December 2003 - cypherpunks-legacy

Re: CAD Stego (fwd)
by John Young 17 Dec '03

17 Dec '03

Jim Choate wrote: >This suggestion is unworkable in application. Why the focus on color, the easiest thing to avoid using, or layers, ditto? Superfluous for serious CAD, these dainty decorations from Martha Stewartville. Most messages could be concealed in "hatched" objects, bit-bloated as they are, indistinguishable from the elements used to hatch. All black and white; maybe a dot of red for cashmere dupe. In fact, CAD is so bloated with dumb cad-jockey features, and sleazebag work-monitoring logs, it puts most ordinary programs (even air-boss MS) to shame, and could hide a herd of rustled Mex longhorns as easily as the Bush family hides dryhole oil reserves, without any more trickery than sandpapering new boots to look worn. Anyway, Jim, I gather from your remarks that you've not fiddled for endless low-paid months and years to figure out how to cheat the evil bosses and automatic work-snoop feature, while onion-siphoning the Net for horny fare under guise of urgent file transfer to foam-mouth ne'erpays. Underground (so to speak) swapping of digital work avoidance tips is a huge use of global bandwidth riding on the backs of big fat docs for globular structures for maggoty thugs. (Although not nearly as gigantic as the porn trade stego-supporting Net infrastructre growth -- over 50% of Net traffic and rocketing.) Who knows how much illicit info is riding the porn river in and out of the most secure sanctums of tyrants?

1 0

let's do it: NYT ad with hash of fingerprints (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 23:21:38 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: let's do it: NYT ad with hash of fingerprints > I would have thought you would take out a cheap personals section > advertisement and print one hash output and a URL. The hash ouput > would be the hash of the hashes of a chosen set of public key > fingerprints. This doesn't provide the same sort of protection the original full page ad is supposed to provide. That full page ad will be accessible as a referenc a hundred years from now in just about every library in the country. The link to a webpage won't be. Distinctly different security animals. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

No Subject
by wabe 17 Dec '03

17 Dec '03

This is an e-mail which I am intentionally muddling by making it have very long lines and stuff. I plan on saving this too, to analyze later and try to recreate using some sort of silly "delete the misplaced carriage return" later. I'm not going to sign it though. So Bill Payne has the black box to sneakers but he won't publish it for fear the NSA will use it to read his e-mail and also because they pissed him off by trying to silence his critisisms of the way they handled something with Iran or something? I don't read legaleze very well.... -wabe

1 0

eternity economics (Re: (eternity) Eternity as a secure filesystem/backup medium (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 21:40:28 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: eternity economics (Re: (eternity) Eternity as a secure filesystem/backup medium > Eternity helps here in that it obscures the poster's identity, and > reduces their exposure in that they personally don't have to send as > many messages. Eternity also helps ensure continued availability, at > least while somebody is funding that availability. True enough, the question becomes who does that continued funding help the most? > Releasing the data themselves is problematic. They may not wish to > accept the risk. Eternity provides a way to pay someone else to take > the risks in ensuring availability. Really? What is the difference? Mallet attacks the server itself who has only the resources available from the source, which I believe can assume safely, which is obviously less than the resource set of those who could actualy act upon or impliment the data under discussion. > The users is getting value for money from the eternity servers -- the > eternity server is providing the service of risk taking. Yes, at bargain basement prices that allow, if not even promote, a daddy warbucks to walk in and up the ante above what the source can pay. No, the source payment mechanism does not promote either server honesty or long term existance of controversial data. We're going round and round here, as I said earlier the views are diametricaly opposite. I would suggest we drop this discussion and let us see what happens over the next few years as it is clear that many people are working on different implimentations. Let's let the market decide which works best. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: how to release code if the programmer is a target for (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 15:15:22 -0600 (CST) > From: "Uhh...this is Joe [Randall Farmer]" <rfarmer(a)HiWAAY.net> > Subject: Re: how to release code if the programmer is a target for (fwd) > > Where does this random user come from? > > Why does it matter? As long as she's competent enough to choose good verifiers > and verify that those verifiers verified the code in question, it all works out > in the end. Because whether she is a honest user or one who is intent on subverting the system is relevant and must be taken into account. > We don't. There is no way to operate without *some* trust; I disagree. I believe it is possible to create a system which is secure and provably so, irrespective of something as nebulous as 'trust'. > Might be, but this code has to be more than just understood -- it must be > painstakingly checked for subtle flaws and bugs. Welcome to the world of > adversarial quality control. Been there it's part of what I do for a living, it's fun. > > Which doesn't effect the ability of Mallet to resign that code at the users > > end in order to break the users local security. > > Unless you're exposing a new weakness in the trust model PGP uses, Mallet can't > do that, providing the user has done good key authentication and hasn't listed > one of Mallet's goons as a trusted code-verifier. This is true if Mallet is attacking the key system, it is not strictly true if Mallet is attacking a specific user. > Yup, that's why the user has to check it by hand. Then the Eternity model is doomed to fail. 90%+ of users who might want to use a data haven model don't have a clue as to how it works or how to actualy check it. > Well, if you can't verify it yourself and you can't trust other people to > verify it, my advice is to give up; you cannot be sure of *any* public keys I disagree, though I am not able to prove it at this time. > keys; any sig you check might be signed by one of Mallet's keys. My point exactly. As with Adam, it feels like we are beginning to go around and around with nothing new to add. I would suggest that we drop the issue for the moment and come back to it at a later time with a little more reflection. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Signed document - a thought... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 21:06:28 GMT > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: Re: Signed document - a thought... > Sounds like you are describing something which is a variant of an > interlock protocol. The idea of an interlock protocol is that you > send out first a hash of what you are intending to publish. > > The MITM has a problem in deciding what to publish, because they have > to publish _a_ hash, but they don't know what it should be of. Exactly. I hadn't heard of the term 'interlock protocol', thanks for the tip. I'll look into it some more. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: let's do it: NYT ad with hash of fingerprints (fwd)
by John Young 17 Dec '03

17 Dec '03

Jim Choate wrote: >This doesn't provide the same sort of protection the original full page ad >is supposed to provide. That full page ad will be accessible as a reference >a hundred years from now in just about every library in the country. The >link to a webpage won't be. Printed ads are sometimes not archived as widely as news articles, due to the cost of reproduction, distribution and storage. The same is true, though, of personals and other types of throwaways. One possibility is to buy an ad on the NYT Front Page which is often sent as an image around the world separately from the full paper, and on which one can buy a tiny ad for about $800 for two lines of text 32 characters long (ID must be included). That's the rate for a one-timer. Adam, could you reduce the requisite gob to fit 64 characters? Each extra line runs about $300. However, bear in mind that a news article is cheaper and will be archived for eternity (until Asteroid Endall); cheaper, that is, if you can pukedrunk a reviler.

2 1

Re: let's do it: NYT ad with hash of fingerprints (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sun, 18 Jan 1998 20:04:40 -0500 > From: John Young <jya(a)pipeline.com> > Subject: Re: let's do it: NYT ad with hash of fingerprints (fwd) > Printed ads are sometimes not archived as widely as news articles, due > to the cost of reproduction, distribution and storage. My experience with libraries is that they subscribe to the entire paper. Place it in their archives and then at some time in the future micro-fiche the whole paper. I have never seen a library that picked and chose what got archived in their paper morgue's. I have done research on newspapers going all the way back to the civil war, I have yet to find one that wasn't archived in toto, ads and all. > The same is true, though, of personals and other types of throwaways. True but the point was that the data these short ads point to is *not* archived by the same entity or necessarily any entity. Is your webpage being archived by your local library? I be the New York Times is. > Adam, could you reduce the requisite gob to fit 64 characters? Each extra > line runs about $300. Your going to compress 100 cypherpunks 64-bit keys (I prefer 128-bit) down to 64 characters without data loss? I wanna see *that* compression algorithm. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Onion routing
by ulf＠fitug.de 17 Dec '03

17 Dec '03

To protect against timing analysis, Onion routing uses encrypted and padded links, and the connection between the user and his local onion router is assumed to be secure. Obviously, padding offers protection against external adversaries only. The onion routers themselves know when an anonymous connection is opened, how much data is transferred, and when it is closed. So in contrast to the mix net (where it is sufficient to use one honest mix in a chain), honest onion routers that are used between two cooperating onion routers do not offer additional protection. Onion routers have a fixed number of neighbours. If the first onion router does not have any honest neighbours, there is no anonymity. Generally, the maximal connected component of honest onion routers forms the anonymity set. Does that mean that every onion router needs to maintain many encrypted links, or is there a more efficient solution?

4 4

NTY compression proposal
by Jim Choate 17 Dec '03

17 Dec '03

Hi, It has been proposed to compress the keys from 100 cypherpunks down to a 64 character add in the NYT. Let's consider the math a moment to determine if this is realizable. Each key will require some sort of identifier, to make it simple lets assume 8 characters to identify the cypherpunks and 8 bytes to represent their key (64-bits). This mean that each line will contain 16 bytes. With a hundred entries that is 1600 bytes or 12800 bits. Now 64 characters of text in a newspaper represents approx. 64 6-bit characters (we can't use a full 8-bit because the paper doesn't normaly support that many characters in normal text). This provides us with 384 bits. The proposal leads to a requirement for an algorithm with an average compression factor of: 12800/384 or 33.33:1 with no data loss. That's a pretty hefty compression factor for average responce. Is there a loss-less algorithm which provides this level? ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2