December 2003 - cypherpunks-legacy

Re: "cypherpunks is dead..."
by Timothy C. May 17 Dec '03

17 Dec '03

At 3:37 PM -0500 2/19/97, Robert Hettinga wrote: >We also have to thank Tim May for his um, ideological, presence on this >list from since before it existed, :-), and, or course, for his current >"leadership", both moral and political. (Of course, I can say all the next >few wierd and gushy things about him without fear of refutation on his >part, 'cause, in his wisdom, I'm still in his killfile ;-)) It was Tim who No, Bob, I actually took you out of my filter file (Eudora's killfile) a while back. It is true that I don't like your style, your writing style, that is. Some say I am overly sensitive to style issues...probably so. I find most modern cyber-journalism unreadable, with the hipper-than-thou "street cred" lingo and the obfuscatory purple prose. I find reading the straight-shooting words of even my ideological opponents (or opponents in some areas) far easier than reading the neo-journalistic hype some of my ideological fellow-travellers use. Nothing personal. >was our compass. It was Tim who came down from the mountain and stopped us >from worshiping the fatted calf of censorship, and who is now leading us >into the promised land of unfettered discourse, both on usenet and on the >new cypherpunk server network. Since Tim paper-trained most of us here >(myself included, though some may debate how well he succeeded :-)), that >is, how to behave on this list, and, most important, how to imagine what a >world of strong crytography on ubiquitous networks would look like, I now >find his "leading" us out onto the net, and away from Sinai, most >symmetrical indeed. :-). Well, I guess I have to say "Indeed." (Though I don't claim to be leading anyone, especially not off the list. After several weeks of saying nothing, I outlined my reasons for disliking the censorship move...reasons that had also been made by many other folks. Anyway, Adam Back's summary of events is pretty close to the mark.) The vision of where the world is headed, noted by Bob, has been clear to many of us for many years. When I first read about public key systems, circa 1977, I got an inkling. When I read Chaum's paper on untraceable digital cash, circa 1986, things got clearer. And when I evaluated the business plan of Phil Salin for his company, American Information Exchange, in 1987, everything fell into place. My role with him was to suggest how cryptographic protocols, including digital cash, would open up information markets. His company eventually got some funding, but failed. This company was several years too early, as it presaged many aspects of the Web (and, not coincidentally, its "sister company" was Xanadu, which even more clearly presaged the Web--indeed, Ted Nelson was the godfather of the Web. Anyway, by mid-1988, I wrote and distributed "the Crypto Anarchist Manifesto," which, to my surprise and satisfaction, basically anticipated all of the things now being done on Cypherpunks and elsewhere (anonymous remailers, message pools, steganography, BlackNet types of markets, ubiquitous crypto, etc.). The missing piece, digital cash, is a hard nut to crack...sure, it exists (Mark Twain Bank, DigiCash, etc.), but it's hard to get robust versions deployed and used. (Getting PGP integrated into mailers is stil bogged down, for reasons I have to believe have to do with pressures from somewhere, else why would e-mail packages not make PGP support painless?) I agree with Bob and others that the Cypherpunks are in no danger of dying out. Things are just about to get a lot more interesting. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

security breached by NaughtyRobot
by eiwasaki＠gol.com 17 Dec '03

17 Dec '03

HELP! Can anyone tell me what this message is that I received in my mail today? Is it real? Should I do as it suggests? I have used the Internet once to purchase some books? Was my credit card number stolen in the process? How did this happen and how will it affect me? What should I do? PLEASE ADVISE ASAP! Thank you for your help Ellen Iwasaki Kumamoto, Japan > From: eiwasaki(a)gol.com > Date: Wed, 19 Feb 97 02:27 CST > Apparently-From: eiwasaki(a)gol.com > Apparently-To: eiwasaki(a)gol.com > Reply-to: eiwasaki(a)gol.com > Registered-mail-reply-requested-by: eiwasaki(a)gol.com > Sensitivity: PERSONAL-CONFIDENTIAL > Precedence: EMERGENCY > Priority: URGENT > Comment: Authenticated sender is <eiwasaki(a)gol.com> > Organization: NaughtyRobot > Subject: security breached by NaughtyRobot > > This message was sent to you by NaughtyRobot, an Internet spider that > crawls into your server through a tiny hole in the World Wide Web. > > NaughtyRobot exploits a security bug in HTTP and has visited your host > system to collect personal, private, and sensitive information. > > It has captured your Email and physical addresses, as well as your phone > and credit card numbers. To protect yourself against the misuse of this > information, do the following: > > 1. alert your server SysOp, > 2. contact your local police, > 3. disconnect your telephone, and > 4. report your credit cards as lost. > > Act at once. Remember: only YOU can prevent DATA fires. > > This has been a public service announcement from the makers of > NaughtyRobot -- CarJacking its way onto the Information SuperHighway. >

2 1

FIPS 196
by John Young 17 Dec '03

17 Dec '03

NIST announced in the Federal Register today "that the Secretary of Commerce has approved a new standard, which will be published as FIPS Publication 196, Entity Authentication Using Public Key Cryptography." http://jya.com/fips196.txt (12K)

1 0

security breached by NaughtyRobot
by Ellen Iwasaki 17 Dec '03

17 Dec '03

HELP! Can anyone tell me what this message is that I received in my mail today? Is it real? Should I do as it suggests? I have used the Internet once to purchase some books? Was my credit card number stolen in the process? How did this happen and how will it affect me? What should I do? PLEASE ADVISE ASAP! Thank you for your help Ellen Iwasaki Kumamoto, Japan > From: eiwasaki(a)gol.com > Date: Wed, 19 Feb 97 02:27 CST > Apparently-From: eiwasaki(a)gol.com > Apparently-To: eiwasaki(a)gol.com > Reply-to: eiwasaki(a)gol.com > Registered-mail-reply-requested-by: eiwasaki(a)gol.com > Sensitivity: PERSONAL-CONFIDENTIAL > Precedence: EMERGENCY > Priority: URGENT > Comment: Authenticated sender is <eiwasaki(a)gol.com> > Organization: NaughtyRobot > Subject: security breached by NaughtyRobot > > This message was sent to you by NaughtyRobot, an Internet spider that > crawls into your server through a tiny hole in the World Wide Web. > > NaughtyRobot exploits a security bug in HTTP and has visited your host > system to collect personal, private, and sensitive information. > > It has captured your Email and physical addresses, as well as your phone > and credit card numbers. To protect yourself against the misuse of this > information, do the following: > > 1. alert your server SysOp, > 2. contact your local police, > 3. disconnect your telephone, and > 4. report your credit cards as lost. > > Act at once. Remember: only YOU can prevent DATA fires. > > This has been a public service announcement from the makers of > NaughtyRobot -- CarJacking its way onto the Information SuperHighway. >

1 0

Re: "cypherpunks is dead..."
by Hayashi_Tsuyoshi 17 Dec '03

17 Dec '03

Dear Mr. Robert Hettinga, This is Tsuyoshi Hayashi, one of subscribers of the cypherpunks list, lives in Yokohama, Japan. I heard today's your voice on the cypherpunks list. I am little sad. I am almost ROM, read-only member... Although I have been hear for two and a half (wow..) years, I posted only three (or four...) messages. I am a bad boy. Sorry. > all Instead of it, I have gotten many many cripto-concerned info (such as PGP) which are worth reading (though they are very difficult for me, both technical and language ;-). Today I know about cryptography a little. I am working nearby the cryptographic field in Japan. So I DO want to say THANKS to all subscribers of the list and the owner-cypherpunks(a)toad.com, and the host machine named toad.com [140.174.2.1]. On Wed, 19 Feb 1997 15:37:08 -0500, Robert Hettinga said: >Anyway, I've learned all these things from many cypherpunks, some still Yes, me too! >Because of this list's effect on my life, I have been motivated to start >the Digital Commerce Society of Boston, to evangelize financial [..] I found your DCSB list out about a month ago. This list is also interesting for me. Thanks. >Next week, I go to FC97 in Anguilla because of the things I've learned on [..] I did want to go to FC97, but there is a long distance between Anguilla and Japan... I hope you will post the summary and/or topics of FC97 to the DCSB. :-) >[..] cypherpunks is not going to >die just because the address "cypherpunks(a)toad.com" ceases to exist. There Yah! >So. In a very real sense, today on cypherpunks is like any other day in the >life of a creosote bush. It's a big desert, folks. We're the only ones who # Sorry. Although there are both "creosote" and "bush" in # my English-Japanese dictionary, I could not understand # the meaning of "creosote bush". Please teach me it in # other easy words if you have a time. In English is OK. # In Japanese is the best. ;-) ==== Mr. Bob Hettinga and all, doumo arigatou gozaimashita! # And sorry for my poor English. In a "Roman Holiday", Audrey Hepburn said, "By all means, Roman..." Today I say, "By all means, Cypherpunks..." Best, - Tsuyoshi Hayashi <take(a)barrier-free.co.jp> - PGP public key: http://www.barrier-free.co.jp/take/pgpkey - (CF 27 34 5B 46 FA 2A 12 D2 4C E3 F7 2A 45 E0 22) - Barrier Free, Inc. (established on 25 Jan 1996)

1 0

Re: E-Gold: It had to happen
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Ian Grigg <iang(a)systemics.com> MIME-Version: 1.0 Precedence: Bulk Date: Thu, 20 Feb 1997 10:53:31 +0100 From: Ian Grigg <iang(a)systemics.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: E-Gold: It had to happen some dead guy called gold dot wrote: > Yo, c-punks: Yo, dude > In the back of the March 97 issue of Liberty Magazine is an ad > for a gold backed e-money system called e-gold(tm). It appears > to be an on-line transaction system for paying other e-gold > account holders in e-money backed with gold or other precious > metals. Nice one, perhaps you could scan in the ad, seeing as my issue doesn't arrive until ... March. Your system "appears to be" an accounting system stuck on top of SSL. But I guess we don't get to find out, for sure, unless we commit lots of bucks... > See http://www.e-gold.com/ for more info. Yeah, nice pages, lots of homework done here folks, but you forgot to mention: who are you? where are you? when are you? will you be? -- iang iang(a)systemics.com ---------- The e$ lists are brought to you by: Intertrader Ltd - Commerce Solutions in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! See <http://www.shipwright.com/rah.html> Or, for e$/e$pam sponsorship, see <http://www.shipwright.com/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: European crypto export policy
by Asgaard 17 Dec '03

17 Dec '03

Ulf Moeller wrote: > I wonder if someone whose Swedish is better than mine could summarize > the article? It is at http://www.et.se/datateknik/arkiv/97-02/5.html After signing the Wassenaar Arrangement, Sweden has written it's own ITAR and there is a subdepartment of the UD, it's Foreign Office/State Department, the ISP (Inspection of Strategic Products), that handles export requests, if need be with the help of the FRA, it's NSA. A representative of the ISP says that only a handful of EU member states are completely cleared by the Wassenaar statutes to be at the importing end of strong crypto: England, France, Holland, Sweden and Germany. Most other EU states could fail because it would be to upgrade them concerning their cryptologic resources. An example is given: the coming Swedish ID smartcard (using DES and 512 bit RSA) would theoretically need a OK from the ISP before being carried over the border to Denmark. A crypto exporter (obviously hardware) complains about harassing bureaucrazy even if Germany is the recipient. So much about that short article. In addition to Goran Axelsson, Sweden's representative in the EU's IT security body whom Ulf is mentioning in his post, Swedish crypto-politics is handled by this guy's boss (at least formally) at the UD, Magnus Faxen. And then there is the FRA (Forsvarets Radioanstalt), a body as secretive as the NSA. They don't officially take part in the discussions at all. Asgaard

1 0

Re: Constitution and a Right to Privacy
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: >It's good if you don't read the L.A. Times. One of their lead editor- >ializers (whores), a professor at USC law school named Erwin >Chemerinsky, >writes in relation to this subject "The federal government is an inde- >pendent sovereign that cannot have its powers diminished by a state >government's actions." (exact quote, 2/7/97). Either that's a load of >BS doubletalk, or it's one of the more fascistic commentaries from the >Times, which is usually bad enough. Hey, don't forget to shoot the messenger. Chemerinsky's statement is a concise summary of at least the last 70 years of double jeopardy jurisprudence. The only thing that's unusual about the use of the "dual sovereign" doctrine against the cops who beat King was that it's usually used against ordinary citizens, not cops. Do you suppose it's possible that some of the other evil conspiracies you see lurking behind every bush are also just reflections of your own fears and misunderstanding? -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMwwPvf37pMWUJFlhAQEdtwf+PXP4jgU9kLlJ4VmI0tp5SUu2A7+4SIu1 fUB6nVCnJFroRAh1ds7lDonW8tjQw19/iOYyg0e1O+8cX4VlC0FhPJjD1nGwReWg z9rFjYpZ0J23Q/fGZwCziz4QF1QZwwqVoiQM+eur7cAKVCTHOZI8v7LEwtJZAeiU TUYS5YR7Vn6lkJ1XZQJv6Cjo1ZWQmldSQ4vue4qAk3DyHoaahbqa8Wkjk1CBmdpk jDmk9Uy3ejwZ54CZz1AQrGM4Cvpc9/rMtUHUuQttN7OU/YSUBTWZivD+TJoVQPAJ iFVcVbRiF6dnzpi7dOYt7E/ZXox1NsH0rgJ8JZuU0s3nuwgtW6qimA== =khMb -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: E-Gold: It had to happen
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Ian Grigg <iang(a)systemics.com> MIME-Version: 1.0 Precedence: Bulk Date: Thu, 20 Feb 1997 10:53:31 +0100 From: Ian Grigg <iang(a)systemics.com> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: E-Gold: It had to happen some dead guy called gold dot wrote: > Yo, c-punks: Yo, dude > In the back of the March 97 issue of Liberty Magazine is an ad > for a gold backed e-money system called e-gold(tm). It appears > to be an on-line transaction system for paying other e-gold > account holders in e-money backed with gold or other precious > metals. Nice one, perhaps you could scan in the ad, seeing as my issue doesn't arrive until ... March. Your system "appears to be" an accounting system stuck on top of SSL. But I guess we don't get to find out, for sure, unless we commit lots of bucks... > See http://www.e-gold.com/ for more info. Yeah, nice pages, lots of homework done here folks, but you forgot to mention: who are you? where are you? when are you? will you be? -- iang iang(a)systemics.com ---------- The e$ lists are brought to you by: Intertrader Ltd - Commerce Solutions in the UK Visit <http://www.intertrader.com/> for details ... Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk Like e$? Help pay for it! See <http://www.shipwright.com/rah.html> Or, for e$/e$pam sponsorship, see <http://www.shipwright.com/rah/> Thanks to the e$ e$lves: Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> Commermeister: Anthony Templer <mailto:anthony@atanda.com> Interturge: Rodney Thayer <mailto:rodney@sabletech.com> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: Cryptanalysis
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:21 AM 2/15/97 -0500, you wrote: >Was wondering if anyone could help me with short explainations on the >cryptanalysis of SKIPJACK and DES. If ya hit www.sauge.com/crypt you >might get a better idea of what i'm trying to accomplish. > >Vague explanations are OK. Dont want long drawn out explainations on >the implementation of an attack (source code, proofs, statistical >analysis and the like), just a short explaination of the attack. Cryptanalysis of DES is a 25-year ongoing academic exercise, with lots and lots of results. It's easy to attack it in 2**55 tries, because of symmetry, but that's a very large number :-) Differential cryptanalysis, discovered by Biham and Shamir, shows that the NSA probably did help the design process when working with IBM to turn IBM's 128-bit-key Lucifer system into DES, and certainly didn't weaken it. Linear cryptanalysis, discovered more recently, shaves some more bits off the strength if you have an extremely large amount of known plaintext. Brute-force attacks on DES (just try lots of keys until you win) used to be viewed as almost infeasible, but about 5-6 years ago there were a couple of designs for cracking machines that could do a 1-day crack for $30-50M, and then Wiener's design for a $1M, 3.5-hour cracking machine about 5 years ago. Gate arrays have gotten denser, faster, and cheaper since then, and if you want to crack a _lot_ of keys (e.g. you're the NSA) you can probably afford to burn ASICs to get even denser and faster. The slow part of the attack _had_ been key scheduling, but recent work by Peter Trei and others shows that you can do key scheduling very efficiently for the brute-force keysearch problem by picking keys in Gray Code order (since a one-bit change in key causes a simple change in key-schedule - it's totally useless for normal encryption/ decryption, but it's a big win for brute-force cracks.) There may be a distributed Internet crack using that approach, though DES is still very inefficient on general-purpose computers and works better on bit-twiddliing chips. SKIPJACK is a totally different game - the NSA keeps the algorithm secret, and the only semi-outsiders who've seen it were a group of 5 people including Dorothy Denning and Dave Maher who were allowed to do a study when the NSA were trying to foist Clipper onto us. They concluded that SKIPJACK was reasonably strong (in their interim report), which gave them good propaganda points, and never did the "final report" that was supposed to address the entire Clipper chip (where most of the technical weaknesses were) and the key-handling charade around it. I don't remember if Matt Blaze's spoofing attack on the Clipper chip came before or after their interim report - the checksums were too short so you could impersonate another chip under reasonably wide conditions. According to the data sheets for the Mykotronx Clipper Chip, SKIPJACK is a Feistel-structured cypher with N rounds (I think it was 16 or 32.) 80 bits is enough that if anybody can discover the algorithm, it's too long to brute force today but starts looking pretty vulnerable in 10-20 years, and of course the Feds would have your keys today, so they can wiretap you, without needing legal authorization, and you can probably bribe a Fed faster than you can brute-force the chip. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0