December 2003 - cypherpunks-legacy

Re: Canarypunk: Jim Bell in a coalmine
by Blanc 17 Dec '03

17 Dec '03

At 02:38 PM 6/22/97 -0400, Robert Hettinga wrote: >Admittedly, this is a distraction from the most important thing, which is >writing code, but I bet that there are in fact cypherpunks-who-don't-code >in Bell's neighborhood, and not necessarily even Friends of Jim, who would >be happy to personally go see how Bell is doing and come back and tell us >what happened. Think of it as part of the feedback loop for net.freedom. A >trip into the coal mine with a canary cage. > >Yeah, I know. It's me making work for someone else. Nonetheless: Anyone out >there want to do this? ............................................................................ ..... I live about an hour's drive from Tacoma. I'm not too enthused about taking such a lengthy trip just to go see how Mr. Private Assassinations is doing, but - taking after your own methods, Robert - I'd be glad to do it in exchange for a trip to Anguilla next Feb. :>) (You know, it is true that having friends in times of stress, like when you're sitting in jail, is good for the soul, but on the other hand one must give credit to Jim for his having created his own situation. He did provoke the government types into suspicions about him and he must have known that distributing his AP ideas, containing such apparent potential for being translated into reality, would make him a grand target. When you do things like that, you ought to consider what you're going to do when "they" come after you. He afterall is quite aware of the atmosphere in which we live and how fragile is the relationship (if it can be called that) which civilians have with the local military saviors which daily protect us from ourselves.) Having said that, I'll consider the possibility, if visitors are allowed on weekends. Perhaps several cpunks could go (if anyone else around here interested? (Wei, Joel, I know you're just dying to go <g>)), if more than one visitor at a time is allowed . .. Blanc

2 1

Re: Canarypunk: Jim Bell in a coalmine
by Blanc 17 Dec '03

17 Dec '03

At 02:38 PM 6/22/97 -0400, Robert Hettinga wrote: >Admittedly, this is a distraction from the most important thing, which is >writing code, but I bet that there are in fact cypherpunks-who-don't-code >in Bell's neighborhood, and not necessarily even Friends of Jim, who would >be happy to personally go see how Bell is doing and come back and tell us >what happened. Think of it as part of the feedback loop for net.freedom. A >trip into the coal mine with a canary cage. > >Yeah, I know. It's me making work for someone else. Nonetheless: Anyone out >there want to do this? ............................................................................ ..... I live about an hour's drive from Tacoma. I'm not too enthused about taking such a lengthy trip just to go see how Mr. Private Assassinations is doing, but - taking after your own methods, Robert - I'd be glad to do it in exchange for a trip to Anguilla next Feb. :>) (You know, it is true that having friends in times of stress, like when you're sitting in jail, is good for the soul, but on the other hand one must give credit to Jim for his having created his own situation. He did provoke the government types into suspicions about him and he must have known that distributing his AP ideas, containing such apparent potential for being translated into reality, would make him a grand target. When you do things like that, you ought to consider what you're going to do when "they" come after you. He afterall is quite aware of the atmosphere in which we live and how fragile is the relationship (if it can be called that) which civilians have with the local military saviors which daily protect us from ourselves.) Having said that, I'll consider the possibility, if visitors are allowed on weekends. Perhaps several cpunks could go (if anyone else around here interested? (Wei, Joel, I know you're just dying to go <g>)), if more than one visitor at a time is allowed . .. Blanc

1 0

recoverability
by Lee Tien 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Although there is still talks much about key escrow/mgmt/recovery, the policy on KMI recoverable products appears to be framed in terms of plaintext recovery. E.g., at a BXA crypto reg seminar, the handout used the following def'n: "Products which allow government officials to obtain, under proper legal authority and without the cooperation or knowledge of the user, the plaintext of the encrypted data and communications." Lee -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBM645jbk2KqHYSFEtEQKFIQCbBiazwaIWeWM28iLHOKIInzCj+nAAn3oj 9OddweX2M+fIa47cigevhiR1 =YuHD -----END PGP SIGNATURE-----

1 0

Re: A better DES challenge
by Mike Duvos 17 Dec '03

17 Dec '03

Matt Blaze <mab(a)research.att.com> writes: > I'm not a big fan of cipher ``challenges'' in which a prize > is awarded to the first person who discovers the key that > produces some plaintext/ciphertext pair. The effort > required to produce a solution tends to grossly overstate > the actual difficulty of searching the keyspace, since > invariably the winner uses the idle time on general-purpose > computers, which are poorly-optimized for use as keysearch > engines. Really. It appears that the DESCHALL frivolities actually enhanced the reputation of DES, fluffy press releases by C2 and Security Dynamics notwithstanding. > A more basic problem with challenges is that even when they > are solved they don't really provide convincing proof that > the keyspace was actually searched. For example, in the > recent 56-bit RSA DES challenge, RSA has no way to prove > that it didn't ``leak'' some hint about the solution to the > winner. (I hasten to point out that I'm not suggesting that > anything like this actually happened, only that a skeptic > might raise the possibility, against which RSA has no real > way to defend itself). This is a problem which I have been pondering in recent days. How would someone in the future demonstrate that they have broken DES, now that the RSA DES Challenge is behind us, and trusted parties offering to generate and keep secret ciphertext/plaintext pairs are no where to be found. It would seem to me that the best way to demonstrate that one has broken a block cipher without releasing ones algorithm would be to generate and publish some key collisions, in which a ciphertext/plaintext pair is mapped by more than one key. If one encrypts plaintext with a known key to generate ciphertext, cryptanalysis of the resulting ciphertext/plaintext pair for a key other than the one used to generate it should be comparable in difficulty to cryptanalysis of a ciphertext/plaintext pair provided by a trusted third party. The ability to generate such collisions at will clearly demonstrates that one can calculate keys from ciphertext/plaintext pairs. > A better challenge, then, would be one in which even the > challenger doesn't know the solution in advance (or would > have had to itself search the keyspace or otherwise > cryptanalyze the cipher in order to find it). For example, > a challenge for a one-way collision-intractable hash > function could simply ask for an example of a collision, or > could ask for the inversion of some well-structured output > (such as all zeros). A step in the right direction. We should develop ways of demonstrating cryptanalysis which do not require one person to solve a problem provided by another person without the possibility of collusion. [snip] > Recall that there are 2^56 DES keys that each select a > different permutation of the 2^64 codebook entries. We > expect that there's about a 1/2^8 chance that there exists a > DES key that converts any given plaintext block to any given > ciphertext block. > My challenge is to find a key such that a ciphertext block > of the form <XXXXXXXX> decrypts to a plaintext block of the > form <YYYYYYYY>, where X and Y represent any fixed eight-bit > byte value repeated across each of the eight bytes of the > block. > Observe that I'm actually posing 2^16 different challenge > plaintext/ciphertext pairs, each with about 1/2^8 > probability of having a solution, where groups of 2^8 > challenges can be searched for simultaneously. Each > challenge may have no solution key, exactly one solution > key, or more than one solution key, but it is very likely > that there is at least one solution key to at least one of > them (in fact, one could expect to find about 2^8 solutions > overall, assuming DES produces good pseudorandom > permutations). I like this. It is somewhat cleaner than the key collision trick suggested above. > I will award a grand prize of 56 bits (seven (7) US > dollars) to the first person to provide a solution key. (The > challenge ends when first key is found). While the prize > money is admittedly trivial (this is out of my own pocket, > after all), I hope it will serve as ``seed money'' that > encourages others to add their own prizes to a growing pot. Let me know when the money reaches $10k. > Of course, I cannot be completely sure whether there exist > any solutions at all. If there were to be no solutions at all, given the alleged pseudorandomness of DES, this would probably be an even more interesting result than solving the problem posed. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $

1 0

Your surfing days are over
by Shift Control 17 Dec '03

17 Dec '03

This week, in the Seaside Issue of Shift Control... "We bade farewell to the snail collectors and moved down to the beach. The tide was out, revealing a broad stretch of seaweed-covered stones. At the tide's edge a man and a woman were harvesting winkles, "for tonight's tea". We continued to the next bay, half expecting to find someone digging for maggots or collecting slugs, but instead we bumped into a naked bloke. He seemed more surprised than us and dashed off into the sea." - Paul Robinson on a weekend away at the seaside. "The good news from the English Tourist Board (ETB) is that the seaside amusement industry is booming: last year we took 18.7 million seaside holidays and spent £4.2bn. The coast is still the most popular domestic holiday destination, possibly because, as Anna Crombie of the ETB points out, 'you can still have fun whatever the weather, which is not always true of our continental competitors'. Who needs the sun when you can visit Mr Blobby's Bubble Kingdom?" - Rebecca Fox provides the ultimate guide to British beaches. "As soon as we got to the sand my father sprinted down to the sea, gritted his teeth and dived in. We stood there unimpressed, looking for the nearest café. Dad waved, beckoning us to join him. With the sun having just gone in and the wind picking up, none of us were going to comply." - Leo Hickman on growing up at the seaside. Plus new fiction, the story of a bionic bee and the chance to see your own music and movie reviews published on the net. ShiftControl: waiting for you NOW at http://www.shiftcontrol.com __________________________________________ Shift Control is produced by the Guardian's New Media Lab with help from Boddingtons and Stella Artois Dry To unsubscribe from this mailing list send e-mail to shiftcontrol-request(a)nml.guardian.co.uk with the following text in the body of the mail message: unsubscribe

1 0

Feds Recant on Mitnick
by John Young 17 Dec '03

17 Dec '03

23 June 1997: New twist/ Feds Recant on Mitnick's Fugitive Status Back in 1994, a supposedly fleeing Kevin Mitnick told anyone who would listen he really wasn't a fugitive from justice. He claimed to be just a paranoid hacker who didn't want to stick around once his probation was up. As it turns out, he may have been telling me the truth. In a federal court in Los Angeles, the government admitted it had made a mistake in saying that Mitnick was on the lam. The admission may put an entirely different twist on the case. If Mitnick wasn't really a fugitive, a couple of probation violations mistakenly escalated into one the biggest manhunts in cyberspace. Petty offenses by Mitnick -- probably punishable by an extension of his probation -- spun into a nationwide cat-and-mouse game that drew a frenzy of media hype. Along the way, Mitnick, who may have been no more than a scofflaw, instead became the notorious criminal mastermind the authorities apparently wanted him to be. ---------- Full report: http://jya.com/kmtwist.txt Crypto news: S.F. Judge Likely to Uphold Encryption Ruling EEMA/ EEMA Slams UK Government Over Encryption Restrictions Two reports on prospects for the McCain/Kerrey bill Two reports on the import of the DES crack http://jya.com/cn062397.txt

1 0

New PGP signatures
by Mark Grant 17 Dec '03

17 Dec '03

Could I humbly request that people don't post the new (SHA?) PGP signatures to the list for the time being as it's a pain in the ass for those of us outside the US who don't yet have the ability to read them. PGP 2.6.x error handling doesn't know what to do with them and it breaks our mail-processing code. Mark

6 7

AP Bot Results
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

"Dead Lucky" is an Assassination Politics Bot operated in response to the illegal and unconstitutional imprisonment of an American citizen in retaliation for exercising his right of free speech. It is the view of the operator's of this AP Bot that since it was the illegal and unconstitutional actions of Federal employees which was responsible for the implementation of this AP Bot and several others, that they should accordingly be subjected to imprisonment without bail for endangering the lives of others, including several Cypherpunks. Leading eCa$h candidates for dying at an opportune time to make some perennial loser "Dead Lucky" are: e$ 2,610.02 J. Kelley Arnold, United States Magistrate Judge, Union Station Courthouse, 1717 Pacific Avenue, Tacoma, Washington e$ 1,500.48 Jeffrey Gordon, Inspector with the Internal Revenue Service, Internal Security Division e$ 758.00 Inspector Cindy Nelson e$ 514.02 Cindy Brown Leading Cypherpunks: Graham John-Bullers TruthMonger Kent Crispin Leading Contributors/Bettors: The James Gang The Dalton Gang The Bell Gang William Geiger III

4 3

anonymous mail
by rttc0025＠pophost.club.innet.be 17 Dec '03

17 Dec '03

could you send me the name of an remailer that works in Belgium please, i would be most gratefull thank you yours truly ambi

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 23 Jun 97 6:48:07 PDT remailer email address history latency uptime ----------------------------------------------------------------------- squirrel mix(a)squirrel.owl.de --+-++++++++ 1:38:27 99.98% weasel config(a)weasel.owl.de --+-++++++++ 1:39:11 99.98% balls remailer(a)huge.cajones.com -+#######*# 9:47 99.93% replay remailer(a)replay.com *-++******** 4:18 99.90% hidden remailer(a)hidden.net __.+-####### 7:22:42 99.88% reno middleman(a)cyberpass.net -.---.-+++++ 2:14:42 99.82% winsock winsock(a)rigel.cyberpass.net ---.--.---- 4:58:14 99.82% jam remailer(a)cypherpunks.ca + ++** **** 18:08 99.57% cyber alias(a)alias.cyberpass.net +++**++***** 12:43 99.56% lucifer lucifer(a)dhp.com +-++ +++++++ 41:58 99.38% mix mixmaster(a)remail.obscura.com ..-.----.- - 9:33:04 99.32% nym config(a)nym.alias.net #*****## 1:05 88.62% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0