December 2003 - cypherpunks-legacy

Limit on number of primes....a (silly) typo...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Just to let you know, I had typed x/ln(x) as the asymptotic limit for the number of primes less than x. This is incorrect. It should be, x/log(x) I guess I did it by habit. Sorry. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Cypherpunks with guns
by Declan McCullagh 17 Dec '03

17 Dec '03

http://www.wired.com/news/news/culture/story/16433.html A group of San Francisco Bay Area cypherpunks recently spent hundreds of dollars per person on "defensive handgun" and "practical rifle" courses at the Front Sight firearms training institute in Aptos, California.

1 0

:-)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Tue, 24 Nov 1998 10:39:41 -0500 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef(a)substance.abuse.blackdown.org Cc: bostic(a)bostic.com Subject: Is there any Substance to this Email ?? Date: Tue, 24 Nov 1998 10:43:51 -0500 From: glen mccready <glen(a)qnx.com> Resent-From: 0xdeadbeef(a)substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef(a)substance.abuse.blackdown.org> archive/latest/274 X-Loop: 0xdeadbeef(a)substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request(a)substance.abuse.blackdown.org Status: U Forwarded-by: Chris Wedgwood <chris(a)cybernet.co.nz> From: tph(a)longhorn.uucp (Tom Harrington) Newsgroups: alt.folklore.computers Subject: Re: Win 98 Snitch? Message-ID: <7279b8$ahr1(a)eccws1.dearborn.ford.com> Mark Statzer (mstatz(a)net66.om) wrote: : Microsoft slapped two more lawsuit against one teenager and one : retired worker for using pirated Windows 98 software. : For your information on how Microsoft actually trace : PIRATED/COPIED/UNLICENSED Windows 98: : Whenever you logon into the Internet, during the verifying password : duration. Your ISP (Internet Service provider eg:SingNET, PacNET, : CyberNET, SwiftNET) will download a SUB-REGISTRY ENCRYPTED HEXADECIMAL : (containing all your PROGRAMS serial numbers installed into Win98!!) : file from your Windows 98 registry. Then they send this SUB-REGISTRY : to Microsoft for verification. And ONLY Microsoft knows how to decode : this encrypted hexadecimal file. If Microsoft verified that the serial : numbers are authentic, then they WILL REGISTER THOSE NUMBERS FOR YOU : A-U-T-O-M-A-T-C-A-L-L-Y !!! : And if Microsoft denied those serial numbers, then they will send an : E-Mail to the ISP you dialed into and your ISP will start tracing : everyone who logons to their systems. That's why during sometime for : no reason your Internet started slowing down. And if your ISP verified : that the SUB-REGISTRY ENCRYPTED HEXADECIMAL file is yours, they will : send : your information over to Microsoft Singapore. And there they will : decide whether to take actions or not. And then, if they _do_ decide to take action, black helicopters start circling your house, using mind-control rays to bend you to Microsoft's will. If this doesn't cut it (say, you're wearing a tin-foil hat), the men in black show up and remove your whole computer, and then use their memory-zapping thingy to erase any memory of ever having a computer. You'll then be officially branded as a dangerous outlaw subversive type (even though you no longer have your PIRATE/COPIED/UNLICENSED software, you've demonstrated that you're the type of person who will _get_ such software) and will not be able to get jobs, insurance, loans, etc. MS will tap your phone, and their agents will follow your every move. : There is already 54 cases in Singapore regarding uses of : PIRATE/COPIED/UNLICENSED Windows 98. Finally, when the revolution comes, MS will see to it that your house is high on the list of sites for the UN invaders to hit with tactical nukes. : Is there any Substance to this Email ?? It's all true. I had to go public with this information, even though the MS stormtroopers will doubtless show up at any second now. The people have a right to know. DON'T EVER GO ON LINE!!! YOUR LIFE DEPENDS ON IT!!!! : Do you Guys think that there exists such a registry in Windows 98 : Has microsoft sued anybody for illegal use of it ?? Sued? SUED???!!? When MS gets through with you, you're going to WISH that they'd jusT SUED you! These people are EVIL!!! They kidnapped my dog and G$%<S-F4>@^<S-F6>RB. f NO CARRIER --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

open-pgp / s/mime interoperability
by Adam Back 17 Dec '03

17 Dec '03

On the IETF s/mime list Jon Callas (PGP/NAI employee and co-author of IETF open-pgp draft for cypherpunks not following open-pgp) wrote: : I'd like to note that PGP is supported by NAI, Microsoft, Novell, : and more that are coming soon. curious as to what form Microsoft support of PGP will come in. Integrated PGP support with microsoft mail clients in later versions? Jon also wrote: : there is no reason why you can't have PGP : messages backed by X.509 certificates, and it is trivial to use S/MIME : with OpenPGP certificates. I'm planning on writing a short : informational RFC on how to do it once we all get RFC numbers for our : respective systems. open-pgp public keys aren't based on X.509 keys, so I would've thought s/mime implementation would barf on them. Are you basing this on the fact that you can extract the actual public key and repackage it as an X.509 public key? In this way you could take the same key into the X.509 / s/mime world, but you would lose open-pgp sigantures on the key, so it would lose it's certification. More recently we've been hearing that PGP6.x? or a future version of PGP does or will allow one to carry along X.509 keys, or perhaps even work directly with X.509 keys. Is this what you are referring to? (Separate question: any due date on the netscape plugin -- I want one of those!) Adam (message from IETF s/mime list the above is quoted from below). ------- Start of forwarded message ------- Date: Mon, 09 Nov 1998 17:54:29 -0800 To: Stefan_Salzmann/HAM/Lotus(a)lotus.com, ietf-smime(a)imc.org From: Jon Callas <jon(a)pgp.com> Subject: Re: Difference between SMIME and PGP At 05:20 PM 11/4/98 +0100, Stefan_Salzmann/HAM/Lotus(a)lotus.com wrote: I am struggling on the difference between SMIME and PGP. One of my customers wants to make the decision between using SMIME and PGP. I have been talking already with them but we got stuck in detailes. Basically its quit clear. SMIME will be supported by all important industry leaders such as Netscape, Microsoft, Novell etc. I'd like to note that PGP is supported by NAI, Microsoft, Novell, and more that are coming soon. Further SMIME supports the hierarchical trust model and PGP only supports the "web of trust" model. Actually, this is false. PGP supports all trust models, direct trust, hierarchical trust, and web of trust. As I said in my previous message, PGP supports 255 levels of hierarchy. However, I forgot to say that OpenPGP does not mandate *any* trust model. As a matter of fact, the OpenPGP working group has rejected any mandate of trust model. You are permitted to use an OpenPGP certificate with PKIX evaluation rules, and still be OpenPGP compliant! Now with PGP Version 6.0, PGP will support also X.509 certificates. Those can also be loaded into an PGP client than an SMIME Client can do it. So where is the difference now? Is it just the fact that the industry decided to go with SMIME or are there more differences (advantages for SMIME) when looking more closely. Actually, the industry hasn't decided to go with anything. Furthermore, there is no reason why you can't have PGP messages backed by X.509 certificates, and it is trivial to use S/MIME with OpenPGP certificates. I'm planning on writing a short informational RFC on how to do it once we all get RFC numbers for our respective systems. For instance using RSA public key encryption versus Deffie Helman public key encryption. How about Digital Signature Standard (DSS)? I have red about DSS and understand that DSS is the standard that provides the Digital Signature Algorithm. Before applying it there has to be calculated an Digest using SHA. I always thought that calculating the digest would be the signature already!! So why using the DSA in addition? Will the digest be decrypted using the Deffie Helman private key? The issue of algorithm is orthogonal to message encoding. The PGP-S/MIME question is really one of message encoding format. Each requires DSS, and allows RSA. The DSS (Digital Signature Standard) describes how to make a signature using DSA (Digital Signature Algorithm) and SHA1 (Secure Hash Algorithm). That's how they relate. You could (for example) use DSA with RIPEMD-160, but it wouldn't be DSS because DSS specifies the hash algorithm you should be using for the signature. DSA is a signature-only algorithm. Consequently, you aren't doing a "decryption" with it when you evaluate a signature. I recommend you look in a crypto source book, like Schneier's "Applied Cryptography" or Menezes, van Oorschot, and Vanstone's "Handbook of Applied Cryptography" for details of how DSS is done. There is also source code available from a wide variety of places. Users that apply Deffie Helman exchange their public values in order to derive an secret key that will be known at both party sides. Is that secret key the private key used to encrypt message digests or is the private key generated by the DSA algorithm? Like I said, DSS has its own signature-only key. As for "Diffie-Hellman" depending on the variant of DH you're using, you may or may not have an actual key. Many real-time systems use ephemeral DH merely to exchange symmetric keys. In OpenPGP, we use the Elgamal system for encryption. S/MIME is using an X9.42 algorithm that is very close (if not identical) to Elgamal. In PGP further exist key rings that contain the public keys of other users? How does that work with X.509 Certificates that actually contain the public key. If there has to be a public key revoked, it happens in the key ring. Would it be possible to export that revoked certificate. If not the revoked public key would resist only lokally. Most systems, be they PGP or X.509, use something akin to a directory to store certs, revocations, etc. Typically, these are HTTP or LDAP based systems. Are there any differences/advantages between RSA and Deffie Helman? Again, this is orthoganal to encoding, as these are merely algorithms. But yes, of course. The security of RSA is based upon the difficulty of factoring large numbers. Most people who toss around the term "Diffie-Hellman" use it to cover an entire family of algorithms whose security is all based on the difficulty of solving discrete logs. These include DSA, X9.42, Schnorr, and Elgamal. They are all approximately of the same strength. There are also a wide variety of advantages and disadvantages. Frequently, these are the same. For example, in RSA encryption and signatures are the same, which is simple, but leads to some hygenic problems. A signature-only system like DSA is less flexible, but easier to export, and enforces good key hygene (meaning that it is bad practice to use the same key for signatures as for encryption). I could go on with a discussion of all this, but this thread is already off-topic for this mailing list. Feel free to mail me privately or phone. You see I am very confused right now and I have the feeling that all my security theories wounŽt match with those used in PGP. There are many good reasons for being confused. One of the most important ones is that there really aren't a lot of differences between the systems. They are all trying to solve the same problem, but each has a slightly different slant to it. I really would appreciate it if there would be someone helping my to remove all that dust of my mind... Thank you in advance You're welcome. Jon ----- Jon Callas jon(a)pgp.com CTO, Total Network Security 3965 Freedom Circle Network Associates, Inc. Santa Clara, CA 95054 (408) 346-5860 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)

3 2

Re: Limit on number of primes....a (stupid) idiot...
by Anonymous 17 Dec '03

17 Dec '03

Jim Choate is so stupid that even when he accidentally gets something right, he quickly "corrects" himself so that he is wrong again: > I had typed x/ln(x) as the asymptotic limit for the number of primes less > than x. > > This is incorrect. It should be, > > x/log(x) Wrong, doofus. x/ln(x) is the correct asymptotic limit. What role could logs to the base 10 possibly play? Do you think God favors the number 10? What a fool you are!

1 0

Re: Netscape AOL Instant Messenger Confirmation (kB3bEjeb1I aohelsux)
by Anonymous 17 Dec '03

17 Dec '03

This does wonders for my opinion of AOL. Even the administration has no clue. AOL administration spammed the Cypherpunks <cypherpunks(a)toad.com> list, using an address for Cypherpunks which has been defunct for over a year now, with: >Thank you for registering for Netscape AOL Instant Messenger! > >Your registration for screen name aohelsux has been received. > >Please reply to this message within 48 hours to complete >the registration process. Simply reply to the present message >and type 'OK' as the text of your message. P.S. "Well they just responded to an address someone gave them," like certain advocates of AOL, lamers, and Microsoft we have on the list have said, is not an excuse. It's easy to set up domain validation. The spammers just don't care.

2 1

Announce - "Registration" Mail List
by BMM 17 Dec '03

17 Dec '03

In order to relieve the CDR list of some of the flood of "You have successfully registered" messages, and because some people feel there is a need for such a thing, I have created a new mailing list for the specific purpose of being used for registering for online services, reg(a)minder.net. Subject lines of mail from the list with be prepended with "[r]" for easy filtering, whether automated or by eye. It is a majordomo list, so those who are familiar with majordomo can subscribe in the usual fashion. For those who are not familar with majordomo, to subscribe send a message to "majordomo(a)minder.net" with "subscribe reg" (without the quotes) in the body of the message. Cheers, -Brian

1 0

Netscape AOL Instant Messenger Confirmation (kB3bEjeb1I aohelsux)
by HyperReal-Anon 17 Dec '03

17 Dec '03

>Thank you for registering for Netscape AOL Instant Messenger! Hey Tim, do you have a spare semi-auto I can borrow? You'll get it back if AOL's security is as low as their intelligence.

1 0

Y2K Report Card
by Anonymous 17 Dec '03

17 Dec '03

AGENCIES GET NEW REPORT CARDS ON Y2K READINESS Saying "the picture is a gloomy one," Congressman Stephen Horn, chair of the House subcommittee responsible for overseeing government progress on averting the Y2K problem, has given out new report cards to federal agencies. Three departments flunked: Justice; Health & Human Services; and State. The Defense Department gets a D-minus. Three departments get A grades: Small Business Administration; Social Security Administration; and the National Science Foundation. The Social Security Administration began working on the problem in 1989, eight years before most other government agencies. - USA Today, Nov. 24, 1998

5 4

Re: Netscape AOL Instant Messenger Confirmation (kB3bEjeb1I aohelsux)
by Anonymous 17 Dec '03

17 Dec '03

>Again, some clueless asshole that can't tell the difference between >solicited responses and Unsolicited spam mouths off. If you would like >to talk about someone, talk about the jerk who set up an AIM name using >the outdated address, not the company that repsonded. > >PHM > >AKA PHMerrill(a)AOL.Com (among other names and addresses) Again, the clueless asshole known as Paul *H.* Merrill jumps up and defends AOL, incompetently-written web sites, and morons everywhere. Someone told AOL to mail cypherpunks(a)toad.com. AOL could have checked to see if the originating site was under the toad.com domain. This is trivial. They didn't. It's rather easy to just require that somebody trying to mail an address under the toad.com domain submit the request from an address under toad.com. In other words, Paul, you believe that if somebody goes and types your address into some system and asks it to send you 512MB of MPEG video, that's okay because it was solicited. It wasn't solicited by you but somebody solicited it. Oops. That's "blatent propoganda." I'd better rephrase. In other words, Paul, you believe that if somebody goes and types YOUR address into fifty different systems, signs you up for a bunch of mailing lists, and generally causes you a lot of inconvenience, that's okay because it was solicited. You don't know who it was solicited by, but somebody obviously did. If you then object to the sites sending you mail rather than just silently unsubscribing yourself every week, are you then just 'some clueless asshole'? Are spammers now not to be held accountable for their spamming because they bought a list of addresses from someone who claimed that the people all asked to be on the mailing list? Why don't we just sign Cypherpunks up for Ignition-Point, the FP list, the ACLU action advisories, Sixdegrees, and whatever else we can find? Or should We just sign up Paul, really, because he doesn't have a problem with this. In fact I'm sure we could make some 'marketting research' to show that he might be interested. Hey let's get the entire CDR subscription list and sign everybody up for FP and ACLU because if you're on Cypherpunks you're obviously interested in those things. The root of the problem is sites which require email addresses for no good reason, and/or don't have the decency to perform a simple check to see if the domains match. They're lazy. They're irresponsible. When confronted, no matter how civil, they react much like you do, Paul, and they don't want to be inconvenienced by having to fix their usually badly-designed web sites. If I recall correctly Tim has the same opinion and has stated it a few times as have others so I'm not alone. Now I leave you, Paul, so you can go back to your 24 hour vigil and you and your quick response team can scour the net for attacks against AOL and the true clueless assholes, and defend them with your last breath. Yet Another 'Clueless Asshole'

1 0