December 2003 - cypherpunks-legacy

Availability of Pini's CryptoCD
by Bill Campbell 17 Dec '03

17 Dec '03

I've been trying to get a copy of the Crypto CD using the ISBN number he used to have listed on his web page. However, every bookstore I've checked with can find no reference to it. Has anyone on the list gotten it via this method? I looked for Pini's web page but it appears to be gone. Anyone know about sources for the CD? Thanks =Bill=

1 0

Availability of Pini's CryptoCD
by Bill Campbell 17 Dec '03

17 Dec '03

I've been trying to get a copy of the Crypto CD using the ISBN number he used to have listed on his web page. However, every bookstore I've checked with can find no reference to it. Has anyone on the list gotten it via this method? I looked for Pini's web page but it appears to be gone. Anyone know about sources for the CD? Thanks =Bill=

1 0

Re: Information Hiding Workshop
by Hal Finney 17 Dec '03

17 Dec '03

> WWW version of cfp at http://www.cl.cam.ac.uk/users/rja14/ihws.html > > Details of the first (1996) information hiding workshop are at > http://www.cl.cam.ac.uk/users/fapp2/steganography/bibliography/workshop.html The second URL above has abstracts from the conference, many of which sound very interesting from a CP point of view. It's kind of strange though that this topic encompasses both steganography and fingerprinting. The first has connotations of freedom, while the second connotes restrictions. What both have in common is embedding information undetectably and/or unremovably. The conference proceedings, "Information Hiding", are currently checked out from the local university library but I will be looking for them. There sounds like a lot of good stuff. Check out the URL for the T. Aura paper below; it has some statistics on actual LSB distributions in digital images, with implications for doing truly undetectable stego. Below are a few of the abstracts, with URL's for more info where available. Hal === Stretching the Limits of Steganography R Anderson, Info Hiding 96 pp 39--48 The author provides a brief overview of the state of the art in steganography, and shows how public key steganography is possible --- at least in the presence of a passive warden. The basic idea is that if the communicating parties can manipulate at least one out of n bits in the cover text, then the warden can not distinguish the parity of successive blocks of n bits from random noise; accordingly these parity bits can be used to hide cipher text in plain sight. Information theoretic limits of general steganography are also discussed, and it is shown that parity techniques can make many systems more efficient. Finally, the differential effectiveness of active and passive wardens is discussed. http://www.cl.cam.ac.uk/ftp/users/rja14/stegan.ps.gz === Computer Based Steganography: How It Works and Why Therefore Any Restrictions on Cryptography Are Nonsense, At Best E Franz, A Jerichow, S Möller, A Pfitzmann, I Stierand, Info Hiding 96 pp 7--21 The authors discuss a system for hiding ciphertext in the low order bits of an ISDN telephone signal, and report measurements of the perceptibility of various covert signal levels as a function of the cover signal and background noise. They also discuss the meaning of perfect and pragmatic security in the stego context. They argue that steganography is easy, and thus restrictions on crypto will simply force criminals to use stego which will make the law enforcement job harder. === Practical Invisibility in Digital Communications T Aura, Info Hiding 96 pp 265--278 The author discusses some of the problems of information hiding, including synchronising with a cover message which is a stream such digital audio. Where the cover message is a block, such as a digital picture, his technique is to use the Luby-Rackoff construction to embed the hidden bits pseudorandomly throughout the picture. A test implementation using SHA as the underlying primitive is reported. http://deadlock.hut.fi/ste/ste_html.html http://www.tcm.hut.fi/Opinnot/Tik-110.501/1995/steganography.html === Establishing Big Brother Using Covert Channels and Other Covert Techniques Y Desmedt, Info Hiding 96 pp 65--71 The author discusses a number of ways in which covert technologies that are initially deployed for relatively mundane purposes, such as copyright protection, can end up being subverted to provide the means of surveillance. This problem could become progressively more serious as more and more everyday objects become endowed with some kind of intelligence and communications capability. === Anonymous Addresses and Confidentiality of Location IW Jackson, Info Hiding 96 pp 115--120 The author describes how anonymous remailers can be used to process personal location information from active badges. The goal is that each user should be able to control who has access to information about his location; the mechanism is that the remailers forward this information to a server that the user trusts to enforce his security policy. The crypto protocols used in this system are described.

1 0

[PROJECT] Virtual c'punks forum
by Michael Wilson 17 Dec '03

17 Dec '03

Tim May recently made some comments that it might be a good idea to avoid having any physical meetings of cypherpunks for the near future, given the Jim Bell circumstance. This ties in with a project that I am currently undertaking, and I thought I would solicit assistance from the cypherpunks at large. Those of you familiar with the mechanisms of the net may be familiar with the concept of MUSHes (a variant of the Multi User Domain or MUD). While email/lists are a wonderful asynchronous communication tool, the value of an interactive medium which provides real-time discussion is a piece of the overall communication spectrum that has been overlooked (mostly). New efforts to move audio or video are interesting, but the net bandwidth needed is extreme at this stage, and frankly 'a word is worth a thousand pictures.' Myself and a friend would like to initiate a MUSH oriented around creating a virtual meeting place for virtual organizations, such as the cypherpunks. Chat systems like IRC don't provide a context, or some of the nifty features you can build into a MUSH. We can provide the coding muscle (although help is always welcome--MUSHcode is a bastard variant similar to C or PASCAL, with some LISPy list processing), but we need a host to provide us with a machine. If you might be interested, drop me a line, I can feed you the MUSH requirements (light--~20M disk space, and light processing, since you're just moving text). A MUSH for a virtual organization will provide benefits: -- an 'avatar' address in the net where people can leave you mail or connect for an interactive discussion; -- a virtual space, like an office, for people who want one; -- meeting rooms, with logging available; -- simulations; -- briefings, so for instance, a newbie to cypherpunks could be told the address and they could log in to receive a canned (but still more interactive) discussion of cypherpunk issues and technology, as well as the option to talk with other c'punks; -- clients for MUSHes are freely available (including window and shell variants), and we could also hack together a secure client; this will also be a good time to work out 'anonymous telnet' systems (MUSHes allow admin to see the host of origin, but not username). We would like to begin this project inside the next few weeks, and we could have something reasonably functional inside of a month after that. Incidentally, this is a project we've been working on for some time, just that the need and utility have suddenly become timely. Michael Wilson 5514706(a)mcimail.com

1 0

Message
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Date: Thu, 15 May 1997 20:03:35 -0600 (MDT) From: Graham-John Bullers <real(a)freenet.edmonton.ab.ca> To: lucifer Anonymous Remailer <lucifer(a)dhp.com> Cc: cypherpunks(a)toad.com Subject: Re: [CRYPTO] Blowfish Sender: owner-cypherpunks(a)toad.com I think Vulis needs each of us to send ten copies of this back to him. On Thu, 15 May 1997, lucifer Anonymous Remailer wrote: > Here, Tim C. May descends into Graham-John Bullers. He should have a cold shower and/or a Turkish coffee. > > ___\ > <o \__o Tim C. May > X\ X> > _/_\____<_\_ > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Graham-John Bullers Modulator of alt.2600.modulated ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ email : real(a)freenet.edmonton.ab.ca : ab756(a)freenet.toronto.on.ca ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.freenet.edmonton.ab.ca/~real/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Sun to sell 3des from Russia
by Adam Shostack 17 Dec '03

17 Dec '03

http://cnnfn.com/digitaljam/9705/19/sun/ Sun will reportedly sell encryption software through a Russian firm May 19, 1997: 6:26 a.m. ET NEW YORK (CNNfn) -- In an attempt to get around U.S. regulations regarding the export of encryption technology, Sun Microsystems Inc. is reportedly planning to sell data security software internationally through a Russian supplier. -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: CFV: moderate sci.cryonics -- CENSORING antispammers
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

Joseph J. Strout (jstrout(a)ucsd.edu) wrote in * In article <Pine.SUN.3.91.970513130935.19729B-100000(a)panix.com>, Charles * Platt <cp(a)panix.com> wrote: * >> >Unacceptable messages include personal attacks, messages posted * >> >without a valid sender address, and any message not pertaining to the * >> >topics above. * > * >I would like to interpret "valid sender address" as meaning an address to * >which replies can be sent, without them bouncing. This would include * >anonymous remailers that allow an (anonymized) reply function. It would * >exclude anonymous remailers that don't allow such a function. * > * >Perhaps we could hear from the person who drafted the CFV to clarify this * >point. Or Keith Lynch could tell us whether he plans to use this * >interpretation. * * Yes, I drafted the CFV, and this is exactly what I meant by "valid sender * address". This is clearly distinguishable from a fake address, which does * not really exist and to which no email can be sent. Requiring a valid * return address applies a small amount of accountability to the poster. * This is the same criterion used, for example, when posting via DejaNews. There is nothing good about this "accountability", and this is precisely what I object to in the CFV. There is no need for "accountability" in the moderated newsgroup. - Igor.

1 0

Remailer messages of variable length
by nobody＠hidden.net 17 Dec '03

17 Dec '03

To complicate traffic analysis Sender can add a padding to his message before encrypting it for some remailer in chain. So that the message is shortened after decryption and stripping of pseudo headers. It can be done with a dummy header lines: ## Padding: fjx6zRURnnK1DV4CdL7gbHpnUiV1KbbRf5HatXiaD+ZPtH0 ... Also, for a length increment a remailer may understand commands like: ## Pad-length: 1K Pad-encrypt-for: remailer(a)replay.com It will then add the 'Padding:' header and re-encrypt the message with the appropriate remailer's public key. The next remailer in chain will see the padding and will try do decrypt the message twice... If stealth crypto is used, a random padding can be simply attached to the end of the message. Also, the remailer by itself can decide to increase a message length to cover some rare big messages. ---

1 0

test
by Jacks-Biz＠usa.net 17 Dec '03

17 Dec '03

test

1 0

RSA v PGP lawsuit
by Greg Broiles 17 Dec '03

17 Dec '03

I drove down to the courthouse in Redwood City today and took a look at the court file for RSA v PGP. The complaint is already online at <http://jya.com/rsavpgp.txt>; there are two exhibits which accompany the complaint in the file, Exhibit A is a 30-page patent license agreement (which I didn't bother to have copied at $.75/page), the second is Exhibit B, a letter from RSA's attorneys to Leonard Mikus of Lemcom Systems dated 4/16/97, which describes the basics of the dispute between RSA and PGP. I copied the letter and have placed it online at <http://www.parrhesia.com/rsapgp.html>. The lawsuit itself is not for monetary damages, but for declaratory and injunctive relief - RSA is asking the court to declare that the license agreement's provision regarding arbitration did not survive the termination of the license; that the royalty, payment, and accounting provisions of the license agreement did survive its termination; and for an injunction ordering PGP to comply with the agreement's terms for paying royalties and accounting for sales. What I find interesting is what is not included in the suit - a claim for patent infringement. (Such a claim can only be filed in federal court, and this suit was filed - at the plaintiff's choice - in San Mateo County Superior Court, a California state court.) The letter identifies several areas of disagreement between the parties: 1. RSA believes it had the right to approve or reject the PGP/Lemcom merger 2. RSA says that PGP has licensed the patent to OEM customers, in violation of the license agreement 3. RSA says that PGP has licensed certain source code to some customers, in violation of the license agreement 4. RSA says that Lemcom has not made a royalty payment since the third quarter of 1996. (But I'm sure I saw something - in the media? - where PGP says they've been making royalty payments.) And the letter says that RSA is immediately terminating PGP's license to use/make software including the RSA public-key algorithm because of those breaches. PGP hadn't filed a response yet - they'll have 30 days to do so from the date of service, and I think they were served with the suit somewhere around the 10th of May. (There was a proof of service document in the file, but I didn't bother having it copied.) -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0