December 2003 - cypherpunks-legacy

using perl-rsa
by Adam Back 17 Dec '03

17 Dec '03

[managed to type kent instead of keng this time, touch typist and not watching the screen either]. Kent Crispin <kent(a)songbird.com> writes: > [...] > > >print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> > >)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` > > BTW, how do you use this code? I'm not a big "dc" user, I must admit. You first of all extract your a PGP key with pgpacket. (You'll need to change the password to be no password (press enter when prompted for password), so that PGP doesn't encrypt the private key. Next, you can do: % perl rsa.pl [e] [n] < plaintext > ciphertext % perl rsa.pl [d] [n] < plaintext > ciphertext to encrypt and decrypt. Here's a small example (Fred is a notional eternity user who's key, both public and private is included in the eternity distribution): Fred's public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQBNAzPfUPsAAAECAMn6jtL3ZNjmBrkDLIktHNmBGc+a59BSvFPN8howj5zAj1U8 5QOfVtV4kOliK2AkCcL2yyz3Wz+AHiYdVyuQJF0ABRG0FEZyZWQgPGZyZWRAZXRl cm5pdHk+iQBVAwUQM99Q/B4mHVcrkCRdAQECQQH/YZqss3VQZwZi5KfylAzFOnz8 /pXOSh8Rf9pTsF2TbsAKIK4xL9PzYoicy/KAZdIN+AJO8dX/xY0a1v5A8xobeg== =iWoN -----END PGP PUBLIC KEY BLOCK----- Fred's secret key (no password): -----BEGIN PGP SECRET KEY BLOCK----- Version: 2.6.3i lQD4AzPfUPsAAAECAMn6jtL3ZNjmBrkDLIktHNmBGc+a59BSvFPN8howj5zAj1U8 5QOfVtV4kOliK2AkCcL2yyz3Wz+AHiYdVyuQJF0ABREAAfsEPkWwiGybJRn00/dB RLZjOZHAmMRVDH6UC9si+GpHDsOs5/eLbK6GUqmbWXG4I4LadxRQz/nplQ+lCVYP ecrbAQDixLjtXlj9ks1e9ZcroU71Pvk84oQjpUhiU1rAIkKh9wEA5APIvVJETEjm DxEpdE6hJkty+nb6v8VNOYlslo8Ol0sA/iwRycjjcNs4A2c9Owt+xLCiMp2JIb0z yf7d4xEcLI1vUXG0FEZyZWQgPGZyZWRAZXRlcm5pdHk+ =CHwS -----END PGP SECRET KEY BLOCK----- (to extract public key do: % pgp -kxa fred fredpub ~/.pgp/pubring.pgp and to get private key do: % pgp -kxa fred fredpri ~/.pgp/secring.pgp ) Next get pgpacket.pl, see ftp://ftp.ox.ac.uk/pub/crypto/pgp/utils/ or something like that. Then run pgpacket on the fredpri.asc (it contains all the info that you want, without looking at fredpub.asc, ie the values for e, d and n): % pgpacket fredpri.asc The values for e, d, and n are: e = 11 d = 043E45B0886C9B2519F4D3F74144B6633991C098C4550C7E940BDB22F86A470E C3ACE7F78B6CAE8652A99B5971B82382DA771450CFF9E9950FA509560F79CADB n = C9FA8ED2F764D8E606B9032C892D1CD98119CF9AE7D052BC53CDF21A308F9CC0 8F553CE5039F56D57890E9622B602409C2F6CB2CF75B3F801E261D572B90245D Now you can encrypt for fred like so: % echo hello world | perl rsa.pl 11 C9FA8ED2F764D8E606B9032C892D1CD98119CF9AE7D052BC53CDF21A308F9CC08F553CE5039F56D57890E9622B602409C2F6CB2CF75B3F801E261D572B90245D > hello.rsa % and to decrypt: % perl rsa.pl 043E45B0886C9B2519F4D3F74144B6633991C098C4550C7E940BDB22F86A470EC3ACE7F78B6CAE8652A99B5971B82382DA771450CFF9E9950FA509560F79CADB C9FA8ED2F764D8E606B9032C892D1CD98119CF9AE7D052BC53CDF21A308F9CC08F553CE5039F56D57890E9622B602409C2F6CB2CF75B3F801E261D572B90245D < hello.rsa hello world % Now dc can do modular exponentiation like so (reverse polish notation): dc> m e ^ n % but that's going to take a long time because it will evaluate m ^ e and then do mod n. So the clever thing that the program does is to implement Knuth's modexp algorithm which reduces the work factor immensly. Actually GNU dc 1.1 (distributed with GNU bc-1.04) now includes "|" as a modular exponentiation operator, so you can do: "m e n |" and it'll do it directly. This feature was a special, just for perl rsa because Ken Pizzini, author of GNU dc, happens to be one of the major contributors of hacks to shorten the perl program, and so have a vested interest. With the dc 1.1 | operator, Ken got the script down to: $/=$z;exec"dc -e'16i0[lN*lMlKlN|+lMlN/dsM0<J]dsJ\U@{[ pop,pop,unpack'H*',<>]}\EsMsKsNx[II*~aSad0<ZLaP]dsZx'" a considerable improvement over: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` > I dug out a midi interpreter I wrote a number of years ago, > and it is indeed trivial to modify it to read any text as input. > Unfortunately, I wrote that long before the midi file spec was > finalized, and the hardware I wrote it for is also long gone. But > it's probably not much work to get file output working again...and > the thought of a general text-to-midi translator is rather > entertaining -- I could play this entire mail message through it, for > example... It would definitely make better music if some rhythmic > variation was part of the coding, but that would make it a little > harder to make an automatic decoder... I'd find it most cool to hear an audio file of the above. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

4 4

DYS_sys
by John Young 17 Dec '03

17 Dec '03

The New York Observer [NYC weekly], August 28, 1995. "Off The Grid: Non-Slaves of New York. 'Sovereign citizenship' isn't just for the power line-tapping, compound-dwelling white supremacists anymore. A guide to getting The System off your back, New York-style." They do not run around in military fatigues, they are not holed up in Central Park, and for the most part, they do not fall into the fringes of the extreme right or the extreme left. Yet here they are, in the center of the Center, going about their daily lives with nary an A.T.M. or credit card in their name, without a Social Security or voter registration card, without insurance or bank accounts and driving with licenses they themselves have rescinded. And one more thing: They do not pay any income taxes. What was made clear by Oklahoma City and Waco and Ruby Ridge, Idaho, and by Ross Perot and the Unabomber and most recently, Bill Bradley, is that dissatisfaction with "the system" is pervasive in this country. Living off the grid is the most personal way of expressing that discontent. But, says Sharon Biggs, who teaches a three-phase, 40 week course out of her Washington Heights home on how to successfully remove oneself from the system, "the complexion is no longer that of the wronged individual or visionary. It has moved into the mainstream -- people who suspect that there is something wrong." DYS_sys (17kb)

1 0

Let Me Repeat, the Raids Must Be Stopped! A PROFOUND THREAT TO FREEDOM OF SPEECH ON THE INTERNET
by syrinx＠c2.org 17 Dec '03

17 Dec '03

PLEASE FORWARD TO ORGANIZATIONS AND INDIVIDUALS SUPPORTING FREEDOM OF SPEECH ON THE INTERNET AND TO CIVIL LIBERTIES GROUPS. As many of you may know, the Church of Scientology (CoS), represented by the Religious Technology Center (RTC), whose primary function is to defend their copyrights and trade secrets, performed their third raid/seizure today against an Internet user for alleged copyright infringement. The prior two were against Arnie Lerma last week, and Dennis Erlich back in February. This raid was against FactNet, an organization dedicated to public awareness of various groups it labels as 'cults', including the Church of Scientology, and one of its leaders, Larry Wollersheim. [It is interesting to note that CoS owes $4 million to Larry Wollersheim based on an award by the courts, and affirmed by the Supreme Court. CoS has refused for whatever reason to pay this judgement, and did very questionable moving of assets out of California to avoid paying. Wollersheim has currently deposed the leader of CoS, David Miscavige, to ask him in court what happened to the assets of the California branch of CoS. Mr. Miscavige went into hiding over a year ago and so has not yet been served with this subpoena.] This raid and seizure is technically allowed under current U.S. civil copyright law when certain conditions are met. Congress originally allowed such raids to deal with copyright infringement involving bootleg material, where seizing the equipment used to produce the bootleg materials would effectively halt production until a court could assess the claims of the copyright holder. I am not sure if the Constitutionality of this law has been ruled upon, but in my opinion it oversteps the bounds of the intent of the U.S. Constitution regarding the bounds of search and seizure. Congress passed this law allowing seizure (in 1976) well before the advent of computer networks. The rationale that CoS used in convincing a judge to issue a Writ of Seizure is that seizing the computer equipment will halt the continued duplication of the copyright material, allegedly in violation of the rights of the copyright owner. This rationale does not hold any water when considering the Internet. Once the material is electronically disseminated on the Internet, seizing the computer equipment used to disseminate the material, as well as copies of the material itself, serves no useful purpose to stop the continued dissemination of the material. For example, the perpetrator of the alleged copyright infringement could, if they want to, simply purchase/rent/use a computer with Internet access, copy the material from another site on the Internet (which observation shows exists all around the world regarding the CoS materials), and redisseminate it as before. The only effective remedy is a Temporary Restraining Order (TRO) and a lawsuit against the individual ALLEGED to have infringed on the copyrighted material in excess of Fair Use. Thus, these three raids by CoS were clearly unnecessary. Furthermore, regarding civil liberties, they are even more troubling. In all three raids, the entire computer, related equipment and tapes were seized by CoS for their erasure of the alleged copyright materials, but without ANY court oversight which would filter out data which has no relevance to the matter at hand and which is protected by the right to privacy and other protections. There may also be further protection under the Electronic Privacy Act (or whatever it is called). A lot of private data from many people, not related to the alleged copyright infringements, may have been compromised. Furthermore, these raids serve to stifle Free Speech on the Internet. In essence, CoS is saying to the Internet community: "If WE feel you are disseminating our copyrighted materials in excess of Fair Use (and we will define what Fair Use is), then we will get a Writ of Seizure allowed under U.S. copyright law and take away your computer BEFORE the court decides on whether you exceeded Fair Use." And if much later the court determines that the dissemination was done under Fair Use, then there is no "effective" and "practical" remedy other than filing a laborious and expensive countersuit, which could drag on for years, to the detriment of the individual originally accused of copyright infringement. CoS knows this, and thus they really don't fear the consequences if they overstep their bounds in this matter. And who wants CoS to plaster the Internet and the newsmedia with their propaganda stating that "Federal Marshalls Seized the Computer of John Doe"? We all know that the general public may see John Doe as some criminal of the first order because Federal Marshalls were called in to handle the matter. This also serves to stifle Free Speech. Thus, we must call upon Congress and the courts to fix this "loophole" allowing these unnecessary and, in my opinion, unconstitutional raids/seizures of computer equipment for alleged *civil* copyright infringement in excess of Fair Use. This "loophole" is a clear threat to Freedom of Speech. I call upon electronic freedom activist organizations, such as EFF, and more traditional civil liberties organizations, such as the ACLU, to do something to stop these raids. I think asking a Federal judge to put a *temporary* halt on all such raids pending Federal court review on necessity and constitutional grounds. In addition, we should call on Congress to amend the copyright laws to take into the special aspect of computer networks so as to not allow the trampling of civil liberties that we've seen with the barbaric CoS raids. If you agree with me, do forward this to your Congressperson, to anybody you know involved in civil liberties issues, religious leaders, etc. Become aware and concerned. If you live in the U.S., you could be the next person raided just for exercising your right to Free Speech. Thank you for listening. Jon Noring **************************************************************************** For more information on the Scientology versus Internet "war", check out both alt.religion.scientology on Usenet, and the following Web site, which has links to nearly all Web pages devoted to the Scientology issue: http://www.cybercom.net/~rnewman/scientology/home.html **************************************************************************** -- OmniMedia | The Electronic Bookstore. Come in and browse! Two 9671 S. 1600 West St. | locations: ftp.netcom.com /pub/Om/OmniMedia/books South Jordan, UT 84095 | and ftp.awa.com /pub/softlock/pc/products/OmniMedia 801-253-4037 | E-book publishing service follows NWU recommendations.

3 2

Letter to AOL on "proposed censorship summit with radical right" (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 1 Aug 1997 07:16:14 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Letter to AOL on "proposed censorship summit with radical right" ---------- Forwarded message ---------- Date: Fri, 1 Aug 1997 10:09:12 -0400 (EDT) From: WildcatPrs(a)aol.com To: declanmccullagh <declan(a)well.com> Subject: Fwd: Your Proposed Censorship Summit with Radical Right Leaders --------------------- Forwarded message: Subj: Your Proposed Censorship Summit with Radical Right Leaders Date: 97-07-31 11:43:06 EDT From: WildcatPrs To: Steve Case Dear Steve Case, As one of the plaintiffs in the ACLU/ALA case on the CDA, who saw it through all the way to the Supreme Court, I am shocked and dismayed that you would dignify the demands of the Christian Coalition et al by sitting down with them in such a summit. You know and I know that America Online will leave that negotiating table having made major concessions on the subject of Internet censorship -- not only for content on gay and lesbian and AIDS, but also women's issues and many other subjects. The religious right have a very long list of subjects that they would like to censor out of U.S. libraries, schools and media...which you will discover if you take the trouble to read BANNED BOOKS, published each year by the ALA. Get a clue, Mr. Case This battle over "content" is not really about "child pornography." It is a thinly veiled disguise for the radical right's efforts to impose its total belief and its proposed penal system on the people of the United States. It wants to have the United States be like the Colony of Massachusetts before the Revolution. I suggest you read some history, and ponder whether you would have liked living under the religious dictatorship that ran the colony. Between 1962 and 1972, I lived in Spain as a working journalist for the Reader's Digest, working out of its office in Madrid, and I saw in operation just the kind of right-wing censorship system that the Christian Coalition et al would like to impose on this country. Part of its success involved just the kind of "self-censorship" that you are now proposing to slap on your own company. You are no different than the Spanish book publishers who sat down with the Catholic Church and agreed on what could be published. As a result, Spanish culture languished. The Spanish people reached the point where they had lots of jokes about self-censorship and didn't take their own media or culture seriously. It all came to an end in 1975, when Franco died, and the Spanish people were so sick of church and censors that the new government moved to end the hegemony of the Spanish Catholic Church and put an end to censorship. So shame on you for moving to introduce this kind of censorship to the United States of America. I have been a loyal customer of AOL since I got onto the Internet two years ago, and I will take my business elsewhere if you go through with this summit. Sincerely, Patricia Nell Warren Wildcat Press 8306 Wilshire Blvd. Box 8306 Beverly Hills, CA 90211 213/966-2466 213/966-2467 fax

1 0

Re: The sorry state of non-US crypto
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

There are also some links on http://iaks-www.ira.uka.de/subjects/crypto.html to ftp-servers with cryptographic stuff outside USA/Canada. The page contains several crypto-related links and is written in german language, but the ftp links at the end of the page are language-independent. Hadmut

1 0

Re: Attila T. Spammer / Re: Denning questions/reverses her position? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: Attila T. Spammer / Re: Denning questions/reverses her position? > From: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) > Date: Fri, 01 Aug 97 09:18:19 EDT > I'm pretty sure she still supports the right of a corporation to > tell the users of corporate systems not to have anything on those > systems that the corporation can't decrypt. And why wouldn't you? Let's look at this a moment. 1. Business, irrespective of size, is not equivalent to the government and specificaly isn't mentioned in the Constitution at all so we are reasonably safe they are exempt from federal compliance with its requirements outside that detailed for citizens and regarding inter-state or international trade. 2. The relationship between employer and employee is one based on a contract. 3. Neither party is forced beyond their own needs and desires to sign the contract. 4. Each party is aware of the contents of the contract before they sign it, or at least is given the opportunity to be made aware. If somebody wants to sign a contract with no knowledge of its contents, so be it. 5. Who owns the computers? The business does clearly. Now a commen proviso on ownership is that the final decision, or the transfer of that decision, is up to the business. Just as it is ultimately up to you who gets to drive your car. 6. Most provisions of employment contain the proviso that the time you agree to work for that employer is to be spent on dealing with the employers needs and not the employees. This is after all at least one of the reasons behind using time off and floating holidays and such. 7. Provided the employee is aware of this policy at the time of signing OR is given a reasonable warning period before a shift of policy after hiring then the employee has no grounds to complain. Myself, I always ask my immediate supervisor for a description of company policy on this. I also always ask if they have an objection to me using the company system to log into my home system during lunch and other 'off-clock' hours. So far I have never been refused. Short answer to this, use your own resources for your own use and don't use other peoples resources to carry on your own activities unless you offer them a cut of the profit. Ultimately this isn't even a question of contracts but of simple plain ol' every-day manners. ____________________________________________________________________ | | | Participation requires more than just bitching! | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: True Names and Webs of Trust
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

BW> Be that as it may, I still think that Zimmermann assumed that BW> key<->real-life-identity mappings would be the primary purpose for the Web BW> of Trust when he wrote "pgpdoc1.txt". And I think he was wrong about that. BW> It is not "arrogant" or "offensive" to say that someone was wrong when you BW> believe that to be the case. Actually, this is what qualifies as a "wicked problem". Until pgp 1.0 came along, there was no way to know how people would =actually= use a public-key system. (Sure, there were lots of theories, and a few academic experiments, but those don't count as RL.) Phil tried to anticipate the kinds of errors that would be made by people unaccustomed to thinking in terms of attacks and threat models. Face it, the average.net.person is not into game theory. Phil was under severe time pressure to get a workable public key system out the door before the government slammed it shut in his face. Now that we have had an opportunity to observe people using the system, we can identify nuances that could never have been debugged on the test bench. We can explain to people the various paradigms for viewing keys, and the importance of being able to trust the "identity" of an anon.id, which seems oxymoronic on the face of it. Some kind of explanation by analogy seems in order: We all know of movie stars who changed their names for Show Biz, or authors who wrote under pseudonyms. Take Mark Twain for example. A person who had read a Twain book, or had friends (his own WOT) tell him how good/bad Twain books were, would develop his opinion of the man's work. His ultimate decision to (not) buy a particular Twain book has nothing to do with the True Name of Mr. Clemens. Where it =does= come into play is in the realm of law. Had Twain libelled a person, the means to identify the Man behind the Mask would be integral to executing the judgement of the court. And even then, if there were sufficient continuing royalties that could be attatched to satisfy the judgement, it would only be necessary to know the True Name of the publisher. So we must be very careful of what it is that we are certifying when we sign something. This is what needs to be addressed in future versions of PGP. * Free the Wisner Five! * Free the Wisner Five! * Free the Wisner Five! --- * Monster(a)FAmend.Com *

1 0

Spooks and Hackers, etc.
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Subject: Internet Police According to an AP story, Wisconsin Attorney General James Doyle says that police must monitor the Internet to stop child porn, drug trafficking, and fraud. "We need to see that police are surfing the Internet just as other people are," Doyle said. "This is a good example of where the law is slower than technology." Doyle made his comments in a speech to the Wisconsin Chiefs of Police Association Conference.

3 2

One effort for Internet Privacy
by Chris Avery 17 Dec '03

17 Dec '03

On a lark, I dashed off a "letter to the editor" of the San Francisco Chronicle, quoted below, lo and behold it got published today. You will see I simplified and softened the message somewhat -- a little spin for the good guys never hurt: (published as lead letter, nice headline) "HOW FAR SHALL WE LET THE EAVESDROPPERS GO?" Editor -- Washington wants the right to "wire-tap" private communications on the Internet, and the issue is now being debated in Congress. I'm not raising the "content" issue, which can be handled by screening software or by ratings; this is instead the issue of privacy in person-to-person communications. The rationale for the bills before Congress is law enforcement, giving officials new methods to detect criminal activity. All well and good, but is it really wise to grant the bureaucracy access into this vital channel of personal communications before we fully understand its potentials? How far shall we let the eavesdroppers go? Beware, these aren't casual issues --- your rights are in danger. CHRIS AVERY Oakland

1 0

The End of the Ecash Trial?
by Nathan Loofbourrow 17 Dec '03

17 Dec '03

I have yet to see a date, but Digicash states several times in their press releases that Cyberbucks are only a trial currency, and that at some point in the future the trial will come to an end. Will the bottom drop out of the c$ market at that point? Without Digicash to authenticate currency, it would appear to be impossible to trade c$ coins. If and when Digicash announces an end date for the trial, I would expect to see quite a spectacular crash in the "real cash for ecash" market. The only way to preserve the market would appear to be providing an ecash-for-ecash exchange with a new bank, presumably a licensee of the Digicash software. Such a bank could, out of little more than good will and a desire to kick-start a new e-currency, offer to exchange c$ for the new ecash. Or, perhaps we just shrug our shoulders, kiss our hardly-earned Cyberbuck goodbye, and mumble about how it was fun while it lasted. Either way, in order to preserve the new e-currency's value -- and correct my economics where flawed -- we need the assurance that the money supply will not experience unreasonable growth. The ecash trial has Digicash's promise of a c$1M cap; is this trust sufficient leverage for the user to leave any amount of value in the Cyberbuck, or its successor? nathan

3 3