December 2003 - cypherpunks-legacy

Re: cryptoanalysis 002
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

> From: Scottauge(a)aol.com > Date: Tue, 20 Aug 1996 18:36:45 -0400 > Subject: cryptoanalysis 002 > For example, if the crypto-alphabet for e is 23, 45, 190, 200, etc, one can > remove some of the frequency for a letter. This definately makes it harder > to attack with the frequency analysis method because the "resolution" of the > distribution for the letter is lessened to a near randomness. (So it looks, > there are still clues, eh?) I think (from memory) this is called "homoalphabetic". Encyclopaedia Brittanica (Cryptology - article by Gus Simmons) says that it is still vulnerable to frequencies of digraphs, trigraphs etc. But even Gauss was keen on it once. I guess it might have value as a part of another system, making a known plaintext into one of many. Whether it's worth the increased cyphertext size in a system you'd hope to be immune to known plaintext attacks anyway is another question. PA

1 0

Anonymous password changed.
by daemon＠anon.penet.fi 17 Dec '03

17 Dec '03

You have requested the replacement or assignment of your anonymous password. Your password is now x4anarchy.

1 0

SpamBot
by blane＠aa.net 17 Dec '03

17 Dec '03

Well, with all the other noise in the list lately, I'll add a little of my own. I woke up today to find my mailbox filled with 20 messages from a 'careernetonline.com' offering to spread my resume across the net for $60. It was one of those terrorist spams where they apologize for wasting your time and tell you that you can stop getting spammed by replying to the message. Well, I really hate giving in to terrorists, no matter what form they take. And I'm sick and tired of spam. So, I'm starting a project called SpamBot. You feed it a message and a list of addresses and the bot send the message to those addresses until they reply with an appropriate message indicating that they are at least looking into the problem. Some people may say that this is sinking to their level. So it is, but I think its time that system administrators realized that there are people who don't appreciate being the target for shotgun marketing schemes (none of which have been of any use to me). Watch my webpage for more info on this helpful little bot. Brian ------- <blane(a)aa.net> -------------------- <http://www.aa.net/~blane> ------- "Extremism in the defense of Liberty is no vice" - B. Goldwater ============== 11 99 3D DB 63 4D 0B 22 15 DC 5A 12 71 DE EE 36 ============

1 0

Asia seen having appetite for Internet banking
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> NEW DELHI, Aug 21 (Reuter) - Asian nations are eager to make >use of the Internet in the field of banking and finance to meet >individual country's needs, a senior official of computer group >Hewlett-Packard Co said on Wednesday. > ``The response through the region is quite phenomenal,'' Jeff >Ayton, the region's director of marketing in the financial >services division of Hewlett-Packard, told Reuters in an >interview. > He said a Hewlett-Packard roadshow he held across the region >revealed a keen interest in the use of Internet in banking and >insurance. Internet experts say customers can use the network to >transact business and banks can improve communications and >customer service with its help. > ``I don't think any Asian country wants to be left behind,'' >he said, but added that the exact level of sophistication in the >demand generated would depend on customer needs and >infrastructure facilities in each nation. > With even rural areas now linked via satellites, there is a >big potential for Internet-linked business in huge emerging >markets, he said. > ``Satellite technology is what will help in countries like >China and India,'' he said, referring to their own satellite >launch programmes. > Ayton said he had found interest in using the Internet in >banking in the Philippines, Hong Kong, Malaysia, Thailand, >Singapore, Taiwan and South Korea. > Hewlett-Packard officials say that countries like India >could leapfrog in computer networking technology because they >have not yet invested huge amounts in computer infrastructure. > Ayton said he was scheduled to meet Indian banking officials >next week to discuss Internet-related possibilities in the >field. > Kapi Attawar, a senior Hewlett-Packard official dealing with >emerging markets, said his company saw particular potential for >the ``Intranet''. The latter enables local networks within >companies to be linked to the worldwide information highway. > Many Indian companies already had local computing networks >using basic data transmission facilities which may be used to >hook on to Internet, Attawar said. > > > _______________________ Regards, Nothing great was ever achieved without enthusiasm. -Ralph Waldo Emerson Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Republican and Democratic party platforms on technology
by declan＠well.com 17 Dec '03

17 Dec '03

Dole's cosponsorship of Pro-CODE was a way to land some California votes and a way to differentiate himself from Clinton, nothing more. A statement he released on May 2 bashed the White House: "The administration apparently thinks very little of the right to privacy -- it presumes the government is entitled to all the so-called 'keys' or secret passwords which protect computer generate [sic] information from prying yes..." I predict that if he were to win, we'd see the fastest policy turnaround ever. The moment he was inaugurated, Dole would pick up where Clinton left off. Clipper IV, here we come... But the benefit of having a pro-privacy statement in the platform (which in fact was watered down significantly from that originally proposed by advocates on our side) is that the platform covers Republican Party candidates for any office, not just the presidency. I'm told that the a Dem convention speaker may talk about privacy issues, however. -Declan Tim writes, quoting me: >Sure, the rhetoric might be slightly different under a Dole presidency. The >focus would be on "halting the spread of abortion information on the Net" >and "plotting by Communists using unbreakable cryptography." > >>(Contrast both parties with the Libertarians, which have a sterling >>commitment to online civil liberties, reflected in the platform approved at >>their convention last month.) > >I certainly plan to vote for Harry Browne, their candidate, even if voting >only encourages the process. > >I first read Browne's stuff back in 1973, and, a few years later, his >wonderful and "Zen Calvinist" (my term) book, "How I Found Freedom in an >Unfree World," which I still recommend to people. As far as I'm concerned, >Browne is the strongest candidate ever fielded by the Libertarian Party.

3 3

Court rules faxes are not binding
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> CINCINNATI, Aug. 21 (UPI) -- A federal appellate court in Cincinnati >ruled this week that faxes are not necessarily legally binding if the >receiving party does not know the communication is coming. > The case stemmed from a 1991-92 strike by 200 Clow Water System Co. >workers who were represented by the United Steelworkers. > The court ruled the Coshocton company, a division of McWane Inc., did >not violate federal labor law when it hired replacement workers after >the union transmitted an unconditional fax offer to return to work in >February 1992. > The union sent its offer by fax at 4:35 p.m. on a Friday, 25 minutes >before the plant closed for the day. The intended recipient claimed he >checked for any communications at 4:30, and when he saw there weren't >any, went home. > On Saturday, Clow hired 80 replacement workers. > The National Labor Relations Board later held that actual knowledge >of the fax was not required. The board said the parties had communicated >by facsimile during their negotiations, and that the facsimile was sent >and received. > But the appellate court said the union had sent only four facsimile >transmissions during 13 months of negotiations. > ``All of these facsimiles contained contract proposals -- a >communication intended to be examined and considered, not a >communication having legal import in and of itself,'' the court said, >ordering the NLRB ruling against Clow must be re-evaluated. > The court said facsimile and electronic mail are becoming >increasingly common forms of business communication, however, both >parties must agree to the use of such media and must be notified when >messages are sent. > ``The critical part of this case is that (the fax) was sent only 25 >minutes before the plant closed,'' David Peck, a lawyer with Taft, >Stettinius & Hollister, the law firm that represented Clow, told United >Press International Wednesday. ``Normal courtesy is to call first and >again after to confirm that a fax has been received.'' > The union claimed Clow committed an unfair labor practice by >permanently replacing economic strikers after the union made an >unconditional offer, as required by federal law, to return to work. > But the court said the fax transmission itself wasn't the issue. > ``The key to this case is simply fair notice,'' the court said in its >decision. ``If the parties did not agree to the method of communication >utilized, and if there is no pattern of conduct reflecting acquiescence >to the method of communication utilized, we will not impute notice of >the communication to the recipient. > ``Communication by facsimile has simplified and streamlined the way >in which business in conducted in this country,'' the court added. >``This technological advance provides a valuable service and benefit, >and our holding should not be taken as an indication that parties should >not use facsimiles to conduct their affairs.'' >-- > C O P Y R I G H T * R E M I N D E R > > This article is Copyright 1996 by United Press International. > All articles in the clari.* news hierarchy are Copyrighted and licenced >to ClariNet Communications Corp. for distribution. Except for articles >in the biz.clarinet.sample newsgroup, only paid subscribers may access >these articles. Any unauthorized access, reproduction or transmission >is strictly prohibited. > We offer a reward to the person who first provides us with >information that helps stop those who distribute or receive our news >feeds without authorization. Please send reports to reward(a)clari.net. >[Use info(a)clari.net for sales or other inquiries.] > > Details on use of ClariNet material and other info can be found in >the user documentation section of our web page: <http://www.clari.net>. >You can also read ClariNet news from your Web browser. > > > _______________________ Regards, Nothing great was ever achieved without enthusiasm. -Ralph Waldo Emerson Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Canada Imprisons People For Human Rights Activity
by koontz＠netapp.com 17 Dec '03

17 Dec '03

>OK, so what would happen if I organized a party with the proclaimed goal >of secession of Oklahoma from the United States? You'd be overwhelmed with contributions?

1 0

U.S. Army Private Faces Spying Charges
by Thomas C. Allard 17 Dec '03

17 Dec '03

source: http://www.yahoo.com/headlines/960821/news/stories/spy_1.html U.S. Army Private Faces Spying Charges WASHINGTON (Reuter) - The U.S. Army said Wednesday it had charged a 20-year-old computer specialist with espionage and computer crimes in a case that the soldier's parents said involved a Chinese national. Pfc. Eric Jenott of the 50th Signal Battalion at Fort Bragg, North Carolina, was formally charged June 28 and is in a Marine Corps jail in Camp Lejeune, North Carolina, awaiting court-martial, the army said. ``The case involves classified information and matters pertaining to national security,'' a three-paragraph statement from Fort Bragg, home of the Army's 18th Airborne Corps, said. It said many of the case's details were too sensitive to disclose. Jenott has been charged with giving ``secret computer passwords relating to the national defense'' to a Mr. Lee, ``a citizen of a foreign nation,'' his lawyer said, reading from the charge sheet. He also faces charges of destruction of government property and larceny. The charge sheet alleged Jenott disclosed the passwords between April and June ``with the intent or reason to believe it would be used to the injury of the United States or to the advantage of a foreign nation.'' It said the passwords ``directly concerned communications intelligence,'' among the most closely guarded U.S. secrets. Jenott is facing a general court-martial, the most serious kind, and a possible life sentence if convicted, his lawyer, Timothy Dunn, of Fayetteville, North Carolina, said in a telephone interview. He said his client was ``not a criminal'' but had broken into a supposedly impenetrable system after advising his superiors of defects in the security system. Dunn declined to discuss the system because of what he called the case's sensitive nature and national security implications. John Jenott said his son, a fluent Chinese speaker whom he described as a ``computer genius'' with a longstanding interest in China, had given a young Chinese friend what the son described as an unclassified computer code. He said his son knew the person to whom he gave the code from one of several trips he had made to China. His son, ``not your average kid-out-on-a-skateboard-type guy,'' could read and write Chinese and lived with a Chinese family in Vancouver, Canada, for about a year when he was in high school, the father added. He said his son told him that before giving away the code, he had been trying to show his superiors a security flaw in a sensitive communication system and eventually demonstrated he could get secret data without authorization. ``He was trying to say we have a weakness,'' John Jenott said in a telephone interview from his home in Graham, Washington. ``This stuff about being a spy -- it's ridiculous.'' His stepmother, Kelly Jenott, said, ``They're blowing this way out of proportion.'' His father said an Army major at Fort Bragg, whom he declined to name, had urged him to persuade his son to sign a confession, so prosecutors would not seek the death penalty. Jenott said his son had told him, ``Dad, I'd rather die than sign that.'' ``He said it's not true. He said, 'I'm not a spy. I didn't commit espionage. And I'm not going to sign something that says I did,''' Jenott said. -30- rgds-- TA (tallard(a)frb.gov) I don't speak for the Federal Reserve Board, it doesn't speak for me. pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D

2 1

"Freedom on Trial," from October 1996 Playboy
by declan＠well.com 17 Dec '03

17 Dec '03

[Some excerpts follow. Pick up the October issue for the full article. --Declan] Playboy, October 1996 "Freedom on Trial: how the communications decency act played in court" By Declan McCullagh (declan(a)well.com) Day 1 (March 21) In the shadow of the Liberty Bell in downtown Philadelphia, the future of online liberty is being decided. A panel of federal judges has gathered to hear a challenge to the Communications Decency Act, which bans "indecent" or "patently offensive" material from being transmitted or displayed online where minors might access it. That means just about anywhere online. [...] Day 2 (March 22) A key witness today is Robert Croneberger of the Carnegie Library of Pittsburgh. The judges are pleased with his description of the Internet as a library -- finally, someone who isn't using technobabble. Croneberger testifies about the difficulties and expense of implementing the CDA, noting that his library would have to hire 180 people to review and censor the 2 million listings in its catalog. Russotto, the government lawyer, is skeptical. During her cross-exam, she tries to make the case that the job wouldn't be so difficult as Croneberger portrays it. Q: Can you do a keyword search through your catalog for words related to sex or for the seven dirty words [to find material to restrict]? A: It depends. Q: But a keyword search on sex wouldn't turn up books about physics, would it? A: I doubt it. Q: And a search on sex isn't going to turn up books about gardening? A: Obviously plants proliferate and flowers grow, but it depends on the words you're using. Q: Would a search on sex turn up a biography of Abraham Lincoln? A: I've read many articles about his supposed sex life, or lack thereof. Q: Would a search on sex turn up any books about geology? A: Only if "rock" is put together with "roll." Croneberger's point is subtle but clear. Sex can't be taken out of a library any more easily than it can be separated from life. [...] Day 4 (April 12) The government witnesses take the stand. First up is Howard Schmidt, an Air Force special agent who says he has conducted 30 to 50 investigations of online porn. The judges are growing weary of demonstrations and sex, so when Schmidt offers to download provocative images from Usenet groups, the panel asks for G-rated animals instead. After the second or third waterfowl image, Judge Sloviter rules, "I think we've seen enough ducks." [...] Beyond its sheer stupidity, [Carnegie Mellon University computer scientist Dan Olsen's -L18 self-labelling scheme] seems to be built with prudery rather than technology. During cross-examination, the judges didn't appear to take him seriously: Q: If you thought about posting a centerfold from Playboy, would you think the image might be indecent or patently offensive for persons under 18? A; If we consider the local community that consists of Dan, Dan would be offended. Q: And how about the seven dirty words. A: Dan would be offended. Judge Buckwalter: Who's Dan? Judge Sloviter: Yes, who's Dan? A: That's me. I'm sorry. Judge Dalzell: Oh, he's the community. He is an expert on what would offend him. A: It's a relatively small community, but it's the one I know best. Buckwalter: I thought Dan was an acronym. A moment later, our lawyers show Olsen a list of Internet addresses and ask if they appear to be porn sites deserving of unsuitable-for-children tags. He hesitates, then says, "I don't know, but I wouldn't go there." Looking over the list, Judge Dalzell adds the punch line. "Chick of the Day could be poultry," he suggests. "You really are in for ducks and poultry," says Judge Sloviter. "It's a leitmotif." Bruce Ennis, counsel for the ALA, asks Olsen how content providers would verify the ages of those who visit their sites. Olsen stammers a bit and then hits on an idea. Ask the Social Security Administration! It keeps records of such things. Big Brother couldn't have said it better. Day 5 (April 15) The government has a tough road ahead. It has to convince three skeptical judges that enforcing the CDA would not become a boondoggle. Olsen, at least, believes it can be done. When asked if his rating system would slow the growth of the Net, he quickly responds, "Absolutely not!" But everyone in the courtroom seems to feel Olsen is being a weasel. Judge Dalzell, the most Net-savvy judge and the only one with young kids (I'm guessing the two are related), helps pin the inventor down. "Assume a chat group -- say, students from 13 to 18 -- is talking about the CDA. In the course of the chat, an 18-year-old is exasperated and types in 'Fuck the CDA.' Is it your proposal that before he types the message, he should tag it -L18?" Dalzell is paraphrasing Cohen v. California, a First Amendment case in which the Supreme Court overturned the conviction of a teenager who wore a jacket that read "Fuck The Draft." Some of Dalzell's other questions were equally astute. "If in one issue of The Economist the word 'fuck' appears," he asks Olsen, "the library putting it online would have to go through the entire issue?" "Somebody would have to make that judgement," Olsen replies. He suggests that librarians band together to censor material. He insists his plan is "flexible." To that, Bruce Ennis reponds testily, "Is it flexible if you, the librarian, risk going to jail for two years if you make the wrong judgment and put material online that is found to be patently offensive for a minor?" [...] Sloviter isn't finished. After Olsen claims that a voluntary rating system developed at MIT is unfeasible because it will "slow the flow" online, she asks how an adult could show -L18 tagged materials to a mature teenager. Olsen replies that a "teacher or parent could log on." "Wouldn't that slow the flow?" the judge asks. Flustered, Olsen suddenly discharges a series of staccato high-pitched giggles. It's the damnedest thing that I have ever heard -- it sounds like a rabbit being tortured to death. The galley stares in horror. Thus ends the testimony of our best witness -- and we didn't even call him to the stand. Day 6 (May 10) During closing arguments, Justice attorney Tony Coppolino dances around providing a legal definition for indecency. He hints that it would include only hard-core porn but concedes the government can't guarantee that an ambitious prosecutor somewhere wouldn't take on an absurd case. Judge Sloviter is growing impatient: "I've been taking the position for 17 years that people should know what they can be prosecuted for," she says "I still don't understand" what indecency means under the CDA. "We've been trying to get at this for 40 minutes," grumbles Judge Dalzell. [...] EPILOGUE We have won -- for now. The government's appeal will reach the Supreme Court during the next few months. If the Court upholds the lower court decision, outraged right-wing groups will demand action. Congress will spring to attention. Bills will be drawn up, campaign funds raised, and porn once again waved in the Senate chamber. Censorship is often championed by adults who want to protect children from a world the adults do not understand. During the hearing, Judge Buckwalter raised this issue while discussing the computer gap between parents and children that helps fuel fears of online dangers. "In another generation that will fade from the picture, don't you think?" he asked. Archaic restrictions over what we can share online, however, may not. ###

1 0

Re: RC4 RC2 & MD5???
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:58 PM 8/21/96 -0700, Jeff Davis wrote: >I assume then that the Netscape encryption is Symetric Key, so how do >RC4 RC2 and MD5 compare and contast? TIA RC2 and RC4 are both both variable key length cyphers developed by Ron Rivest for RSA Data Security Inc. They were both protected by trade secret, but both have been reverse engineered and posted to the net. Both of them have fast-path export approval if their key length is 40 bits or less. MD5 (Message Digest 5) is not a cypher but a secure hash. If takes an input of variable length and computes a 128 bit hash. Recently some weaknesses have been found in MD5 leading to the recomendation that new applications be coded to use SHA1 instead. As a note: Any good secure hash can be used as a symetric key cypher. Usually doing so involves considerably more computation than a symetric cypher of equal strength. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0