December 2003 - cypherpunks-legacy

Crypto Interface in Netscape
by Adam Shostack 17 Dec '03

17 Dec '03

Is it just my windows machine or are the security dialogs in Netscape3.0b6 completely unreadable? I get a dithered grey background behind black text. Can'tread the dialog boxes that show up when I see a new cert. (Speaking of which, there seems to be a new long list of acceptable CA's. Has Netscape published a policy doc explaining how Adam's Quik & EZ CA can get on the list? And, those CA's should have hyperlinks, so I can easily find their policies for key signing, so I can decide rationally that I don't trust the Post Office to certify things. Right now, its just a gut feeling that they can't be trusted. "Please don't call them junk certificates.") Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Oregon License Plate Site in the News Tonight!
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 11:23 PM 8/8/96 -0700, Timothy C. May wrote: >At 2:49 AM 8/9/96, John F. Fricker wrote: > >>Isn't that the role of legislation? To implement solutions that society >>would not do on it's own? >> >>The enabling technology is obviously off the self. >> >>I think you may have misinterpretted my last sentence which was supposed to >>have had a ? at the end. Where's the proof reader when you need one! > >"To implement solutions that society would not do on it's own?" > >Would not do, or could not do? It is within anyone's power to ask their >psychiatrist what form of encryption he uses to protect his files. Likewise >with doctors and hospitals. > Well where there's a will there's a way. I agree that the general public and the market place often lacks the power to affect particular events. Central planning can facility certain processes. Free-marketers may argue that I can query and select based upon my encryption criteria but chances are my psychiatrist will do nothing more than "make note" of paranoia and ponder it's significance: "Do you resent your mother?" >(Though I freely admit that one would not be likely to get very far. For at >least the next decade or two, the reaction will likely be "Huh?" But >"legislation" mandating a form of encryption is not the answer. For many >reasons.) > >On this list at least, calls for passing laws to implement societal >solutions are not usually smiled upon. This is not to say such discussions >are out of bounds, only that you'd better make some persuasive arguments >and not just appeal to our common sense sympathies for social engineering >and more laws. I am not a great fan of social engineering and regulations. Yet the legisture in Oregon may get called for a special session to address this issue and I see this an opportunity for a grander arguement than merely acccess to the DMV data. And as much as we dislike the presence of the governments they do indeed exist. Living within their domain limits our choices to either: complacency through inaction (cynicism et al), attempts at isolation (back to the land), or taking an active role through voting, education, civil disobedience or participation in the process (a pox on party politics! the latter choice is easily the least enticing while civil disobedience can be truly fun! >g<). Ok so call me a statist and shove me out the door, but I am not argueing for the existance of a state. It does currently exist and I am not self-sufficient. But I digress. So. #1) My state legislature may very well get called to address this issue. Do they have any concept of the big picture here? That the DMV data is one small part of a debate regarding privacy which needs to be addressed. This is an opportunity for some education and by the end of the day I should know if my representatives are willing to listen. #2) The records industry (for lack of a better term to encompass all companies that accumulate data on individuals) needs some standards and guidelines. Or walls and fences. Maybe even bars and a moat! And the sooner the better. Federally imposed software requirements are not uncommon in certain industries. It is time for standards for the personal data maintained by co-operating entities (ie agencies the public co-operates with such as doctors, the DMV, and so on). #3) The goal is the anonymous citizen. The first step it to secure the data currently exposed. Can this be done _without_ legislation? --j

2 1

SecurID
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

someone at my firm is about to press the securid system down our collective throats. please point me to the recent thread on this subject, and/or point me to some url's or the like, or to someone who has some firsthand knowledge of the pitfalls and/or vulnerbilities of secirid. cheers, -paul

3 2

Re: Why should we trust the system?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:19 PM 8/9/96, Anonymous wrote: >Further, my original question, phoned in anonymously to the FBI, >mailed in anonymously to this list, and asked to the media (I >guess I like wasting my time) has never been either asked or >answered. I will restate it in stronger terms: >"Why the hell, when you have a tape of the perp. saying something, >do you not air it in the middle of a city chock full of people >who could very well know this guy's voice/mannerisms?" Why didn't >the media ask for it, and then give the answer (the fibbieclerk >had no answer at all for me) the FBI gave?? Am I missing something? >We hear 911 tapes ALL THE TIME of various stuff happening. Has the >FBI suddenly become a bunch of civil liberties activists WRT the >privacy of terrorist bombers? >Just asking. This is the single best suggestion/question I have heard about this entire case! Why, indeed, has the 911 threat not been aired publically, where someone might recognize the voice as being that of their brother, or boss, or whatever? And might hear immediately that whomever it is, it ain't Richard Jewell. If any of you cyber-journalists who hang out here in the wings on Cypherpunks, collecting material for stories, are reading this, please ask your journalists covering the Atlanta bombing about this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

The Ostrich Security Principle
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:47 PM 8/9/96, Sandy Sandfort wrote: >It probably needs a whole new domain. How 'bout: > > burglary.org > >That way, when burglars see an Oregon car loaded with a family >heading south into California on vacation, they can just go on >line and get those folks' address from the database. > >Afterwards, a thank you note to Oregon's DMV would be in order. Sounds like a market niche to me...people at the border could sell the plate numbers (and even full DMV searches) of cars they see....maybe with a higher price paid for "real-time quotes," and a lower price paid for "15-minute-delayed quotes." Just like the stock market. By the way, I'm watching MSNBC and they're engaging in a fretfest about this Oregon situation, with calls for "regulating the Internet." "There is no good reason for this to be on the Internet." is one line I heard. (If the stuff is legal to own, and is "public information," just what exception to the First Amendment could be used to bar publishing?) BTW, this latest issue is similar to the flap several years ago over Lotus' plan to sell to the public a CD-ROM of zipcodes and whatnot. (I think it was called "Lotus Neighborhoods.") So-called "privacy activists" raised a hue and cry and the plan was cancelled. Of course, corporations and other such interest groups can get the data, so not much was accomplished. Many of us thought it was a blow to real privacy issues. The Ostrich Security Principle: "It is more important to have the _illusion_ of privacy than to have real privacy." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

secret sharing protocol - new or reinvented ?
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

Schneier in That Book 2nd Ed p73 refers to "secret sharing with disenrollment", but without giving details of such a scheme. He gives a reference [1004] I think, by K Martin, which has about 10 pages on the subject. But I have not got it. I planned a "secret sharing with disenrollment" scheme last night. Here is a brief description and if somebody with the book tells me it's new (unlikely I think) I'll write it up in more formally. It has a resemblance to S/Key, but in the other direction and using a keyed hash function. If you see snags with this, I'd like to know. Peter Allan peter.allan(a)aeat.co.uk Trent chooses his shareholders, a block cypher (or keyed hash), a threshold, and a number of steps. The threshold should be more than half the number of shareholders. (Say 15 shareholders for a 10 out of 15 scheme, using DES, over 20 steps.) Trent generates 15 64-bit DES keys (not caring about parity), and gives them securely one to each shareholder. He introduces all shareholders to each other so they can recognise each other later. He also tells them the number of steps (here 20). Trent (in possession of all shares) calculates the secret, which is a 64-bit number. Obviously this could just be a key for a secret not yet created at share distribution time. Secret calculation is performed by executing the required number of steps, and the result of the last step is the secret. Disenrollment (conducted by shareholders, presumably under orders from Trent) is the performance of one step, omitting those to be disenrolled. (The number of possible disenrollments is limited by the threshold.) One step is this set of actions: Using a normal threshold scheme, such as Shamir's Lagrange Polynomials a sufficient number of shareholders construct a single secret from their shares. Call this M. M is then used to update all their shares using a keyed hash function. Table 18.1 suggests H_i = E H_i-1 (M) XOR M M and every H_i-1 is destroyed. Now those absent from the meeting have no M value to advance their share, and nobody (even the other shareholders following a change of heart) can reproduce it for them. Shareholders deduct 1 from the number of steps still to be performed.

1 0

Re: Drive the SF Central Freeway, have your license plate photo'ed.
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

How about a cypherpunks group activity for the SF area? 2 per car, one to drive, and one to moon.... Ryan ---------- Previous Message ---------- To: geeman, cypherpunks cc: From: shamrock @ netcom.com (Lucky Green) @ smtp Date: 08/08/96 10:45:06 PM Subject: Re: Drive the SF Central Freeway, have your license plate photo'ed. At 21:55 8/8/96, i am not a number! wrote: >CBS radio news this morning: 80,000 commuters traveling the central >f'way in SF will have information mailed to them regarding the quake >retrofit blah blah. > >How? Their license plates have been photographed. >... and the cheery "news" anchorwoman sweetly moved on to the next >story..... You *are* making this up, right? Please say you did. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Unknown address (fwd) tigerteam???
by Ray Arachelian 17 Dec '03

17 Dec '03

What's the story with the tiger.team(a)tigerteam.org bounces? I've been getting quite a few of these from time to time, once when sending a message Sterndark. In this case this message wasn't addressed to cypherpunks(a)toad.com, and it was a private message to Adam Back aba(a)dcs.ex.ac.uk... I couldn't do a traceroute to dcs.ex.ac.uk since it's an unknown host to my system... So perhaps, given the hit below, this is by uucp, but even so, should the bounced message come from tigerteam?? Is tigerteam somehow snarfing up messages they shouldn't? Even if they're a uucp gateway to England, shouldn't the bounce come from dcs.ex.ac.uk and not from tigerteam/netcom??? % whois shows this for them: whois tigerteam.org Tiger Team Buddhist Information Network (TIGERTEAM-DOM) 347 Warwick Suite #101 Oakland, CA 94610 Domain Name: TIGERTEAM.ORG Administrative Contact, Technical Contact, Zone Contact: Macko, Jeffrey (JM67) jmacko(a)TIGERTEAM.ORG (510) 268-1012 Record last updated on 29-Mar-94. Record created on 10-Sep-93. Domain servers in listed order: UUCPNS1.NETCOM.COM 163.179.3.221 UUCPNS2.NETCOM.COM 163.179.3.222 The InterNIC Registration Services Host contains ONLY Internet Information (Networks, ASN's, Domains, and POC's). Please use the whois server at nic.ddn.mil for MILNET Information. Looking at the headers for the bounced message I see: >From postmaster(a)tigerteam.org Fri Aug 9 07:52:01 1996 Return-Path: postmaster(a)tigerteam.org Received: from netcomsv.netcom.com (uucp12.netcom.com [163.179.3.12]) by ian.dor sai.org (8.7.1/8.6.12) with SMTP id HAA09408 for <sunder(a)dorsai.dorsai.org>; Fri , 9 Aug 1996 07:52:00 -0400 (EDT) Received: from tigerteam.org by netcomsv.netcom.com with UUCP (8.6.12/SMI-4.1) id EAA15108; Fri, 9 Aug 1996 04:42:10 -0700 Received: by tigerteam.org (wcGATE v4) id 37297W Fri, 9 Aug 1996 10:33:39 GMT From: postmaster(a)tigerteam.org (Postmaster) Subject: Unknown address Date: Wed, 7 Aug 1996 13:54:32 GMT Message-Id: <96080903333941546(a)tigerteam.org> Organization: Tiger Team Info Net: Modem (510) 523-5300 To: sunder(a)dorsai.dorsai.org Status: RO X-Status: The user this message was addressed to does not exist at this site. Please verify the name and domain in the original message that follows. Message was addressed to: TIGER.TEAM(a)tigerteam.org ========================================================================== + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== \|/ |sunder(a)dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= <--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== + v + | Janet Reno & GAK|AK| do you not understand? |======= ===================http://www.dorsai.org/~sunder/========================= Key Escrow Laws are the mating calls of those who'd abuse your privacy! ---------- Forwarded message ---------- Date: Wed, 7 Aug 1996 13:54:32 GMT From: Postmaster <postmaster(a)tigerteam.org> To: sunder(a)dorsai.dorsai.org Subject: Unknown address The user this message was addressed to does not exist at this site. Please verify the name and domain in the original message that follows. Message was addressed to: TIGER.TEAM(a)tigerteam.org ----- Original Message follows ----- From: Ray Arachelian <sunder(a)dorsai.dorsai.org> To: Adam Back <aba(a)dcs.ex.ac.uk> Date: Wed, 7 Aug 1996 14:06:45 -0400 (edt) Subject: Re: crypto CD source On Tue, 6 Aug 1996, Adam Back wrote: > > Cypherpunks archive? > > http://infinity.nus.sg/cypherpunks/ > > The earlier archives were at www.hks.net, try mailing cactus(a)hks.net. I've a bunch of .gz files for the filtered cypherpunks list I run, they should contain stuff as far back as last year. How would I get these to ya? ========================================================================== + ^ + | Ray Arachelian |FL| KAOS KERAUNOS KYBERNETOS |==/|\== \|/ |sunder(a)dorsai.org|UL|__Nothing_is_true,_all_is_permitted!_|=/\|/\= <--+-->| --------------- |CG|What part of 'Congress shall make no |=\/|\/= /|\ | Just Say "No" to|KA|law abridging the freedom of speech' |==\|/== + v + | Janet Reno & GAK|AK| do you not understand? |======= ===================http://www.dorsai.org/~sunder/========================= Key Escrow Laws are the mating calls of those who'd abuse your privacy!

1 0

Re: e$: Watching the MacRubble Bounce
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

Actually, DEC is trying to stay in business building expensive Windows boxes. The numbers I remember hearing are something like: 1,000,000 Unix machines 10,000,000 Macs 150,000,000 "PCs" (presumable not running *nix) Why should we care what platform people develop for? I use all of 'em. If a package supports more than one, all the better. As to why one should develop crypto stuff for unix, the demographics of this list are probably reason enough.. I use PCs as my main platform, but I get the distinct impression that most of the folks here use unix primarily. Maybe they're just the most vocal :) Ryan ---------- Previous Message ---------- To: jwz cc: cypherpunks From: deviant @ pooh-corner.com (The Deviant) @ smtp Date: 08/09/96 06:23:32 AM Subject: Re: e$: Watching the MacRubble Bounce -----BEGIN PGP SIGNED MESSAGE----- On Thu, 8 Aug 1996, Jamie Zawinski wrote: > If you accept that, then doesn't that make writing crypto software for > any Unix platform *even more* of a waste of time? Because last time I > checked, there were way more Macs on mom-and-pop's desks than Unix > machines, counting *all* vendors. Pardon my French, but you mus be fucking stupid or somehing. How many universities use UNIX platforms? How many companies use UNIX platforms? Sun, DEC, and SGI don't stay in buisiness by building cheap Windows boxes ya know. There are 13948 _registered_ LINUX machines, not to mention the unregistered ones. Don't tell me that Cray's were designed to run MacOS or Windows 95. UNIX isn' NEARLY as dead as Apple is. --Deviant Military secrets are the most fleeting of all. -- Spock, "The Enterprise Incident", stardate 5027.4 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMgrZbTAJap8fyDMVAQFSagf8C3/HIX7XwtFYRAKxhs8AlDIsO1EXDgr9 jm9RzjGMXqHkgg0OC/0Bzp+OtcYYL5qg/JtaZo90LIdPbqEeOb7HkcYgXkPZ9SLd sQKIsZMr6IShG7ZIdPH9BRJWn131ExbUjCZ5IfMJVHsimTVbfLHHSppDylxtl2bG pI6d9FdCWj8puL3omB9PD9gpjoaF4p961+HBclH8W6PLzI+swc/6f49Uxv3LIF4w gm5IepZmoerW2iK2hwawngZPZJ4Sr4VqzyrAIvDl+rIFLFlN3ejNaGEjwHcNc43+ IBwoOS4kdv16faxT1jBskbKhcywmGqfIrap6Rdr0KkO5DyHHsSTz5g== =UBUr -----END PGP SIGNATURE-----

1 0

Re: Boom!
by Thomas C. Allard 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) said: > What recourse does he have that camera crews were invited in on the > searches? Subject: CBS Liable for Filming Search From: dante(a)halcyon.halcyon.com (Dan Tenenbaum) Date: Fri, 8 Jul 94 15:52:58 EDT Article: 28633 of rec.arts.tv Followup-To: alt.prisons Newsgroups: alt.prisons,misc.legal,alt.politics.usa.constitution,alt.privacy,rec.arts.tv Organization: mellow owl mailing field Xref: glendora alt.prisons:817 misc.legal:28311 alt.privacy:7678 rec.arts.tv:28633 [Paul Wright, the imprisoned editor of Prison Legal News, sent me the following and asked me to distribute it widely on the the net because there has been no coverage of this in the mainstream media. Followups to alt.prisons because I read it. Nyah. Typos are mine. The article will appear in slightly different form in the next PLN. PLN is available from P.O. Box 1684, Lake Worth, FL 33460. $12 for subscriptions and $1 for a sample copy. Dan Tenenbaum (dante(a)microsoft.com or dante(a)halcyon.com) CBS Liable for Filming Search In a landmark decision a federal court in New York has ruled that a CBS film crew and Secret Service agents are liable for filming and broadcasting a search of a private citizen's home. It is the first reported court decision to hold a television broadcaster liable for accompanying police agents on a search and filming it for the broadcast. Anyone who has watched "Cops," "Hard Copy," "America's Most Wanted," or any of the "real life" cop shows has seen the degrading and propagandistic manner in which the victims of police repression are portrayed. The broadcasters and the police can be sued and held liable for such actions. In 1992 Secret Service agents obtained a search warrant from a federal court authorizing the search of an apartment shared by Babatunde Ayeni, his wife Tawa, and small son Kayode, seeking evidence of a credit card fraud operation. At 6PM on March 5, 1992, several Secret Service (SS) agents forced their way into the Ayeni residence announcing they had a warrant to conduct a search and ask questions. Only Mrs. Ayeni and her son were home at the time. At about 8:15 four more SS agents arrived with a film crew from the CBS news program "Street Stories." The CBS film crew was never identified as CBS employees. The CBS crew followed the SS agents and taped them as they searched the apartment. They took closeup shots of the home's interior, its closets, personal letters, family photos, etc. In the apartment's foyer an SS agent was interviewed about the modus operandi of people who commit credit card frauds and the tools of their trade. During this tape sequence the SS agent implied the complicity of the other residents of the Ayeni apartment. No evidence implicating the Ayenis in any illegal activity was found during the search. One of the agents was filmed expressing his disappointment. The Ayenis filed suit against the federal agents as well as CBS, contending that the search and its filming violated their fourth amendment right to be free from unreasonable search and seizure. In his opinion Judge Weinstein agreed with the Ayenis. The defendants sought qualified immunity, which the court denied. Under the doctrine of qualified immunity government agents are entitled to be free from liability for money damages even if they violate constitutional rights as long as the right is not "well established" so that a person of reasonable intelligence would know that the right violated was recognized. In the case the court held that any reasonable police agent would have known that it is unconstitutional to have private citizens accompany them on a search to film and broadcast the search. The court relied on 18 U.S.C. sec. 3105 which requires that search warrants be served by an official authorized to serve the warrant and by no other person unless their assistance is required in conducting the search, i.e. an accountant, forensic expert, etc., depending on the nature of the offense being investigated. Thus, the SS agents should have known that having a film crew taping their activities was illegal. Courts have previously held that taking photos is a "seizure" within the meaning of the fourth amendment. CBS also claimed qualified immunity from suit. The court notes that private entities are not entitled to qualified immunity from suit, it only applies to government actors. The court used harsh language in condemning the actions by the SS and CBS. "The search warrant was issued to agent Mottola and other agents of the Unites States Secret Service for precise and limited purposes. It authorized their entry into the Ayenis' home only to search for items related to credit card fraud. Agent Mottola's act of facilitating the CBS camera crew's entry into the apartment and its filming of the search exceeded the scope of the warrant. It was allegedly in clear violation then well [sic] established fourth amendment principles. ...it is the equivalent of a rogue policeman using his official position to break into a home in order to steal objects for his own profit or that of another." For immunity purposes it would be "...grossly unreasonable for a government agent not to have known that the presence of private persons he invited in so that they could titillate and entertain others was beyond the scope of what was lawfully authorized by the warrant. "CBS had no greater right than that of a thief to be in the home, to 'capture' the scene of the search on film and to remove the photographic record. The images, though created by the camera, are a part of the household; they could not be removed without permission or official right....The television tape was a seizure of private property, information, for non-governmental purposes." It is entirely possible that litigation by the victims of this type of police and media activity may be able to halt the spread of "police TV." Findings of liability against both police and the broadcaster will see to it that police activity is not broadcast to "entertain and titillate." So if you've been filmed against your will during a police search you too can sue for an invasion of your privacy and your fourth amendment rights. The court decision is reported at: Ayeni v. CBS, Inc., 848 F. Supp 362 (ED NY 1994). rgds-- TA (tallard(a)frb.gov) I don't speak for the Federal Reserve Board, it doesn't speak for me. pgp fingerprint: 10 49 F5 24 F1 D9 A7 D6 DE 14 25 C8 C0 E2 57 9D

1 0