December 2003 - cypherpunks-legacy

InfoWar Epilogue 4 / TEXT
by Matthew Ghio 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger <tm(a)dev.null> Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * gomez ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- Subject: Re: Just say "No" to key recovery concerns...keep OpenPGP pure From: Adam Back <aba(a)dcs.ex.ac.uk> To: tcmay(a)got.net CC: shamrock(a)cypherpunks.to, cypherpunks(a)cyberpass.net, eric(a)sac.net Tim May <tcmay(a)got.net> writes: > I'll try a different way of making my points... > At 9:12 PM -0700 10/14/97, Lucky Green wrote: > >I can't help but see a difference between enforcing to encrypt to a > >default key and storing the user's key outright. IMHO, the former entails > >less potential for abuse. > > All other things being equal, maybe the former is slightly less intrusive > than the latter. But maybe not even this, as the two give the same results. > After all, what's the real difference between "all mail, incoming and > outgoing, must also be encrypted to a CMR key" and "you must deposit a copy > of your key with us"? CMR keys are the root of all evil in pgp5.5. Without them almost any permutation of recovery care to construct would be less useful to the GAK'ers, for all the organizational, and inconvenience reasons Tim describes. Governments have problems handling complexity. So make their job complex. If you were one of the people writing the IRS tax software back in the 60s, and you were in deep cover, a proto-cypherpunk, and were bright enough to see the future possibilities you would have done all you could to fuck up the IRS system. You would have obfuscated the code. You would have put logic bombs in it. You would have destroyed the source code surreptitiously. (Destroying source code has analogies to destroying keys at earliest opportunity, you are destroying something which your enemy needs). Any bets as to if any of this actually happened on purpose? I reckon so. So, do you all reckon we can make task of fielding GAK impossibly complex for such a big disorganized government? Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- gomez I used to be a bright-eyed young computer guerrilla myself, many years ago, but I guess I have grown a little less radical as I have matured, since it now bothers me when youngsters such as Adam Back attempt to encourage others to sabotage the code of decent, hard-working programmers. This matter is of particular concern to me, since Basis, Inc. initially built the Purchasing and Contracting application in the IRS National Office, to run under UNIX on Zilogs, with a preSQL Informix database. Thus Back's intimations of "deep cover proto-cypherpunks" sabotaging the IRS could quite possibly cause serious harm to my professional reputation, in light of the wild-eyed claims made about me in 'The True Story of the InterNet' manuscripts. I have grown quite tired of being the target of some half-baked, delusional psychopath who is making me a character in the bizarre prevarications which drool from his mind, onto the printed page. I made the mistake of taking pity on a poor fellow one night in a Berkeley bar, buying him a few drinks in return for the atrocious tunes he played on a cheap, pawn shop guitar, and soon found him showing up on my doorstep every time he hit town, looking for a handout. Later, I found out that he had forged a letter of recommendation in my name, in order to help himself get established in the computer industry. It was very disturbing to discover some of the atrocities he had done under cover of affiliation with myself and Basis, Inc., causing me a great amount of legal problems. Now, after believing that his obsessive-compulsive fixation on me (because of his affection for my Jack Russell Terriers) was a thing of the past, I find that he is now pushing some crazy theory in regard to the Y2K problem, which is really a fairly insignificant matter that he has blown all out of proportion, and that he has drawn Adam Back into his madness to one degree or another. Mr. Back seems, from what little I know of him, to be a fairly reasonable individual, but lately he has been sinking into the same type of illogical rants and conspiracy rhetoric that the imbecile who calls himself the Author is notorious for. And now Back is making veiled references to persons connected to 'The True Story of the InterNet' obfuscating the IRS software code and planting logic bombs in it. Of particular concern to me is the fact that I personally had a hand in a rather innocent affair that resulted in our company making some coding changes which could possibly be misconstrued to indicate that we were involved in some type of testing of a Year2000 bomb in the IRS software code. One of the requirements for the application we built for the IRS was that no PO (Purchase Order) could be issued without a signed Requisition being referenced. Also, no PO could reference a Requisition issued outside the current fiscal year. Thus, no PO could be written for a Requisition from the previous year. Butthe BIG Butthe IRS staff had long been doing thisviolating the strict letter of the IRS rules-especially around the beginning of a new fiscal year. Lacking a current fiscal year requisition, they referenced one dated the previous (just closed) fiscal year. Suddenly, however, our application stopped their usual practice dead in the water, once certain PO's could not be processed because we required reference to valid (current year) Requisitions. We later discovered that the staff had been "cheating" by defeating our system's logic, after we were called in to tighten up all the design's enforcement of logic. Next thing you know, we were asked to relax the logic. I would like to stress that it is a matter of record that the calendar year related problems were a result of the government specifications and requirements for the application, and not the result of some devious plot on the part of myself or Basis, Inc., to surreptitiously investigate the potential for designing code that would take advantage of the unique problems surrounding the advance from the 1999 calendar year to the year 2000 in order to bring the IRS system to its knees. Neither was the fact that the garnisheeing of my paycheck by the IRS stopped shortly after our work on the IRS system started in any way related to my work on their system. It was merely a coincidence of timing. Conspiracy theorists might also make much of the fact that several Basis applications programmers shortly thereafter took jobs with the IRS for half of their former pay, but this can be explained by their desire for the long-term security and benefits that come with working for the federal government. The fact that most of them left the IRS and returned to Basis shortly after completing a major reworking of the calendar year updating system which locked the IRS irrevocably into two digit year entries indicates nothing more than the fact that they preferred living on the Left Coast. People often offer raised eyebrows when discovering that I went from having my paycheck garnisheed to receiving a $150,000 tax refund on a $100,000 salary, each year, but this is because they fail to take into account the fact that my work as a Research Faculty member for the Center for Policy Alternatives at MIT involved an interdisciplinary research center with links to Sloan School, which gave me access to superior financial management advice. The Center's close relationship to MIT's engineering departments was in no way connected to any sort of covert government activity, nor to any secret work on the development of the forerunners of today's InterNet in a manner that would make it possible for powerful non-elected Committees and secret Commissions to take control of a large segment of government and society. The Center for Policy Alternatives ceased to exist years ago, and the rumors that the Center was merely moved underground to secretly work toward establishing organizations such as FEMA, and the like, are preposterous. I am really growing sick and tired of the lies and slander that surround myself and Basis, Inc., as a result of the jealousy of other major league computer companies over our success at the peak of the Open Systems computer consulting industry. The constant insinuations that we cannot be trusted with highly sensitive systems such as those at the IRS and PacBell, simply because of our early history as Deadheads, is an insult to our integrity. To suggest that Acidhead Grateful Dead fans all have radical political agendas is no more true than suggesting that all Malcolm X followers are black. Well, OK, maybe that's a bad example Regardless, I would like to put to rest, once and for all, the preposterous rumors that have been circulating which link myself and other top computer industry executives to some mythical secret organization whose aim is to subvert the legitimate machinations of authority and the established power structure. I totally deny any connection to 'The True Story of the InterNet' or to anyone involved in the writing and/or dissemination of the manuscripts, and I would advise others to do the same. Copyright TruthMonger <gomez(a)BASISINC.com> "Last one seen fixing it, gets the blame." ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ----------------------------------------------------------------------------

1 0

More Government Bullshit
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From News of the Weird: * In July, the Nova Scotia Gaming Control Commission formally banned the popular charity fundraiser, "cow-patty bingo," in which a promoter marks a field into squares, takes bets, and then releases a recently-fed cow to "select" a winning square. The Commission believed the game could be rigged by training a cow to use a particular spot in the field. The next day, incoming Nova Scotia Premier Russell MacLellan said the ban could be ignored. That same week, the district attorney's office in Santa Clara County announced that a similar fundraiser for the imminent Gilroy, Calif., garlic festival, based on the famous Clydesdale horses' two-mile march through town, could not be held because it violated the state gambling law.

1 0

The reason terrorists carry fly-swatters
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

>From News of the Weird: * The San Jose Mercury News reported in March on some working models of the Defense Department's tiny flying machines ("micro air vehicles"), no larger than birds, including one helicopter that could fit inside a peanut shell, that are suited for tasks such as locating hostages in occupied buildings, sniffing out poisonous chemicals, and finding enemy snipers. Each micro air vehicle carries cameras, sensors, transmitters, and antennas.

1 0

The reason terrorists carry fly-swatters (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 19 Oct 1997 05:31:34 +0200 (MET DST) > Subject: The reason terrorists carry fly-swatters > From: nobody(a)REPLAY.COM (Anonymous) > * The San Jose Mercury News reported in March on some working > models of the Defense Department's tiny flying machines ("micro > air vehicles"), no larger than birds, including one helicopter that > could fit inside a peanut shell, that are suited for tasks such as > locating hostages in occupied buildings, sniffing out poisonous > chemicals, and finding enemy snipers. Each micro air vehicle > carries cameras, sensors, transmitters, and antennas. Actualy there was a show on The Discovery Channel last week that discussed these as well as many other robotics projects being pursued by various groups currently. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

about MISTY encryption algorithm
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

itsubishi Electric Corp. has developed new secret-key cryptosystem MISTY1 and MISTY2, which are ciphers with 128-bit key and 64-bit data block. They are provably secure against differential and linear cryptanalysis, and also fast on software implementations as well as on hardware platforms. Using ciphers on wide-area networks requires a method to maintain security as long as its encryption key (password commonly shared by a sender and a receiver) is kept secret, even if the mechanism of the encryption is made public. However, possibilities of unauthorized access will increase when the encryption mechanism is made public. In fact, several encryption algorithms, whose specifications were made public, have been compelled to make specification changes, and to sacrifice their encryption speed in return for an increased cipher strength to protect against recent decoding methods. This is why an encryption system whose security against these decoding method is strictly evaluated at the design stage has become necessary. Since announcing its linear cryptanalysis, Mitsubishi Electric has been making efforts to develop encryption technology backed by adequate security. In January 1994, Mitsubishi Electric performed the first successful experiment to decode the Data Encryption Standard (DES), an American standard commercial encryption system, to quantitatively evaluate its strength using this linear cryptanalysis. Using this evaluation technology, Mitsubishi Electric has developed an encryption algorithm that provides sufficient security and achieves high speed encryption. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

ATTENTION GOLFERS! PLAY GOLF AND GET PAID FOR IT!
by pipai＠big.or.jp 17 Dec '03

17 Dec '03

<HTML><PRE>Hello, I work with a golf and travel company and we are looking for people that would be interested in earning money playing golf while enjoying some incredible benefits. While working (or playing) with this business you will enjoy the following: š Deducting greens fees, cart fees, equipment, and club dues from your income taxes, š Working from the comfort of your own home over the telephone or on the course, š Accessing discount golf trips to fantastic golf destinations throughout the world, š Purchasing top - of - the - line golf equipment at below discount retailer prices, š Receiving over 50 percent off greens fees at over 3000 courses across the country, š Having access to our outstanding training and support system that insures success, š Earning an immediate primary or secondary income doing something you love, As part of our Team, there are two primary ways to build your golf business. You can either make a point to play a lot more golf and talk with others about tremendous discounts on golf equipment, golf travel packages, and our business, or I can teach you to build your entire business over the telephone from the comfort of your home via direct mail or mass Email. The choice is yours. The startup cost is between $500 to $800 depending on how you choose to operate your business and includes: a small business tax package, The Lifelinks Select Program, an Antigua golf shirt with corporate logo, The Fran Tarkenton Small Business Package, instructional golf video, The Golfers Travel Benefit Package, product catalogs, audio tapes, golf hat, golf balls, an advertizing kit and many other collateral materials. Our startup and training packages were designed to give you everything you need to operate a legitimate home-based golf business. Think about it, you can play more golf for less money , take it off of your income taxes, purchase brand name equipment at rep prices, and make money while having fun on the course. This is a serious venture and many of us are making thousands of dollars a month and you can to if you are willing to play more golf and plug into our very simple training system. Whether part or full-time, if you feel you have a legitimate interest in making money with your passion for golf please call 1-904-634-8057 for a two minute recorded overview then leave your name, state, and both work and home phone numbers. We will be glad to rush you a free comprehensive information package. Please, serious inquiries only. I apologize for any inconvenience and hope to hear from you soon. Thank you for your time. Best regards, Wally Ludviksson PS: Call 1-904-634-8057 now for the two minute overview and to receive your free comprehensive information package. </PRE></HTML> pÁ(a)big.o

1 0

about MISTY encryption algorithm
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

Mitsubishi Electric Corp. has developed new secret-key cryptosystem MISTY1 and MISTY2, which are ciphers with 128-bit key and 64-bit data block. They are provably secure against differential and linear cryptanalysis,and also fast on software implementations as well as on hardware platforms. Using ciphers on wide-area networks requires a method to maintain security as long as its encryption key (password commonly shared by a sender and a receiver) is kept secret, even if the mechanism of the encryption is made public. However,possibilities of unauthorized access will increase when the encryption mechanism is made public. In fact,several encryption algorithms, whose specifications were made public,have been compelled to make specification changes, and to sacrifice their encryption speed in return for an increased cipher strength to protect against recent decoding methods. This is why an encryption system whose security against these decoding method is strictly evaluated at the design stage has become necessary. Since announcing its linear cryptanalysis,Mitsubishi Electric has been making efforts to develop encryption technology backed by adequate security. In January 1994, Mitsubishi Electric performed the first successful experiment to decode the Data Encryption Standard (DES), an American standard commercial encryption system, to quantitatively evaluate its strength using this linear cryptanalysis. Using this evaluation technology, Mitsubishi Electric has developed an encryption algorithm that provides sufficient security and achieves high speed encryption. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Re: "First do no harm"
by James A. Donald 17 Dec '03

17 Dec '03

At 12:16 AM 10/20/97 -0500, Jean-Francois Avon wrote: > In the old days, you used to scramble through his mountain of > paper on his desk. In more recent days, you frantically > scanned his exemplary organized data structure and found > the documents. Today, the said data structure is still > exceptionally orderly, but only to reveal several very > describing filenames with a dot-asc or dot-pgp extension. > > Any comments? Sounds like a good argument for banning employees from purging their mail. :-) This employee regularly purged his mail, an operation far more effective than merely encrypting it. In well run companies, the boss does not wade through the employees trash. If I have email that I may need to refer to, I file it appropriately. PGP is not primarily designed for storage of sensitive data. Insert usual argument concerning encryption of transmissions versus encryption of storage. Your argument is an argument for corporate access to secure file systems, not corporate access to secure email. For some far from mysterious reason, those who provide secure file systems feel little need to provide a back door. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: OUBAKAYAROU!! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 18 Oct 1997 23:02:36 -0700 > From: Bill Stewart <stewarts(a)ix.netcom.com> > Subject: Re: OUBAKAYAROU!! (fwd) > At the time the list was created, and I subscribed to it, > the announcement indicated that cypherpunks-j and cypherpunks-e > were independent lists, rather than mirrors, No, Bill, the cypherpunks-e list was announced by me and it was announced as a *specific* member of the existing CDR started at my specific request. Only the cypherpunks-j was ever announced as the indipendant list, which I intended to change. I further sent out a note requesting feedback on non-English traffic and it's acceptance on the existing CDR. I received nothing but smart-ass replies so we decided not to gateway that traffic but leave the cypherpunks-j traffic fully indipendantly. That lack of responce is what motivated the cypherpunks-e list. It was nearly a week after the -j list that the -e came online because I had to work that weekend and the -j operator was going to Australia. > Well, for a while, -e was badly broken. However, if the purpose > of the list is to be yet another mirror, fine, getting list mirrors > working is a trickier job than getting an independent list up and working. It is still 'broken' in that the mailer software they use doesn't accept submissions with blank subject: lines. As a consequence I get several bounces a day, usualy from anonymous accounts, that I simply /dev/null. Whether this is a bug or a feature is up to your own interpretation. I am looking into putting something in place so that SSZ puts something like: Subject: [unknown subject] on the traffic that is subject: blank since the -j and -e remailer software can't have this behaviour turned off. > Yeah; you've been getting flaked a lot lately. I remember back > in the old days having to get New Jersey Bell to deal with > bad data quality on my home voice line About the only good thing I can say is that I got a $150 credit and the phone bill is $70/month for the 3 analog lines so I get to ride free dial-in's on SWBT's dollar for two months. The ISDN seems to be relatively stable since turning in the trouble call and doing the testing, which showed 100% reliability (right). ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Revealing individual messages.
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:34 PM 10/18/1997 +0100, Ian Miller wrote, to ietf-open-pgp(a)imc.org >One thing sadly lacking from all current PGP implementations is the ability >to reveal the contents of _some_ messages encrypted to you, without handing >over the secret key. This is most important as damage limitation when >ordered by a court of law to reveal certain messages. [The most >pathological case is where Mallory has generated those messages himself, >merely to persuade the courts to force you to hand over your privacy key.] The easy approach is to decrypt the message, but there's of course no way for the Court to validate that your decryption was correct. But if you want more than that, it's not hard to write, either by finding where in the 7000 pages of PGP source (:-) to add a few print statements, or by using the APIs when they come out. Perhaps it's even there today, by setting -debug=42 or whatever. The decryption needs to show 1) The public key that was used to encrypt the message 2) The PK-encrypted session key, including the random padding 3) The decryption of the PK-encrypted session key, including the random padding, (and including the algorithm indicator, if it's encrypted) 3.1) Indication of which bits are the session key itself, for the slow-witted 4) The decrypted compressed plaintext (optional) 5) The decrypted raw plaintext And it would be nice to have a tool that also provides a mechanism to encrypt a random-padded session key to a public key to verify the output. Perhaps Adam Back (et al.)'s 2-line perl code, with some pretty output formatting. > Accordingly for RSA encryption at least I propose a >modification to the DEK plaintext that contains the session key. Currently >this is largely random containing over a hundred bytes of nonce >(for a 1024bit-key). If part of this nonce was replaced by sender-Id, >timestamp and similar data, then Alice would at least learn who had sent >the message (Bob) and when. They might then have to opportunity to contact >the Bob to ask for retransmission and warn of the interception. No way. This is bad. You don't want traceability built into PGP. If the sender _wants_ to be traceable, he can sign the message. If the sender wants convenient but repudiable identification, he can put his name and any other information he wants in the plaintext. Besides, PGP doesn't know who the sender _is_ except by signature; you can set a default key if you like, but otherwise there's no way for PGP to decide whether to use the "Bob <marley(a)wailers.com>" key in Bob's secret key ring, or the "Louis Freeh <biglouie(a)fbi.com>" key, and for that matter PGP will work fine with no secret-key file at all. If you're concerned about Bad Cops planting forged messages on people, this won't help - it's easy for them to forge unsigned information also. After all, the PGP source code is open, so Bad Cops can add code to set the timestamp/sender/etc themselves. Or they can ignore code, and just set their system clock appropriately. Thanks! Bill Bill Stewart, stewarts(a)ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0