December 2003 - cypherpunks-legacy

Re: The Living and the Dead
by jim bell 17 Dec '03

17 Dec '03

At 12:40 PM 9/16/96 -0400, Brian Davis wrote: >On Sun, 15 Sep 1996, jim bell wrote: > >> .... >> How would an AP-type system treat Robert McNamara? He'd be dead in a >> second. To those who say, "What good would this do?" I respond: Anyone in > ^^^^^^ >Kind of kills the betting pool, doesn't it? > >EBD Okay, it was just an expression... It would probably take a couple weeks. Jim Bell jimbell(a)pacifier.com

1 0

RE: Workers Paradise. /Political rant.
by jim bell 17 Dec '03

17 Dec '03

At 11:24 AM 9/16/96 EDT, Dr.Dimitri Vulis KOTM wrote: >jbugden(a)smtplink.alis.ca writes: >> dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) wrote: >> >Starting with the lying old fart himself. >> >> You shouldn't be so hard on Tim. I tried giving up farting years ago but I = >> found >> I gained a lot of weight. It's also become more socially acceptable as evid= > >I wonder why containing one's fart would cause one to gain weight. Volume maybe, >but I'd think that gas weight about as much as the air it displaces. Actually, less: It's mostly hydrogen. Jim Bell jimbell(a)pacifier.com

1 0

Spam blacklist project
by hallam＠ai.mit.edu 17 Dec '03

17 Dec '03

Hi, The following idea just hit me. How about a server which maintained a list of people who don't want to recive SPAM? The idea being that email recpients who don't want SPAM send their email address to the list. A SPAMer who want to check an email to see if it is on the list could then obtain the SHA-Digested list of addresses and remove them from their internal databases. Of course I don't for a moment imagine that this will be 100% effective. Without government regulation there will always be slimeballs who send mail to people who don't want it. The advantage of this scheme is that it would mean that the spam industry can avoid regulation pressure and they can deflect criticism. Meanwhile recipients of unwanted spam have a legitimate beef. Comments? Phill

6 7

Re: New Remailers?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:53 AM 9/16/96 BST, you wrote: >I recently secured an account with anon.penet and then a few days later got >a post informing me that the servive was now terminated. Anybody out there >know of any remailers where you dont have to have a Phd in computer science >and a thorough working knowledge of PGP in order to operate? Raph Levien's remailer list lives at http://www.cs.berkeley.edu/~raph/remailer-list.html Most of the remailers on it are the one-way variety - you can send mail to someone anonymously, but you don't get an address for people to reply to you. They're easy to use. Some of them also support anonymous reply blocks, which are a somewhat difficult-to-use feature - you basically PGP-encrypt your return address (in the correct syntax), and tell anybody who wants to reply to you to include the block at the beginning of their mail. There have been some pseudonym servers besides anon.penet.fi, which provide higher security, and are easier to use than anonymous reply blocks, once you set them up (which generally involves creating anonymous reply blocks :-) Two of them have been spammed to death, but the cyber remailer at alias(a)alias.cyberpass.net is still up. Send it a request for help to get information. Raph has a new system coming soon; see his remailer list for details. Private Idaho is Joel McNamara's friendly user interface for remailers and PGP. http://www.eskimo.com/~joelm/pi_list.html . Runs on MSWindows. It made it _much_ easier to use the alpha nymserver while that was still alive; don't know if the new version supports cyber yet or not. Remailer security depends on encryption - otherwise wiretappers can watch mail going into the remailer and know where it's going. So you'll need to learn to use PGP, but it's pretty straightforward, and Private Idaho makes it more convenient. The Mixmaster remailers provide higher security remailing, also with no reply capability; you need to get special client software, which I think isn't ported to Windows yet? >Also, are there any remailers which will accept binary attachments? There are three popular ways to do binary attachments - 1) MIME-encoding (uses MIME headers and maybe a 7-bit content transfer encoding.) 2) UUENCODE (simple-minded header and 7-bit ASCII.) 3) Mail-handler-specific headers with binary stuff following Uuencode is a no-brainer - just stick the uuencoded binary after the remailer headers. As far as I know, none of the remailers are particularly MIME-aware, but they do glue headers together. So you could probably start sticking MIME headers after the remailer headers and try a few times to get it to work. Mail-handler-specific behaviour is, of course, mail-handler-specific :-) You can try it and see, and remember that the person at the other end may not have the same kind of mail handler you do, so even if you sent the mail directly instead of through a remailer, it might not work. You may have trouble getting your mail client to do what you want for sending the message (e.g. if you use Cc:Mail or MSMail.) I looked at the code for my remailer, which is a modified Ghio2, though I don't think I modified this part, and it'll trash binaries. The problem is that, after processing headers, it shoves the rest of the input stream into the output file by a loop of fgets() check for cutmarks fprintf() which will trash anything that contains nulls, and may not do the right thing for newlines either, though it won't bother high-bits. I suppose it wouldn't be too hard to write a getchar/putchar loop that checks for cutmarks while transferring data safely (this would be easier if cutmark behaviour includes outputting the cutmark.) However, the remailer uses the native mail program (e.g. sendmail) to forward the mail, so if your sendmail trashes binaries, or does annoying vestigial things like changing "From " to ">From " at the beginnings of lines, it'll still lose. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Kiddie porn on the Internet
by jim bell 17 Dec '03

17 Dec '03

At 08:51 AM 9/15/96 -0700, James A. Donald wrote: >[Allegations that "save the children" is a political organization >providing cover for an effort to ban cryptography] > >At 01:54 PM 9/9/96 -0400, Hallam-Baker wrote: >> Their main mission is sending food to Ethiopia and other famine >> areas, development work etc. It is ultra-worthy stuff. > >Not everyone who sends food to the starving children is ultra >respectable. >Problem is that the usual cause of starving children is tyranny. >In order to get close enough to the starving children to take >those cute fund raising photographs you have to pay off and get >cosy with tyrants. This creates a moral hazard, in that it is >hard to tell the difference between normal bribery needed to do >anything in a tyrannical state, and bribery to bribe tyrants to >create starving children for photo ops. >It is very common for international charities to develop excessively >friendly relationships with murderous tyrannies, Yet another obligatory AP (Assassination Politics) reference: If a person is really interested in helping out "starving children" he may be able to do far more good by purchasing the death of the local tyrant(s), rather than (just) buying more food. After all, if the donor really believes that this starvation isn't endemic to the country, he has to conclude that it's a condition which is forced on the victims. In addition, you almost always find that these starving countries have well-supplied militaries, defending the local warlords against each other as in Somalia. Indeed, in Somalia the incoming food was actually used to buoy up one group against another, because access to it is controlled directly or indirectly by the factions. Some might argue that the death of a single leader doesn't normally fix the problem. While that's often true, it's normally because there isn't an automatic guarantee that the next 20+ leaders will ALSO be killed if they display the same problems as the first. Provide that guarantee, and (somewhat paradoxically) not only do you not need to kill the 20+, you probably won't have to kill the first one! (wondering when the world will see the light...) Jim Bell jimbell(a)pacifier.com

2 1

Redundancy in XOR encryption
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a question I hope someone here might be able to answer: As the method of cryptanalysis of XOR (Ie. index of coincidence) relies on redundancy in the plaintext, would the following be strong: Compress P to get perfect compression (ie. 0 redundancy) Encrypt F (the compressed text) using a repeated key XOR of course this is all rather theoretical as there is no such thing as perfect compression, but I just thought it might be interesting to see if this is indeed strong, superficially it appears so to me... -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: cp850 iQCVAwUBMj2TvL5OPIRbv66xAQGRpgP+LU0Y8sxzO6rObCYAQdrD8/R/iDJN3m0Z 4ZetS7jcbz7wT6bj2l7Usb0F4h/YMhxtl0y9EQ91ozg35jfRKdy2IwUoMDvqsVSZ wKmaM/DpEt2LDyRQnzIvlNYQp6/eXQoBUb7r9SH/dZbjM7culpjzJLhd07Nx5okE jUmPNBLm9m0= =RHie -----END PGP SIGNATURE----- Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ 9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi mUqFH41Z7NkyO8ZFdi5GGX0= =CMZA -----END PGP PUBLIC KEY BLOCK-----

2 1

Pro-CODE bill may not help much
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

After reading the text of Senator Burns's pro-CODE bill (S.1726), I'm not convinced that the bill would actually remove the barriers to the export of PGP and other strong encryption software. I'd like to know whether you agree with my concerns, or if you think that the bill would adequately protect encryption software exports. shabbir(a)vtw.org (Voters Telecommunications Watch) writes: >DESCRIPTION OF S.1726, PRO-CODE BILL >The Pro-CODE Act resolves to: > >1. Allow for the *unrestricted* export of "mass-market" or "public-domain" > encryption programs, including such products as Pretty Good Privacy and > popular World Wide Web browsers. > >2. Requires the Secretary of Commerce to allow the less restricted export > of other encryption technologies if products of similar strength are > generally available outside the United States, roughly up to DES > strength. > >3. Prohibits the federal government from imposing mandatory key-escrow > encryption policies on the domestic market and limiting the authority > of the Secretary of Commerce to set standards for encryption products. I'm not sure that this interpretation of the pro-CODE bill is correct, at least as far as points (1) and (2) are concerned. It appears to me that the bill allows the goverment to retrict all exports of cyptographic software for general use, as long as similar retrictions are imposed on the export of software for use by foreign banks. PGP could still be prohibited. I will quote the relevant sections of the bill, with my comments. >From the text of the Pro-CODE Bill: >SEC.3 DEFINITIONS. > > (8) GENERAL LICENSE- The term "general license" means a > general authorization that is applicable to a type of > export that does not require an exporter of that type > export to, as a condition to exporting- > (A) submit a written application to the Secretary; > or > (B) receive prior written authorization by the > Secretary. In other words, a "general license" means that rules may be established regulating the export of certain materials, as long prior written application or prior written authorization for the export is not required. For example, "Permission is hereby granted to export all encryption software with a key length not exceeding 40 bits; no written application is necessary." would be an example of a general license to export a particular type of software. >SEC. 5. PROMOTION OF COMMERCIAL ENCRYPTION PRODUCTS. > > (c) CONTROL OF EXPORTING BY SECRETARY.- > (2) ITEMS THAT DO NOT REQUIRE VALIDATED LICENSES.- > Only a general license may be required, except as > otherwise provided under the Trading With The Enemy Act > (50 U.S.C. App.1 et seq.) or the International Emergency > Economic Powers Act (50 U.S.C. 1701 et seq.) (but only to > the extent that the authority of the International > Emergency Economic Power Act is not exercised to extend > controls imposed under the Export Administration Act of > 1979), for the export or reexport of- > (A) any computer software, including computer > software with encryption capabilities, that is- > (i) generally available, as is, and designed > for installation by the user or purchaser; or > (ii) in the public domain (including on the > Internet) or publicly available because it > is generally accessible to the interested > public in any form; or > (B) any computing devise or computer hardware > solely because it incorporates or employs in > any form of computer software (including > computer software with encryption capabilities) > that is described in subparagraph (A). I interpret this to mean that export of this type of software can still be restricted by the terms of a "general license". Even though prior written permission cannot be required for export, export is permitted only if the terms of the general license are complied with. This is not the same as "unrestricted export of mass market software"; in fact, for some types of software, the "general license" rules could still forbid export entirely. The following section describes the conditions under which the Secretary of Commerce is required to grant a general license allowing export: > (3) COMPUTER SOFTWARE AND COMPUTER HARDWARE WITH > ENCRYPTION CAPABILITIES.- > (A) IN GENERAL.- Except as provided in subparagraph > (B), the Secretary shall authorize the export > or reexport of computer software and computer > hardware with encryption capabilities under a > general license for nonmilitary end-users in > any foreign country to which those exports of > computers software and computer hardware of > similar capability are permitted for use by > financial institutions that the Secretary > determines not to be controlled in fact by > United States persons. In other words, the Secretary must define the terms of the general license in such a way that software of "similar capability" to software that is exportable to foreign banks is also exportable for general use. Note that the requirement is that the software must be similar to software that can already be exported for use by foreign banks; it is neither necessary nor sufficient that similar products be available from foreign sources. The "similar products available from foreign competitors" rule was in the Leahy bill, but I see nothing like it in the pro-CODE bill. PGP could be held not to be of "similar capability" to the banking software, and not exportable under the terms of the general license, because it uses a different encryption algorithm, a different key length, and is capable of encrypting arbitrary data, not just financial transactions. In the future, if key escrow requirements were imposed on software exported to foreign banks, the same restriction could be imposed on software exported for general use. It seems to me that the idea behind section 3(A) is that if foreign bankers are willing to accept a certain level of encryption, then everyone else will accept it too, so the software industry will be able to make money exporting it; the few people who want something better (e.g. to protect their privacy against government wiretapping) don't have to be protected, because denying them protection won't cost the software companies any money. I include section 3(B) only for completeness, because it is mentioned in section 3(A): > (B) EXCEPTION.-The Secretary shall prohibit the > export or reexport of computer software and > computer hardware described in subparagraph (A) > to a foreign country if the Secretary > determines that there is substantial evidence > that such software and computer hardware will > be- > (i) diverted to a military end-use or an end- > use supporting international terrorism; > (ii) modified for military or terrorist end- > use; or > (iii) reexported without the authorization > required under Federal law. Do other people agree with this interpretation of the bill? Are most people satisfied that the bill would actually protect the right to export PGP and other strong encryption software? I haven't seen this discussed in this group before. I realize that this may be academic, because the bill is unlikely to pass now.

1 0

Flamewars and events of the outside world
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Is there anybody who saw a correlation with the occurences of flamewars or nut-cases on the list with important things that happened in the outside world that could benefit from having the CPunks looking the other way? Like this one with "Anonymous" going on. And a few others lately. Some clueless or semi-outsiders seems to drop in the group and sling mud to detract every active participants from the other topics discussed (usually, more to the point with CP). I am not ranting about the answering, I'm simply puzzled by the phenomenon. Just like, as a rule here in Canada, every time the country is really going down and that everybody start getting fed-up of the govt, suddenly the debate on death penalty or abortion or racial equality or salary inequality among sexes just pops-up. Every times, it looks it happened purely as an happenstance but every time, there was something very fishy going on at another level. Ciao jfa Jean-Francois Avon, Montreal QC Canada DePompadour, Societe d'Importation Ltee Finest Limoges porcelain and crystal JFA Technologies, R&D consultant physicists and engineers, LabView programming PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

1 0

Re: J'accuse!: Whitehouse and NSA vs. Panix and VTW
by jfricker＠vertexgroup.com 17 Dec '03

17 Dec '03

At 11:33 AM 9/13/96 -0700, stewarts(a)ix.netcom.com wrote: > >At least one of the newspaper articles I've read has referred to the need >for real authentication on the net to prevent the anonymity that makes >this kind of attack possible, and in particular for the major network providers >to make sure that they don't export messages with bogus addressing, >a cure that the article said would take several months to deploy. >I don't know if they were referring to IPv6, or sendmail modifications, >or router hacks, or what; the article's author seemed to think this was >about bogusly-addressed email messages rather than understanding SYNs. > Well IPSec provides for authentication of endpoints which would identify the syn attacker. What amazes me is that routers happily pass packets with foreign IP return addresses. I guess there is some valid utility to being able to originate a connection that actually goes somewhere else for intiating a many to many protocol. But I can't think of any practical application that would necessarily be that way. So why do routers let packets leave local networks that do not appear to originate from said local network? Doesn't routing work "both ways" so to speak?

4 3

Re: Diffie Hellman - logs in Galois fields
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk writes: > > Hi all, > > A question for the matematicians out there: > > I am looking at the Diffie Hellman public key exchange protocol and > am trying to find out why it is computationally hard to take logs in > a finite (Galois) field. I think polluting this mailing list with trivial questions such as this is just as bad as polluting it with personal attacks. Read the FAQs. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0