December 2003 - cypherpunks-legacy

Re: Using a password as a private key.
by Christopher Steel - Java Design Center McLean VA 17 Dec '03

17 Dec '03

Why not encrypt the private key with a 128 bit symmetric key (created from the hash of a username and paasword) and store on a keyserver, along with the public key? That way, you don't have to store it yourself locally, you get it off the keyserver. I wrote a keyserver that does just that. In addition, it also verifies ies the user before returning the key. It requires the user to encrypt a known string with a separate password. The encrypted string is sent to the keyserver, encrypted with the keyserver's public key. Seems rather safe. Anyone disagree? -Chris P.S. I might not use it for military purposes, but for company email... "RedRook" <redrook(a)yahoo.com> wrote: >Date: Tue, 27 Oct 1998 13:53:07 -0800 (PST) >Assymetic crypto systems such as >Diffie-Hellman, El-Gamel, and DSS, allow the private key to be a >randomly chosen number. But, as a cute hack, instead of using a >random number, for the private key, you could use a hash of the User >Name, and a password. > >Doing so allows the users to generate their private key on demand. >They don't have to store the private key, and if they want to work on >a another computer, they don't need to bring along a copy. >Has any one tried this? Is there existing software that does this? Any >comments on the security of such a scheme? >The only draw back that I can think of is the potential lack of >randomness in the key. If the user chooses a bad password, it would be >possible to brute force the public key. >Harv.RedRook(a)yahoo.com >_________________________________________________________ >DO YOU YAHOO!? >Get your free @yahoo.com address at http://mail.yahoo.com >

1 0

Cameras in Public Places (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 26 Oct 1998 11:57:22 -0800 > From: Michael Motyka <mmotyka(a)lsil.com> > Subject: Cameras in Public Places [ravage: don't remember who said it... > > ] > > Privacy is also needed on public places (e.g., violated by face > > recognition systems) Anonymity is not equal to privacy. > The appropriate way of dealing with them is to wait for some people to > be misidentified and then file suit against the municipality using the > equipment. Harassment, false arrest, invasion of privacy, abuse of > power, loss of reputation, loss of the ability to earn a living - take a > few of the cities for $10 or $20 million and they'll get the message > that they've been had by the SW vendors. It makes no more sense to outlaw cameras in private or public places than it does to outlaw printing presses in some areas, a very basic way they're identical from the perspective of the law - it isn't the media that matters (with little respect to Marshall). What matters is they record some 'instance' and allow it to be distributed widely. What we do need is a mechanism that prohibits the police or other law enforcement bodies from access without a properly served warrant. Camera use in say a mall is permissible because it's the vendors who pay the rent who are deciding what is and isn't safe - not the customers of those vendors. It's permissible in traffic control and such because it is cost effective in those applications. In traffic control, if a motorist stalls or a wreck occurs the civilian (ie non-LEA) operators can call the necessary resources into play. Once the cop is on the scene a warrant could be issued if charges of some sort are filed. Ulitimately, what we need is a law that says: All law enforcement personnel are prohibited from accessing public or private documents in the course of their duties without a properly served and executed warrant. The two key points are 'public and private' and 'course of their duties'. A cop should be able to walk into a public library and get a book on some subject of interest (even law enforcement). But if it's related to the LEA's cases then a warrant should be required to step foot in the building. Now if he's a beat cop walking his patrol he obviously can't stop chasing a perp on the run who traverses the library (though it is highly unlikely they would stop to read, but imagine a dope deal just as well). Now, one way to deal with that is to insert some sort of phrase about 'openly accessible' or 'anonymously accessible' (that way the question becomes does one need an ID, if so then you need a warrant). ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

looking for articles
by Homayoun Saleh 17 Dec '03

17 Dec '03

Hello, I am looking for any articles or papers having to do with the computability of Poisson distributions in the plane, and someone suggested I ask this list. If anyone knows of anything related, or where else I should be looking, please let me know. Thanks a lot. Cheers, Homayoun

1 0

looking for articles (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 27 Oct 1998 18:13:14 -0500 (EST) > From: Homayoun Saleh <hsaleh(a)phoenix.Princeton.EDU> > Subject: looking for articles > I am looking for any articles or papers having to do with the > computability of Poisson distributions in the plane, and someone suggested > I ask this list. If anyone knows of anything related, or where else > I should be looking, please let me know. > Thanks a lot. Not sure it's what you're looking for but: Statistical Distributions M. Evans, N. Hastings, B. Peacock ISBN 0-471-55951-2 It's got around 40 different distributions and their related equations and characteristics. There is also an appendix that lists the various distributions and the functions in several computational math programs (go MapleV !)... Now if you're looking for various approaches to how to impliment it then I can't help you there, I cookbook that sort of stuff out of my library. Have you tried Knuth? ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Rendering ( was MIB Subponeas ) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 26 Oct 1998 11:31:52 -0800 > From: Michael Motyka <mmotyka(a)lsil.com> > Subject: Rendering ( was MIB Subponeas ) > Collecting real names and addresses is, apparently, enough of a concrete > step to at least begin the "rendering" process. Which is the whole point of probable cause and civil rights. It turns out the 'respect' part is the hard one...;) > press-squashing, poison-cow BST boys ). Then what would be needed is > some sort of Eternity Service for an active server - detect tampering > and jump hosts. Actualy, something like Plan 9 would be more effective. That way the thing is distributed from the get go. With a suitably object oriented approach it could be feasible to distribute the data to specific servers but encode the program in the connections between the servers task swappers. By using Plan 9's economic resource bidding model it injects a level of anonymity in the repetitive execution aspect that wouldn't normaly be there. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Using a password as a private key.
by Anonymous 17 Dec '03

17 Dec '03

RedRook(a)yahoo.com writes: > Assymetic crypto systems such as Diffie-Hellman, El-Gamel, and DSS, > allow the private key to be a randomly chosen number. But, as a cute > hack, instead of using a random number, for the private key, you could > use a hash of the User Name, and a password. > > Doing so allows the users to generate their private key on demand. > They don't have to store the private key, and if they want to work on > a another computer, they don't need to bring along a copy. Has any one > tried this? Is there existing software that does this? Any comments on > the security of such a scheme? The only draw back that I can think of > is the potential lack of randomness in the key. If the user chooses a > bad password, it would be possible to brute force the public key. You can accomplish the same thing by encrypting your private key (including RSA) with a passphrase and publishing it. Because of the problems with passphrase bruting, it probably only makes sense to do this with a machine-generated passphrase which has guaranteed entropy. Something like: "Aarhous mocrader Fals paca rate portion wiserustingned" has a guaranteed > 128 bits of entropy, which should be enough for most purposes. Probably with an hour's study most people could memorize such a passphrase.

1 0

Re: UK police chase crooks on CCTV (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: bill.stewart(a)pobox.com > X-Sender: wcs(a)idiom.com (Unverified) > Date: Mon, 26 Oct 1998 09:27:28 -0800 > Subject: Re: UK police chase crooks on CCTV (fwd) > >> ``The only people entered on to the system will be convicted criminals > >> who, through our intelligence, we believe are habitually committing > >> crimes in the area,'' > >> Dave Armond as saying. ``If people are not committing crime they have > >> nothing to fear, but if they are among the small minority who are, the > >> message is, 'We are watching out for you.''' > The policeman's statement, if honest, implies that the > system needs a real mugshot or more detailed set of pictures to work from, > so they're going to start with feeding it the Usual Suspects, > for whom they can get good data for the system to search. > It probably also has capacity limitations, so they won't be searching > for everybody they have pictures of, just the most likely. For now. What's the curve on facial recognition for 2x improvement? It would seem probable to me that there would be a feature to snap closeups off the cameras and feed them back in real-time. Talk about real-time traffic analysis. > >We need a law or court ruling pretty quickly in the US that sets the > >standard that a group of people have no more or less rights than an > >individual. This will required LEA's to provide probable cause prior to any > >actions against groups of people (such as this). > > Ain't gonna happen - are you kidding? If there is a ruling like that, > it'll be done in some way that restricts citizen rights rather than > expanding them, or expands police powers rather than restricting them. I'll have to disagree. > It's already legal for cops to hang around street corners watching for > suspicious activities or suspicious people, and all video recognition Um, it was always legal and should continue to be so, just as it should be legal for you or I to stand around that corner and watch for unusual activity. It's there job. They call it walking the beat. > Unfortunately, I'm being increasingly forced to take the David Brin position of > "Cameras are cheap, get used to it, just make sure we have more cameras > pointing at the cops than they have pointing at us, and make sure > the cameras the government has are citizen-accessible as well." I don't know about citizen-accessible. I don't want some joe blow walking down the street to get access to the cameras that track my trek to work each day. No, it needs to be very limited and require full interaction of the courts to gain access. Simply putting on a police uniform (or a army uniform) shouldn't mean you give up your rights as a citizen. This may be hard to believe, but I'm not the state's nigger and neither is that police officer or soldier. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

unsubcribe
by StoneCold-PT 17 Dec '03

17 Dec '03

unsubcribe ---Diederik Smets <Diederik.Smets(a)emd.be> wrote: > > IF the owner of the id also entered an internet password AND it is the same > as the one for the id file, then you can use brute force (dictionairies) to > try and crack it. Get the encrypted value in the > properties>fields>HTTPPassword of the persons document in the PNAB and > compare it to the results of the @password() function. > > Alternatively, do a search for old id files which might still be accessible > with the 'default' password (if you know which one that is), but you won't > be able to access servers that have the 'check password' option enabled. > > If you need to access a local DB that has 'enforce a consistant ACL across > all replicas' enabled, just use another id and add that person's name with > the necessary roles to the ACL via LotusScript. > > Diederik > > > Hello > I'm using lotus notes and I have a big problem. I have a id file with > no > password. How can I get a password for it or reset it. Is there some type > of > utility or something someone knows of?I have been told that I'm out of luck > unless I have the original. > > John... > > > == My Favorite Surfing Sites: http://www.dilbert.com/ and http://www.nro.odci.gov/ "To keep you is no benefit; to destroy you is no loss" by Thida Mam _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

RE: No Subject
by Harvey Rook (Exchange) 17 Dec '03

17 Dec '03

> More interesting, though, is this: why would a block cipher > use key bits > rather than an LFSR to do input or output whitening? Is it strictly a > performance issue? Is it proven that doing this doesn't leak > key bits in > some way? > > Mike > In many newer block ciphers, the key schedule comes from a fairly good one way hash of the key. Take a look at RC6, or TwoFish. Essentially this accomplishes the same thing as using a good LSFR. Harv.

1 0

Re: capitalism run amuck by Korton (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 26 Oct 1998 09:28:56 -0500 > From: Soren <sorens(a)workmail.com> > Subject: Re: capitalism run amuck by Korton > is that there is a distinct difference between capitalism in a free market, > and the kind of corporate-capitalism that the world is enmeshed in now. corporate-capitalism? Is that church-religion? Spin doctorism. The problem is that economics have social effects and by extension it has responsibilities along with them. We've allowed monetary interests drive our government instead of issues of true civil liberties. This should not be implied that this has *ever* been true. The Constitution starts out talking about creating a 'more perfect' union. It's a goal we should be striving for. The founding fathers knew they couldn't fulfill it, they knew their children wouldn't do it. They did believe that latter generations could achieve it. We haven't fallen from grace, and the politicians are probably not any more corrupt, because we never had it. If democracy fails it's because *WE* failed. The problem with free-markets is they give up all pretext to being imperfect and claim to be *the* answer. But at they same time it completely ignores an entire group of aspects of business operation and asks us to ignore them too. > The former allows for the free exchange of value based upon the participants > understanding of that value. That pretty much excludes Jews & Arabs, etc.... > concepts such as "natural wealth", "legal tender", "zero sum economies" Who in their right mind compares our economy to a zero sum economy? > An assumption is made that I fundamentally disagree with -- democracy > is the holy grail of human social intercourse.  Never, in recorded It's not the holy grail but there isn't another system with anywhere the potential for fulfilling human desires with a minimum of abuse and overhead. Perhaps it would be simpler to simply admit the obvious and clearly state that we no longer have a democratic system. > history, has democracy existed without the support of client slave states/populations.  Well considering the world didn't pop out of a test tube but evolved over time this argument holds little weight. The point *is* that democratic system hold the best model we know of to date. Our particular twisted model of it fails, that doesn't mean theory failed. It's one of the reasons I always chuckle at those who say the fall of the CCCP meant the fall of communism. What a maroon. > but its a whisper in a propaganda hurricane,  The US is not a democracy, > it is a republic. For those of you who don't know the difference; a democracy > puts everything up for grabs, including your life, liberty and the pursuit > of happiness, while a republic provides 'certain inalienable rights', similar > to those  currently being alienated by the Klinton Kongressional Klan. Um, actualy that is incorrect. A democracy is a system whereby the rules of the system are determined by interaction of the population at the individual level through a vote or other representitive mechanism. A republic is one (sic) that uses a Senate (an elected body of individuals supposedly held in high esteme, usualy two or more acting together) as that representative mechanism. There are actualy many different mechanisms that are usable in a democratic system. Another thing is that in a Democracy there isn't a need for a Bill of Rights since all participants are considered rational. The founding fathers had useful insite when they appended that document under protest. The problem with applying any political system is the 'shall not' and similar phrases. What is the most interesting to me is that there is absolutely no reason to have a President. There is nothing other than historical status quo that individuals need to be the leaders of countries. Washington knew this when he refused to be addressed as "Your Highness". It's a representation of mass human psychology. > to realise that under capitalism, democracy is now for sale to the > highest If so then it's only because we can't garner the support to pass an amendment. If the problem is that serious and wide spread it should be put to a vote and noted as an amendment. What simply amazes me is why neither the pro- or con- side of the gun debate ever brings this up. This whole issue could potentialy be solved by have the competing camps create two amendments and submit them to the houses in the individual states. Justification for this is pursuant (untested) in the fact that the people are given a right to redress of grievances. Since the law prohibits individuals from suing the government unless some weird permission is obtained then the next best alternative would be direct submission of potential amendments directly into the state legislatures. The people have a right to change the law via constitutional amendment unfettered by federal intervention or regulation. This would be a simple and expedient process with email being what it is... > <BLOCKQUOTE TYPE=CITE>is treated as progress. The world is now ruled by > a global financial casino staffed by faceless bankers and hedge > fund speculators who operate with a herd mentality in the shadowy > world of global finance.</BLOCKQUOTE> And you want to turn these folks loose in an economy with no regulation (ie free-market)? > details of our president's sex life and calls for his impeachment for > lying > about an inconsequential affair. Ok, so next time I have to speak under oath for a traffic ticket it's ok if I lie too? How about a murder trial? How about *your* murder trial? Anyone who doesn't understand the implications of a class based legal system in a democracy is lost in the ozone... I'm gonna stop now, this is entirely too long an initial troll and I don't have the time to go through it further. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0