Roosevelt's words of November 4, 1938, are worth recalling: "If American democracy ceases to move forward as a living force, seeking day and night by *peaceful means* (emphasis mine) to better the lot of our citizens, fascism will grow in strength in our land." Freedom and liberation are an unending task. ---------------------- If you set out to defeat an enemy because you despise what they do or say, make sure that you are different - not just stronger. Ciao, James

1 0

Re: New Infowarfare Panel
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:14 PM 7/18/96, David Sternlight wrote: >At 8:30 PM -0700 7/17/96, Timothy C. May wrote: > >>Winn Schwartau is running conferences, is talking about the imminent danger >>of the nation's computer networks being knocked out (paraphrasing his >>latest "Wired" item: "imagine your ATM network being knocked out and people >>being unable to gain access to their money"). >> >>Schwartau is predicting/advocating a "fifth branch" of the military to deal >>with the this threat. A cyberforce, as it were. >> >>Color me skeptical, but I see this all as a lot of hype and fear-mongering. >>Folks in the Pentagon, FBI, and NSA probably see it as a way to get more >>funding, Folks in the consulting business probably see it as a way to crank >>up the seminar prices and increase the number and frequency of "Information >>Warfare" workshops and seminars. > >Haven't there been some worked examples of information warfare that make >this fear and the need to deal with it legitimate? I'm certainly not saying "information warfare" is impossible--for example, I did some work in the late 70s for DARPA on knocking out satellites with particle beam weapons. Specifically, I rebutted MIT Professor Kosta Tsipas' claim that directed energy weapons in orbit would require tens (or more) of Space Shuttle trips _per shot_. I showed the DARPA people how it could be done with 5 orders of magnitude less energy, and speculated that "ticklings" of satellites could be done with commercially available ion implanters--they got real concerned and I was not invited to the classified sessions where they discussed this threat model, as I lacked a clearance. However, the current wave of publicity about "information warfare" seems to focus on _possible_ scenarios, with Hollywoodesque overtones. (And I just learned that "infowar consultant" Schwartau is indeed "working on a movie." Not to ascribe impure motives to him--who's to say what's impure?--but it still sounds like hype to me.) >As I recall my background reading in the public press, wasn't the etiology >that we figured out how to do some pretty nasty things (the Gulf war was >one presenting occasion) to enemies' info infrastructures to threaten their >entire social system. Then, as I understand it, someone smart said >something like "If we can do this to them, then someone can do this to us." >and we were off to the races. Sure, we dropped conductive fibers on their power lines, we blew their dishes out with Special Ops sniper fire, and we did a lot of other such things. Could this destroy the nation's "infrastructure"? Hey, there have been scenarios for disrupting Wall Street, for all sorts of things. Bombs in power plants, knocking over high tension lines, etc. Some things never change. But destroying or even seriously damagaing the U.S. infrastructure would be _very_ hard to do. Sure, the government should think about such things. Utilities companies routinely plan for efforts to disrupt service. (I live a mile or two from where "Earth Action Now!" knocked over a power line about the time treehugger activist Judi Bari was partly blown up while apparently transporting a homemade bomb down here to Santa Cruz.) >It's the military and counterintel community's job to think like this and >act to protect us. I don't think imputing selfish motives is dispositive. I noted that there is a recent wave of hype: books, conferences, calls for action, even movie deals (:-}). Given that there is no real evidence that these mysterious "HERF guns" have ever been used, nor is there evidence that they would do much beyond knocking out the PCs in the office they were aimed at, this is why I said "color me skeptical." By the way, I was interviewed for the BBC programme "The I-Bomb," had discussions a while back with someone working on HERF guns, and have been in touch with Schwartau on this latest round (he contacted me). I'm still skeptical. "Extraordinary claims require extraordinary proof." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0