December 2003 - cypherpunks-legacy

Crypto use to foil law enforcement?
by Greg Broiles 17 Dec '03

17 Dec '03

I ran across this entry in the Congressional Record which discusses several examples where encryption was discovered in the course of a law enforcement investigation. [Congressional Record: September 18, 1996 (Senate)][Page S10882-S10886] [...] Mr. GRASSLEY. Mr. President, I'm pleased that the Senate has passed the eonomic espionage bill. This is an important measure that I believe will save American business significant amounts of money. The theft of confidential information from American businesses is a serious problem, and this bill takes important steps in the right direction. I am particularly pleased that the Senate has accepted the amendment I offered with Senator Kyl. This amendment commissions the first-ever study on the criminal misuse of encryption technologies. Under the Grassley-Kyl amendment, court officers who prepare pre-sentencing reports will include information on the use of encryption to conceal criminal conduct, obstruct investigations, and commit crimes. The sentencing commission will then collect and collate this information and include it in its annual report to congress. In this way, I am hopeful that Congress and executive branch will have reliable data on whether the criminal misuse of encryption is actually a problem and, if so, what response to this problem would be appropriate. As chairman of the Oversight Subcommittee on the Judiciary Committee, I did an informal survey of state-level law enforcement concerning the criminal misuse of encryption. This informal survey, while not scientific, provides valuable insights into the actions of the criminal element in our society. Here are just some of the responses my subcommittee received. In one case involving John Lucich of the New Jersey attorney general's office was involved, a computer was seized pursuant to a warrant in a serious assault case. Examination revealed that approximately 20 percent of the hard drive files were encrypted. Investigators sought the assistance of two different Federal agencies. Both of these agencies were unsuccessful in decrypting the files. Finally, a third Federal agency was successful in decrypting the files after expending considerable resources. The Decrypted files did not contain evidence of the assault but rather contained evidence of child pornography. The encryption type likely used was ``DES.'' And Officer Tim O'Neill of the Roseville, California Police Department reported to the subcommittee that he participated in a search involving a complaint against a subject who was on probation for solicitation/annoyance of minors. The subject had a hidden encrypted file on his personal computer. In the ``slack'' area at the end of the file the officer found names, addresses, school, grade, and phone numbers of 4-5 young teen girls. The encryption type used was known as ``pincrypt.'' Officer Mike Menz of the same department advised the subcommittee that he was working on a joint State/Federal major check fraud case where part of the potential evidence was encrypted. Ivan Ortman, a senior prosecutor in Seattle, Washington, encountered some encrypted files and password protection in a cellular phone fraud investigation. For a number of files the popular and inexpensive ``PGP'' type of encryption was used. Orton indicated that no effort was even made to examine the files as the police could not locate any method for ``cracking that encryption.'' In other words, why try since such an effort is certain to be futile. Surely a rational society should look long and hard at this situation. Agent Chuck Davis of the Colorado Bureau of Investigation reported to the subcommittee that he has encountered encryption as well as password protection problems. In one embezzlement case, a computer system has seized. Examination revealed that files on the hard disk were encrypted. The software manufacturers were contacted and the technical personnel who wrote the program advised that, ``they had left no `back door' access to the product as this would adversely impact sales. The hallmark of the program's appeal is that it cannot be broken, even by those who created it.'' Agent Davis advised that his investigation was ``halted'' due to the time and expense of a ``brute force attack''. The encryption program used was entitled ``watchdog.'' Agent Davis also advised the subcommittee that password protection also presents problems for other types of investigators. In cases involving theft of drugs from an emergency room by a doctor, bribery/ extortion by a police officer, and the suicide by an 11 year-old boy after telling friends that he had been molested by a family friend, investigators encountered password protection. The first two cases were successfully resolved through assistance from the manufacturer of the software. The third case, however, especially illustrates the seriousness of decryption problems--determining the unique key or in this case, password from a large number of possibilities. According to Agent Davis, a mere 4 character password has 1.9 million possibilities due to the number of keyboard characters. Can you imagine how difficult it must be to figure a short, 4 character password. What if the password were 10 characters or 20 or more? It's easy to see why criminals are moving toward password protection for their records. -- Greg Broiles gbroiles(a)c2.net 510-986-8779 voice 510-986-8777 fax

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 19 May 97 6:49:06 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net ******+*++#* 4:09 99.98% squirrel mix(a)squirrel.owl.de ++-+++-+--- 2:11:39 99.87% weasel config(a)weasel.owl.de ++-+-+-+--- 2:13:33 99.86% winsock winsock(a)rigel.cyberpass.net ---.-+.---- 5:30:41 99.83% jam remailer(a)cypherpunks.ca ******** *+* 13:32 99.63% lucifer lucifer(a)dhp.com +++.- ++*+++ 1:14:45 99.62% cyber alias(a)alias.cyberpass.net * *+**+**** 14:21 99.49% balls remailer(a)huge.cajones.com #####*## #++ 5:06 99.06% mix mixmaster(a)remail.obscura.com __ __ .--*-* 34:59:29 98.54% replay remailer(a)replay.com ** **.-+ 2:26:52 98.42% reno middleman(a)cyberpass.net +-.-+-+ -+ 2:17:53 95.56% hidden remailer(a)hidden.net ##..-####* 2:30:26 93.35% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Need some info...
by Wasim Q. Malik 17 Dec '03

17 Dec '03

Hi. I'm gonna give a talk on the subject of hacking/security soon. Need your help with it. Things that I'm gonna include are: what is hacking, ethics of hacking, psychlogy of hacking, other abstracts. Some technical stuff, such as hacking tools and tactics, including IP spoofing, packet sniffing, cracker programs, keyloggers, progs like satan, etc. Can you suggest some additional stuff to be included, or if you have any resources (URLs, articles, progs, HOW-TOs, graphics, anything!), related to any of the above topics, technical or whatever, please please do send it over. Your suggestions will be a great help, as well as any info. Thanks. Wasim Q. Malik Network Security Expert SDNP Pakistan

2 2

Re: PGP 5.0 beta is out at PGP.com
by geeman 17 Dec '03

17 Dec '03

and if they encrypted or eliminated the feature that logs all my pgp-encrypted traffic. At 11:39 AM 5/17/97 -0700, Alan Olsen wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >The pgp 5.0 beta is out. It is for Win95/NT 4.0 only. PGPKeys.exe pukes its >guts out when run. (At least on my machine.) > >It looks like they have hired a new graphics artist. The splash page looks >interesting. Nice if the rest would run... > >-----BEGIN PGP SIGNATURE----- >Version: 5.0 beta >Charset: noconv > >iQEUAwUBM337SeQCP3v30CeZAQHrIwf3bwkNKXwDPb5R2qLMneIIWBTfYvwAGCQ6 >8xqd0BHSsD+7ZzF4u9iVZWV9sHN/62LxAo886FfDP7PtKG+JZrZCa+KOUj2Zw3qk >1wltug8/rylAoLHulXwFVfwWb001jMIsS5RYNqDLqyccVF2TWUbVKQEgH7EI9VJ3 >EU8gZzHF61ok+bqacmV/r7ANoIdfFRvLZHm0iGo6Xm4xHz8lw2JzDWWvnhWnEquD >mf3XUaNRVYnI4/+kgs8fx5golMY3pPQrl6PR0XdvvLJITUhiqM3SVTDs9IL4hWAx >V7WWGPHaJZw6nVAl5LNbLK9puGFw0FMap1a6Ld+HnmRlxlgpr8B/ >=gdHU >-----END PGP SIGNATURE----- > >--- >| "Bill Clinton - Bringing back the sixties one Nixon at a time." | >|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | >| mankind free in one-key-steganography-privacy!" | Ignore the man | >|`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| >| http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com| > > >

2 1

Re: Mail bombs from "helpful" Cypherpunks
by Robert Hettinga 17 Dec '03

17 Dec '03

At 11:26 pm -0400 on 5/18/97, Tim May wrote: > I have no way of > removing such "mail bombs" with my Eudora/POP system until they have been > downloaded to my machine My version of Eudora, and, I think, the freeware version also, has a little check box in the "Checking Mail" settings dialog which lets you leave messages over a certain size on the server, where you can delete them without having to download them. Since I'm on about 100 mail lists at last count, including, of course, the SET-dev list, where such godawful cluelessness (including, BTW, the use of multimegabyte .pdf, Microsoft Word <including macro viruses, of course>, and ASN1 files :-)) is commonplace, I have found this little checkbox a godsend. I have mine set at 100k. It works for me. Of course, Tim doesn't get to read this message, or any other, for that matter, to do him any good this time around... If we lived here, we'd be home now. Self reference is a dish best tasted cold, I suppose. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: CFV: moderate sci.cryonics -- CENSORING antispammers
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

Jay Denebeim (denebeim(a)deepthot.cary.nc.us) wrote * Igor Chudov @ home <ichudov(a)algebra.com> wrote: * * > Charles, sci.cryonics may well be in need of moderation. The * > proponent may also be a great person. I also have deep respect for * > you personally. But the provision in the charter that does not * > allow postings without a replyable sender address is rather * > unfortunate. I would certainly vote yes if that particular provision * > was removed. Otherwise, I find it unacceptable for myself to vote * > YES. * * Why is that Igor? There's been very little, if any, spam generated to * rastb5m users, and that provision has been in place since before * anti-spam forgeries were in vogue. If spammers arn't mining a TV * group, they certainly wouldn't be mining a sci group. I see your point, Jay. What you are suggesting, probably not without reason, is that the spam volume is not expected to be huge. I may agree to that. The problem with this argument is that 1) No matter how much spam they get, posters have a legitimate reason to protect themselves 2) Typically, altering the reply address is done before the newsreader is even started, changing it for only one censorous newsgroup is a royal pain in the back 3) People should have freedom to post anonymously, especially on such sensitive topic as cryonics 4) Anonymity is NOT a threat to moderated newsgroups Considering all that, I do not consider the proposed charter to be acceptable. (see http://xp5.dejanews.com/getdoc.xp?recnum=5944883&server=db97p2x&CONTEXT=864…

1 0

For whom the Bell tolls...
by Alan 17 Dec '03

17 Dec '03

The article on Bell was printed in this morning's Oregonian. Hoo Boy! They are accusing him of all sorts of nasty shit! "Planning to poison the Bull Run watershed with Botulism." "Planning to use a carbon thread attack on the 911 system." And more. If John Young has not printed the article by the time I get home from work, I will type the whole thing in. They are REALLY playing rough this time!

1 0

Re: Distributing cryptographic code
by Bill Stewart 17 Dec '03

17 Dec '03

>> We would like to put this code up for distribution (within the US >> of course), but don't actually know what is a 'reasonable' amount of >> protection that one need apply to prevent people from exporting >> it to the rest of the world. The current MIT PGP software distribution has apparently had some discussion with the Feds. MPJ>The technical solution that I have come up with is (1) have a web form MPJ> that asks 3 questions*, with the questions defaulting to "no" The questions that get asked can be phrased in a lot of different ways; as an anarchist I think that pgp.com's is a lot more friendly than some. A few places go to the extremes of "Are you a Subject of the US Gov't? Do you agree to be bound by every provision of the US Export laws, written or unwritten, and not even CONSIDER giving this code to anyone who might be a Furriner? Sign in blood here!", while others are more like "Have you heard that the US export laws say <blah blah blah>? Do you state that it's ok for you to have the code, and that it's Not Our Fault?" MPJ> If all 3 answers are "yes", and if the email address given is in a MPJ> domain that might be in the USA (.com, .gov, .org, .us, .mil, .net, Of course, .com, .net, and .org are non-nationally-based domains, and even email servers physically located in the US often have users located outside US territory. CompuServe is a prime example, with users all over the world. Some US-only-code-distribution sites try to keep track of which sites are in the US, at least for .net. Since the MIT code distribution site has been allowed to operate in spite of this, the attitude of the Export Cops appears to be a "Yes, we know it's bogus and unenforceable, but we need to at least maintain the pretense that we're enforcing it, so don't ask for too much technical clarification or we'll have to say No." [* Mime-Attachment: x-audio Audio-Parameter-Setting: Don-Hopkins-Imitating-Monty-Python "WHAT is your name? WHAT is your favorite color? HOW FAR can a migrating swallow fly while carrying a coconut?" "Er, is that a European swallow, or an African swallow?" # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Information Hiding Workshop
by Ross Anderson 17 Dec '03

17 Dec '03

Call for Papers WORKSHOP ON INFORMATION HIDING 15 - 17 April 1998 Portland, Oregon Many researchers are interested in hiding information or in stopping other people doing this. Current research themes include copyright marking of igital objects, covert channels in computer systems, subliminal channels in cryptographic protocols, low-probability-of-intercept communications, broadcast encryption schemes, and various kinds of anonymity services ranging from steganography through location security to digital elections. These closely linked areas of study were brought together in 1996 by a workshop on information hiding held at the Isaac Newton Institute in Cambridge. This was felt to be very worthwhile by the research community, and it was decided to hold a second workshop in 1998. This second international workshop on information hiding will be held in Portland, Oregon from the 15th to the 17th April 1998. Instructions for authors: Interested parties are invited to submit papers on research and practice which are related to these areas of interest. Submissions can be made electronically (latex or postscript; preferred format is latex using llncs.sty) or in paper form; in the latter case, send eight copies suitable for blind refereeing (the authors' names should be on a separate cover sheet and there should be no obvious references). Papers should not exceed fifteen pages in length. Addresses for submission: awk(a)mailbox.jf.intel.com David Aucsmith Intel Architecture Labs 5200 N. E. Elam Young Parkway Hillsboro, OR 97124-6497 USA Deadlines: Paper submission: 31st December 1997 Notification of acceptance: 28th February 1998 Camera-ready copy for preproceedings: 31st March 1998 Camera-ready copy for final proceedings: 31st May 1998 Program committee: David Aucsmith (Intel) - chair Ross Anderson (Cambridge University) Steve Low (AT&T Bell Laboratories) Ira Moskowitz (US Naval Research Laboratory) Andreas Pfitzmann (Technical University of Dresden) Jean-Jacques Quisquater (Catholic University of Louvain) Gus Simmons (University of New Mexico) Michael Waidner (IBM, Zuerich) WWW version of cfp at http://www.cl.cam.ac.uk/users/rja14/ihws.html Details of the first (1996) information hiding workshop are at http://www.cl.cam.ac.uk/users/fapp2/steganography/bibliography/workshop.html

1 0

Re: Jim Bell goes to Jail!
by Lucky Green 17 Dec '03

17 Dec '03

At 09:17 AM 5/19/97 -0700, Alan Olsen wrote: >At 12:08 AM 5/19/97 -0700, Lucky Green wrote: > >>There are two reasons I can think of immediately why the feds would keep >>the warrant sealed. The first is that they don't want to reveal just how >>little evidence they have. The second reason is that the warrant might give >>some clue as to future actions/other suspects. Remember that the IRS agent >>found the AP essay by means of an Internet search engine. That almost >>certainly means he is following the discussions about Jim Bell on the Net. >>Such as the discussion on Cypherpunks. > >Actually the agent claimed to have found it among some papers in Jim's car >when the seized it for back taxes. I stand corrected. The essay was found in the car. However, after the essay was found the agent searched the Internet for copies of the essay and posts by Jim Bell discussing it. The agent's original affidavit states the number of AP related post by Jim the fed could find via a search engine. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

3 2