December 2003 - cypherpunks-legacy

FWD: Another try to kill democracy
by SPG 17 Dec '03

17 Dec '03

Hi Y'all, I just got wind that the German government is planning to force german ISP's to shut off access to my ISP, XS4ALL, because the german magazine 'Radikal' has a web page on xs4all. This magazine is a radical left wing magazine of the type that in the netherlands is 13 in a dozen, and in germany (obviously) labelled 'terrorist'. The issue here is not my political beliefs (quite distant from radical I can assure you) but the fact that the german government does NOT see fit to extradite nazi war criminals, to fire Judges, DA's and other powerfull officials who were member of the nazi party during WW2, or to take steps towards closing access to US neo-nazi sites, but DOES deem it necessary to shut off an entire server because of a (in the netherlands perfectly legal) left wing magazine. Not so much is changed after all I guess. As student history I can name several people also labelled 'terrorist' before by a government, who were not. 'Terrorist' is the name opressive and undemocratic Junta's use for their opposition. Please considder mirroring or linking to this site. THIS IS A MATTER OF PRINCIPLE!! It has litle to do with the actual content of the page (wich is quite harmless) URL: http://www.xs4all.nl/~tank/radikal/index.htm or contact tank(a)xs4all.nl REMEMBER! NEXT OPINION LABELLED 'UNWANTED' BY A GOVERNMENT, MAY BE YOURS!! Greetz. DD. -- --__+==[ NOTE!! This e-mail adress is read by several different people, due to the fact that it is in use as mailing adress for our editorial staff (TRIBE MAGAZINE), If your message is of a personal nature, and is not to be reposted or used in our magazine , please state so. NOTE: we maintain the right to ignore this, if it has news value. ]==+--__

2 1

"Bit Tax" article in EET
by jim bell 17 Dec '03

17 Dec '03

August 26, 1996, Electronics Engineering Times, Page 4 "Europe wary of bit tax" By Peter Clarke Maastrict, Netherlands Since it surfaced in a report prepared for the European Commission earlier this year (see April 29, page 1) the idea of a "bit tax" on data communications has received a mixed response in Europe. Feedback has ranged from calls for adoption and implementation from within the Belgian government, to a qualified rejection by one vice president of the European Commission (EC), to disjust and disbelief amonst individual Interenet users, particularly in Italy. The bit tax idea, only a very minor part of an interim report, has received a great deal of publicity from private individuals, who seem to be the most upset, fearing state interference as an attempt to tax freedom of speech. Luc Soete, director of the Maastrict Economics Research Institute on Innovation and Technology, has been heavily flamed via e-mail since the report's publication. As chairman of the so-called High Level Experts Group (HLEG) which authorited the report, it was he who included just one clause in about 100 pages of text, calling for an investigation of the taxing of data transmission over networks, and particularly over the internet. [JB: I can't resist adding a comment here. One of the most threatening aspects of this "bit tax" idea (even far more important than the value of the money paid) is the fact that it would make all ISP's and Internet users automatically subject to "tax evasion" charges which would just be a smokescreen for content investigation, and would automatically "justify" wiretaps where content-based investigation would be impossible. It is very likely that threatening an ISP with such charges would cause him to become more cooperative, and the difficulty in calculating and verifying the accuracy of the taxes paid would make everyone an inadvertent criminal, which would give the government enormous leverage it wouldn't otherwise have. The way I see it, anyone who values freedom who would otherwise support a bit-tax-type proposal should run into a brick wall with this problem, and join the opposition to it right here.] Speaking at a conference on telecommuting, the Belgian Minister for Telecommunications, Elio Di Ruppo, came out as a supporter of the bit tax. But the Flemish government, which is responsible for half of Belgium, claims a bit tax would undermine its efforts in promoting information technology within its territory. The report was prepared for DG-V, the department of the EC responsible for social affairs, but Martin Bangemann, the EC vice president who heads up DG-XIII and is responsible for information technology and telecommunications, has expressed concern over the impact of a bit tax. Issues include economic growth and roll out of next-generation information and communications technologies and how a bit tax could be implemented. The EC's official position on the bit tax is that it has no position. "This is only an interim report at the moment," said a spokesman for the DG-V. "The bit tax idea may not even be present in the final report." Not Possible? "The big problem is that it's a nice idea, but implementation may not be possible at the European level," the spokesman continued. It may have to be set at the world level. At the moment, we are waiting for the final report." Officials responses to the interim report, from government and industry bodies, have been generally favorable but often don't mention the bit tax, Soete said. "The bit tax responses have been much more individual. It just goes to show that people don't read reports, but they do read newspapers." Soete continued: "E-mail responses have been very offensive, very negative." Reluctant to give examples, Soete admitted that many e-mail messages had attacked him personally but that the gist was "keep your hands off the Internet." Those responses, as well as more cogent arguments put forward, have prompted Soete to publish a second paper, titled: "The bit tax: the case for further research." In this, Soete has recast the bit tax as a replacement for the value-added tax (VAT) on information-technology goods and services, rather than as an additional tax. "There was an issue of double taxation there, which it is hard to justify," he said. VAT is a European-wide system of taxation on consumption roughly equivalent to the US sales-tax system: It is typically set at 17.5 percent of the untaxed value. Soete argued that VAT is heavily based on ideas of material inputs at different states through a chain of manufacture and is not well-suited to "intangible" services. He pointed out that a telephone call is currently priced and taxed in relation to the distance and time. Instead, Soete proposes the bit or byte--rather than the second--as the fundamental unit of measure. Taxation on that basis might save small-scale users money while increasing the tax burden on large-scale users. "This is a new system of communications, and the assumption that we should be able to use it without any taxation is ridiculous," Soete said. As planned, the HLEG will rewrite its report in light of responses and further research by the end of 1996 before submitting it to DG-V, which is then expected to call for some of the particular recommendations to be investigated in 1997. [end of article] Jim Bell jimbell(a)pacifier.com

1 0

Question re: MD5/other key-crunching methods
by DAVID A MOLNAR 17 Dec '03

17 Dec '03

On the plane back home, I had the pleasure of being treated to a screening of "Sgt. Bilko". Not a bad movie overall, but had a nice throwaway crypto line. It got me to thinking, though... Is it possible to make generalizations about the MD5 hashes of classes of input values? That is, can one say that "no input values of length greater than 512 bits will..." or 'all input values starting with the value 3 have a tendency to..." with any degree of probability? I know hash functions strive to evenly distribute values over their range, but I wonder if it might sometimes be possible to predict the hash of a value without computing it. Why? Well, it's mainly in regards to the way MD5 and other hash functions are used in mapping pass phrases to actual key values for a cipher. Suppose I have a situation in which I feel comfortable in making certain generalizations about the passphrase. Perhaps it's all lowercase, perhaps all alphanumeric, has five hyphens, whatever. Information which may allow one to restrict the passphrase to a certain range. In a system where the passphrase is the encryption key, that range of key values can be doled out and searched sequentially. Since they are likely to be one or several contiguous blocks, one may simply distribute the task of searching each one to willing machines everywhere. The efforts with respect to RC4-40 in the previous year prove that much. If I can rule out even 10% of all possible keyvalues, I've saved a good deal of time. What if one is dealing with a passphrase key-crunched w/MD5, though? The obvious way to go about it is to compute the MD5 hash for each and every value in the given range, then test that set of keys. This is an extra step, and adds a measure of extra time to the whole operation. Sure, one may abstract it away by claiming it's trivial compared to the problem of searching an exponetially large keyspace, but that seems something of a cop-out. Perhaps it's a silly question, but is it possible to identify a set of hashes which correspond to a set of domain values w/o performing the hash itself? I'm aware that it's not possible to reverse a one-way hash like MD5 (wish we could...what a compression ratio!), and I know "good" hash functions strive for properties which would make this exceedingly difficult. However, has anyone looked at the question? Is it worth considering? Thanks. -David Molnar

1 0

What is the EFF doing exactly?
by Black Unicorn 17 Dec '03

17 Dec '03

On Mon, 2 Sep 1996, Stanton McCandlish wrote: > > > What is or is not your personal or EFF's official position is meaningless. > > > It is clear that the personal beliefs of those involved in EFF are > > > those of compromise, present day politics, and a general lack of moral > > > fiber. > > But that's not clear at all, since none of you have access to internal > discussion on this or any other topic here. Esther's position is one of > guarded caution. Our former board member David Johnson's was one of > almost complete anti-anonymity (a fact that probably had a lot to do with > his leaving the board), while other board and staff members are 100% > pro-anonymity, and yet others are middleground or entirely silent on the > topic. Why am I any more mistaken for pointing out that a single influential member of EFF's staff or board is anti-anonymity and yet remains with the organization than you are for pointing out that a single influential member who happened to be anti-anonymity has left? If my position, as you represent, is misguided, surely your point about Mr. Johnson is equally so. If the board is almost 100% pro-anonymity, where's the official position? In so far as an organization is much defined by those involved, I think it entirely right to wonder aloud about the personal motives of the staff and board. I think this PARTICULARLY prudent given EFF's reputation and prior conduct. I would be most happy to be proven wrong and see EFF suddenly, in a burst of impressive moral fiber, speak out publically and take some political action to assure anonymous communication. > > Things simply are not as black and white as they might seem. > Well, let's have a clear official position issued then to end all dispute. > > I agree with you whole-heartedly. I am stunned by the EFF's position on > > this matter and they no longer have my support. Here are some more > > of Dyson's statements on this subject. > > You've not been reading very carefully. There is no "EFF's position on > this matter". There is just Esther Dyson's position on this matter, > and quoted out of context. Maybe there should be an EFF position on the matter. What is EFF doing if not supporting anonyminity? I'm hardly going to support an organization that proports to be pro-internet freedom and yet has no official position on anonyminity. Of course you should expect people to wonder about EFF when you have no official position and yet some staff and board members seem to have a statist bent. > -- > <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish > </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org > </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation > </A><P> Online Activist </HTML> -- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li

6 12

Undeliverable Message
by MAILER-DAEMON＠mqg-smtp3.usmc.mil 17 Dec '03

17 Dec '03

To: <cypherpunks(a)toad.com> Cc: Subject: Re: Cypherpunk Mailboxes? Message not delivered to recipients below. Press F1 for help with VNM error codes. VNM3043: BANYAN SERVER@MAG26@2DMAW NEW RIVER VNM3043 -- MAILBOX IS FULL The message cannot be delivered because the recipient's mailbox contains the maximum number of messages, as set by the system administrator. The recipient must delete some messages before any other messages can be delivered. The maximum message limit for a user's mailbox is 10,000. The default message limit is 1000 messages. Administrators can set message limits using the Mailbox Settings function available in the Manage User menu (MUSER). When a user's mailbox reaches the limit, the user must delete some of the messages before the mailbox can accept any more incoming messages. UNDEFINED-----BEGIN PGP SIGNED MESSAGE----- On Mon, 2 Sep 1996, William H. Geiger III wrote: > Hi, > > I have a thought for addressing the anon. problem. > > We could create a network of anonymous remailers with mailboxes. All > messages in the mailboxes are stored encrypted. No information about the > users are keep. Users would be be given x K of mailbox space. > > We could use PGP keys for encrypting the messages. Each user would have his > own key pair for his anonymous mailbox. Any plain text messages received to > the server would be encrypted on recept. > > Let the government's subpoena away. :) > > "Sorry we don't have user addresses, no I can't decrypt those messages > Senator." <BEG> > > What do you think? The only problem is there has to be someway for users to retrieve their mail. The current nym server approach is to use an encrypted reply block to send a user new mail. This way the nym server doesn't know who the user is. If users have to actively retrieve their mail, then the feds could install a packet sniffer on the remailers net link to find out the real email address of an anonymous user. - -- Mark PGP encrypted mail prefered. Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMiscESzIPc7jvyFpAQGQ8ggAoHoGwwLI/8WI3XEBvA/Yo/lOPu1bQGYZ +m/jYzZjlF/YcS54J+H+L+xRo9WcOJkm7LLetTRZM3N/vG71M01vLcoOnfciRjFz AhLj2V5DGEcyQE0GMBXOxgxKvnzMVkFJh6ZWFalIM0DedncdX541W3j+almPb7Yr YyT+On5mqbPd0U5rJgv2CfE5CFlAE7XyO0KteH5aONK3f6TxzGH4cGG8wSZaBiu4 jP55nTl8VdtMH7MBDqOFkAH7IOboDZzjDglbuFHFk/nhtKfYIzg4c/ck5VCZ1vs8 xIqaPIMzpQF/smfKS2upyhZB1fb3G101lUJmjoVkEATQhwMzLBhY1Q== =QbyB -----END PGP SIGNATURE-----

1 0

Re: FWD: Another try to kill democracy
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Sep 02, 1996 21:53:42, 'SPG <spg(a)dds.nl>' wrote: >As student history I can name several people also labelled 'terrorist' before >by a government, who were not. 'Terrorist' is the name opressive and >undemocratic Junta's use for their opposition. --------- >From the US journal "Foreign Affairs," Sep/Oct, 1996: Postmodern Terrorism Since 1900, terrorists' motivation, strategy, and weapons have changed to some extent. The anarchists and the left-wing terrorist groups that succeeded them, down through the Red Armies that operated in Germany, Italy, and Japan in the 1970s, have vanished; if anything, the initiative has passed to the extreme right. Governments and media in other countries do not wish to offend terrorists by calling them terrorists. The French and British press would not dream of referring to their countries' native terrorists by any other name but call terrorists in other nations militants, activists, national liberation fighters, or even "gun persons." ---------- For the full 30kb essay see: http://jya.com/pothot.txt

1 0

Re: FLT 800: From the Rumor Mill...But It Makes Sense.. (fwd)
by James A. Donald 17 Dec '03

17 Dec '03

At 09:04 PM 9/1/96 -0400, Alan Horowitz wrote: > The Aegis ship in the Gulf wzs not in an exercise. It was in a war zone. > > If my memory serves, the Iranian jetliner had its squawker turned off, or > broken. Your memory does not serve: The computers record of the events was: Computer tells crew: Civilian jetliner on radar. Crew expecting an attack by jetfighters, tell computer to shoot it down. Computer does not put up a bunch of dialogs saying: "Hey, I think this is a CIVILIAN airliner, did you get that CIVILIAN airliner, are you quite sure you want it shot down? Instead it just shoots it down. Human error by the American military. Possibly poor user interface on the computer. Possibly indifference to civilian lives by the American military. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Pseudocrypto detector is going wild (was: Re: ALPHACIPHER - An unbreakable encryption program.)
by Bill Stewart 17 Dec '03

17 Dec '03

C Matthew Curtin <cmcurtin(a)research.megasoft.com> posted a reference to ALPHACIPHER, which appears to be Yet Another Snake Oil System. It's got good intentions - it uses (ahem) "one-time pads", and tries to build a convenient user interface for low-volume work. Of course, it apparently doesn't quite get it: > ALPHACIPHER uses key sets generated by a > proprietary random key set generator > to insure the production of unique, high-quality keys. The key set generation is inherently part of the encryption process; since it's proprietary, it's not possible to test the quality of the random numbers, but they must be assumed to be low-quality crackable stuff unless the author is willing to reveal the algorithm and demonstrate otherwise. The program is written in DOS, and produces its output as UPPERCASE LETTERS to avoid being caught by eavesdropping scanners that might detect other patterns. Not unreasonable, I guess. The author, Wolfgang Hammersmith, also wrote The New ADFGVX, a cypher that can be done by hand (if necessary), which he does acknowledge is breakable, but comments that for short messages, there may not be enough information to break it. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: strengthening remailer protocols
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:25 PM 9/2/96, John Anonymous MacDonald wrote: >I don't really see the use of this complicated scheme. The main >problem seems to be that if M floods remailer R with messages to B, >and A sends a message to C through R, then it will be clear to M that >A's message was destined for C. > >Rather than divert messages, then, I propose that for each input >message there is a 10% chance that a piece of cover traffic is >generated. Thus, if M sends 50 messages through R and sees 6 outgoing >messages going to remailers C, D, and D, he will now know which >messages correspond to the message that A send through. This type of attack is why "reply-block" schemes are fundamentally flawed. Any such scheme gives an attacker (a traffic analyst) a wedge with which to deduce mappings. It is a kind of "chosen plaintext" attack (loosely speaking). Or a "forcing attack." Maybe a "flooding attack" is as good a name as any. One floods the reply block and simply watches where the water goes. (If there were more academics in the crypto community looking at digital mix issues, there would likely be clever names for the various attacks.) Several folks on this list, including (from memory), Scott Collins, Wei Dai, Hal Finney, myself, and others, have noted this weakness over the years. Note that merely fiddling around with probabilities of transmission, such as described above, will not be enough. This just adds a layer of noise, which will disappear under a correlation analysis. (For newcomers, there are interesting parallels between statistical analysis of ciphers and similar analysis of remailer networks. And lots of statistical tools can be used to deduce likely mappings based on source/sink correlations, digram analysis, etc. Making a remailer network robust against such analyses will take a whole more basic thinking. Merely increasing message volume is not enough. Nor is increasing latency enough. Generally speaking, of course.) Instead of reply blocks, I think use of message pools (a la BlackNet) is a more robust reply method, as it uses "widely-distributed messages" (a la Usenet newsgroups) to get around the source/sink correlation issue. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: Free Speech and List Topics
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> More disturbing to me recently has been the steady increase in subscribers > to this list who don't seem to value free speech very highly, who write of > their own nation's censorship as valiant efforts to protect citizen-units > from foreign devils, and, even more shockingly, from supposed defenders of > electronic freedom who are now talking about the need for limits on > anonymity. I too have noticed this, but we must remember that although we are the people who see the tyranny of censorship etc. all to clearly we are in a very small minority, the majority of people do not support censorship because they have made a reasoned judgement, the either support it because they are too lazy to do anytthing, too shit scared of the government if they do, or they just do not take the time to understand the issues and so support the common view, there is also the case that many people "go with the majority", because they do not want to appear different, and the media has so demonized free speech and liberty advocated that to associate yourself with them now is equivalent to telling people you are a rampant sexually deprived paedophile in an anorak. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az4= =riHc -----END PGP PUBLIC KEY BLOCK-----

1 0