December 2003 - cypherpunks-legacy

Re: Patriots should use PGP
by Jim Byrd 17 Dec '03

17 Dec '03

Why on earth would an American football team need PGP?

3 2

[Crypto Patent] Authentication "scheme"
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Just snatched off the newspool... Anitro --------------------------------------------------------------------------- Scheme for authentication of at least one prover by a verifier Source: MicroPatent MicroPatent via Individual Inc. : Abstract: A new procedure for authentication of at least one prover by a verifier, the authentication being based on public and secret key cryptographic techniques and making use of a zero-knowledge protocol. In addition, this protocol is established using the problem of constrained linear equations and finds applications in cryptography. This procedure uses a published matrix M of dimension m.times.n where coefficients are chosen at random from the integers from 0 to d-1, where d is generally a prime number close the square of a number c. The "prover" authenticates itself to a "verifier" by performing hashing functions based on a randomly chosen vector U of dimension m and a randomly chosen vector V of dimension n, the results of which are called commitments and are sent to the prover. The prover then chooses one of several predefined functions and requests that the verifier perform this one predefined function. When the verifier receives a result of the predefined function, it compares the result with the commitments to determine if the prover has provided a correct set of responses. The procedure also can be repeated for other random vectors U and V for increased security. Ex Claim Text: Method for authenticating a prover by a verifier based on a cryptographic technique using a secret key, a public key and a zero-knowledge protocol, the method comprising the steps of: a) generating a secret key, including at least one vector S of dimension n having coordinates chosen from a set X, b) generating a matrix M of dimensions m.times.n whose coefficients are chosen at random from integer values from 0 to d-1, where d is a prime integer close to the square of a number c, c) generating a public key comprising at least one vector P such that P=g(M(S)), where g is a function defined by said set X and a subgroup G of a set of integers (1, 2, . . . d-1) and which associates an element g(x) of G to each coordinate x of the at least one vector P such that x is described uniquely as a product of g(x) and an element k(x) of X; d) generating at least two random vectors by the prover; e) generating plural commitments by applying a cryptographic hash function to functions of S, M and the at least two random numbers; f) exchanging plural messages between the prover and the verifier based on said public key and said secret key; and g) authenticating the prover by the verifier based on said plural messages, said public key and said secret key. Patent Number: 5581615 Issue Date: 1996 12 03 Inventor(s): Stern, Jacques [12-09-96 at 14:42 EST, Copyright 1996, MicroPatent]

1 0

Java DES breaker?
by Ray Arachelian 17 Dec '03

17 Dec '03

Here's a thought, While Java isn't a workhorse performance wise, it's very simple for anyone with a half decent browser to use java applets. Writing an implementation of DES in Java should be fairly easy, however it will run slow on most browsers. This performance drop will make it far easier for Joe Webuser to easily help break DES for us. Previous efforts at breaking DES and RSA have done quite well, but the number of people involved can be greatly increased if you tell someone just go to this page and leave your browser on overnight, every night. The applets would get a key range from the server, process them, and return a yeah or nay back for however far they manage to process before the user returns in the morning. With JIT's (Just In Time Compilers) and the sheer numbers of users that this can attract, the efforts at breaking weaker cyphers can be increased. =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com =========================

7 20

Re: Puzzle Palace 2nd edition (1983) Info
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:03 AM 12/10/96 -0800, you wrote: >>Hope that clears things up... > >No, I fear you are _confusing_ people with this comment. > >Yes, there was a 1983 paperbound edition, with a few new items added to the >1982 orginal. Ho hum. (I have both, and have for many years. It was finding >the '92 edition that sparked much of my interest in the NSA, back in 1982.) > >What we are waiting for is the _real_ Second Edition, the long-awaited >revising of "The Puzzle Palace." It is expected later this year or next. Sorry I was unclear. Actually I was refering to what _Schneier_ was calling the "Second edition". (The penguin edition is more like version 1.1.) The afterward just seems to be a tacked on collection of fragments. Hopefully the real Second Edition will add more content. --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

No Subject
by pfarrell＠cybercash.com 17 Dec '03

17 Dec '03

1 0

Re: Redlining
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"mjmiski(a)execpc.com" "Matthew J. Miszewski" 11-DEC-1996 03:35:52.25 >My question was a real one. The basis of it comes from my work with the >homeless in which they have a difficult time getting a job because they >have no "home address" to put on the forms, some do not have or remember >their SSNs, etc. This causes a cyclic problem for the homeless. My >question to Tim was, in the real world, how is the protection of this data >feasible. And what institution ultimately requires the SSN and a considerable number of these other pieces of information? What institution puts a considerable number of roadblocks in the way of getting a post office box, for use as a home address, without a "home address"? >I do have responses to each of your "points" in your last post, but have >found the process of responding point-by-point tedious and non-productive If you've got such responses, please give them. They may very well be tedious; I'd disagree about them being non-productive, based on my past experience. Without such responses from you to some very well-reasoned arguments, we are left with the equivalent of the Feds on cryptography, i.e., "if you knew what we know you'd agree with us." -Allen

2 1

Cypherpunks December Meeting (SF Bay Area)
by Dave Del Torto 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [wide distribution: please excuse any duplicates you may receive] Salutations, The Cypherpunks December 96 Physical Meeting is being hosted by Pretty Good Privacy, Inc. We've rented a meeting room at the Hotel Sofitel (see below) that can accomodate ~100 people. There will be munchies, and I think this qualifies as a cypherpunk milestone of sorts, so I hope lots of you show up. Please see <http://www.pgp.com/961214.html>. General Info: 1) RSVP's Please RSVP ASAP to <mailto:ddt@pgp.com?subject=cpunks-mtg-rsvp> if you plan to attend (reply to this with "cpunks-mtg-rsvp" as the Subject). It's very important that I have a clear idea of how many humans plan to attend as soon as possible, because we're also providing refreshments/snacks which we need to order from the hotel in advance. Thanks. 2) Location/Time We'll be holding this "Open Meeting on US Soil" at the: Hotel Sofitel 223 Twin Dolphin Drive Redwood Shores CA 94065 415.598.9000 tel Meeting time is 11 AM - 5 PM (a Sofitel time slot), as we have to be out of the room shortly after 5 PM for a wedding setup). The Sofitel is a block or two south of the shining Oracle towers on Twin Dolphin Drive, which is easily accessible from Hwy 101 (on the east/SF Bay side of the freeway) in Redwood City (12 miles south of SFO airport and a few miles south of the Hwy 92/San Mateo Bridge junction as references). There are directions and a simple GIF map at the meeting info URL. <http://www.pgp.com/961214.html>. NOTE: when you arrive at the Sofitel, look for signage pointing to the exact room we're meeting in, or inquire at the main desk. Bring your friends. 3) Demos If you want to demo something at the meeting, tell me ASAP(!). We encourage anyone who has anything Cypherpunks-related to present (even stuff that's already been seen before but which has been updated) to bring/show it. I'm going to set the arbitrary cutoff date for demo reservations as 11:59 PM on Thursday 12 December: we can have the right equipment ready for you if you list what you need in detail. If you wait until the last minute and bandwidth is limited, we may not be able to fit you in, unless you have something very simple to show, so please bear that in mind. There will be overhead projection and an RGB projector available. Net connections can be arranged with advance notice. Right now, we have not arranged anything beyond a Metricom modem (28.8Kbps), but we can arrange an analog modem line or even an ISDN if there's a specific need. Tell me soon(!). 4) Handouts/Door Prizes/Raffle Handouts are welcome: please give me your stack of handouts for the table when you arrive. If you want to pass out detailed mailbomb instructions, please do it outside the building at your own risk (inside the meeting, please refrain from getting PGP Inc in trouble, we do enough of that ourselves already ;). There will be door-prizes from PGP, but supplies are limited if 100 people show up. We may also raffle off some software (upgradable when our new stuff comes out). 5) PGP Key "Thing" Bring a printout of your key fingerprint/key. Or a diskette version, or both. We'll have a key exchange/signing session at the end of the meeting. 6) PGP/MIME BOF at the IETF The IETF's PGP/MIME BOF is Friday 13 Dec, 9:00-11:30 AM (Crystal Room, Fairmont Hotel, 170 South Market St. in Downtown San Jose, 408.998.1900 main). Since it's a Birds Of a Feather session, I think interested people in the San Jose area can show up if they want. Please come by if you want to help support RFC 2015 so PGP/MIME can take the next step toward IETF Working Group discussion so we can eventually move it to the IETF Standards Track process. Anyone who's at the IETF is encouraged to stay over until Saturday and come to the Cypherpunks meeting too! - -- I hope to see everyone there! If you have questions about any of this, email me (I'm at IETF this week, but I'm wireless). If there are any last-minute announcements before Saturday, I'll post them. dave ________________________________________________________________________ Dave Del Torto +1.415.65432.31 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv Comment: Verbum sapienti satis est. iQCVAwUBMq7z7KHBOF9KrwDlAQHcRQP/b/FOYPca2tN9mRlJXoLhgeI1swGESUHs 5CzTNcFq92EeiEeNYgq6Ri/itAzovTbt75AvJdfULrHrA48sQ9QGZy/qedRjNv+q w29a0olc9sRh3EpRvW83ioeju2pyJ5zynpu3wua8H5j6p4NAKJmnte0VzxL9n4KA Ezgov90jxuc= =j4Q1 -----END PGP SIGNATURE-----

1 0

Re: Redlining
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 9:04 AM 12/10/1996, Black Unicorn wrote: >On Tue, 10 Dec 1996, Huge Cajones Remailer wrote: >> I believe that ten, or a hundred, or a thousand people should be able >> to pool their money and lend it to whomever they please for whatever >> reason they like. >> >> That, essentially, is what a bank is. I do not believe the government >> should dictate which people you, or your bank, are allowed to lend to. > >Create a bank where the identity of the customers are unknown and you >solve the redlining problem. I can imagine a bank whose depositors are not known. I can also imagine a bank which itself operates anonymously. How would people borrow money against real estate and remain anonymous? It seems to me that the borrower cannot do so if the real estate will act as collateral. Also, how would an anonymous bank foreclose on a mortgage? Red Rackham

3 2

The Sword of Damocles
by Timothy C. May 17 Dec '03

17 Dec '03

The recent discussion of the dangers of PICS--especially the dangers that a widely-deployed PICS system might encourage/enable governments to mandate PICS ratings in various ways--is just one of several "swords of Damocles" we have talked about for several years. By a "sword of Damocles" I mean any technology or system which, if deployed, could present an almost overwhelming temptation for governments or special interest groups to direct in directions most of us would find highly objectionable and even dangerous. (I use the metaphor of this sword of Damocles--the king of some place placed Damocles under a sword suspended by the thinnest of threads, to remind Damocles of who had the power--because no other metaphor seems to fit as well. Another metaphor is that of the danger of any technology which could become oppressive by the "flip of a switch." For example, if key recovery becomes widespread, with limited numbers of recovery centers, then governments could quite easily use administrative or executive orders to limit the options available for choosing such centers, or the licensing requirements for such centers...by the "stroke of a pen" ("flip of a a switch," or "flag day" in computerese), the voluntary system becomes much less voluntary. At the most extreme level, nearly all of us would object mightily to any system in which cyanide release systems were installed in our homes, no matter the assurances that the cyanide would only be released if proper legal orders were gotten!)) Some of the debates over crypto policy have involved people who don't see what the concern is about future actions, who basically trust the government to keep a system voluntary when it was promised to be voluntary. (David Sternlight comes to mind...from 1993 onward several of us just could not convince him that the Clipper danger lay in the potential for key escrow eventually being mandated...he just kept focussing on the "voluntary" aspects of Clipper sales, and thought our criticism of Clipper as an attempt to interfere with "free markets." Nonsense of course, but because of the "sword of Damocles" concerns, not the particular situation at some present instant.) To make this issue clearer, I'll just list several sorts of examples. Not all are the same, but the themes are similar. 1. An implantable ID device is developed for humans, along the lines of the "Pet I.D." chips which are already gaining wide acceptance. (And which we've discussed several times on this list. See archives or use Alta Vista, etc.) While such a "voluntary" system is "unexceptionable" to most civil libertarians, in the sense that libertarians do not object to the non-aggressive choices of others to do with their bodies as they please, there are clearly some "sword of Damocles" concerns. For example, a widely-used system of implants could be mandated first for schoolchildren (gotta stop those kidnappings), then for released criminals (part of parole), then for deadbeat dads (don't want them to flee), then for other classes. This is of course a serious issue, despite some marginalization in the press as being primarily a concern of the religious Right and their fixation on "the mark of the Beast." 2. Key Escrow, a la Clipper, the latest Key Recovery plans, etc. Even if announced as "voluntary," as of course Clipper was, our concern was largely with the "sword of Damocles" aspects, that the government appeared to be interested in driving out non-escrow alternatives and widely-deploying a nominally voluntary system which could, at the stroke of a pen, become mandatory. The various issues surrounding key escrow have been so well-covered I won't repeat points here. This is just a classical sword of Damocles issue. 3. Government regulation in general. Anytime the government gains the power to regulate some product class or industry, there is this sword of Damocles effect. A recent example is the area of _vitamins_, with the vitamin and health food store industry vigorously fighting proposals that the Food and Drug Administration (FDA) step in to the "vitamin anarchy" arena and place restrictions on vitamins, advertising, licensing, etc. The sword of Damocles comes from the very real possibility that initially quite "reasonable" limits will "open the door" for later, more draconian actions. (Whew, I've mixed a couple of metaphors with a couple of classical Greek allusions. Sorry.) 4. Gun control. Gun _registration_ is almost the canonical sword of Damocles, in terms of what gun rights folks fear the most. They know that once the locations and quantities of guns are known, it is a much simpler matter for some later government to order such guns turned in to be melted down. It happened in the 1930s in Germany, it happened in other countries more recently, and it is even happening with the U.S. military "disarming the civilians" in places like Somalia, Bosnia, Zaire, and any other place the U.S. military is sent in as a "peacekeeper." (Note: In Somalia, the U.S. disarmed the "soft targets:: simple farmers who had rifles they'd had in their families for generations. This had the tragic effect of making these very farmers then easier prey for jeeploads of looters and Somali "soldiers," who often followed the U.S. "pacification" squads and looted the homes and farms of the now-disarmed villagers! Some tradition for the U.S. to uphold, eh? No "right to keep and bear arms" for the peasants we are supposedly there to help.) Whatever one thinks of guns and gun rights, clearly this is a good example of why registration is fought by so many people, even if "assurances" are given that the registration has nothing to do with confiscation. (Right.) 5. "Voluntary self-ratings." The PICS discussion, and earlier discussions of "voluntary self-ratings" of CDs, videos, and other entertainment, brings up these same issues of Damoclean swords. Could a nominally voluntary ratings system be mandated by the courts, or by Congress? Depending on the outcome of the CDA case, I think so. If the Supreme Court upholds the CDA, it could be argued that anyone who fails to voluntarily self-label his speech faces sanctions if anyone finds his speech in violation of community standards, blah blah. (If one's speech is "non-explicit," as, say, this post of mine is here, then of course it almost certainly would not have to be self-rated...unless I said "Fuck," in which case I'd better consult the various PICS ratings and pick one to protect me to the maximum extent...I consider this scenario probable if the CDA is upheld and a major step away from "free speech" and "cabeat emptor" and a step toward wide self-suppression of controversial speech.) So, these are various examples of "swords of Damocles." That is, systems or technologies which are so potentially dangerous to deploy--in the sense that governments, do-gooders, and lawyers are so tempted to make them mandatory or to use coercion to drive out alternatives--that we should try to anticipate the Damoclean dangers of such technologies and work to head off such futures. Cypherpunks don't trust governments which say "Trust us" or "We're here to help." Governments, like that king in the myth, can cut that threat holding up that sword with little effort. "The Position Escrow System is voluntary. Citizen-units who wish to wear the Localizer (tm) are encouraged to do so, This has been shown to help the police in deterring kidnappings and is helping rescue units find lost hikers and skiers. Those citizen-units who wish not to cooperate in such efforts are free at this time to be rogues, but rogue-units will of course be treated with more suspicion and the failure to wear a Localizer (tm) may of course, as the Supreme Court ruled in 2003, be considered probable cause for a search. And since there are now twice as many laws as there were in 1996, most citizen-units are choosing not to be rogue-units." --Citizen-Unit Timothy C. May ID: 7734%-sd123227-666 Location at 19:09 UCT: 37 02 30 N / 121 48 45 W Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

RE: Java DES breaker?
by Mullen Patrick 17 Dec '03

17 Dec '03

A few small bugs in this idea, at least for the masses -- 1) This would only appeal to people who have unlimited usage 2) ...and don't care about not having their phone available (I know they're asleep at the time) 3) ...and don't have an ISP that will kick them off when a timeout period expires. ...But if you implement it in a way where the user can hang up the phone and leave the browser on with the applet running, that would probably work. It would be easier to use than downloading executable code and a keyspace manually... PM _______________________________________________________________________________ From: Ray Arachelian on Tue, Dec 10, 1996 15:57 Subject: Java DES breaker? To: cypherpunks(a)toad.com Here's a thought, While Java isn't a workhorse performance wise, it's very simple for anyone with a half decent browser to use java applets. Writing an implementation of DES in Java should be fairly easy, however it will run slow on most browsers. This performance drop will make it far easier for Joe Webuser to easily help break DES for us. Previous efforts at breaking DES and RSA have done quite well, but the number of people involved can be greatly increased if you tell someone just go to this page and leave your browser on overnight, every night. The applets would get a key range from the server, process them, and return a yeah or nay back for however far they manage to process before the user returns in the morning. With JIT's (Just In Time Compilers) and the sheer numbers of users that this can attract, the efforts at breaking weaker cyphers can be increased. =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;10 Dec 1996 15:57:37 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Tue, 10 Dec 1996 20:57:29 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id IAA21427 for cypherpunks-outgoing; Tue, 10 Dec 1996 08:23:56 -0800 (PST) Received: from beast.brainlink.com (sunder(a)beast.brainlink.com [206.127.58.17]) by toad.com (8.7.5/8.7.3) with ESMTP id IAA21422 for <cypherpunks(a)toad.com>; Tue, 10 Dec 1996 08:23:53 -0800 (PST) Received: (from sunder@localhost) by beast.brainlink.com (8.8.2/8.6.12) id LAA01432; Tue, 10 Dec 1996 11:26:19 -0500 (EST) Date: Tue, 10 Dec 1996 11:26:19 -0500 (EST) From: Ray Arachelian <sunder(a)brainlink.com> To: cypherpunks(a)toad.com Subject: Java DES breaker? Message-ID: <Pine.SUN.3.91.961210112058.1282A-100000(a)beast.brainlink.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-cypherpunks(a)toad.com Precedence: bulk

2 1