December 2003 - cypherpunks-legacy

Re: Revealing individual messages.
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Bill Stewart wrote: > If you're concerned about Bad Cops planting forged messages on people, > this won't help - it's easy for them to forge unsigned information also. > After all, the PGP source code is open, so Bad Cops can add code to > set the timestamp/sender/etc themselves. Or they can ignore code, > and just set their system clock appropriately. BC's can also plant secret keys on your machine, along with messages forged using those keys. It is a good idea to keep badly forged messages on your machine, as well as badly forged keys. There are many ways to manipulate files and emails so that discrepancies exist. e.g. - messages with a time-stamp later than the file date; replies with an earlier time-stamp than the original message; changing fingerprint on the same key.

1 0

A Math problem related to cryptography
by Jeffery Walker 17 Dec '03

17 Dec '03

I have been working on some math and C++ code to implement it. The problem relates to a possible new means of factoring. However, I have run into a problem which I cannot solve. Indeed it maybe impossible. The problem is this: Find and equation using only multiplication, division, GCD, LCM and powers (not addition or subtraction) in terms of a and b which is equal to a+b for all Integers. If so desired it can be assumed that a and b are relative primes with a>b. Note that equivalent problems include but aren't limited to finding a similar equation for a+1. If other functions such as logs are required they may be allowed but I would have to look into it. To encourage people to answer I am offering $20 for a solution and $10 for a proof that it is impossible. I will judge all answers as to the validity both in terms of actually being correct (or in the case of a proof a valid argument) and in that they do not use functions such as addition or subtraction which are not allowed. Thanks, Jeff P.S. I am very interested in joining the coderpunks list as I do program and am interested in cryptography as related to programming. If someone would be kind enough to recommend me I thank you. +____________________________+ | Jeffery Walker | | E-mail: jeff(a)beol.net | | http://web.beol.net/jeff | +____________________________+

1 0

No Subject
by Mike Ronn 17 Dec '03

17 Dec '03

1 0

encryption key expiry in pgp5.x
by Adam Back 17 Dec '03

17 Dec '03

What happens in this scenario with pgp5.0, or pgp5.5: - You have a signature key which you'll keep for say 2 years before creating a new one. - You have a policy of generating new encryption keys every 6 months. - Your email archives are stored as received still encrypted to your public encryption key (I think you have no choice but to do this with some of the pgp5.x plugins). - You expire the key, and securely wipe the private half of the key. (An advantage of rekeying in this way is to gain forward secrecy: messages gathered by an attacker can no longer be decrypted with information you have, but to get the forward secrecy you must literally securely wipe the private key). If you do this, you won't be able to read your old mail folder, because you no longer have the key it was encrypted to. Does this imply that you must keep the private key for perpetuity? (Or at least as long as you want to read old mail archives). One presumes the same problem applies to CMR recovery keys, they must also be kept as long as recovery is required, if the user forgets the password. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Security flaws introduced by "other readers" in CMR
by Jean-Francois Avon 17 Dec '03

17 Dec '03

From: Fabrice Planchon <fabrice(a)math.Princeton.EDU> To: Adam Back <aba(a)dcs.ex.ac.uk> Cc: cypherpunks(a)cyberpass.net Subject: Re: Security flaws introduced by "other readers" in CMR >They do: the title is "Le programme PGP se range", which I unfortunatly > have know idea of how to translate. It can be translated by "PGP gets into the groove" it "behave itself". It finally obtemperate (wether prompted or not). It grow's up and become reasonable. "se ranger" is what you do with your car when a cop car pulls you on the side. it gets in line There is an ambiguity in this expression. "Se ranger" is usually used for a transition to an unusual or not approved behaviour to a accepted or acceptable behaviour. It entails a "higher" authority or standard. This is why I use a much more americanized language when I speak in french about civil liberties and related subjects. The french language almost equate government intentions with fatherly love... :-) Over the years, I found that most French peoples have a feodal attitude with a tendency to almost blind veneration of hierarchy. (flames to dev(a)nul.con) I suppose it comes from their History. In general, if a govt said it, it *has* to be good. It is as if they were trained since young age to surrender their capacity for independent judgment and reason. And quite distressingly, it happens even with extremely intelligent individuals. OTOH, the uncommon ones that do not exhibit such psycho-epistemological trait tend to be real hot shots, independent type. I am not French, but Canadian (french) and we often have scrapes with French on this topic. They tend to trust their govt, unless somethings warrant otherwise. Here in french Canada, we are much more American in that sense. Notwithstanding what trumped-up polls say, we have a much more american-styled opinion. Ciao JFA

1 0

Re: Security flaws introduced by "other readers" in CMR
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Jean-Francois Avon wrote: > From: Fabrice Planchon <fabrice(a)math.Princeton.EDU> > >They do: the title is "Le programme PGP se range", which I unfortunatly > > have know idea of how to translate. > > It can be translated by > "PGP gets into the groove" "falls in line" > it "behave itself". "obeys" > It finally obtemperate (wether prompted or not). "self-restrained" > It grow's up and become reasonable. "matures" and "conforms" > "se ranger" is what you do with your car when a cop car pulls > you on the side. it gets in line "Habeus Automobileus Recovery" > There is an ambiguity in this expression. "Se ranger" is > usually used for a transition to an unusual or not approved > behaviour to a accepted or acceptable behaviour. > It entails a "higher" authority or standard. Such as Hitler, or Freeh, or DeGaulle. There is a lot of truth to the "loose shoes, tight pussy, and a warm place to shit" school of dictatorship. As long as your butt is warm, do you really care whether 'they' are burning Jews or Jesuits to supply you with heat? Has PGP scored Joe 'White Shoes' Jackson as their SpokesPerson? VeriteMonger

1 0

your MIS email address (cosmos) may be deleted if you do not respond
by MicroServe's HELPDESK 17 Dec '03

17 Dec '03

Dear MicroServe Subscriber, The MIS accounting department is in the process of upgrading it's software. Unfortunately, they found some information missing from your account. So, we're going to need your help. Please go to the following URL (web address) with your WWW browser (Netscape, Internet Explorer, etc) and follow the online instructions. You should not have to anything except click CONTINUE once you arrive at the page. WEB URL: http://2009263:cosmos@mismail.microserve.net:235/ ACCOUNT ID: 2009263 MAILBOX: cosmos Login name: cosmos In real life: Daniel Leeds Directory: /usr5/accts/c/cosmos Shell: /usr/bin/ksh Last login Fri Jun 20 12:46 on pts001 from unknown-2-66.ra New mail received Wed Oct 15 17:05:23 1997; unread since Thu Oct 16 19:27:50 1997 PLEASE NOTE: This must be done from YOUR ppp (dial-up) account. The system will not work if you try to do this from a friend's (or any other) dial-up account. UNIX Shell customers should call (717)821-5964 extension 3 to speak with a technical support representative. Any account which still has info missing as of November 1, 1997 will be suspended (and will be deleted on November 8, 1997), as we will have to assume that the email box belongs to no one. If you have any questions, please email helpdesk(a)microserve.net. Thank You, MicroServe Engineering Department ------------------------------------------------------------------------ MicroServe Information Systems 100 North Wilkes Barre Blvd Wilkes-Barre, PA 18702

1 0

index.html
by Jim Choate 17 Dec '03

17 Dec '03

CNN logo Navigation Infoseek/Big Yellow Pathfinder/Warner Bros Tech banner IBM AS/400 rule WILL HEADLESS HUMAN CLONES GROW ORGANS IN 10 YEARS? 'Human Cloning' graphic October 19, 1997 Web posted at: 8:39 p.m. EDT (0039 GMT) LONDON (AP) -- Headless human clones will be used to grow organs and tissues for transplant surgery in the next five to 10 years, a leading authority on the ethics of human cloning predicted Sunday. Dr. Patrick Dixon, author of "The Genetic Revolution," which forecast the cloning of animals, made the prediction after The Sunday Times reported that British scientists have created a frog embryo without a head. Scientists believe the technique used to create the headless frogs could be adapted to grow human organs such as hearts, kidneys, livers and pancreases in an embryonic sac living in an artificial womb, the paper said. Many scientists believe human cloning is inevitable following the July 1996 birth of Dolly, the world's first cloned mammal. She was created at the Roslin Institute in Edinburgh using cells from a sheep's udder. "I predict that there will be great pressure to combine cloning technology with the creation of partial fetuses, missing heads, arms or legs as organ factories for tomorrow's people," Dixon told the British news agency, Press Association. "These will be developed on an experimental level somewhere in the world in countries where there is little or no gene legislation within the next 5-10 years because of the overwhelming demand," he said. "The demand is there, the technology is almost there as well," he said. Dixon called for an urgent global biotechnology summit to examine every aspect of genetics, and provide the foundations for international agreements. International inconsistencies on various aspects of genetic engineering, including human cloning, urgently need to be ironed out, he said. "Genetic engineering is a very exciting technology, it has the power to feed the world, cure disease but you do have to ask fundamental questions before it is too late," Dixon said. "The headless frog embryo is another example of the way the technology is racing far ahead of public understanding," he said. "We must get the thinking in place which looks over the horizon beyond today's headlines to what tomorrow will bring," Dixon said. "Scientists have been making up the rules as they go along." Genes manipulated to suppress frog's head Jonathan Slack, professor of developmental biology at Bath University, told The Sunday Times that he created headless frog embryos by manipulating certain genes -- and used the same technique to suppress development of a tadpole's trunk and tail as well. The headless frog embryos have not been allowed to live longer than a week because under British government rules, embryos are not considered animals until they are a week old, the paper said. Slack believes the breakthrough could be applied to human embryos because the same genes perform similar functions in both frogs and humans, The Sunday Times said. The newspaper said the lamb and frog techniques could be combined so that people needing transplants could have organs "grown to order" from their own cloned cells. These organs would exactly match the patient and there would therefore be no danger of rejection. It would also ease the shortage of organs for transplant, The Sunday Times said. Slack told the paper that using intact human embryos would not be possible because they would have to be killed. "It occurred to me a half-way house could be reached," he was quoted as saying. "Instead of growing an intact embryo, you could genetically reprogram the embryo to suppress growth in all the parts of the body except the bits you want, plus a heart and blood circulation." Growing parts of human embryos to cultivate organs could bypass many legal restrictions and ethical concerns, because without a brain or central nervous system the organisms may not technically qualify as embryos. Professor: 'No ethical issues' Lewis Wolpert, professor of biology as applied to medicine at University College London, called Slack's suggestions sensible and feasible. "There are no ethical issues because you are not doing any harm to anyone," The Sunday Times quoted him as saying. But Oxford University animal ethicist Professor Andrew Linzey told the newspaper: "It is morally regressive to create a mutant form of life." "It's scientific fascism because we would be creating other beings whose very existence would be to serve the dominant group," he was quoted as saying. Copyright 1997 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. rule CNN Plus * Message Board: Cloning Health Special: Cloning Related stories: * Report: Cloned sheep has human gene - July 24, 1997 * Embryo splitting caught in cloning controversy - June 25, 1997 * Scientists grow monkeys from cloned embryos - March 2, 1997 * Firms team up to make cloned cattle with special milk - October 7, 1997 Related sites: Note: Pages will open in a new browser window * Genzyme Transgenics * Genetics and Ethics - Biomedical Ethics Unit, McGill University * Institute for Philosophy and Public Policy - Animals as Inventions: Biotechnology and Intellectual Property Rights * Genetic Engineering Home Page External sites are not endorsed by CNN Interactive. _________________________________________________________________ Infoseek search ____________________ ____ ____ _________________________________________________________________ rule Watch these shows on CNN for more sci-tech stories: CNN Computer Connection | Future Watch | Science & Technology Week rule Message Boards Sound off on our message boards You said it... [INLINE] IBM AS/400 rule To the top © 1997 Cable News Network, Inc. All Rights Reserved. Terms under which this service is provided to you.

1 0

Re: "First do no harm"
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On Sun, 19 Oct 1997 16:31:10 -0700, Tim May wrote: >At 5:23 PM -0700 10/19/97, Jean-Francois Avon wrote: >First, are you reading Cypherpunks? No. I don't have time to even read all of e$ and e$pam. I am not yet retired... :-) >If so, post there. If not, please >forward my reply to the "e$" Done. >If I operated a small company, I would have no policy on this at all. Just >as I wouldn't routinely tape-record employees, I wouldn't monitor their >mail. >Do most small businesses steam open all of the incoming and outgoing paper >mail? Let me describe a scenario: one key employee isn't there because... ...he is somewhere else [ :-) ] Then, comes an urgent message forcing the company to make a split-second decision before the employee gets back. It happens _all_the_time_ in small businesses where they do not have the ressource of the big companies. You, the boss, want to re-read some critical documents before making a move. Of course, your employee was the most consciencious and trustworthy employee on this side of Andromeda, only, your memory fails as what was the *exact* wording of the critical documents. It furthermore happens that the said faithfull employee is, unknown to you and in his mind not-company-detrimental, getting intronized to the mile-high club between L.A and Tokyo in the plane lavatory, therefore not reacheable by any modern means. Wouldn't you wish you had his corporate private key? In the old days, you used to scramble through his mountain of paper on his desk. In more recent days, you frantically scanned his exemplary organized data structure and found the documents. Today, the said data structure is still exceptionally orderly, but only to reveal several very describing filenames with a dot-asc or dot-pgp extension. Any comments? >If a small business owner doesn't trust his employees, all is lost anyway. >(Employees can post stuff from home, can take diskettes out of the >building, etc., so what is gained by monitoring their mail?) I thought that this was so self-evident that I did not even thought usefull to explain. I was not talking about having employees giving copies of their personnal private key but of their corporate private key. The one they use to transact business over unsecured lines, not the one they use to send raunchy messages to their lover. >And if an employer is known to monitor employee mail, this actually >increases his liability for certain things. (If an employer does not, then >he has a better defense of claiming that some employee was acting on his >own, etc.) I never talked of monitoring e-mail, only of making sure the business retains access to employee-generated documents. I used to have a private key for the company at a previous work location. The first thing I did was to give my boss my passphrase for being afraid of what could happens if ever they needed a critical document during my absence. He did not even know how to use PGP, but I made sure that somebody did. This is why I said that a "secret" copy would be given to the boss. He could encrypt the employees keys, print it on a micro-dot and hide it under his gold tooth cap. And that way, there is always deniability since there is official company policy. Or better, all the boss has to do is to generate the employee's keys himself. He could forever deny having made a copy and nobody could prove that he did. Personnally, I would make sure that all keys to be used to transact business be generated by the boss, to be handed on a diskette in person. As far as trying to prevent malicious action, I agree that there is no way an employer can do that. Anybody really intent on screwing up things can. Ciao jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

One-Way Functions
by semprini＠theschool.com 17 Dec '03

17 Dec '03

I've read tons about how DES, PGP, and all of those programs use a one-way function involves the difficulty of factoring out numbers. Are there other one-way functions? --Dylan

1 0