December 2003 - cypherpunks-legacy

Re: Crypto Num Mum, Hmm
by red 17 Dec '03

17 Dec '03

Are perfect numbers of any use in cryptography? I have yet to come across the usage or application, let alone heard of it, but has there been any proposals? Thanks. -rednax- red_naxela(a)geocites.com "smile and the mirror smiles"

1 0

Crypto Num Mum, Hmm
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The Washington Post, September 9, 1996, p. A2. Computers: Number Crunchers' 1 and Only It's big. It's beautiful. And it's prime. Computer scientists at Cray Research have discovered the largest known prime number. A prime number, for those of us who have forgotten grade school mathematics, can only be divided by itself and by 1. Smaller primes include 2, 3, 5, 7 and 11. The new one, 2^1257787-1, is a bit bigger. Printed out, the 378,632 digit number would take up 12 newspaper pages. "We're pretty confident that this is the largest known prime number," said researcher Paul Gage. There are an infinite number of primes but they are extremely difficult to find. The newly discovered prime number is of a type known a "Mersenne" prime, named for a 17th century French monk and mathematician. It is easier to prove the prime-ness of Mersenne numbers than other primes, thanks to complex mathematical software. Cray runs the prime-testing program to search for bugs in its new supercomputers. Gage said the discovery of the prime was a happy byproduct of the process. The new number was discovered during a six-hour run testing a new Cray T94 system. Prime numbers are useful in the field of cryptography, where they are used to help construct virtually unbreakable codes. The new prime is far larger than those commonly used. Said Gage, "A cryptographer interested in numbers this big wouldn't be talking about it." -- John Schwartz [End]

3 2

Terrorists
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:29 PM 9/9/96, Duncan Frissell wrote: >At 01:49 AM 9/9/96 -0700, Timothy C. May wrote: >>And the net effect of crypto anarchy is to destabilize and marginalize >>central governments, which is a net positive effect. If some eggs get >>broken in the process, the biological imperative will generate more eggs. >>No big deal. > >Particularly since governments murdered 160 million in the last 100 years >while we civilians have only managed to murder a paltry 20 million or fewer. >A savings of 160 million deaths leaves a lot of room for a non-harmful >increase in private murder. We could increase the private murder rate by 8 >to 10 times and still break even. > >Note too that most terrorism is aimed at governments (even if practiced on >civilians). In the absence of government, terrorist incentives may be reduced. Remember, folks, it is _governments_ which interfere with natural movements of people, capital, but not birds. I don't want to jeopardize my reputation as a List.Racist, but I think one of the longterm (not in the next 15 years) implications of the things we talk about will be the increased lowering of national borders. (Yes, I have long talked about national borders being only speed bumps...here I'm talking about _physical_ borders.) Some good insights into the "border issue" are in the current movie "Lone Star." See it to appreciate things from a Mexican's perspective, when Texas is viewed as being essentially Mexican. (Some great humor, too. And a good murder mystery. And a love story. Conspiracy, humor, murder, love...all the ingredients of a great story. All three major American races collide, and mix. No role for Asians, though. Another movie...maybe a Wayne Wang movie.) ("Lone Star" is this year's "Pulp Fiction," just as "Usual Suspects" was last year's "Pulp Fiction.") Crypto anarchy means the undermining of governments, and hence handouts to people by government. People will only move physically for physical jobs, and not for handouts. People will flow to where the jobs are, and jobs will flow to where the people are. Isn't this what we really want? --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: [WAS xs4all.nl] Terrorists
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:54 PM 9/9/96 -0700, Timothy C. May wrote: >Given the mounting hysteria about terrorism (by the government, at least), >and given the various laws on the books, I would not be surprised to see >some Web sites prosecuted as "harboring" terrorists terrorist-symps. > >If any of you are not citizens of the U.S., and are here on visas, I would >give this some real serious thought. Of course, maybe deportation is a >blessing in disguise. > Course in 1951 they tried the same thing against Commies with the Smith Act. Even authorized concentration camps for 'em and everything. But it didn't work. We were still up to our asses in Commies even with the Act. They even captured the White House eventually. I don't think the anit-terroism act will be any more effective. DCF

1 0

Re: [WAS xs4all.nl] Terrorists (fwd)
by Stephan Schmidt 17 Dec '03

17 Dec '03

Stephan Schmidt wrote: > > Perhaps my connection is only disrupted accidently, but > I can't access www.xs4all.nl from one account > (the two others still work). > IP tried : 194.109.6.100 > > SPG: What is the 'new' IP ? The numbers are rotating every hour, so i can send you a the ip-number every hour to trace to :) > (I hope you don't think I'm a spy for > the German Government :) spy's are not interrested in ip-numbers i think. > Perhaps this time we have to > proove that it's impossible to > block an IP/Web site, so that all govs > get a clue about who inet works. i think they have already or will be informed by the ICTF in some day's. Look at: http://www.anwalt.de/ictf/_960910d.htm Also note one of the first lines: ACHTUNG: Dieses Dokument (einschließlich aller Anlagen) darf bis zu seiner Vervollständigung und Freigabe weder zitiert, in WWW-Server eingestellt, noch abgedruckt werden. :) Henk ps. stephan, can you forward this to the list. I'm reading this list on a server with mail2news, also as a newsgroup i cant reply to ;(

1 0

FW: RRE: Lexis-Nexis personal information database
by Mullen Patrick 17 Dec '03

17 Dec '03

Okay, here's the story. The below is true, except they do NOT have your mother's maiden name. The have your name, SSN, current addy, two previous addys, and date of birth. They also have aliases, if available. Their main customers are attorneys who use this _online_ service to search for people. They've been in business for 20 years, but this list has only been run for a few months. Their customer base (I assume including all databases, which includes lists of ALL legal actions (traffic tickets??)) is 750,000. Hm. Oh, and the SSN isn't given out, but it can be used to search for someone more easily. So, when you do a query, all you'll get is Name, address, phone number, and date of birth, as well as two previous addresses, for what it's worth. The only thing you get that you wouldn't find out by looking in the White Pages is the DOB, and that you could make up. Another case of mass-hysteria (but, of course, *I'm* no longer on the list... ;-) BTW, they're very nice as you get taken off the computer. LONG time on hold, though... Spyjure _______________________________________________________________________________ From: E. Allen Smith on Tue, Sep 10, 1996 3:14 Subject: RRE: Lexis-Nexis personal information database To: cypherpunks(a)toad.com One wonders exactly how much of this information is compiled from government-generated sources? The SSN is automatically originally government-derived, of course... -Allen From: IN%"rre(a)weber.ucsd.edu" 7-SEP-1996 02:02:07.36 [Excerpt from Privacy Forum 5.17.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 3 Sep 96 12:01 PDT From: privacy(a)vortex.com (PRIVACY Forum) Subject: PRIVACY Forum Digest V05 #17 PRIVACY Forum Digest Tuesday, 3 September 1996 Volume 05 : Issue 17 ----------------------------------------------------------------------------- Date: Tue, 3 Sep 1996 11:22:15 -0400 (EDT) From: Larry Hunter <hunter(a)intr.net> Subject: Lexis-Nexis personal information database Lexis-Nexis sells a commercial database called "Ptrax" which holds detailed personal information on nearly all Americans (L-N claims it contains 300 million names). This database includes name, current address, up to two previous addresses, phone number, birth-date, social security number, mother's maiden name and possible other personal information. This database is kept quite current. Through the Nexis Express service, this information could be available to any individual with a credit card. As most readers will are aware, such information could easily be used for theft of identity and other frauds. It is possible to have one's name removed from this database by making a telephone request. Call (800)543-6862, select option 4 ("all other questions") and tell the representative answering that you wish to remove your name from the Ptrax database. You may also send a fax to (513)865-7360, or physical mail to LEXIS-NEXIS / P.O. Box 933 / Dayton, Ohio 45401-0933. Sending physical mail to confirm your name has been removed is always a good idea. As word of the existence of this database has spread on the net, Lexis-Nexis has been inundated with calls, and has set up a special set of operators to handle the volume. In addition, Andrew Bleh (rhymes with "Play") is a manager responsible for this product, and is the person to whom complaints about the service could be directed. He can be reached at the above 800 number, selection option 4 and then ask for extension 3385. The information in this note has been been confirmed by me, and was originally provided in forwarded messages from Russell Whitaker, Jason Werner, Vern Winters, Katherine Florman and Reuben Snipper. Larry Hunter hunter(a)intr.net ------------------------------ End of PRIVACY Forum Digest 05.17 ************************ ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;10 Sep 1996 03:14:49 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Tue, 10 Sep 1996 7:12:48 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id UAA22945 for cypherpunks-outgoing; Mon, 9 Sep 1996 20:08:38 -0700 (PDT) Received: from OCELOT.RUTGERS.EDU (ocelot.rutgers.edu [128.6.11.33]) by toad.com (8.7.5/8.7.3) with SMTP id UAA22938 for <cypherpunks(a)toad.com>; Mon, 9 Sep 1996 20:08:25 -0700 (PDT) Received: from mbcl.rutgers.edu by mbcl.rutgers.edu (PMDF #12194) id <01I9AIVKYUFO9ULM12(a)mbcl.rutgers.edu>; Mon, 9 Sep 1996 23:03 EDT Date: Mon, 9 Sep 1996 23:03 EDT From: "E. Allen Smith" <EALLENSMITH(a)ocelot.Rutgers.EDU> Subject: RRE: Lexis-Nexis personal information database To: cypherpunks(a)toad.com Message-id: <01I9AIVKYUFO9ULM12(a)mbcl.rutgers.edu> X-Envelope-to: cypherpunks(a)toad.com X-VMS-To: IN%"cypherpunks(a)toad.com" Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0

Re: China joins Singapore, Germany, ....
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:29 PM 9/9/96, Duncan Frissell wrote: >Course there hasn't really been much net censorship. Germany and China's >attempts have not been effective. The Feds lack a mechanism for "blocking >sites." There is no one in a position to give such an order. There is no >chance that such an order would be obeyed in any widespread way in any case. >Outlaw boards crackdowns didn't diminish the number of outlaw boards. Porno >boards crackdowns did not diminish the number of porno boards. Since it is >easier to create a site than it is to set up a board, legal maneuvers by the >Feds won't work. > >Making sites "illegal to connect to" is meaningless because most users won't >even know what is on the list and most of those who do will be encouraged to >connect to them rather than discouraged. While I agree with Duncan's sentiments (obviously) and even agree that censorship is impossible to completely implement, I think Duncan is oversimplifying and thus trivializing the dangers to Chinese, German, Singaporan, etc., subjects. Prison sentences in Germany for those who reveal forbidden information about "the Holocaust," prison terms (or worse) for dissidents in Burma, China, and, of course, various other nations and "democratic people's republics." Even here in the United States, connecting to an illegal site may mean imprisonment. (The charge: trafficking in child pornography, for example.) Rather than saying such laws are "meaningless," developing blinded, steganographic, etc. proxies may be a more useful strategy. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: BoS: Can you trust your ISP ??
by Ben Camp 17 Dec '03

17 Dec '03

Any sort of Certificate authority based protocol is dumb. It's like RSAC charging 500 bucks for rating a web site. Nothing anyone does on the web is important enough to encrypt. Anyway, as far as SSL goes...we've all heard about how proactive Netscape is in preventing key comprimise. Its too late. Ben Camp At 06:49 PM 9/9/96 -0700, Eric Murray wrote: >I~nigo Gonzalez writes: >> >> Hello, >> I'm thinking about how can I get rid off this kind of attack *before* it >> happens. Can you please send me your comments about this? I don't know so >> much about the how SSL works, but I think this is something that can >> happen... > >[classic Man-in-the-Middle attack] > > >What you described is the Man In The Middle attack, often >abbreviated on these lists as MITM. The fact that there's >an abbreviation for it should indicate to you how often >it is discussed. However it's also one of the first >problems (besides the basic encryption) that protocol >designers think of. > >It's been taken care of in SSL3- the server's certificate >must be signed by a CA that the client trusts. Unless >the digital signature can be spoofed, and it probably >can't be, the client can be certain that the server certificate it got >is really from the server that it claims to be from. > >Assuming that RSA still can't be broken, the client can be sure >that the pre-master-key material that it sends to the server >(and which is the basis for the symmetric crypto session keys) >will not be compromised. > > >If you grab a copy of the SSL3 spec (from netscape's web site) >and read the appendicies there's more good stuff about possible >attacks and what's been done to counter them. > > > > >-- >Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm >Principal, LNE Consulting: SSL, crypto applications, Internet security. >PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF > > >

2 1

Re: Court challenge to AOL junk-mail blocks
by Peter Trei 17 Dec '03

17 Dec '03

[you can't bounce spam back to it's source] > Why not? Because spammers _invariably_ forge the return addresses to keep > exactly that from happening. What I do is look into the headers, and start bouncing it back to the domain administrator, if I can't find any better mail address. Pegasus makes it easy to automate this. I *do* send one politely worded request first - it takes a second spamming before I'll set up the rule. Peter Trei trei(a)process.com

1 0

Allo allo
by Smaug 17 Dec '03

17 Dec '03

Just figured i'd drop a hello in the box. Hopefully at least a few of you have encountered me at some point... For the rest, I am Si_Druid (si is for Silicon...) and i've been around too long :) I consider myself a cyBerpunk by a definition that myself and a group of other CbP's came up w/ that seemed to fit best. Whether it is best or not is a matter of much discrepancy by the hard core "CbP is a fictional genre" groupies, but its rather irrelevant to the rest of the populace. So why am i here? Well, our ideas on CbP include just about all forms of survival in this society, and cryptology is probably one of the leading forms. I figured I'd better throw my hat in the ring before it got out of hand and i wound up eating it instead. I'm not terribly experienced w/ crypts, pgp still annoys me, but 'back in the day' i used to write some low level crypts that were relatively impossible to break... they were also impossible to decrypt, which meant that the only way to use them was to work forward.... mostly i did password encryption schemes, this one working the best: string #a nice set of ascii codes currkeyletter #letter from string in use password #a password from 5 to whatever characters encrypted #the password encrypted char #the current character of the password we're playing w/ stringchar #the char # in the string for char=0 to lengthof(password) #getting our stringchar stringchar=char while stringchar >= lengthof(string) { stringchar=stringchar-lengthof(string) } currkeyletter=string[stringchar] #writing the encrypted password if char = 0 #first letter encrypted[char]=resolve(password[char],0,password[char+1],string[stringchar] else if char = lengthof(password) #last letter encrypted[char]=resolve(password[char],encrypted[char-1],0,string[stringchar]) else encrypted[char]=resolve(password[char],encrypted[char-1],password[char+1], string[stringchar]) end of for resolve(pw,en,pw2,st){ result=pw+en+pw2+st while result>=250 { result=result-250 } return(result) } ----- doesnt really matter what language you write it in, the difficulty is essentialy that the only way to solve it is to test all possible passwords and strings... which is... (lets say a complexity of pw=7, str=6) 52^7 * 250^6 ~=10^26 I think that was somewhere near the number of electrons in the universe :) Anyway, just providing y'all with something to toy with.... Si. Oh what a tangled web we weave, when we practice to deceive Case in point - www.*.*

1 0