July 2003 - cypherpunks-legacy

moderated cryptography list
by pmetzger＠lehman.com 17 Dec '03

17 Dec '03

Hello, all. I'm looking for a site willing to host a high-quality moderated cryptography mailing list which I am thinking of starting up. The list would be designed as a low volume, high readership, high quality source for 1) In-depth technical discussions of cryptography 2) Announcements of cryptographic products 3) Announcements of news items of interest to the cryptography community. 4) VERY limited numbers of postings on the social implications of cryptography, and I mean VERY limited. All postings would be explicitly approved by the moderator before going out to assure quality. Yes, that means fascistic restriction of your capacity for free speech, in exchange for not being overwhelmed with garbage every day. It is ultimately envisioned that should the list be a success I would try to move it to a moderated Usenet newsgroup. If you think that such a list is a Good Thing, and you can host it (which requires that you have a good internet connection and root access or similar on the machine in question), please let me know. I'll do all the work, and the crypto community will thank you tremendously. Perry Metzger

2 1

Re: Anarchy Gone Awry (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This post is a perfect example why the two lists should be kept seperate and not merged. This sounds to me like it belongs on alt.politics.data- highway. -uni- (dark)

2 1

Re: CHAUM CHIMES IN
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Date: 08 Sep 93 16:30:55 EDT >From: Sandy <72114.1712(a)CompuServe.COM> >Subject: CHAUM CHIMES IN >Message-Id: <930908203054_72114.1712_FHF95-2(a)CompuServe.COM> ..From: > SANDY SANDFORT Reply to: ssandfort(a)attmail.com [ . . . ] >Of course, the next letter to the editor calls for the adoption >of systems to track every vehicle at all times. The genius who >wrote the letter, thinks it would be a good way to prevent >nuclear, biological or chemical terrorism. Geeeeez. It was signed by Dorothy Denning, right? Actually, they should take that to its full conclusion. We need implants in every individual, broadcasting to the local surveillance agency, giving not only location but also every word spoken in the vicinity. It could also do a chemical analysis of the air in the neighborhood. It should also have a radiation counter. It should also monitor the host body, looking for signs of anger or sexual arousal? How else will we be guaranteed safe from mad bombers, rapists and child molesters? How else will our big budget LE agencies be able to protect us? I know. When it's finally adopted, worldwide, they'll call it the Ellison Plan. :-( - Carl

2 1

Stegno and DAT and digital music...
by Peter Wayner 17 Dec '03

17 Dec '03

In this week's Sunday NYT, Hans Fantel, their music guy, writes at length about the new "dithered" CD's and how the guys have improved the sound. He says that the original CD format was limited to 16 bits of sound because of costs. But many audiophiles reacted very negatively to the tinny, metalic quality to the music. For this reason, the companies have developed 20 bit DAT recording tape and then come up with ways to "dither" this into 16 bits. I am curious if anyone knows the details of these algorithms. Also, his point suggests that flipping the least significant bit of 16 bit music may not be imperceptable to some ears. If the classical music starts to sound tinny then there might be something subversive in the least significant bits. -Peter Wayner

2 1

Remail: errors
by HFinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been out of town for the last week, so I missed some CP mail. It looks like some good things are happening with remailers, though. Kudos to Karl, Sameer, and the others for their work! I have received many messages to my remailer in the last week which came from remail(a)tamsun.tamu.edu, which were PGP-encrypted apparently in an effort to get my remailer to send them. They did not work, though, because there was no "Encrypted: PGP" header to trigger the remailer's decryption. This can be arranged by creating the message something like this: ======================================================== :: Request-Remailing-To: hfinney(a)shell.portal.com :: Encrypted: PGP - -----BEGIN PGP MESSAGE----- <rest of message> - -----END PGP MESSAGE------ ======================================================== This would then be sent to remail(a)tamsun.tamu.edu. I don't know whether the multiplicity of such erroneous messages is just due to one person stubbornly re-trying, or whether there is an error in one of the new programs for creating chained remailer messages. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLJaNuKgTA69YIUw3AQHrNwQAowMEQwuH6YyHoj6T7AqZFLNdTf+eqJ9L LhAatHS94nmC1smkfVNq0dZmigmkvBdMNEPlBZemmxALz+KJw6OSY/ULSBmuVNEq 5rJANh3XimoJWqLISy2lZiuC5Fw2R7UvRadcdM94pncSVvev92Fyf7CqEOOtrGAK PUzRds7BVNo= =FpLa -----END PGP SIGNATURE-----

2 1

more than spread spectrum
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

There are alternatives to spread spectrum, if we're threatened with loss of freedom to communicate. We could lay our own wires/fibers. We could set up a mesh network of infrared lasers through the air. Last time I looked, there were no laws against shining lights out your window as long as they didn't bother anyone. An infrared laser could hardly bother anyone. We could produce a line of cheap cards to plug into a PC which would do packet routing, using a variety of physical links -- our own wires, lasers, very low range radio, .... Each card would connect to three or more neighbors and become part of the global mesh. Adaptive routing with no global map would suffice for the card and would keep the whole system peer-to-peer with no need for central control and no chance for central tapping. Of course all of these solutions require a high density of users. A college campus might be the right place to start. We could then branch out to cities. I suspect that a place like Chicago or NYC with high rise apartments might be the place to start -- many options for line-of-sight communications. The benefit isn't just for Cypherpunks. It's a free network for the masses -- like the original USENET (with each user donating routing and store/forward) but with unrestricted, low-range, continuously operating physical links. I'll volunteer to do the software for the node card. Does anyone have hardware design/fab to donate to the effort? - Carl

4 3

Finding collision resistant hash functions
by Sarad AV 12 Aug '03

12 Aug '03

hi, Is there a polynomial time algorithm that will find collision hash functions or how are we supposed to find collision free hash functions?What exactly is the difficulty in finding collision free hash functions? Regards Sarath. __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com

3 5

Re: Someone at the Pentagon read Shockwave Rider over the weekend
by Tim May 10 Aug '03

10 Aug '03

On Tuesday, July 29, 2003, at 11:49 AM, Trei, Peter wrote: >> Tim May[SMTP:timcmay@got.net] >> >> >> On Tuesday, July 29, 2003, at 09:26 AM, Bill Stewart wrote: >> >>> Also, NYT Article was >>> http://www.nytimes.com/2003/07/29/politics/29TERR.html?th >>> >>> But it sounds like they've chickened out, because various people >>> freaked >>> about the implications. (And they only got as far as it being >>> "an incentive to commit terrorism", without getting to >>> "a funding method for terrorism" or to "Assassination Politics".) >>> >>> >> >> Not to mention the obvious problems with letting government agents bid >> on things like when various unwanted foreign leaders would be >> assassinated. >> > Over on Dave Farber's IP list, it's been pointed out that there > is a pre-existing, live, real-money market in futures on these > types of events. Go over to www.tradesports.com, and click on > 'Current Events' under 'Trading Catagories' on the left. Drill down > and you'll find things like 'WMDs will be found in Iraq on or before > Sept 31', the value of which has dropped from 80 to 25 over the > last few months. Yes, a bunch of "ideas futures" markets have existed for nearly a decade. An acquaintance of mine, Robin Hanson, was actively promoting such things in the late 80s and may have been involved in some of the Extropians-type markets which arose a few years later (I recollect several efforts with varying degrees of success). And several years ago some companies actually tried to built real markets around these kinds of predictions. Maybe one of them is the "contract company" (pun intended) on this latest DARPA fantasy. The problem is not with the idea of using markets and bets and Bayesian logic to help do "price discovery" on things like when the Athlon-64 will actually reach consumers, or when the new King of Jordan will be whacked, and so on. The problem is, rather, with _government_ establishing a monopoly on such things while putting suckers like Jim Bell in jail basically for espousing such ideas. And, as I noted, there are significant problems with government employees in a betting pool (gee, aren't even office baseball pools technically illegal? Haven't they prosecuted some people for this? Yep, they have) where they also have control over the outcome. Jim Bell used this as a payoff mechanism for assassinations ("Alice bets $1000 that Paul Wolfowitz will be murdered with his family on August 10, 2003")...the same logic applies to the government's dead pool. --Tim May "That government is best which governs not at all." --Henry David Thoreau

6 10

Re: A 'Funky A.T.M.' Lets You Pay for Purchases Made Online
by Sampo Syreeni 10 Aug '03

10 Aug '03

On 2003-07-23, Sunder uttered: >If you want to do electronic payments that are non-anonymous you can >simply use a credit card or debit card (or something like paypal, egold), >or for larger quanitities you can do wire transfers - so why would we >need yet another a non-anonymous "cash" that isn't cash? I only objected to the notion that all digicash needs to be anonymous in order to be desirable. I didn't say this particular system amounts to desirable weak digicash. To that end it would likely make far more sense in the short term e.g. to marry Visa Electronic to PayPal. In the long term multiple cooperating PayPal-like entities could then be used to build mixnets, making the digicash strongly anonymous. As for Morlock Elloi's objection, what you have on your bank account *is* money, and debit cards simply a technological quirk which allows us to access it. Furthermore, any medium of indirect exchange is by definition money and at least Merriam-Webster defines cash as "ready money". So we might define cash as the most liquid form a money available. After that we can claim that in the presence of ubiquitous debit capability and a steadily growing aversion towards those using paper money, the latter is not in fact cash at all, but a less liquid cash (bits on a mainframe) substitute used when we're willing to pay a premium (in convenience and depreciation) for anonymity. -- Sampo Syreeni, aka decoy - mailto:decoy@iki.fi, tel:+358-50-5756111 student/math+cs/helsinki university, http://www.iki.fi/~decoy/front openpgp: 050985C2/025E D175 ABE5 027C 9494 EEB0 E090 8BA9 0509 85C2

10 18

RE: Secure IDE?
by pgut001＠cs.auckland.ac.nz 05 Aug '03

05 Aug '03

"Trei, Peter" <ptrei(a)rsasecurity.com> writes: >It's a move in the right direction, but I wish they had followed through and >done the right things: > >* [AES | 3DES]/CBC I get the feeling they use ECB for speed (heavy pipelining) rather than cluelessness. >with a good distribution of IVs Where would you store them? The feature of this is that it's fully transparent, so you can't store IVs anywhere. >* User-generated keys (before initial disk setup, of course). That one's the only thing I can't find a good technical reason for... perhaps it's just commercial, since they see the dongles as a revenue source and will sell you software to set up n dongles yourself, where price is proportional to n. >* Some kind of PIN or password protection on the dongle. How would you do this without a custom BIOS (remember that their general product is for dropping into any PC)? >40 bit DES is not secure against your kid sister (if she's a cypherpunk :-), >much less industrial espionage. I'm more worried about key backup - it's bad enough having cheapest-possible- components IDE drives without complicating it further with a second point of failure. In the meantime a better option is still the triumvirate of: - Sensitive data saved only to RAM disk. - 3DES-encrypted volume mounted as a filesystem, which I can back up in encrypted form if necessary, and with all crypto done in software with per- sector random IVs, user-generated keys, and all the other stuff you asked for. - Encrypted swap. (Oh yeah, and a UPS so you're not tempted to temporarily save stuff to disk elsewhere in case the RAM drive goes away suddenly). >"40-bit DES (US Data Encryption Standard) is adequate for general users" > >Yeah. Right. If you're worried about Joe Burglar grabbing your laptop (for the value of the laptop) and your business data being leaked as collateral damage, or someone stumbling across your warez or pr0n, then it's probably adequate. Since this is what general users would be worried about, I'd agree with the statement. Anyone worried about more than that (probably about 0.01% of the market) isn't a general user any more. Peter.

2 1