December 2003 - cypherpunks-legacy

"The 666 Club"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:27 AM 6/1/96, Deranged Mutant wrote: >On 23 May 96 at 7:46, Declan B. McCullagh wrote: >[..] >> More to the point, the left and the right come together on privacy issues. >> >> Remember the Christian Coalition's take on national ID cards? "Mark of >> the Beast!" (Does anyone have an original cite for this? I also recall >> the CC opposing Clipper...) > >There was actually a pretty good special on the 700-Club when Clipper >first came out (at least from a transcript posted on the comp.org.eff >newsgroup). > >Yep. They were against it. I saw a videotape of this episode of "The 700 Club," in November 1992. Pat Robertson and his co-anchor were worked up about (and against) Clipper. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Where does your data want to go today?
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Me: > >Using a random IV also limits the effectiveness of using known > >headers for "known plaintext" attacks. Also note that a good block > > cipher isn't that vulnerable even to "known plaintext" attacks. Bill Frantz: > I don't think this is true given a brute force attack. Let me > assume DES-CBC as a specific system. Let us assume that the > plaintext is: > <snip> > The brute force system decrypts the first, and second blocks (8 > bytes each) of the cyphertext, XORs them, and compares the result > with "PKZIP2.1". If the comparison is equal it has the key. > > If we eliminated the header and just started with the compressed > data, then the brute force system would have to decrypt and > decompress enough of the data to run statistical tests. The cost of > the additional decryptions, decompression, and statistical tests > substantially raise the cost of the brute force attack. I will concede that having a known header, such as a PKZIP header, does weaken a crypto to certain degree, but I still believe that it is not a significant problem. Here's why: 1. If the best attack against the crypto system is to brute force attack (having to decrypt two blocks per key) I don't consider that a weakness. Assuming you are using IDEA or another 128 bit key algorithm and if everyone in the world owned two computers, each powerful enough to make a million attacks a second, and they all decided to cooperate in cracking your key it would still take (on average) until the next ice age to complete this attack. Admittedly DES wouldn't hold up nearly as well, but if you are using straight DES you have bigger concerns than the occaisional known plaintext attack. 2. Known plaintext is something that you have to assume that your enemy has at least occaisional access to. Lots of messages have known beginnings and endings. Sure it would be nice to reduce the amount of known plaintext, but I think there are much more significant concerns. 3. The disadvantages of not having the headers. The headers are there for a reason: to communicate that the following file is in a specific format. Without the headers, you have to use another secure channel to communicate what file type is being transmitted. Again, I concede that a crypto system would be more secure if no known plaintext was ever transmitted, such as compressed file headers. But this minor loss of security is nearly inescapable and also relatively insignificant. David F. Ogren ogren(a)concentric.net PGP Key ID: 0xC626E311 PGP Key Fingerprint: 24 23 CD 15 BF 8D D1 DE 81 71 84 C8 2C E0 4B 01 (public key available via server or by sending a message to ogren(a)concentric.net with a subject of GETPGPKEY) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMa/qu/BB6nnGJuMRAQH8MAP/epcVGiS+9U1aWs1diuiVsMSjellYRjNm p9huFrzT9eaBrfVz0MI2yhZ8IWNctDWznQdmtcmdRKoFm5Knfu+vIyKH6oILplyB dgfPsSh3R/pJKXs2hD4q8PgE+laaTyFZyW1MqPbAjlKUS/T1w9bhL3lQnsrKZPf+ Qyxa19Vlya0= =sHIE -----END PGP SIGNATURE-----

1 0

Re: [Off-Topic] "Curfews"
by Brendon Macaraeg 17 Dec '03

17 Dec '03

hi Tim and all: Been lurking on this list for about a month and find it really interesting. I'm still working my way through the FAQ from the talk.politics.crypto newsgroup to get up to speed, but have been using PGP for about six months now. I've been toying with starting an anon-remailer as well....that Quickremail program looks cool...anyone install and run it yet? I think Tim's post relates to the idea that we're living in a society that finds it acceptable to monitor our movement of all sorts. Not just physical, but --for lack of a better word-- virtual as well. By that I mean, organizations both large and small have the means to track our purchases and activities --generally, any activity that is logged or leaves a data/paper trail says something about us and creates a virtual persona-- and using such info. to make inferrences about our lifestyles. Just the other day I had a heated talk with someone about drug tests in the workplace. She said they're fine. Frankly, I am against them. Take your jar and shove it. "Life, Liberty, and the Pursuit of Happiness" implies a right to privacy. That's why I started using PGP and want to make an effort to keep up on topics related to keeping my life private and shielded from those who would like otherwise. What will employers want to know next? What movies I rent? What books and magazines I read? What else do I do on my freetime that may or may not be "unacceptable"? I worry that our personal lives are becoming more and more regulated by government, regulation that allows employers and other institutions to rationalize their privacy-invading actions and that's why I too find Clinton's push for a state-instituted curfew disturbing as well. What next? Will my employer start telling me I have to be home by 11 p.m. so I can be a happier, more productive worker? -B At 07:08 PM 5/31/96 -0700, you wrote: > >As I said, should such curfews become widespread, children will of course >need forms of age identification, and this opens yet another door for >universal I.D. cards. And for "travel papers." > >Maybe it would be easier to just put a tattoo on their arms--especially as >the younger generation is so into tattoos these days. "Pappieren, bitte. >Macht schnell!" > > ===================================================== Brendon Macaraeg http://www.itp.tsoa.nyu.edu/~brendonm Finger macaragb(a)acf2.nyu.edu for my PGP Public Key

1 0

Cassidy's Sacremento Bee article.
by Robert Hettinga 17 Dec '03

17 Dec '03

As I said here before, cypherpunk (and DCSB founder) Peter Cassidy, who did an article in the last Wired on the Bernstein case, just did a story on the NSA's involvement in the digital telephony bill in this Sunday's Sacremento Bee. Pete says, > I spoke with an editor at the BEE. The story takes up most of the front > section of the FORUM section. Headline screams: > SILENT COUP IN CYBERSPACE > US Intelligence Agencies Threaten Businesses and Personal Privacy. Since this story is also supposed to hit the wires, it would be interesting if it goes anywhere else... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Paper about legal aspects of electronic cash
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Simon Schlauri" <schlauri(a)pobox.com> To: "ecash(a)digicash.com" <ecash(a)digicash.com> Date: Sat, 01 Jun 96 11:56:48 Reply-To: "Simon Schlauri" <schlauri(a)pobox.com> Priority: Normal Subject: Paper about legal aspects of electronic cash Sender: owner-ecash(a)digicash.com Precedence: bulk Hello all I'm a law student at the University of Zurich, Switzerland. During the last months I've been working on an paper about legal aspects of electronic cash, in which DigiCash's ecash is one of the two main models I examined. The main part of the paper consists of a thesis on the qualification of ecash as an analogy to bank cheques or private banknotes based on digital documents. The paper contains a large list (40 items) of further literature, too. This paper is now available via Internet at the following Address: http://www.inf.ethz.ch/department/IS/ea/iur/1996/Arbeiten.html with a link to the file ftp://ftp.inf.ethz.ch/pub/org/ti/ga/Patru/legal/1996/schlauri.ar.ps (PostScript, 36 pages, about 370K. The paper is written in German.) I'm looking forward to your comments. Regards Simon Schlauri ______________________________ Simon Schlauri St.Gallen, Switzerland schlauri(a)pobox.com http://www.pobox.com/~schlauri --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

2 1

Find Article. (Hack China?!?)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Posted in alt.privacy..... In article <4oo7dj$3am(a)sunrise.pku.edu.cn> deezxl(a)sunstation2.tsinghua.edu.cn (HOME_Xuelong Zhu) writes: From: deezxl(a)sunstation2.tsinghua.edu.cn (HOME_Xuelong Zhu) Subject: Find Article. Date: 1 Jun 1996 01:46:27 GMT Please tell me where I can find the WWW site or FTP site with many articles (thesis,all kinds of paper,etc) about date security and cryptology. please send your answer to deezxl(a)tsinghua.edu.cn Thank you very much. --

1 0

NYT on NRC Report
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, May 31, 1996, p. D2. White House Challenged on Data Security By John Markoff The United States Government should immediately relax export controls on electronic data coding products and allow the computer, software and telecommunications industries to set data security standards, a new report urged yesterday. The report, commissioned by Congress and prepared for the National Research Council of the National Academy of Sciences, stands in direct opposition to existing Clinton Administration proposals for data security standards and for linking the relaxation of export controls to the adoption of such standards. The report calls for the widespread commercial adoption of technologies used to prevent illegal wiretapping of computer data, telephone, cellular and other wireless communications. The National Research Council provides science and technology advice under a Congressional charter. The report also states that despite creating potential problems for law enforcement agencies by making it easier for criminals to shield their communications from Government wiretappers, cryptography would also help prevent crime by sheltering communications and electronic transactions from the prying eyes of electronic interlopers. "Without information security, computer crime in this country will rise very rapidly," said Kenneth W. Dam, the chairman of the panel that prepared the report. Mr. Dam, Deputy Secretary of State during the Reagan Administration, is also professor of American and foreign law at the University of Chicago. The report, industry executives said, is likely to become a key weapon in the battle between the Federal Government and industry and civil liberties groups. "It echoes things we have been saying for some time," said Jim Bidzos, chief executive of RSA Data Security Inc., a developer of computer security software. "The next battleground is going to be Capitol Hill because the Administration isn't going to give up easily." In particular, the report takes issue with Administration efforts to force the use of data-scrambling systems using "escrowed" keys that would let law enforcement and intelligence agencies use built-in backdoors to read coded information. Cryptography, once used only by spies and the military, has become an increasingly vital technology for insuring security in electronic commerce and personal privacy. It relies on the use of mathematical formulas to scramble electronic information so that it cannot be read without the proper digital "key." Key escrow systems like those proposed by the Administration in its Clipper chip program would split the key and have trusted third parties like the Treasury Department hold parts of it, making it possible for law enforcement agencies to generate keys without consulting the sources of the data. As recently as two weeks ago, the Administration was pushing for key escrow coding approaches to data scrambling. A draft White.House policy paper has proposed linking relaxation of export controls to systems that included key escrowing. The recent paper also indicated that the Government was willing to accept "self-escrow" systems for some large corporations that would allow them to to hold all parts of the keys. Critics of key escrow management technology note that it can be abused by agencies that wish to exceed their surveillance authority and that the technology is vulnerable to a single point of failure. If a so-called master key is stolen, they say, the entire coding system can be compromised. Because strong cryptography would complicate the mission of United States intelligence agencies, the Federal Government currently places tight controls on the export of software and hardware that offer stronger cryptographic protection than 40-bit keys. Such keys are made up of a binary number that is 40 digits long. Computer experts have shown that 40-bit keys are vulnerable to attacks. The report released yesterday, "Cryptography's Role in Securing the Information Society," calls for dropping stiff export controls on products that use the Data Encryption Standard, which relies on a 56-bit key and offers stronger protection against computerized attacks than a 40-bit key. [End]

1 0

Re: Backdoor in RSA Discovered
by Gary Howland 17 Dec '03

17 Dec '03

Hi, Here is an example of a PGP key that has been generated, but with a secret backdoor. It is not possible by looking at the generated key to see that it has a backdoor. The key generation code contains Mallets public key. When generating a key, the upper bytes of N are set to an encrypted factor of N. The encryption is done using Mallets public key, so only Mallet can retrieve the factor from N. I think this example demonstrates the need not only for having key generation source code (which is required anyway in order to verify the quality of the random number generator), but also for being able to compile and link this source, since without this ability it is too easy to have such a backdoor in the system (yes, the code could be reversed engineered, but this can be made very difficult by having self modifying code etc.) There does however appear to be one way to assure the user that this trickery is not going on. This can be done by generating "vanity keys", that allow the user to specify a phrase that will appear in the PGP ascii key. If this were done, then there would be little room left in N to store details about its factors. Here is a working example of this backdoor: This is Mallets secret key (passphrase "xyzzy"): Type bits/keyID Date User ID sec 496/5D925633 1996/06/01 Bill Klinton <bill(a)whitehouse.gov> -----BEGIN PGP SECRET KEY BLOCK----- Version: 2.6.2 lQD5AjGwJnsAAAEB8M6FnxIdQZrORfKlb6/l74S6YUT0GQHvzrioiXJoRd2gnAAs e99C/XPKZShiylm+nu5UD8zDBBtcoiBdklYzAAURAQxi1EDMl1u+Aew7e7bKTY6c l/RAUacgZ9zbL1tl96kxQucLrt8l6Sz11EOmnV9eDZdf1LYG9jg5WbLvNGqpmzyY PlNKBJn/7gD4hu3YUt9caDyY5/X2ASMaL40gb1y1YZxjbTbB4Xjd8wD4+Iv9qhEQ fLjeYi+iUhnNkMtPyeg/+TR6rdP/c42UXAD2mqW0VuM8wiib0nbwfXwC0SlJveLG UwNOgRIujTwS7k35tCJCaWxsIEtsaW50b24gPGJpbGxAd2hpdGVob3VzZS5nb3Y+ =oOrI -----END PGP SECRET KEY BLOCK----- The key consists of the following: n: ce859f121d419ace45f2a56fafe5ef84ba6144f41901efceb8a889726845dd a09c002c7bdf42fd73ca652862ca59be9eee540fccc3041b5ca2205d925633 e: 11 d: 0c25fa4c5c12eafd132c6415a0ef68713823d6e12ea5c2cfecbe9eac607c94 75d1b60c2a3aef89438692326d70d88080317b0cd04432d5a0230de572e819 p: d2640ede17e8c05545aa9ecfd5154f934021e4ef8ef22a248abe0ab3f1aaed q: fb4ada7f960c9a8ab23010ff4936a9a2db834346694979c72f90296cff419f This is Joe's PGP key (passphrase is "xyzzy"): Type bits/keyID Date User ID sec 1024/D0351D23 1996/06/01 Joe Sixpack <joe(a)aol.com> -----BEGIN PGP SECRET KEY BLOCK----- Version: 2.6.2 lQHgAjGwKUIAAAEEAIBG2pH3rabYMSWhVjcnG8v9HVU4vwtBuBysnvuJI4PvjV3o +YnuFD+x3aF8O52jgpBTllAxhndDSPUXQaj+sXEGDkV0Nq8RCZ02usaj24ogn0+S KW9ej8GgWL8EmlP1H1Qrv39/qz1VSqvxczCLYoRetHETR0JirwcMj9fQNR0jAAUR AYwvF+QHqifbA/4oAli05pLm0QlkbOqimdm4QS3OC1r9kdqvO88GF5nj9EgLm1a+ svRThXiO586Udi1UkSXvM60o4nz6tGASavgc7X8JaL/B2yOcMH9gF6CN6zabiyAb anrJe06IuKH3980GoQ2Sp1sssFHqxgper1ga3STmUVj/dQBjaFUI1qwDkwIAnRPO F7qIopIcEhnxW1OXcv0/9Afhugy3ERbGZwTaaw2fAiiyD41FpkbOUbao8D5Vkndr y6h2LEC7P5iwfdAF3AIAPz/2nRuZAnyNrA4ESvryyHMejwsz9BAkok+MT2z2E85W h8laL76yok5DZz56bRqH2gyQkPR5Rx3hnLx+fqL45gIAzy3CkdR77yw8bXUH8/Av azYh0m4KzEsw8P1a10YkVxP8xiTbqYbN0lmzOrdWlEW6dZjkx5q67vt1op7hDtqW LJwYtBlKb2UgU2l4cGFjayA8am9lQGFvbC5jb20+ =evl9 -----END PGP SECRET KEY BLOCK----- The key consists of the following: n: 8046da91f7ada6d83125a15637271bcbfd1d5538bf0b41b81cac9efb89 2383ef8d5de8f989ee143fb1dda17c3b9da382905396503186774348f5 1741a8feb171060e457436af11099d36bac6a3db8a209f4f92296f5e8f c1a058bf049a53f51f542bbf7f7fab3d554aabf173308b62845eb47113 474262af070c8fd7d0351d23 e: 11 d: 2d462f06576a771f2067a25aaa0dcd934a46968c7fa99eb97388381c8a c13d9fd78a8e7630ae617fe46c571cc9bf2aa68d4aad85b7206653fba1 cbf90e78026398a33f3a99dd4ced780f9bd854b2560f5cd9c6113ab837 7443d9e946a3c2c74989f26f775635cd6ebd8a665e0885e28c60d714b3 c9981c0ff09fa561a7d7d8f1 p: 804e00dc8ea1c0a55c2f5a5b14fdb05f84ecb1c5d1463562925637624e 6f1d945adbc4ed2cb4dd266f8f9c59f6c07d7b3d3ee20328bfdf12f54f 654256a63e01 q: fff1bc1c496fa118c2307c31498f3b403df9d9dd77b91295a3191d5a26 924d8ff276696adeb344ca6cbeddb976fa387b64697f12b8a8dec43d4e 2b561e00a323 If we look at bytes 1-63 of n: 46da91f7ada6d83125a15637271bcbfd1d5538bf0b41b81cac9efb892383ef 8d5de8f989ee143fb1dda17c3b9da382905396503186774348f51741a8feb1 and decrypt this using Mallets private 'd', we get 4e00dc8ea1c0a55c2f5a5b14fdb05f84ecb1c5d1463562925637624e6f1d94 5adbc4ed2cb4dd266f8f9c59f6c07d7b3d3ee20328bfdf12f54f654256a63e which you can see is Joe's P without the leading 0x80 and trailing 0x01 Here is the code (in Perl) that generated Joe's key. This code contains only Mallets public key. my $bits = 512; # Bits in p and q, not in n # # Set up Mallets public key # my $me = new MPI 17; my $mn = restore MPI pack("H*", "ce859f121d419ace45f2a56fafe5ef84ba6144f41901efceb8a889726845dda09c002c7bdf42fd73ca652862ca59be9eee540fccc3041b5ca2205d925633"); # # Note - first byte is 0x80, # first bit of second byte is zero # to ensure that P is less than Mallets n # my $p; do { $p = randomSpecial($bits, "100000000", "00000001"); } while (!isPrime($p)); # # Now encrypt P for Mallet # my $ss = $p->save(); substr($ss, 0, 1) = ''; # Remove high and low bytes substr($ss, -1, 1) = ''; # since we know what they are my $tmp = restore MPI $ss; my $s = new MPI; MPI::mod_exp($s, $tmp, $me, $mn); $s = restore MPI pack("C", 128) . $s->save() . pack("C", 1); my $tmp = new MPI; my $q = new MPI; MPI::lshift($tmp, $s, $bits); MPI::add($tmp, $tmp, new MPI 256); # To prevent Q being too large MPI::div($q, new MPI, $tmp, $p); do { $q->inc(); } while (!isPrime($q)); my $e = new MPI 17; my $sk = RSAKeyGen::deriveKeys($p, $q, $e); # # Save our key # my $passphrase = "xyzzy"; my $skc = new SecretKeyCertificate($sk, $passphrase); my $fos = new FileOutputStream("secring.pgp"); my $dos = new DataOutputStream($fos); $skc->saveToDataStream($dos); my $id = new UserIdPacket 'Joe Sixpack <joe(a)aol.com>'; $id->saveToDataStream($dos); This is the code to recover P from Joes public key (Mallet's private key is required) # # Mallets secret key # my $mn = restore MPI pack("H*", "ce859f121d419ace45f2a56fafe5ef84ba6144f41901efceb8a889726845dda09c002c7bdf42fd73ca652862ca59be9eee540fccc3041b5ca2205d925633"); my $md = restore MPI pack("H*", "0c25fa4c5c12eafd132c6415a0ef68713823d6e12ea5c2cfecbe9eac607c9475d1b60c2a3aef89438692326d70d88080317b0cd04432d5a0230de572e819"); my $rp = new MPI; my $pe = restore MPI substr($sk->n()->save(), 1, 62); MPI::mod_exp($rp, $pe, $md, $mn); # Decrypt Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

Re: [Off-Topic] "Curfews"
by Blake Wehlage 17 Dec '03

17 Dec '03

At 07:08 PM 5/31/96 -0700, Timothy C. May wrote: >Cypherpunks, > >This is off-topic for the list, but I want to share it anyway. It touches >on issues of increasing police surveillance, and also touches on the issue >of "age credentials" (in the sense that how else is a cop who stops a young >person for "curfew violation" to determine if a violation has occurred when >most 14- and 15-year-olds carry no driver's licenses?) > >The "curfew" meme is spreading quickly, with Clinton calling for a federal >curfew, at least in cities, and Dole trying to outdo him with even more >draconian curfew laws. Many communities already have them, including San >Jose, New Orleans, and other large cities. And my own community, Santa Cruz >County, ironically begins a curfew program on Saturday, tomorrow. > >I wrote this item for our local newsgroup, scruz.general, announcing that >"my household" will not abide by this law. I didn't come out and say "my >kids" would not abide by it, inasmuch as I have no kids. So I elliptically >referred to "parents and guardians"...after all, my sister visits with her >husband and son, and in theory I could be the guardian of this kid. And >friends bring their kids. > >My point is to send a "warning" to the Sheriff's office that at least some >households think this crackdown on the movements of children is >unacceptable. Children have the right to travel, especially as the parents >permit it, without being stopped, questioned, forced to state their >destinations, and, if the answers don't satisfy the cop, taken into >detention at some children's equivalent of a "drunk tank." > >(Some purists claim that children are exempted from normal constitutional >protections, such as the right of free association, the right to be free >from unwarranted searches and seizures, the right of free speech, etc. >Especially this comes up in debates about rights in public schools (speech, >locker searches, movements are controlled, etc.). But I think a public >school environment is a dramatically different situation, whatever one >thinks of these claims about rights, from a kid walking on a public street. >To claim that such a child may be stopped, interrogated, taken to a >detention center, without a crime having been committed, is a clear >violation of his or her rights.) > >As I said, should such curfews become widespread, children will of course >need forms of age identification, and this opens yet another door for >universal I.D. cards. And for "travel papers." > >Maybe it would be easier to just put a tattoo on their arms--especially as >the younger generation is so into tattoos these days. "Pappieren, bitte. >Macht schnell!" > >Here's what I sent in to scruz.general tonight: > > >So Santa Cruz begins its own fascist crackdown on the free movements of >persons. The "curfew" begins Saturday night. > >Allegedly these persons are children, but it is up to parents and >guardians to control the movements of their children or charges in public >places, NOT the function of the police to detain these children or >charges. (Initially a "warning," but the child's name is recorded in >police data bases....if the child is detained a second time, he or she may >face detention time, community service, fines on the parents or guardians, >and so forth.) > >ANNOUNCEMENT: I am responsible for the children in my household or in my >custody or guardianship. Not the cops. Not the Sheriff. Not the CAMP >helicopters. Not the narcs. Not the vice squad. Not anyone but me. > >I am instructing those in my household or who visit to IGNORE all >interrogations by cops. I am telling them not to let the cops search their >bags, not to let the cops ask where they are going, not to let the cops >demand that they give a reason for being out. If they pick up people from >my household, I expect the children to remain silent and to just fill up >the god-damned jail cells until I eventually raise a ruckus and (maybe) >pick them up. > >If some kids are out and about and making mischief, the cops should >concentrate on catching _those_ children! Don't immobilize all kids for >the sake of supposedly cutting down on the activities of the perps. As >with so many do-gooder laws, the effect will largely be felt on the "good" >kids and will be ignored or evaded by the "bad" kids. > >As to the claims that children have no valid reason to be out after 9, or >11, or whatever, this is not for anyone but the parents and guardians to >decide. The god-damned cops are not the ones to decide what a valid reason >for being out is. > >(I have heard that "religious worship," a la "Midnight Mass," is one of >the valid reasons for a child to be out after curfew. Fine, religion is >then the stated reason those in my household are out! I will tell them to >tell any nosy cops or Sheriff's Deputies that they are worshippers of >Baal, and Baal requires them to be out to appreciate the darkness. If the >cops claim this is "not a valid religion," I will recite to them the First >Amendment of the U.S. Constitution, where it says: "Congress shall make no >law respecting the establishment of religion or prohibiting the free >exercise thereof.") > >I moved to the rural part of Santa Cruz, Corralitos, to escape this >fascist and socialist nonsense, and now I find it primarily the >Sheriff-dominated parts of this county which will now claim to tell >parents and guardians they no longer control their children. > >Fuck this. > >--Tim May > >-- >Boycott "Big Brother Inside" software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Licensed Ontologist | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > Timothy, For the first time in my life I agree with you. I am 13 and the cop here a assholes. I have been caught about 13 times, yelled at me called my parents who could give a rat's ass. I feel spend tax payer's money on more cops to catch the bastard who kill people, not on the kids who just like to take a walk with my girlfriend. Or when I'm going to the corner store to buy a 6-pack. A 6-pack of coke. Well as the old saying goes, fuck this and everything that has to do with it!!!!!!!! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Blake "Pokey" Wehlage Gaa- 3.69 <jwilk(a)iglou.com> Record- 2-4-4 Age- 13 Final Standings- 2nd Place (Beat in Championship) President & Founder: Revolution Software "I have the fastest glove in the east!" Profanity Software "Hackers never stop hacking they just get caught" VSoft My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie til' 5:00p, hack til' 7:00a Hank Aaron- d:-)!-< Pope- +<:-) Santa Claus- *<:-) Yo Mama- :-0 Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Remailer chain length?
by Jim Choate 17 Dec '03

17 Dec '03

Hi Scott, Forwarded message: > Subject: Re: Remailer chain length? > Date: Fri, 31 May 1996 14:55:58 -0500 > From: Scott Brickner <sjb(a)universe.digex.net> > > >If this is strictly true, why not simply run several instances of a remailer > >on the same machine. Then randomly chain them prior to sending them off > >site. This would be a lot cheaper and faster than trying to convince > >hobbyist to set it up or businesses to to use their profit & legal council. > > Because it's not strictly true. Implicit in traffic analysis is looking > at the "envelopes" of the traffic. Since this means intercepting those > envelopes, once you've put your monitor on the first remailer at a site, > you've probably gotten all the rest at the site for free. > > I don't think multiple remailers at the same site help anything. > I agree completely. If traffic analysis is going to be done on a single box it isn't going to matter how many remailers are there. The monitor will simply grab them all. At this point it simply maps them thusly: incoming message > remailer #1 > .... > remailer #n > outgoing That this really maps to is obvious: incoming message > remailer #1-#n > outgoing The only thing this does is increase the number of valid entries in the From: field. Succesful traffic analysis does not require that the From: field contain only a single item. As a matter of fact it makes no difference what the headers contain unless the body is put in some kind of envelope for final delivery. Why? Because all one has to do is look at the body of the text which will not have changed. This leads to a simple model, based on a physical remailer: 1. Physical remailer receives an evelope addressed to them. 2. They open it and find a $1 money order (for paying the remailer) and another envelope with another delivery address on it. 3. Remailer puts $1 in bank and the interior letter in the mail. To convert this to electronic means: 1. Remailer receives a email that is encrypted except for the header. 2. Remailer decrypts mail (ie removes the outer envelope) and find three items, block of encrypted data (ie inner envelope) with header to next site and e$ token for $1. 3. Remailer sends the data on its way. There are a couple of points to be made. 1. No traffic is handled in the clear except for the header to the current destination all others are nested in encryption. 2. Remailer chaining is handled entirely by the customer (ie customer addresses the envelopes) 3. $1 is the smallest amount normaly accepted as a fee for a valid contract. 4. Remailer can't look at data because there is no way to find the correct sequence of keys to unlock the nested encryption. 5. Automaticaly limits spamming unless a remailer allows cloning AND all recipients share a commen private key. 6. It maps 1:1 onto the physical remailer model with the same limits on information at each stage. This allows one to directly apply the current history of precedence involving anonymity and physical remailers. Under todays current legal and social structure this is the only model that will prevent remailers from being held accountable for their traffic and at the same time provide enough income to keep legal protection at hand. Note that I am not saying you still can't be brought brought up on charges, simply that you (as a remailer) now have the structure in place to fight it succesfuly. This is the basic model that the Austin Cypherpunks are working on at the currrent time. The big problem we have right now is determining if the body is actualy encrypted. We have done some basic tests of encryption-spoofing using pgp and it is looks to be a thorny problem. It simply is not trivial to look at a block of characters and determine if they are actualy encrypted. You can't rely on the wrapper around the data put there by the encryption program because this can be kept intact and the data changed. As long as the checksum matches it all looks the same. Even if the test is done with a dictionary this won't help because rsa does not guarantee that once the data is encrypted that the output would be gibberish, sort of like the "All the monkeys in the world typing create Shakespeare" story. It is completely feasible (though unlikely) for the encrypted text to be something meaningful in some language or another. Jim Choate

2 1