December 2003 - cypherpunks-legacy

Re: (eternity) Eternity as a secure filesystem/backup medium
by Kent Crispin 17 Dec '03

17 Dec '03

On Wed, Jan 21, 1998 at 03:04:07AM +0100, Anonymous wrote: > Bill Stewart writes: > > > >Do the math, though, for 128bit. There are traditional analyses > > >which include the amount of silicon on the earth, the number of atoms > > >in the universe, etc. The general consensus is that traditional > > >techniques are not feasible for brute forcing 128bit ciphers before > > >the heat death of the universe. > > > > Hard to say. Assuming that Quantum Cryptography doesn't allow > > finite-sized computers to do large exponentially complex calculations > > in short finite time, you're probably limited by the number of atoms > > in the available supply of planets, and Heisenberg may still get you > > if that's not a low enough limit. Moore's law isn't forever. > > A practical 128-bit key-cracker could be built with about 10000 cubic ^^^^^^^^^ > meters of silicon. (Figure one transistor per cubic micron, 1 ghz > operation, do the math...) The technology to build a computer of that > size is still a few years away, but it is theoretically possible to build ^^^^^^^^^^^^^ > a 128-bit key-cracker without using quantum computers or travelling to > other planets. "In theory, theory and practice are the same, but in practice they are different." -- Kent Crispin, PAB Chair "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0

Is cyberpass.net down?
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Considering the paucity of traffic and the cyberpass.net deferred time-outs I suspect there is a problem over there. Anyone got a clue? Danke. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

security and hidden networks (was On the LAM--Local Area Mixes)
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

summary this post suggests that technically, routing through a sub-network does not necessarily increase complexity or hinder traffic analysis, as it can be treated as a virtual node. given that, LAM-type networks may not provide much protection in a politically unkind environment. i also suggest a way of rating (or classifying) secure networks based on how well they hide suspect data and routes in other traffic. as this in response to tim may's LAM post, i'll respond quoting that. Tim May <tcmay(a)got.net> writes: >A message would enter the physical site, bounce around to N machines, and >exit, perhaps going to other machines and sites, and back again, etc. (The >image was of perhaps 20 or 30 cheap PCs linked with Ethernet in a set of >apartments in Berkeley--obtaining search warrants or court orders to allow >monitoring of all 20 or 30 machines, scattered across several physical >addresses, would be "problematic.") i won't repeat my objections to a reliance on "problematic" court orders, which i've made in another post. let us simply assume, for example, that i am the NSA, and i don't need court orders, but i'm a sneaky sort so i don't want to go in with guns blazing just yet. Alice has a network, alice.net, 10.1.1.0. she has many machines on this network, some hers, some belonging to Bob. when Alice and Bob plan stink-bomb attacks on the IRS (sorry, when they, or Li-Xia and Bu-pang, write articles on human rights violations in xinjiang) to Carol and David, outside their network, they first bounce their packets around their 30 machines. i sniff all packets going into and out of the network 10.1.1.0, from the upstream provider (Alice has her whole building in a faraday cage, which is ok because she never tries to use her mobile phone indoors). so. does it matter in the least, to me, whether alice wrote her last rant from kitchen.alice.net (10.1.1.1) or garage.alice.net (10.1.1.2) or whether it was actually Bob - Bob Inc, to be safe - from 10.1.1.33? it could matter politically/legally (if i wanted to prosecute) or technically (if i want to trace traffic down, to, from or through alice's net). technically first: it doesn't really matter. i treat alice's net as a hermetically sealed virtual "node"... >-- the routing topology of the site may be an interesting area to look at. >Ideally, a "Linda"-like broadcast topology (all machines see all packets, >like messages in a bottle thrown into the "sea") could have certain ... which is all the more correct topologically if broadcast addresses (10.1.1.255) are used. so i treat alice's net as a single node, and monitor traffic as it enters and leaves that "node". just as i would monitor traffic entering and leaving a single machine, without caring much which disk drive or memory bank it passed through. with a single physical entry and exit point to the network it can be treated exactly as if it were a single node for the purposes of any traffic analysis (security/traceability). multiple physical connections might complicate it slightly, but if i'm sniffing them all, and they connect to the same set of machines (i.e. the same network), not much (if it's IP the address spaces may differ but that's a minor matter). depending on what remailer math tells us - and we really do need remailer math, as tim pointed out! - bouncing traffic around sub-nets may have little impact on security. it could remain the same; i don't see how it could become much better; it could plausibly get worse, if multiple nodes in a single subnet can eat into your random route hops resulting in concentration of traffic through fewer virtual "nodes". the only situation in which this isn't true is if the source and destination of traffic are both within the sealed network - presumably what would happen most of the time with tim's suggestion of voice/high-bandwidth stuff. now for the political/legal bit. given that i'd like to see cypherpunk technology as daring enough to be of use outside western democracies, let's look at a slightly challenging situation. you're a bunch of people, each with your own firm for added safety, in this building. now i'm not a decent american cop, worried about court orders etc. ok, i don't exactly want to shoot all of you at once. but if i am satisfied (which i could be, using technical methods) that lots of "suspicious" stuff is coming from your network, then i'll certainly come in and reeducate you all on your "errors and distortions." (sorry, just finished a week of watching andrzej wajda films at a retrospective.) oho. it's a BIG building. and i don't really suspect all of you. ok, i go have a chat with the network admin - Alice - and hold her responsible. she has great respect for the government and police and would never write such a nasty thing as "the state tortures political prisoners?" uh oh. so i tell her that for the good of the country she must let someone listen in at her machine ("you didn't keep logs? ah, that was a mistake, no?") - i'm now inside, and the sealed network shrinks. of course if i'm impatient and don't believe her innocent approach, i just use the rubber hose. the same goes for multiple physical links into the same network. can _technology_ - rather than relying on law-abiding cops, and rights-abiding laws - provide a solution? the key is the BIG building. the more non-suspicious routes there are - i.e. a route through normal, unsuspected people, typically but not necessarily outside the physically well-protected area - the harder to usefully treat a network as a virtual node. looking at 10.1.1.0 as a node may help, just 256 people there; but 10.1.0.0 is a bit big to make a coherent "node" so although a LAM may be a great way to _test_ new tech and protocols out, i'd think it a big mistake to actually deploy it, as it were, on a large scale. it wouldn't help at all in the tough spots, and it would only serve to make the easier spots tougher, strengthening the immune system of would-be tyrannical states (i.e. the nicer western democracies). in general "WAMs" would be much more helpful and secure. the other thing that helps is of course the degree of non-suspicious traffic on suspected routes. putting them together, i think you can get some measure of the utility of a protocol and topology. the ideal would a) make it technically impossible to trace the route of suspicious traffic; and b) make it politically/legally difficult to prosecute originators/destinations of suspicious traffic. it would do this by a) blurring the distinction between suspicious and "regular" routes; and b) make it difficult to distinguish suspicious from harmless traffic on those routes; c) make it difficult or impossible to block suspicious routes or intercept/monitor suspicious traffic without causing unacceptable deterioration of service for "ordinary" traffic. two ratios seem useful to me as a way of organising cryptoanarchic network protocols. suspicious routes/ordinary routes; suspicious/ordinary traffic on any route. an ideal universal DC-Net with padding to keep constant throughput would have both ratios tending towards 1 - there is only one route - broadcast - for everyone; and traffic is constant so the degree of really suspicious stuff is unknown. pure Blacknet-type systems tend towards [1,0] - there is only one route, assuming everyone uses it. but without padding, you could suspect all traffic. Pipenet tends towards [0,1] - there are many routes, and they're all pretty suspicious as it's possible for the monitor to discriminate among them. but traffic is constant, so you don't know when to suspect. regards, rishab First Monday - The Peer-Reviewed Journal on the Internet http://www.firstmonday.dk/ Munksgaard International Publishers, Copenhagen Intl & Managing Editor - Rishab Aiyer Ghosh (ghosh(a)firstmonday.dk) Mobile +91 98110 14574; Fax +91 11 2209608; Tel +91 11 2454717 A4/204 Ekta Apts., 9 Indraprastha Extn, New Delhi 110092 INDIA

1 0

$50 encryption policy contest
by Dr. Alan Sherman 17 Dec '03

17 Dec '03

$50 www Contest I will pay $50 to the best www page created by 12noon EST, February 15, 1998, meeting the enclosed specifications. In short, the page must have a form through which anyone may enter a question, which will be automatically entered onto a list of submitted questions displayed on another page. I will use the winning entry to collect questions for the upcoming March 6 talk on encryption policy by Barry Smith (FBI). How to enter: email a url of your entry to sherman(a)cs.umbc.edu include the phrase "Barry Smith Contest Entry" in the subject header. All URL's for all entries will be listed from http://www.cs.umbc.edu/events/spring98/crypto2.shtml Rules: 1. The page must work from the CMSC computing environment, but initial judging will take place on the designer's server. 2. Anyone in the world may enter. 3. If no one submits an adequate entry by February 15, a $20 prize will be awarded to the best entry that meets a restricted set of specifications. In this case, the contest will be extended for one more week, with a reduced prize of $30 for the best full entry received by 12noon EST, February 22, 1998. 4. Entries will be judged on the basis of satisfying the specifications, robustness, creativity, ease of use, and visual appeal. 5. Group work is allowed and encouraged. 6. I will be the sole final judge of the winner. Specifications: A. $20 Restricted Specifications 1. The form must include entries for a restricted-length question (at most 500 ascii characters), an email address, and optionally a name. 2. The form must include a submit button, which when clicked, will automatically append the question to a list of questions on a separate www page. Each displayed question must include the author's email and name (if provided). B. $50 Full Specifications In addition to the $20 specifications, the forum must also meet the following sp[ecifications: 3. (**important**) The page of submitted questions must have a means by which anyone can score the quality of the question on a scale of 1 to 5 (say, by clicking on the appropriate score button), with 5 being the highest score. For each question, its median score must be displayed. Questions must be listed in order of decreasing median scores. 4. The form must have an entry for optional URLs. These URLs must be posted with the question in such a way that they are active. 5. There must be an entry for sender status (selection from a list of options, such as cypherpunk, NSA employee, UMBC student, other student, government employee, faculty, industrial engineer, ...) 6. (optional) For each question, also list the number of votes entered for each score in addition to the median score. 7. (optional) Reject any question containing a vulgar word. 8. (optional) Feel free to add other appropriate constructive functionality.

2 1

Student expelled for writing hacking article, from Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 21 Jan 1998 10:49:17 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Student expelled for writing hacking article, from Netly News The "So You Want To Be A Hacker" article in question: http://cgi.pathfinder.com/netly/editorial/019821.html -Declan ****** http://cgi.pathfinder.com/netly/opinion/0,1042,1699,00.html The Netly News (http://netlynews.com/) January 21, 1998 Hacking 101 by Declan McCullagh (declan(a)well.com) The end of senior year for most high school students is a time for college decisions, vacation planning and beer-tinged teenage revelry. Not so for Justin Boucher. Today the Milwaukee, Wisconsin-area native will be expelled from Greenfield High School because of an article he wrote entitled "So You Want To Be A Hacker." Published under a pseudonym in an unofficial student newspaper, it described in colorful (and sometimes profane) language how enterprising snoops could break into the high school's computer network. The advice ranged from the glaringly obvious ("Some commonly used passwords at very stupid schools are...") to the Hacker Code of Ethics ("Never harm, alter or damage any computers"). The finer points of hacker morality and teenage toomfoolery, however, were lost on irate school officials, who expelled Boucher for one year. [...]

1 0

javasoft password?
by Adam Shostack 17 Dec '03

17 Dec '03

http://developer.javasoft.com ok, so who set the password for the cypherpunks account here, and why isn't it cypherpunks or writecode? :) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: British Ministers Adopt Unbreakable Crypto
by Bruce Schneier 17 Dec '03

17 Dec '03

> >LONDON (AP) -- It's a briefcase even James Bond could love. > >Britain's more adventurous Cabinet ministers soon will be spiriting >laptop computers inside their signature ``Red Box'' briefcases, >complete with fingerprint recognition systems and silent alarms. > [.....] > >``There is even a duress finger,'' Rushworth said. ``That is for if a >terrorist or gunman has a gun to the minister's head forcing him to >open the computer. It will appear to function normally but doesn't, >and sends a silent alarm to the Cabinet Office.'' This is INSANE. How could someone be so stupid as to announce such a feature in a newspaper. I guess this means that if a terrorist sees a Cabinet minister with such a computer, he had better shoot to kill. The whole point of a feature like this is that its existence is secret. Someone is NOT paying attention. Bruce ********************************************************************** Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 101 E Minnehaha Parkway, Minneapolis,MN 55419 Fax: 612-823-1590 http://www.counterpane.com

6 5

Microsoft and DoJ: which one has guns?
by Declan McCullagh 17 Dec '03

17 Dec '03

A long-sounded theme at least on cpunks... ---------- Forwarded message ---------- Date: Wed, 21 Jan 1998 12:51:19 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: FC: More on Don Boudreaux "Calm Down" letter on Microsoft My article on the politics of antitrust: http://cgi.pathfinder.com/netly/opinion/0,1042,1678,00.html -Declan ******** Date: Wed, 21 Jan 1998 14:35:48 -0500 From: James Love <love(a)cptech.org> To: declan(a)well.com Subject: Re: FC: "Calm down!" -- Don Boudreaux letter to NYT on Microsoft Calm down Don Bx, If Microsoft really has great software, it doesn't need to use these heavy handed tactics. jl -- James Love Consumer Project on Technology P.O. Box 19367, Washington, DC 20036 love(a)cptech.org | http://www.cptech.org 202.387.8030, fax 202.234.5176 ********** Date: Wed, 21 Jan 1998 15:09:14 -0500 From: Don Bx <dboudreaux(a)fee.org> To: Declan McCullagh <declan(a)well.com> Subject: Re: FC: "Calm down!" -- Don Boudreaux letter to NYT on Microsoft (fwd) Sincere thanks to all who wrote in response to my letter to the NY Times. One point: Vigorous competition and clever marketing are NOT anticompetitive. Yes, Microsoft owes much of its success to hard bargaining; yes, Microsoft is a wiz at marketing; and yes, Microsoft's products are not as good (in an engineering or technical sense) as are some products produced by rivals. But antitrust law is meant neither to outlaw hard bargaining and marketing, nor to ensure that only the technologically best products survive on the market. Too many computer experts wrongfully infer from the fact that MS's products aren't the best available to the conclusion that, therefore, MS's success is illegitimate. Such a conclusion would be like saying that General Motors's success is illegitimate in light of the fact that Lexus and Porshe make better automobiles. Bill Gates may be an ass; I don't know and I don't care. I never met the man. But I do know that antitrust law has done great damage to this nation's economy during the past 100+ years. The DOJ has guns; Bill Gates doesn't. When DOJ enters the picture, it literally threatens to shoot consumers and businesses who refuse to do as it says; Bill Gates makes no such threats. For that reason alone I'm all for keeping Bill Gates free of government interference. Don Boudreaux -------------------------------------------------------------------------- POLITECH -- the moderated mailing list of politics and technology To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: subscribe politech More information is at http://www.well.com/~declan/politech/ --------------------------------------------------------------------------

1 0

Swinestein for Senate!
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

ACRAMENTO, Calif. (AP) - Sen. Dianne Feinstein ruled out a race for the Democratic nomination for governor Tuesday, saying she didn't want to enter "a very debilitating campaign environment." Feinstein's decision came less than two weeks after President Clinton personally urged her to enter the race. That call followed pleas by Democratic members of Congress and the state Legislature to run. "I made the decision definitely last week," she told reporters in a telephone conference. "It was like a huge weight that came off my shoulders." "It's a long story. There probably has been no decision in my life ... that I have put more thought and energy into. There also has been none that has caused me more angst," Feinstein said. "The decision moment came in a way ... in the conversation with the president ... I thought if any call were to push me over the brink, it would be a call from the president of the United States." Feinstein said it was during that conversation that "I realized my ambivalence," she said. Feinstein, who had been weighing a race for the Democratic nomination for months, said she could serve the people of California better in the U.S. Senate. Gov. Pete Wilson, a Republican, can't run again this year because of term limits. The leading Republican candidate is Attorney General Dan Lungren. Other Democrats considering running are Lt. Gov. Gray Davis, businessman Al Checchi and state Senator John Vasconcellos. Feinstein, 64, lost a close race for governor in 1990 to Wilson. She was elected to the remaining two years of Wilson's Senate term in 1992, defeating his appointed successor, and ran again in 1994 to win a full six-year term.

1 0

Will bureaucrats turn the Net into TV? Note from FCC
by Declan McCullagh 17 Dec '03

17 Dec '03

A note from an acquaintance formerly at the FCC. --Declan ---------- Forwarded message ---------- Having spedt my years at the FCC doing pre-repeal Fairness Doctrine and Sec. 315 equal time matters, I think [deleted-dm]'s concerns, tho' justified politically [because most adminsitrations will leave no good technology unhobbled] are without substantial legal basis. The hook for the Fairness Doctrine obligation imposed on broadcasters as a corollary to their statutory 'public interest' obligations was as a licensee of scarce broadcast spectrum--a discrete frequency awarded on a putatively compettive basis. Those key elements[scarcity/license/obligation] are--for now--lacking in the on-line environment. And while no doubt this or another Administration, or wiley Congressional staffer could gin up a plausable nexus between the web and interstate commerce, sufficiient to sustain a new public interest obligation, I think we're two or three generations of bandwith scarcity away from that becoming a compelling element of a cyber-resource allocation scheme. Without that overarching allocation-based [license] compulsion (to force even facial compliance with an obligation, so that enforcement would become essential to compliance, thus creating a need for thousands of Web police to review commercial licensees sites and traffic--[what a nightmare] -) -the liklihood of developing a meaningful scheme of public interest obligation would be a an overdebated and overhyped PC exercise, quickly becoming comic--and then dangerous.

3 2