December 2003 - cypherpunks-legacy

Re: Gaining trust in OCO crypto code
by norm＠netcom.com 17 Dec '03

17 Dec '03

I agree with most of Bill's points. It is the right sort of analysis. At 3:06 PM 9/12/96, Bill Frantz wrote: .... >(2) Key generation. There are published ways to encode an RSA secret key >in the corresponding RSA public key. A key generation algorithm which only >uses 32 bits of the random number would be hard to detect, but easy to >break by one who knew its secret. You have to be able to examine in detail >how keys are generated. Actually if you generate 100,000 RSA keys with the algorithm the birthday effect says that you will have some collisions. Of course even 100,000 key generations takes a long time. .... >(1) Implementation of a cryptographic algorithm. If we can feed it enough >test cases, and compare the output with a public, well vetted >implementation, we can come to believe that it is correct. For some purposes. On the transmitting end if the enemy can choose the plain text then a tested but bogus implementation can take special action upon seeing a signal in the plain text stream. One such action would be to merely shut down. On the receiving end a bogus implementation can detect a signal inserted in the cipher text by the enemy and cause damage. I havn't thought of any low visibility attacks but I suspect that there may be some. If random number generation is specified not to be integral to RSA key generation, then two or more untrusted programs, from mutually hostile sources, can generate your RSA key if they yield the same output from the same input. In paranoia situations I would rather trust my keyboard random than an algorithm chosen by my enemy.

1 0

ISP-TV Interview with Solveig Bernstein
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: Interview with Solveig Bernstein *** Monday, September 16 9:00 PM ET Solveig Bernstein Assistant Director of Telecommunications & Technology Studies Cato Institute ISP-TV will present an interview with Solveig Bernstein from the Cato Institute. Ms. Bernstein will be discussing legal issues concerning the CDA, the upcoming Supreme Court case, and other telecom legal issues. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network

1 0

Government awards GAK contract to Nothern
by David Lesher 17 Dec '03

17 Dec '03

Clarinet sez: OTTAWA, Sept. 16 (UPI) -- The federal government has chosen Northern Telecom's data security software, Entrust { } Public-Key Infrastructure (PKI)... for gov't use..... worth $7.3 million...... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close...........(v)301 56 LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead........vr vr vr vr.................20915-1433

1 0

Re: 56 kbps modems (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 16 Sep 1996 17:56:43 -0700 (PDT) > From: Lucky Green <shamrock(a)netcom.com> > Subject: Re: 56 kbps modems > > On Mon, 16 Sep 1996, Jay Gairson wrote: > > > Speaking of ISDN, how many people, can afford to have a personal ISDN > > line in there house? And then afford to connect to something/someone > > else on a next to permanent basis monthly? > > No problem here. My ISDN bill is a small fraction of my regular phone bill. > Count me in. I am wired 24 hrs a day via ISDN. Jim Choate CyberTects ravage(a)ssz.com

1 0

Searching an email address
by nobody＠replay.com 17 Dec '03

17 Dec '03

I have been trying to find out info re: someone via his email address and didn't find anything. The server is telaver.com, e.g., name(a)telaver.com Any suggestions outside of the usual search machines?

1 0

U.S. Helped Wipe Out One of the Kurdish Factions
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:00 PM 9/16/96, jim bell wrote: >condition which is forced on the victims. In addition, you almost always >find that these starving countries have well-supplied militaries, defending >the local warlords against each other as in Somalia. Indeed, in Somalia the >incoming food was actually used to buoy up one group against another, >because access to it is controlled directly or indirectly by the factions. The reports that the U.S. spent $100 million supporting the Kurdish struggle against the central government is a related point. The $100 M went into weapons, food, etc., which the U.S.-supported side used against the Iran-supported side. Then the U.S.-supported side allied themselves with the central government, however temporarily, and is not engaging in a "mopping up operation" (translation: summary execution of all members found of the losing side, including wives and children). Our $100 million helped wipe out the "losing side" Kurds, and also strengthened the previously-poor reputation of Saddam Hussein (who just got a unanimous vote of support from the Arab League foreign ministers meeting in Cairo...this likely explains why the weekend's predicted massive raid on Baghdad was shelved...Clinton is already backpedaling, and may send Hilary/Hillary to Baghdad to help the Baghdad "Save the Children" chapter). (Note: Only this last point, about Hilary, is made up...the rest is what is actually happening.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Assassination Politics, was Kiddie porn on the Internet
by azur＠netcom.com 17 Dec '03

17 Dec '03

>>Yet another obligatory AP (Assassination Politics) reference: If a person >>is really interested in helping out "starving children" he may be able to do >>far more good by purchasing the death of the local tyrant(s), rather than >>(just) buying more food. > > >The problem is that assasination rarely leads to the installation of >a government that is any better. In most cases it gets worse. > >In the past the US excuse for supporting bloodthirsty murderers like >Pinochet, Saddam, Marcos and Noriega was that the alternative was >worse. > >In cases like Eritrea or Ethiopia the average term of office of any >given despot tends to be rather short in any case. In most cases its >a case of there being little to choose between the leaders of the >various factions and that ending the war on any terms is better >than allowing it to continue. > We've all heard these arguments, but are they true? Who says so, and how can they be certain? Jim's suggestion has never, to my knowledge, been tried on a consistant, large, scale. When all conventional alternatives have been tried and fail, what have we or the starving children got to lose? I'm sure there are qualified mercinaries available at the right price to put together wetwork operations, just look in soldier of fortune. I once had a hand in establishing a non-profit. Perhaps we can name it SPECTRE (SPecial Executive for Counter-intelligence, Terrorism, Revenge and Extortion) after Ian Flemming. Is it legal for citizens of the U.S. to engage in contract killing of foreign military, politations, etc? How about U.S. or foreign non-profits? In a related matter, I used to be an avid RC modeler. By marrying a single-board computers, DGPS (Differential GPS) and Giant Scale Remote Control technologies it now appears straightforward to produce inexpensive consumer cruise missiles capable of accurate (<10 meter radius) delivery of 10 kg. explosive, gas or biological payloads over several hundred km. for less than $10,000 each. Both reciprocating and miniature jet engines are available. Might make cheaper alternative to mercinaries. -- Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to perscription DRUGS.

2 1

really undetectable crypto made somewhat practical
by jim＠suite.suite.com 17 Dec '03

17 Dec '03

The primary drawback to the stego scheme I described in the previous post was the ratio of stego bits per message. The scheme would only transmit an estimated 4 stego bits per message. Then it occurred to me that I can improve the ratio by basing the scheme on the hashes or words rather than the hashes of entire messages. Previous Scheme: construct a sequence of plaintext messages such that the first 4 bits of the MD5 hashes of the messages combine to produce the cyphertext of the true stego message. The sender would only need to send the plaintext messages. The recipient would calculate the MD5 hash of each plaintext message, extract the first four bits from each hash, append them together, then decrypt the result to obtain the true stego message. New Scheme: First, calculate the MD5 hash of all the words in the various dictionary files used by the password cracker program and create a database containing every word and the first 4 bits of its MD5 hash. Given such a database, it would be possible to write a program that accepts as input a block of cyphertext (the stego message, encrypted), chunks it up in to groups of 4 bits and then, for each chunk, displays the words that have hashes that start with those same four bits. The person running the program would select words that form meaningful sentences but also produce hashes that combine into the encrypted stego message. This scheme would send 4 stego bits per word. In addition to ordinary words, the database could contain names, misspelled words, abbreviations, words with alternate capitalization, slang terms, technical jargon, whatever. Fortunately, senders and receivers don't need to synchronize word databases. The recipient doesn't need to have any word database. The receiver can reconstruct the hidden encrypted message simply by calculating the MD5 hash of each word in the plaintext message, gathering up the appropriate hash bits and decrypting the result. This scheme could send more than 4 stego bits per word, but as you increase the number of stego bits per word (sbpw), you reduce the number of words that will work for a given chunk of cyphertext, making it harder to construct meaningful sentences (e.g. given a 40,000 word database, 4 sbpw yields 16 word groups with approx 2500 words per group; 8 sbpw yields 256 word groups with approx 156 words per group. 8 sbpw would probably not work well). Would this scheme work? It works in the sense that you can use it to send arbitrary encrypted messages through channels that don't allow anything but human-readable plaintext messages, but does it do so in an undetectable manner? I think so, but I don't know for sure. Jim_Miller(a)suite.com

1 0

Re: Risk v. Charity (was: RE: Workers Paradise. /Political rant).
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Mon, 16 Sep 1996 19:58:25 -0400, Black Unicorn <unicorn(a)schloss.li> wrote: > >Remember the original purpose of social security. A government fund which >was self sustaining because it only gave out what was put in and gained by >investment. Not quite. You'll remember that SS was pitched to the masses as such during the Great Depression, but its true purpose was to allow older workers to quickly retire and make room for the largely unemployed men in their prime, family raising, years. > >> A social safety net is simply a form of health and life >> insurance. Statistical arbitrage if you will. > >Yes, but not for the reasons you would cite. Social safety nets prevent >rioting by the lower classes, revolution and general civil disorder >because they appease the masses. Indeed this is a form of health and life >insureance for the middle and upper classes. No doubt. See my previous comment. > >> By spreading the risk you >> minimize the cost. Yes, some people will take advantage of the system. >> But like a virus, a robust system should be able to withstand this form >> of attack. > >This is absolutely silly. Speading the risk alone does nothing. The cost >for those who can pay is increased, and the cost for those who cannot pay >is made 0 (it already was 0 incidently). > >It is also the reason the taxpayers (and not the savings and loan >community at large) were forced to bail out the failed financial >institutions. Namely, because premiums were not tied to risk. The FDIC, >as of last year in any event, charges a flat rate fee for all financial >institutions. This is independent of any risk analysis of their >investments. i.e., a financial institution that invests in trailor parks >in Arkansas pays the same premiums for federal deposit insurance as a >institution that invests in government issued debt instruments. (There is >some ceiling for risk, but not a graduated system below the ceiling). > >The result was (is) an incentive to risky investments. If you are a >financial institution and I tell you "I will charge you $1.00 to insure >$1000.00 of low risk and low profit investments, but I will charge you a >while $1.00 to insure $1000.00 of extremely risky but highly >profitable option and currency investments" which one are you going to >choose? (Hint, you're an idiot if you pick option #1). > >The reason the insurance fund was depleted is because there was no risk >balancing built into the system. The premiums did not cover the losses. >They would have if they were risk adjusted. > Next major recession: Here we go again. >Spreading the risk, by itself, does NOT reduce cost. You must properly >PRICE risk. > >This is the distinction between insurance and welfare. Right on! >Welfare merely hands out money for those who have not bothered or cannot >afford insurance. The result is an INCREASE in cost (taxes) to those who >are coughing up the cash so that they may support. > PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to perscription DRUGS.

2 1

All Bets Off
by Brock N. Meeks 17 Dec '03

17 Dec '03

Just so this isn't hanging in cyberspace forever, my $5,000 bet for anyone to prove the TWA 800 flight was downed by a U.S. missile is now *off the table*. It's been two-plus weeks since I tossed out the bet and no one took me up on it, so it's now being formally withdrawn. --Brock

4 3