December 2003 - cypherpunks-legacy

Re: CFS Questions (protocol? safer/idea linkings?)
by David Rochberg 17 Dec '03

17 Dec '03

ftp://research.att.com/dist/mab/cfs.ps is Blaze's CFS paper (which I was silly not to read before my last post to cfs-users). It should answer many of your questions. The answer to your "why so muany keys" question is that CFS uses two keys per attachment (2 * 64 per hybrid-3DES instance * 2 instances = 256). This is an attempt to foil structural analysis of the files---under ECB mode alone, identical parts of the file will be encrypted to identical ciphertext. To encrypt data, CFS first XORs the data with a long (.5 Mbyte, according to the paper) repeated psuedo-random mask. The mask is generated by running the cipher in OFB mode with one of the keys. Then the result of the XOR is encrypted in ECB mode with the other key. (There's some other optional XORing that goes on as well---read the paper). The passphrase->key bit is based on SHS. Take a look at new_pwcrunch in getpass.c in your distribution. -david

1 0

Re: Micropayments: myth?
by Bill Stewart 17 Dec '03

17 Dec '03

>>don't people get this? with microcurrency, you don't say to a >>seller, "bill me for this item". it would rarely work like that at >>all. instead, it is, "here is my money, please give me the item". > >What is the authentication process for the "money" your are "giving" in this >scenario? Varies with the micropayment system. Some proposals are to use Digicash, either online or offline. Others are to use simpler systems, such as S/Key variants or piles of tokens - you'd use some heavyweight payment system like a credit card / ATM / digicash to buy 100 or 1000 microtokens, which you'd use for the actual payments, and which would require less computation to authenticate. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

1 0

Re: Win95 Blowfish Implementation
by Deranged Mutant 17 Dec '03

17 Dec '03

On 22 Jun 96 at 19:49, Perry E. Metzger wrote: > Actually, MD5 has no restrictions on it at all. Its one thing RSA DSI > is nice about. Copies of the code are everywhere on the net, and are > totally unrestricted. I thought they asked for an acknowledgement in manuals or the programs usage or title message that it used RSA's MD5 implementation, *if* you used their source code. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Those Evil Republicans
by Duncan Frissell 17 Dec '03

17 Dec '03

"They believe that the Government is the problem and that what everyone needs is to be told, 'You're on your own; go out there into the tender mercies of the global economy; have a great time in cyberspace, and we'll get out of your way.'" -- William Jefferson Blythe Clinton in a speech to the AFSCME in Chicago on Friday. I guess he doesn't want us to have fun in cyberspace -- though he didn't say so directly. DCF In the same speech in which he talked about people hunting ducks with rifles.

1 0

FISA Mock
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-23-96. WaPo Mag cover story: "Secret Intrusions" Government surveillance, terrorism and the U.S. Constitution: The story of a Washington Courtroom no tourist can visit. Last year, a secret court in the Justice Department authorized a record 697 'national security' wiretaps on American soil, outside normal constitutional procedures. Is the world growing more dangerous -- or has Big Brother found a way around the Foruth amendment. A revealing report on burgeoning FISA wiretap intrusions, featuring FBI, NSA, CIA, Freeh, Kallstrom, Gorelick and little-known Mary Lawton who, before her death, guaranteed the incorruptibility of FISA: "In the modern age of intelligence gathering and federal law enforcement, no one was more important to the management of the most critical legal issues binding the two communities." And what has happened without her "gold standard of legality in the world of counterintelligence." A wideawake eye-opener to General Reno's sweetsong lullaby at the Commonwealth Club. Taken from a book due out next month: "Main Justice," by Jim McGee and Brian Duffy. ----- http://pwp.usa./pipeline.com/~jya/fismok.txt (54 kb) FIS_mok

1 0

Arsenal Ship Details
by jya＠pipeline.com 17 Dec '03

17 Dec '03

A front-page detailed description of the Navy's latest work on the remote-controlled Arsenal ship: http://www.washingtonpost.com/wp-srv/WPlate/1996-06/23/100L-062396-idx.html

1 0

Tales from the UK: Part III
by winn＠Infowar.Com 17 Dec '03

17 Dec '03

Attacks on the Financial Sector: Reprise I've spent the last two weeks in Europe, five countries, an avarage of 2.6 countries per day. Two kids and a wife along for a 'family vacation' which I have concluded is a modern day oxymoron. I'm thankfully back on the road to DC and Atlanta, sans kids, in a few days for a well earned rest. :-) (Love you honey, really do, but I do need a break . . . .) But what you care about is the attacks that the Sunday Times has been talking about for the last couple of weeks. I've received incredible volumes of email on this story asking for more details - mostly very supportive - so here goes I met with the Times in London's Trocadero (while the kids played Virtual Games upstairs in an incredible arcade). I also spoke with them at length while at the top of Le Tour Eiffel, at Euro-Disney (Space Mountain violently pivots you end over end in complete darkness: a definite PG-13 ride), on the Chunnel Train and at Legoland. First, the errors in their reporting that annoy me: 1. As a co-sponsor of InfoWarCon, I can assure you that the Brussels event had *nothing* to do with the alleged attacks as the June 2 article implies. 2. There were absolutely *no* secret meetings at InfoWarCon about the alleged attacks, 3. Laithe Gambit is not a secret study group about the distresses of the financial community. It is a NATO SHAPE security group and most of it is quite open. Despite the protestations of the Net community, masses of media folks and my own criticisms of their writings, the Sunday Times is sticking by their stories with dedicated vehemence. In some ways they seem confused and chagrined that their reporting is suspect. They really do believe what they are saying. I argued that they gave no names of their sources and they responded that it wasn't necessary since they used the word 'spokesman' in several places. We have to remain disagreed on that point. If it's a rumor, then say it's a rumor. If it's a well placed source who wants anonymity, say so. If it's a spokesman, name him in writing. As a result, the U.S. media has been calling Kroll Associates and the NSA and the British DTI and so on and getting rebuffed at every turn with firm denials of having ever had conversations of the nature claimed in the Times' articles. According to the media with whom I've spoken, this is a giant red flag. Curiously, though, according to the Times, when they call back the very sources used for the articles in the first place, they too are being met with cold shoulders and 180 degree attitude shifts. Curiouser and curiouser. The Times swears by the validity of the story, and is putting on additional pressure to those people who they claim are in-the-know and will come out with the real details which could be further corroberated. I will be receiving, hopefully this weekend, (not here yet) an updated article that is being published in the UK on this story. From what I've heard about it so far, it will include some comments from Russian Admiral Pirumov (ret) and others on the record. In the next couple days: Someone in Basel corroberates the tale. Peace Winn Winn Schwartau - Interpact, Inc. Information Warfare and InfoSec V: 813.393.6600 / F: 813.393.6361 Winn(a)InfoWar.Com

1 0

Sign me up
by Todd Murchison 17 Dec '03

17 Dec '03

Please post me on the mailing lists.

1 0

Re: Oil Change software snoops through hard drive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:31 PM 6/23/96, Alan Lewine wrote: ><<I wrote: >>But this isn't MS's RegWiz. It's capabilities sound much greater, and >>it's not clear how to opt out, etc. >>Tim May replied: ><<Not buying it and not installing it would appear to be an easy way to >"opt out.">> >Maybe i'm confused, but oil change sounds like a mole that can burrow >unbidden into user's disks. I don't think user installation is required, >or else it will auto install the user code on installation of whatever >software has licensed it. If I understand your comments (the strange wrapping doesn't make it easy), you are confusing Oil Change with a virus or worm. It's a commercial product, offering a (putative) service to those who buy it. One "opts out" by not buying and installing it. There may be privacy implications, but then there are privacy implications in all sorts of other areas. Such as filling out a loan request, applying for a credit card, visiting a doctor, etc. I'm of course not saying that these privacy implications are not worth discussing, and do not vary from example to example in seriousness, only that Oil Change hardly appears to be a significant threat. To repeat, no one is forced to buy and install Oil Change, and it certainly doesn't copy itself onto the machines of unsuspecting users. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: L&J: Libertarians
by Jean-Francois Avon 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 22 Jun 96 at 18:56, jim bell wrote: > In practice, I think we'll discover we don't NEED politicians at > all! I was having a discussion with a retired physics dept director the other day. He never heard of AP and we did not discuss it. But we discussed the Net a lot. And he made a very fundamental remark. He said someting along thoses lines (not an exact quote but one that sums it up in essence) : "It is amazing how the Net is. It is a total anarchy and yet, it seems to work *perfectly* well without any central decision making authority. Actually, no central authority could ever make it happens better than this actual anarchy led by self-interest on the part of each individuals each owning a tiny piece of the network." It make me think about how essential the govt is, and especially in the field of economy... > Sure, there are some people who scoff, > but I think they're just displaying sour grapes. They're so used to > the current system, they want to "fix" it with half-measures rather > than really eliminating the problems. Some peoples have a vested interest in maintaining the system as it is. For example, take here in Canada, progressive tax rates / a flat income tax. If a flat income tax rate would be put in place, just think of how many chartered accountant would be jobless overnight... > That's exactly the kind of discussion I want to have, on the 'net. > It turns > out, however, that many if not most of the people who "get" this > idea, are satisfied that it'll work, and don't seem to see the need > for discussion of the details. Anybody who discuss it openly on the net and plan to implement it will get killed by governments (pick your favorite one). I find it very unlikely that all e-mail on the topic is not monitored, just as anything having my name, or Jim Bell's or anybody else that ever discussed the topic. Even peoples who apparently seemed to denigrate AP, like Unicorn, will be suspected since they'll reason that he might have a secret wish to implement it while opposing it publicly. Just like mole get to the highest rank in the organization they want to undermine. That is the *nature* of any security oriented organization. And communicating with each other with PGP without remailers would probably put us instantly on a hit list. To quote a famous french comic strip " when in doubt, it's better to hang..." . The best protection is either a long chain of remailer or to post *everything* publicly on C'Punks *AND* several newsgroups at the same time. Then, again, they might make "examples", helped by a scare publicity campaign by the mass medias. Wake up to it guys, if ever such a system gets implemented, it will be a major war and govt will use every allies they might have (mainly, the conventional mass-medias) to eradicate it. The war will be fought underground but it will be savage, as all wars are. I don't think that you will ever succeed to "educate" a sufficient part of the public to make things work as you figured. The net population represent a minuscule fraction of the population and most net surfers don't even care. C'Punks has a total cumulative subscription of, say, 10000 (out of the blue number), which represent (at 40E6 internet users) around 2.5 percent of 1 percent of all net users. Many individuals consider that it is better to get taxed to 50% and keep 100% of their life... JFA -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Verify/Decrypt with PGP v2.6 or later. iQEVAgUBMc0L5ciycyXFit0NAQHFjggAiWQUV0YudQPHq1Q7Y8zkv64PicePiyoX MEBOfseSx6SEiSoB0N/JY3FBZYOEa6QYfYiNr/FBSWjyPVEuxQcJc3SBQ354lFOQ ZqiQnR6TrjzxZo0Z+NaVYI2Ys+G5ykOGW45NElF5TRyk0YjK1HI/dlS7UpD9Li1E +xMtJo8x+/joWYEc45ABIHg0DUAJWe4MG7AEcmde4veOcyC/yMi1gy+2QLMARyZ/ VbTfhJ+V1D5zwBTNVQCtcIOJMeXmMDeBy6gkBRlaYP5r6az+uQa6AKfo78Y3f1eQ P6XZWuGeWLPvdIeq+FTwWvULdfPkZ4xJtaCIJC03gOgBmXsuWNmy8Q== =Yovo -----END PGP SIGNATURE-----

2 1