December 2003 - cypherpunks-legacy

No Subject
by Mike Ronn 17 Dec '03

17 Dec '03

1 0

encryption key expiry in pgp5.x
by Adam Back 17 Dec '03

17 Dec '03

What happens in this scenario with pgp5.0, or pgp5.5: - You have a signature key which you'll keep for say 2 years before creating a new one. - You have a policy of generating new encryption keys every 6 months. - Your email archives are stored as received still encrypted to your public encryption key (I think you have no choice but to do this with some of the pgp5.x plugins). - You expire the key, and securely wipe the private half of the key. (An advantage of rekeying in this way is to gain forward secrecy: messages gathered by an attacker can no longer be decrypted with information you have, but to get the forward secrecy you must literally securely wipe the private key). If you do this, you won't be able to read your old mail folder, because you no longer have the key it was encrypted to. Does this imply that you must keep the private key for perpetuity? (Or at least as long as you want to read old mail archives). One presumes the same problem applies to CMR recovery keys, they must also be kept as long as recovery is required, if the user forgets the password. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Security flaws introduced by "other readers" in CMR
by Jean-Francois Avon 17 Dec '03

17 Dec '03

From: Fabrice Planchon <fabrice(a)math.Princeton.EDU> To: Adam Back <aba(a)dcs.ex.ac.uk> Cc: cypherpunks(a)cyberpass.net Subject: Re: Security flaws introduced by "other readers" in CMR >They do: the title is "Le programme PGP se range", which I unfortunatly > have know idea of how to translate. It can be translated by "PGP gets into the groove" it "behave itself". It finally obtemperate (wether prompted or not). It grow's up and become reasonable. "se ranger" is what you do with your car when a cop car pulls you on the side. it gets in line There is an ambiguity in this expression. "Se ranger" is usually used for a transition to an unusual or not approved behaviour to a accepted or acceptable behaviour. It entails a "higher" authority or standard. This is why I use a much more americanized language when I speak in french about civil liberties and related subjects. The french language almost equate government intentions with fatherly love... :-) Over the years, I found that most French peoples have a feodal attitude with a tendency to almost blind veneration of hierarchy. (flames to dev(a)nul.con) I suppose it comes from their History. In general, if a govt said it, it *has* to be good. It is as if they were trained since young age to surrender their capacity for independent judgment and reason. And quite distressingly, it happens even with extremely intelligent individuals. OTOH, the uncommon ones that do not exhibit such psycho-epistemological trait tend to be real hot shots, independent type. I am not French, but Canadian (french) and we often have scrapes with French on this topic. They tend to trust their govt, unless somethings warrant otherwise. Here in french Canada, we are much more American in that sense. Notwithstanding what trumped-up polls say, we have a much more american-styled opinion. Ciao JFA

1 0

Re: Security flaws introduced by "other readers" in CMR
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Jean-Francois Avon wrote: > From: Fabrice Planchon <fabrice(a)math.Princeton.EDU> > >They do: the title is "Le programme PGP se range", which I unfortunatly > > have know idea of how to translate. > > It can be translated by > "PGP gets into the groove" "falls in line" > it "behave itself". "obeys" > It finally obtemperate (wether prompted or not). "self-restrained" > It grow's up and become reasonable. "matures" and "conforms" > "se ranger" is what you do with your car when a cop car pulls > you on the side. it gets in line "Habeus Automobileus Recovery" > There is an ambiguity in this expression. "Se ranger" is > usually used for a transition to an unusual or not approved > behaviour to a accepted or acceptable behaviour. > It entails a "higher" authority or standard. Such as Hitler, or Freeh, or DeGaulle. There is a lot of truth to the "loose shoes, tight pussy, and a warm place to shit" school of dictatorship. As long as your butt is warm, do you really care whether 'they' are burning Jews or Jesuits to supply you with heat? Has PGP scored Joe 'White Shoes' Jackson as their SpokesPerson? VeriteMonger

1 0

your MIS email address (cosmos) may be deleted if you do not respond
by MicroServe's HELPDESK 17 Dec '03

17 Dec '03

Dear MicroServe Subscriber, The MIS accounting department is in the process of upgrading it's software. Unfortunately, they found some information missing from your account. So, we're going to need your help. Please go to the following URL (web address) with your WWW browser (Netscape, Internet Explorer, etc) and follow the online instructions. You should not have to anything except click CONTINUE once you arrive at the page. WEB URL: http://2009263:cosmos@mismail.microserve.net:235/ ACCOUNT ID: 2009263 MAILBOX: cosmos Login name: cosmos In real life: Daniel Leeds Directory: /usr5/accts/c/cosmos Shell: /usr/bin/ksh Last login Fri Jun 20 12:46 on pts001 from unknown-2-66.ra New mail received Wed Oct 15 17:05:23 1997; unread since Thu Oct 16 19:27:50 1997 PLEASE NOTE: This must be done from YOUR ppp (dial-up) account. The system will not work if you try to do this from a friend's (or any other) dial-up account. UNIX Shell customers should call (717)821-5964 extension 3 to speak with a technical support representative. Any account which still has info missing as of November 1, 1997 will be suspended (and will be deleted on November 8, 1997), as we will have to assume that the email box belongs to no one. If you have any questions, please email helpdesk(a)microserve.net. Thank You, MicroServe Engineering Department ------------------------------------------------------------------------ MicroServe Information Systems 100 North Wilkes Barre Blvd Wilkes-Barre, PA 18702

1 0

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM AS/400 rule WILL HEADLESS HUMAN CLONES GROW ORGANS IN 10 YEARS? 'Human Cloning' graphic October 19, 1997 Web posted at: 8:39 p.m. EDT (0039 GMT) LONDON (AP) -- Headless human clones will be used to grow organs and tissues for transplant surgery in the next five to 10 years, a leading authority on the ethics of human cloning predicted Sunday. Dr. Patrick Dixon, author of "The Genetic Revolution," which forecast the cloning of animals, made the prediction after The Sunday Times reported that British scientists have created a frog embryo without a head. Scientists believe the technique used to create the headless frogs could be adapted to grow human organs such as hearts, kidneys, livers and pancreases in an embryonic sac living in an artificial womb, the paper said. Many scientists believe human cloning is inevitable following the July 1996 birth of Dolly, the world's first cloned mammal. She was created at the Roslin Institute in Edinburgh using cells from a sheep's udder. "I predict that there will be great pressure to combine cloning technology with the creation of partial fetuses, missing heads, arms or legs as organ factories for tomorrow's people," Dixon told the British news agency, Press Association. "These will be developed on an experimental level somewhere in the world in countries where there is little or no gene legislation within the next 5-10 years because of the overwhelming demand," he said. "The demand is there, the technology is almost there as well," he said. Dixon called for an urgent global biotechnology summit to examine every aspect of genetics, and provide the foundations for international agreements. International inconsistencies on various aspects of genetic engineering, including human cloning, urgently need to be ironed out, he said. "Genetic engineering is a very exciting technology, it has the power to feed the world, cure disease but you do have to ask fundamental questions before it is too late," Dixon said. "The headless frog embryo is another example of the way the technology is racing far ahead of public understanding," he said. "We must get the thinking in place which looks over the horizon beyond today's headlines to what tomorrow will bring," Dixon said. "Scientists have been making up the rules as they go along." Genes manipulated to suppress frog's head Jonathan Slack, professor of developmental biology at Bath University, told The Sunday Times that he created headless frog embryos by manipulating certain genes -- and used the same technique to suppress development of a tadpole's trunk and tail as well. The headless frog embryos have not been allowed to live longer than a week because under British government rules, embryos are not considered animals until they are a week old, the paper said. Slack believes the breakthrough could be applied to human embryos because the same genes perform similar functions in both frogs and humans, The Sunday Times said. The newspaper said the lamb and frog techniques could be combined so that people needing transplants could have organs "grown to order" from their own cloned cells. These organs would exactly match the patient and there would therefore be no danger of rejection. It would also ease the shortage of organs for transplant, The Sunday Times said. Slack told the paper that using intact human embryos would not be possible because they would have to be killed. "It occurred to me a half-way house could be reached," he was quoted as saying. "Instead of growing an intact embryo, you could genetically reprogram the embryo to suppress growth in all the parts of the body except the bits you want, plus a heart and blood circulation." Growing parts of human embryos to cultivate organs could bypass many legal restrictions and ethical concerns, because without a brain or central nervous system the organisms may not technically qualify as embryos. Professor: 'No ethical issues' Lewis Wolpert, professor of biology as applied to medicine at University College London, called Slack's suggestions sensible and feasible. "There are no ethical issues because you are not doing any harm to anyone," The Sunday Times quoted him as saying. But Oxford University animal ethicist Professor Andrew Linzey told the newspaper: "It is morally regressive to create a mutant form of life." "It's scientific fascism because we would be creating other beings whose very existence would be to serve the dominant group," he was quoted as saying. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule CNN Plus * Message Board: Cloning Health Special: Cloning Related stories: * Report: Cloned sheep has human gene - July 24, 1997 * Embryo splitting caught in cloning controversy - June 25, 1997 * Scientists grow monkeys from cloned embryos - March 2, 1997 * Firms team up to make cloned cattle with special milk - October 7, 1997 Related sites: Note: Pages will open in a new browser window * Genzyme Transgenics * Genetics and Ethics - Biomedical Ethics Unit, McGill University * Institute for Philosophy and Public Policy - Animals as Inventions: Biotechnology and Intellectual Property Rights * Genetic Engineering Home Page External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM AS/400 rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

Re: "First do no harm"
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On Sun, 19 Oct 1997 16:31:10 -0700, Tim May wrote: >At 5:23 PM -0700 10/19/97, Jean-Francois Avon wrote: >First, are you reading Cypherpunks? No. I don't have time to even read all of e$ and e$pam. I am not yet retired... :-) >If so, post there. If not, please >forward my reply to the "e$" Done. >If I operated a small company, I would have no policy on this at all. Just >as I wouldn't routinely tape-record employees, I wouldn't monitor their >mail. >Do most small businesses steam open all of the incoming and outgoing paper >mail? Let me describe a scenario: one key employee isn't there because... ...he is somewhere else [ :-) ] Then, comes an urgent message forcing the company to make a split-second decision before the employee gets back. It happens _all_the_time_ in small businesses where they do not have the ressource of the big companies. You, the boss, want to re-read some critical documents before making a move. Of course, your employee was the most consciencious and trustworthy employee on this side of Andromeda, only, your memory fails as what was the *exact* wording of the critical documents. It furthermore happens that the said faithfull employee is, unknown to you and in his mind not-company-detrimental, getting intronized to the mile-high club between L.A and Tokyo in the plane lavatory, therefore not reacheable by any modern means. Wouldn't you wish you had his corporate private key? In the old days, you used to scramble through his mountain of paper on his desk. In more recent days, you frantically scanned his exemplary organized data structure and found the documents. Today, the said data structure is still exceptionally orderly, but only to reveal several very describing filenames with a dot-asc or dot-pgp extension. Any comments? >If a small business owner doesn't trust his employees, all is lost anyway. >(Employees can post stuff from home, can take diskettes out of the >building, etc., so what is gained by monitoring their mail?) I thought that this was so self-evident that I did not even thought usefull to explain. I was not talking about having employees giving copies of their personnal private key but of their corporate private key. The one they use to transact business over unsecured lines, not the one they use to send raunchy messages to their lover. >And if an employer is known to monitor employee mail, this actually >increases his liability for certain things. (If an employer does not, then >he has a better defense of claiming that some employee was acting on his >own, etc.) I never talked of monitoring e-mail, only of making sure the business retains access to employee-generated documents. I used to have a private key for the company at a previous work location. The first thing I did was to give my boss my passphrase for being afraid of what could happens if ever they needed a critical document during my absence. He did not even know how to use PGP, but I made sure that somebody did. This is why I said that a "secret" copy would be given to the boss. He could encrypt the employees keys, print it on a micro-dot and hide it under his gold tooth cap. And that way, there is always deniability since there is official company policy. Or better, all the boss has to do is to generate the employee's keys himself. He could forever deny having made a copy and nobody could prove that he did. Personnally, I would make sure that all keys to be used to transact business be generated by the boss, to be handed on a diskette in person. As far as trying to prevent malicious action, I agree that there is no way an employer can do that. Anybody really intent on screwing up things can. Ciao jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

One-Way Functions
by semprini＠theschool.com 17 Dec '03

17 Dec '03

I've read tons about how DES, PGP, and all of those programs use a one-way function involves the difficulty of factoring out numbers. Are there other one-way functions? --Dylan

1 0

Re: A Math problem related to cryptography
by phelix＠vallnet.com 17 Dec '03

17 Dec '03

On 19 Oct 1997 18:36:26 -0500, Jeffery Walker <jeff(a)beol.net> wrote: > > I have been working on some math and C++ code to implement it. The >problem relates to a possible new means of factoring. However, I have run >into a problem which I cannot solve. Indeed it maybe impossible. The >problem is this: > > Find and equation using only multiplication, division, GCD, LCM and >powers (not addition or subtraction) in terms of a and b which is equal to >a+b for all Integers. If so desired it can be assumed that a and b are >relative primes with a>b. Note that equivalent problems include but aren't >limited to finding a similar equation for a+1. If other functions such as >logs are required they may be allowed but I would have to look into it. > > To encourage people to answer I am offering $20 for a solution and >$10 for a proof that it is impossible. I will judge all answers as to the >validity both in terms of actually being correct (or in the case of a proof >a valid argument) and in that they do not use functions such as addition or >subtraction which are not allowed. > (why do I get the feeling that I'm doing somebody's homework assignment) Claim: In the realm of Integers, There does not exist a formula using only multplication,division,GCD,LCM,and powers such that f(a,b)=a+b for all integers a,b Proof (by contradiction): I assume that a,b are primes > 2. Lets also define x,y,z,w,m,n and any integer >=0 and C,D,E as any integer > 0. Now let's look at the operations available to us: multiplication and powers: C=C*(a^0)*(b^0) CD=E(a^0)*(b^0) where E=CD a=1*(a^1)*(b^0) a^2=1(a^2)*(b^0) Cab^2=C*(a^1)*(b^2) well , all results can be expressed in the following form: C*(a^x)*(b*y) division: a !| b and b !| a (here !| means "does not divide") (From here on out, lets assume that a !| C,D,E and b !| C,D,E. it makes things simpler) Ca/a=C*(a^0)*(b*0) Ca/D=E*(a^1)*(b^0) assuming that E | C I won't go through all this. It should be obvious that for all allowed divisions, the result can be expressed as C*(a^x)*(b*y) GCD: gcd(a,b)=1 gcd(a,C)=1 gcd(Ca,Da)=max(a,gcd(C,D)) gcd(Ca,Db)=gcd(C,D) gcd(C(a^x),C(a^y))=C(a^(min(x,y))) gcd(C(a^x)*(b^y),D(a^z)*(b^w))=gcd(C,D)*(a^(min(x,y)))*(b^(min(z,w)))) =E(a^m)*(b^n) for E=gcd(C,D) m=min(x,z) and n=min(y,w) so, all results of GCD can be expressed in the form: C(a^x)(b^y) LCM: LCM(C,D)=CD/gcd(C,D) LCM(C(a^x)*(b^y),D(a^z)*(b^w)) =CD*(a^(x+z))*(b^(y+w))/gcd(C(a^x)*(b^y),D(a^z)*(b^w)) =( CD/gcd(C,D) * (a^(|x+z-min(xz)|)) * (b^(y+w-min(yw)) = E(a^m)*(b^n) where E=CD/gcd(C,D)=lcm(C,D), m=x+z-min(x,z) , n=y+w-min(y,w) so, all results of LCM can be expressed in the form: C(a^x)(b^y) Now, as you can probably tell by now, I don't remember a damn thing about groups, rings, and fields. If i did, I could have done all of the above in one paragraph. SO, what I'm trying to say is that all the numbers you can operate on here will be of the form C(a^x)(b^y). SO you really have to prove at least the following C(a^x)(b^y)=a+b for some C>0, x,y>=0 integers Now, you could probably say that C=a+b, x,y=0, but that's a cop out and is probably not allowed. Now, watch while I cop out and provide an easy counterexample: assume some formula exists such that f(a,b)=a+b with f only using *,/,gcd,lcm,^ operators let a=5, b=7 Since I know that ultimately anything I do with constants and the operators 8,/,gcd,lcm,^ will result in something in the form of C(a^x)(b^y), I won't even mess with the formula there must exist some C>0, x,y>=0 that makes: C(5^x)(7^y)=5+7=12 of x>=1 and y>=1 then C(5^x)(7^y)>12 for all C>0 if x=0 and y=0, C=12 (this works) if x=1,y=0 then 5C=12. there is no C which satisfies this. if x=0,y=1 then 7C=12. there is no C which satisfies this. so, the only solution is C=12, or more generally, C=a+b oops, that can't be the formula since we're not allowed to do that. QED. Well, that was pretty sloppy, so lets be more general about this: C(a^x)(b^y)=a+b Now, I'm sure that somewhere in the history of mathematics somebody has proven that for primes a and b where a,b>2 that a*b>a+b. So, for any x,y,C>0, C(a^x)(b^y)>a+b. C, of course, cannot be negative, or zero, so all were left with is x or y being zero. Let y=0. we have: C*a^x=a+b C*a^x - a = b a*(C*a^(x-1) - 1 ) = b a*E=b Now, a and b are primes and a!=b. From the fundamental theorem of algebra, every number can be represented by a series of primes such as: p1^a1 * p2^a2 * p3^a3 * ... In a*E=b, if we factor each side down to its primes, we find that the right hand side does not contain the prime 'a' which is on the left hand side, so a*E != b. A similar argument can be used for the case x=0. This leaves the only solution to C(a^x)(b^y)=a+b being x=0,y=0 C(a^0)(b^0)=C=a+b which isn't allowed. QED Now, If you're like me, you've probably read the above and don't have a f*cking clue what I meant (I sure wouldn't if I read all that crap). So here's the executive summary. With the operators you've defined on the number set you want to work with, no matter how complicated or crazy your formula is, I can express the result at C(a^x)(b^y). And hopefully, I've shown that C(a^x)(b^y) cannot equal a+b except in the trivial case of C=a+b (with x,y=0) which is what you don't want. >Thanks, >Jeff >P.S. I am very interested in joining the coderpunks list as I do program >and am interested in cryptography as related to programming. If someone >would be kind enough to recommend me I thank you. > I wasn't aware that you had to be invited to the coderpunks list. Just send a message to majordomo(a)toad.com with the following in the body: subscribe coderpunks -- Phelix, who really should have been able to give a better proof (especially since one of my degrees has the word 'Mathematics' on it)

1 0

Fwd: list of keyservers
by Bill Stewart 17 Dec '03

17 Dec '03

Attila sent the following list of keyservers ---------------------------------------------------------- the following is a collection of key servers; and there are more. <a href="http://pgp5.ai.mit.edu/pks-commands.html"> bal keyserver at MT </a> <a href="http://www.pgp.com/keyserver/pks-lookup.cgi"> pgp corporate keyserver </a> <a href="http://akpublic.research.att.com:80/~reiter/PathServer/"> reiter PathServer at research.att </a> <a href="http://w3.gti.net/netrin/matrix/"> Matrix Key Server </a> (an oddball, down on 19/10/97) the rest are clones of MIT <a href="http://goliat.upc.es/~alvar/pks/pks-toplev.html"> Universitat PolitÞcnica de Catalunya, Barcelona </a> <a href="http://www.cl.cam.ac.uk/PGP/#pks"> Cambridge University </a> <a href="http://www.service.uit.no/pgp/servruit.eng.html"> University of Troms </a> <a href="http://www.nic.surfnet.nl/pgp/pks-toplev.html"> Tilburg University </a> <a href="http://math-www.uni-paderborn.de/pgp/"> University of Paderborn </a> <a href="http://pgp.tnjc.edu.tw/pgp/pks-toplev.html"> Tung-Nan Junior college, Taiwan </a> <a href="http://pgp.uni-mainz.de/keyserver"> University of Mainz </a> Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0