December 2003 - cypherpunks-legacy

CyberPromo sparks a new list
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There seems to be some interest, so I've started a list to discuss the CyberPromo ongoing abuse. The list is a simple exploder located at mail-abuse(a)scytale.com. For the present, I'm handling the list manually, so add/delete requests should be sent to me, roy(a)scytale.com. Personal referrals are welcome, but please don't publicize the list generally. - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmWUABvikii9febJAQEPhQQAmMcPvTtAOptXvUbojCXpzWcupniPN+// z6W0/TEBPG5hvA42NiYXOUgvp2ESuKux1uOZfHp5jQb+FnZP6ac38e6mNQ9LxXAA 2iDA3NB2ZopfreIcnAzUt0uzXyQBUaZ1B/LTfyzs6u89nvTqg2cEcUfMm1MI4zDM wGh1KR0kXA4= =RsGr -----END PGP SIGNATURE-----

1 0

Re: Re: SPA's Press Release
by Fred Goldberg 17 Dec '03

17 Dec '03

At 05:10 PM 10/16/96 -0500, Sean Sutherland stood upon his soapbox and declaimed: >Their term, "contributory >infringement" is almost like suing the bartender because a customer got into a >wreck while drunk. Right or wrong, in some states, at least, you can not only sue a professional bartender, you can sue any individual who serves liquor at a private party and allows a guest to drive home under the influence, if the guest causes damage to you or your property as a result. Many people support this "vicarious liability" theory as it relates to drunk driving. Next time, pick a better analogy. You may have just given their lawyers the analogy they need to prove their case. Fred Goldberg WA2BJZ EMT-D

1 0

Q.E.D.
by cypher＠cyberstation.net 17 Dec '03

17 Dec '03

Some of you have sardonically written to say "Nihil Est Demonstrandum," N.E.D. because an OTP must be derived from a hardware source, that is, it must be a pure random sequence of limitless entropy. Accordingly, they unbashfully assert that an OTP generated by a computer program is not possible. How do they know that? Does the Bible tell them so, or the Koran, or do they get it from the Torah? Why not cite the source of their certainty instead of advancing an unsupported proposition. I do not mean to be rude, but excuse me, what scientific proof can they offer for that immovable avowal? There is no scientific proof whatsoever, none at all, except for the words and their steadfast, and maybe self serving, postulate. Accordingly, obviously it is they, not us, who are the ones that have "Nihil Est Demonstrandum," in this matter. There is not one scintilla of sustainable evidence to support such a doctrine. While the vast majority of people knowledgeable about cryptography have not heretofore believed that it is possible for software to produce an OTP, that does not make it a scientific fact, but merely means it is the consensus of scientific opinion that it is not possible. With all due respect to Bruce, and his exceptional work, Paul, Roy and many others who obviously know the subject matter of which we speak, I offer that history is replete with scientists supplying proof of the seemingly impossible. In support of their position, some have pointed out that John von Neumann, to paraphrase, stated that ARITHMETIC cannot produce random numbers, a thesis which I agree with; but where is that, in any way inconsistent with IPG's position on EUREKA? IPG has produced a system to generate software OTPs, albeit it within limited but more than ample entropy, not software random numbers. We stipulate the obvious fact that the encryptor stream generated by EUREKA is a PRNG stream, though we do consider it gross denigration to castigate it as ONLY a PRNG stream. It is a PRNG issue that also happens to be an extremely well behaved OTP sequence, with limited but ample entropy, as well. It meets each and every criteria rationally established for an OTP in all reasonable aspects. Subjected to any and all statistical analyses, the EUREKA PRNG stream manifests itself as being random, though we know, as a scientific fact, that it is not. To substantiate that posit, and unlike the consensus of scientific opinion, obviously N.E.D., that believes that software cannot produce an OTP, IPG offers "Quod Erat Demonstrandum," Q.E.D. scientific proof that we can produce a humungous number of software OTPs sufficient to meet any and all current or future requirements. You do not need to be an Einstein, a Hawking, or a von Neumann, to understand the fundamental basis of the IPG EUREKA algorithm. Succinctly as I can , that is, given a truly random key of entropy N, and possibly truly random look up tables of combined entropy M, it is possible to generate up to N streams of characters of a length in this case of approximately 10^223, that manifest themselves as true OTPs. Think about that simple supposition for a moment. What do we mean by an OTP? We mean that an OTP is a stream of characters, or numbers, that cannot be derived in the absence of the key that was used to generate them, or alternately by trying all possibilities of that said key. Thus, when using the resultant as an encryptor stream, the only information derivable from the ciphertext is the determination of the maximum possible length. Furthermore, by using the exclusionary proof, you cannot preclude any possible message of that said length. If you think through that hypothesis, it becomes clear that such is not precluded by von Neumann's proffer, or by fundamental mathematical principles. The question then, is how can you go about doing that? That is all that IPG has done. We have figured out a mathematical certain way, ( Q.E.D.), of generating N number, or rather a number very close to N, of OTPs from a given key of entropy N, and we can prove it. Not only that, but you can prove it to yourself, Q.E.D. We maintain that it is discernible to any knowledgeable person who probes the algorithm, that the only analytical tack that can be mounted against EUREKA is brute force and that is patently impossible. One of your Cpunk colleagues says he uses Triple DES, 168 bits, and he does not believe that it can be brute forced - I agree, 3-DES, 10^50+ possibilities, cannot be brute forced now, or in the foreseeable future - then what about the EUREKA's 10^34322 possibilities, 10^34271+ greater than 3-DES? No way, not now, not ever. Furthermore, EUREKA is an order, or more, magnitude faster than triple DES, easier to use, much more secure, etal. Another has suggested that if the key, and all the variables are hacked, then the system can be compromised. That is true, but again excuse me, does not that apply to any system, whether it be RSA, PGP, IDEA, and yes also a hardware sourced OTP. EUREKA's only edge in that regard is that built in means that facilitate safeguards which minimize such risks. EUREKA is not a panacea for all your encryption needs. RSA, PGP, ENTRUST, and other systems fill very important exigencies. Where EUREKA shines brightest is in two important strategic user applications: 1. To set up a permanent line of Internet/intranet communication privacy between two, or a group of, individuals. As a result, pass phrases, session encryption keys, and other work impediments of that genre can be largely eliminated. While applicable to everyone, this is especially true of newbies, computer novices, technophobes, and other non-techies. It is much faster, easier to use, and more flexible than other systems for this application. As such, it is ideal for intranets, or mixed Internet/intranet systems. 2. To protect your private hard disk files, programs or data, from compromise by hackers and interlopers. In this application it is unsurpassed because differential analysis of changing files is rendered impossible and it is extremely fast. See for yourself. Prove it to yourself, Q.E.D. The IPG algorithm is available at: http://netprivacy.com/algo.html or a condensed version at: http://netprivacy.com/condalgo.html P.S. My resume can also be found there http://www.netprivacy.com/resume.html P.S. Have any of you received the long: Phoenix arisen from the ashes posting that we made on 10-06-96 weird things are happening. > ================================================================== > > Donald R. Wood > ipgsales(a)cyberstation.net >==================================================================== > > Some people are more certain of their own opinions than they are of > facts presented by those they disagree with - Aristotle > > ---------------------- Quod Erat Demonstrandum ----------------------

2 1

Re: Comments on binding cryptography (1)
by Jim Miller 17 Dec '03

17 Dec '03

Bert-Jaap Koops writes: > It does not want to solve the problem of > criminals using encryption. > Then he comments on binding cryptography. Then he concludes with: > I would prefer it if no such system were needed, but if it > helps in protecting me from criminals, I can live with it. > Feeling any cognitive dissonance, Mr Koops? Jim_Miller(a)suite.com

1 0

rival Clipper products
by scrappo.reverb＠juno.com 17 Dec '03

17 Dec '03

What somebody needs to do is make a rival for Clipper products. I propose that somebody with enough money should have a Clipper-type chip implementing Triple-DES or whatever developed and marketed. They should do the same things, except not be restricted by the government (obviously this wouldn't be for export) by the means of using weak crypto. These devices could probably be marketed to the same audience that Clipper products are aimed at, i.e. the general unsuspecting populace. The only problem I could see would be educating whoever buys into how the government is pulling the wool over their eyes. I'm sure with some funding from a major source, or some donation of time/supplies from a manufacturing company, it could be pulled off in grand fashion. Who said we can't play the government's little game? This along with some "Big Brother Inside" stickers massively propagated, and it might fly. Any insights?

2 1

re: Q.E.D.
by romana＠glamazon.com 17 Dec '03

17 Dec '03

> You do not need to be an Einstein, a Hawking, or a von > Neumann, to understand the fundamental basis of the IPG > EUREKA algorithm. > ...they also laughed at Bozo the Clown. Romana Machado romana(a)fqa.com http://www.fqa.com/romana/ http://www.glamazon.com/

1 0

Societal Policing Association (SPA) Sues Sameer!
by nobody＠replay.com 17 Dec '03

17 Dec '03

Subject: SOCIETAL POLICING ASSOCIATION SUES COMMUNITY CONNEXION!! To: cypherpunks(a)toad.com Date: Wed Oct 16 Here's what I have learned about the SPA, the Societal Policing Association, a group supported by the CyberAngels, the Family Decency OrganizatIon, and the Association of Police Chiefs. NotE their term "contributory infringement" for anyone who fails to agree to report suspicious behavior. ("A citizen-unit who neglects to perform his societal-unit duties and who stands by as thoughtcrime is committed is just as guilty as the active member of the crime.") Details are in: http://www.spa.org/thoughtcrime/orwell.htm. "Anyone who knows or should have known that he or she is witnessing, inducing, applauding or tangentially contributing to infringement of any of the moral and decency rights by another person is liable for contributor infringement. " -- posting of views critical of authority -- linking to FTP or Web sites where unauthorized viewpoints may be obtained -- informing others of FTP sites were such views may be unlawfully obtained -- aiding others in locating or using unauthorized software supporting sites upon which the above information may be obtained allowing sites where the above information may be obtained to exist on a server Then there's their Vicarious Liability for Infringement by Another Person, outlined by: "Anyone who has the authority and ability to control another person and who fails to do so is vicariously liable for the infringement of another person." *** SPA Files Morality Suits Against ISPs and End Users Internet Decency Campaign Launched (Oct.10, 1996 --Washington, D.C.) -- The Societal Policing Association (SPA) announced today that it has filed five civil lawsuits for morality violations occurring on the Internet. Three of the lawsuits were filed against Internet service providers (ISPs), and the remaining two were filed against individual end users. Additionally, SPA launched its Internet Decency Campaign, which includes education and enforcement components, in an effort to educate and work cooperatively with ISPs regarding morality and decency violations. ISPs who immediately enroll their employee-units in decency reeducation programs and who agree to participate in SPA's program to stamp out illegal thoughts will receive immunity from SPA lawsuits and will receive a pro rata share of the collected loot from other ISPs sued by the SPA. ISP lawsuits were filed on Oct. 7 and 8 against Community ConneXion of Oakland, Calif.; GeoCities of Beverly Hills, Calif.; and Tripod Inc. of Williamstown, Mass. The SPA members named as plaintiffs in all three suits were the Christian Coalition, the Anti-Defamation League of B'nai Brith and the Million Aryan March. In each case, SPA first contacted the ISP and requested that the offensive thoughts be purged, but the ISPs cited the notoriously Communistic "First Amendment" and the anti-Christian "Electronic and Communications Privacy Act" and refused to cooperate. "These lawsuits send a clear signal to ISPs and end users that neither so-called "free thinking" nor failure to pay our protection fee will be tolerated. The Internet does not provide a safe haven for these types of activities," said Emmanuel Goldstein, SPA Reichsfuhrer. "Our intentions are to work cooperatively with ISPs. A key element of the IAPC is the ISP Political Reeducation Program devoted to alerting ISPs to their potential state of sin and providing them with the tools and moral guidance to save themselves," said Winston Smith, SPA's Reeducation Coordinator. --Keyser Soze, Political Reporter -- --

1 0

Re: Q.E.D.
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:28 PM 10/16/96 -0500, IPG Sales wrote (original at excessive length): > ... IPG has produced a system to generate software OTPs, > albeit it within limited but but more than ample entropy, not > software random numbers. > > We stipulate the obvious fact that the encryptor stream > generated by EUREKA is a PRNG stream, though we do consider > it gross denigration to castigate it as ONLY a PRNG stream. > It is a PRNG issue that also happens to be an extremely well > behaved OTP sequence, with limited but ample entropy, as well. The problem is you are misusing the term One Time Pad. > It meets each and every criteria rationally established for an > OTP in all reasonable aspects. One of the criteria for a OTP is that you can credibly claim that ANY plain text (of the correct length) is a valid decryption of a cyphertext encrypted with a OTP. Since your PRNG has less entropy than the message, there are output sequences that can not occur. Therefore there are plaintext messages which have no possible key. These messages are not credible decryptions and the PRNG is not a OTP. This criterion is directly related to the provable security of the OTP. As such it is certainly a rationally established criterion. Now your PRNG may be a reasonably secure cypher system. (I haven't looked at it.) However it isn't an OTP and should not be advertised as such. Doing so makes people familar with the field think you don't know what you are talking about. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Re: The Utility of Privacy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:57 AM 11/18/96 -0800, Huge Cajones Remailer wrote: > >At 8:38 PM 11/17/1996, Huge Cajones Remailer wrote: >>> Privacy is a hassle. Is it worth it? >>> >>> Which unfortunate situations does privacy prevent? What are the odds >>> that they will occur? How much effort will it take to prevent these >>> outcomes? As a model, use the present and future situation of a >>> typical reader of this list. Risks of not employing privacy techniques: 1) You might have to pay 30%+ of your income in taxes. 2) Your driver's license might be capable of being suspended. 3) Your children will be more likely to be grabbed by Child Protective Services. 4) You are *much* more likely to come to the attention of the authorities. 5) Your usenet posts on gun control may be reported to the local sheriff's office and an armed agent of the state may call you. 6) You may be dunned by debt collectors. 7) Your property will be at greater risk of forfeiture to the government or loss to private litigation. 8) You may have to pay thousands of dollars a year in auto insurance. 9) You are more likely to lose a job because of something your employer finds out about you. 10) If you live in a "non-attainment area" your older car may fail emissions inspection. That's all for now. I've got a million of them. DCF

1 0

re: accutrade
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Hacking the 9 digit account number and 4 digit PIN will be easier than attacking the OS directly. Either method though would certainly ring loud bells at Accutrade unless they are infected with headinbutt disease.

2 1