July 2018 - cypherpunks-legacy

[cryptography] DKIM: Who cares?
by Peter Gutmann 06 Jul '18

06 Jul '18

Steven Bellovin recently forwarded the following link to another list: http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/ In summary, it turns out that what seems like half the world's DKIM users are using toy keys as short as 384 bits. This isn't just Joe's Pizza and Panelbeating, it's a worldwide who's-who of big-site DKIM users all using weak keys. Does anyone know why they all do this? Since it's so widespread, my guess is that the organisations involved don't really care about it and are just going through the motions, "we're doing this for form's sake and because not doing so would look bad, not because we believe it adds anything worthwhile". Peter. _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: The use of malicious botnets to disrupt The Onion Router
by Scott Bennett 06 Jul '18

06 Jul '18

On Sat, 2 Feb 2008 01:57:01 -0500 "Ron Wireman" <ronwireman(a)gmail.com> wrote: >It seems to me that we owe a lot the roughly 1,500 people who donate their >bandwidth to our project at any one time. They give us a tremendous gift >that allows us to participate in unpopular or even dangerous political >speech and debate, to by-pass inappropriately restrictive filters, and to >limit the amount of information about ourselves that we reveal to the >organizations who run the Internet sites we access. I don't wish to divulge >some of the ways in which I've used tor to protect myself, but I'm sure all >of you reading this list can think of many examples where it has assisted >you in your own life and most of you use it on a frequent basis. All of >this comes at the cost of time and money from many volunteers who receive no >benefit whatsoever from relaying your traffic for you. Actually, there are benefits, some of which are even pointed out in various web pages and/or documents available at www.torproject.org. One is that running a server helps to hide your client's traffic by mixing it in with all the traffic relayed for others. Another is that each server's presence increases the overall capacity for traffic going through the tor network, thereby providing support for even bigger crowds of packets and circuits for your own to be concealed among. > >It seems to me, however, that even this gracious act of charity may be no >match for the types of attacks we may be faced with as we become more >popular and, as a result, more of a target. The number of users running tor >nodes pales in comparison to the number of computers that may be in any one >of the many individual botnets, which are groups of hijacked computers >controlled in unison by a single entity. The largest of these botnets ever >discovered had over 1,000 times the number of nodes that tor does. What >happens when one of these botnets are commanded to join tor all at once and >begin harvesting private data that people naively did not encrypt or, worse, >replacing all pictures requested with goatse.jpg? These and other malicious The problem of corrupted exit servers is indeed one that we should all ponder until a solution may be found. However, setting up, say, 1,000 hidden, slaved, correctly configured tor servers via a bot net may be rather more difficult to accomplish than you have fully considered. Entry guards and middlemen probably wouldn't be useful to an attack coordinator. >acts could easily take place, perhaps even perpetrated by a malevolent >government entity, and would cause significant disruption to our router. > >We must take expedient measures to prevent this type of attack, because as >of now, tor is quite vulnerable, perhaps even critically so. The group of >computers that make up the official Network Time Protocol pool, a network >that is used to provide extremely accurate time synchronization for millions >of computers around the world, has a manually administrated list. Since it >has about as many nodes on it as tor has, it suggests that maintaining such >a list would not be difficult. It seems to me that this would be an >excellent way to prevent a node flood attack. Without it, tor will be rot. > Again, I think you may well be underestimating the manpower required to install and configure lare numbers of tor servers. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * ********************************************************************** ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

RE: thoughts on one time pads
by Trei, Peter 06 Jul '18

06 Jul '18

You missed the old standby - the microwave oven. The disk remains physically intact (at least after the 5 seconds or so I've tried), but a great deal of pretty arcing occurs in the conductive data layer. Where the arcs travel, the data layer is vapourized. The end result is an otherwise intact disk in which the data layer is broken up into small intact islands surrounded by clear channels. It might be interesting to try a longer burn, in which case you might also want to put a glass of water in with the disk(s) to preserve the microwave's electronics. This is probably less effective than the other methods you've described, but its very fast and leaves no noxious residues. It also uses a very commonly available tool. Peter Trei -----Original Message----- From: owner-cryptography(a)metzdowd.com [mailto:owner-cryptography@metzdowd.com] On Behalf Of Peter Gutmann Sent: Saturday, January 28, 2006 2:25 AM To: cryptography(a)metzdowd.com; jthorn(a)aei.mpg.de Subject: Re: thoughts on one time pads Jonathan Thornburg <jthorn(a)aei.mpg.de> writes: >Melting the CD should work... but in practice that takes a specialized "oven" >(I seriously doubt my home oven gets hot enough), and is likely to >produce toxic fumes, and leave behind a sticky mess (stuck to the >surface of the specialized oven). For no adequately explored reason I've tried various ways of physically destroying CDs: - Hammer on hard surface: Leaves lots of little fragments, generally still stuck together by the protective coating. - Roasting over an open fire: Produces a Salvador Dali effect until they catch fire, then huge amounts of toxic smoke ("fulfilling our carbon tax quota" was one comment) and equally toxic-looking residue. - Propane torch: Melts them without producing combustion products. - Skilsaw: Melts them together at the cutting point, rest undamaged. - Axe: Like skilsaw but without the melting effect. - Using the propane torch and hammer to try and drop-forge a crude double- density CD: Messy. Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

None
by David Shaw 06 Jul '18

06 Jul '18

development list <sks-devel(a)nongnu.org> Subject: Crypto-related domain name auction to benefit FSF and FSFE Hi everyone, I have a few crypto-related domain names that I bought a few years ago for one project or another. (Among other ideas, I had once thought to set up a 'who will sign my PGP key?' exchange, but then biglumber.com did it so well, there was little point in doing it all over again). I've been sitting on the domains for a while, but they're not really doing anyone any good like that. So, rather than just letting them expire and be snapped up by link farms, I thought I could do something more useful for the community - auction them off and donate the money to the FSF and FSFE. The 5 domain names are: keyservers.net keyservers.org (I don't own keyservers.com - it's parked by someone with advertising links on it) keysigners.com keysigners.net keysigners.org I figured a two-week auction period would do it, but if someone feels strongly that isn't enough time, let me know. The basic idea is that people can send me their bids for each domain name, and I will post the current high bids (without identifying the bidder) on http://www.jabberwocky.com/domain-auction.html After the auction is over, I will notify the high bidder for each domain that they are the winner. The auction winner is responsible for sending the winning bid directly to the FSF or FSFE (winner's choice). An easy way to do this is via Paypal to donate(a)fsf.org or paypal(a)fsfeurope.org, but other means are available if necessary. Once the FSF or FSFE confirms to me the donation has arrived, the auction winner and I can do the usual domain name transfer process. Any questions or comments? I'd like to start the auction on Monday (May 24th). Feel free to forward this note to anyone who might be interested in the domains. David _______________________________________________ Gnupg-users mailing list Gnupg-users(a)gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

1 0

Re: The use of malicious botnets to disrupt The Onion Router
by Scott Bennett 06 Jul '18

06 Jul '18

On Sat, 2 Feb 2008 01:57:01 -0500 "Ron Wireman" <ronwireman(a)gmail.com> wrote: >It seems to me that we owe a lot the roughly 1,500 people who donate their >bandwidth to our project at any one time. They give us a tremendous gift >that allows us to participate in unpopular or even dangerous political >speech and debate, to by-pass inappropriately restrictive filters, and to >limit the amount of information about ourselves that we reveal to the >organizations who run the Internet sites we access. I don't wish to divulge >some of the ways in which I've used tor to protect myself, but I'm sure all >of you reading this list can think of many examples where it has assisted >you in your own life and most of you use it on a frequent basis. All of >this comes at the cost of time and money from many volunteers who receive no >benefit whatsoever from relaying your traffic for you. Actually, there are benefits, some of which are even pointed out in various web pages and/or documents available at www.torproject.org. One is that running a server helps to hide your client's traffic by mixing it in with all the traffic relayed for others. Another is that each server's presence increases the overall capacity for traffic going through the tor network, thereby providing support for even bigger crowds of packets and circuits for your own to be concealed among. > >It seems to me, however, that even this gracious act of charity may be no >match for the types of attacks we may be faced with as we become more >popular and, as a result, more of a target. The number of users running tor >nodes pales in comparison to the number of computers that may be in any one >of the many individual botnets, which are groups of hijacked computers >controlled in unison by a single entity. The largest of these botnets ever >discovered had over 1,000 times the number of nodes that tor does. What >happens when one of these botnets are commanded to join tor all at once and >begin harvesting private data that people naively did not encrypt or, worse, >replacing all pictures requested with goatse.jpg? These and other malicious The problem of corrupted exit servers is indeed one that we should all ponder until a solution may be found. However, setting up, say, 1,000 hidden, slaved, correctly configured tor servers via a bot net may be rather more difficult to accomplish than you have fully considered. Entry guards and middlemen probably wouldn't be useful to an attack coordinator. >acts could easily take place, perhaps even perpetrated by a malevolent >government entity, and would cause significant disruption to our router. > >We must take expedient measures to prevent this type of attack, because as >of now, tor is quite vulnerable, perhaps even critically so. The group of >computers that make up the official Network Time Protocol pool, a network >that is used to provide extremely accurate time synchronization for millions >of computers around the world, has a manually administrated list. Since it >has about as many nodes on it as tor has, it suggests that maintaining such >a list would not be difficult. It seems to me that this would be an >excellent way to prevent a node flood attack. Without it, tor will be rot. > Again, I think you may well be underestimating the manpower required to install and configure lare numbers of tor servers. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * ********************************************************************** ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by David Shaw 06 Jul '18

06 Jul '18

development list <sks-devel(a)nongnu.org> Subject: Crypto-related domain name auction to benefit FSF and FSFE Hi everyone, I have a few crypto-related domain names that I bought a few years ago for one project or another. (Among other ideas, I had once thought to set up a 'who will sign my PGP key?' exchange, but then biglumber.com did it so well, there was little point in doing it all over again). I've been sitting on the domains for a while, but they're not really doing anyone any good like that. So, rather than just letting them expire and be snapped up by link farms, I thought I could do something more useful for the community - auction them off and donate the money to the FSF and FSFE. The 5 domain names are: keyservers.net keyservers.org (I don't own keyservers.com - it's parked by someone with advertising links on it) keysigners.com keysigners.net keysigners.org I figured a two-week auction period would do it, but if someone feels strongly that isn't enough time, let me know. The basic idea is that people can send me their bids for each domain name, and I will post the current high bids (without identifying the bidder) on http://www.jabberwocky.com/domain-auction.html After the auction is over, I will notify the high bidder for each domain that they are the winner. The auction winner is responsible for sending the winning bid directly to the FSF or FSFE (winner's choice). An easy way to do this is via Paypal to donate(a)fsf.org or paypal(a)fsfeurope.org, but other means are available if necessary. Once the FSF or FSFE confirms to me the donation has arrived, the auction winner and I can do the usual domain name transfer process. Any questions or comments? I'd like to start the auction on Monday (May 24th). Feel free to forward this note to anyone who might be interested in the domains. David _______________________________________________ Gnupg-users mailing list Gnupg-users(a)gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

1 0

Lucrative update
by Patrick 06 Jul '18

06 Jul '18

Lucrative release 4 is out. I know many people are used to seeing releases numbered like "0.000001", "0.000002", "2.0.3.0.14.657" etc. but release numbering systems are essentially arbitrary in nature so don't get excited as Lucrative goes toward version 50+. This release is a fairly minor one, but included some changes such as the client name that I wanted to get out as soon as possible. There is also a new development weblog at http://lucrative.thirdhost.com/weblog/. I went through an install with someone over IRC last night and made a blog entry summarizing the install notes. I recommend reading the notes before attempting an install. I am glad to help with an install, drop me a note at patrick(a)lfcgate.com if you have trouble. Some documentation on the various entities in the Lucrative system is now available on the website, http://lucrative.thirdhost.com/documentation.php but more is needed and coming. If Lucrative is interesting to you, please consider helping in any way you can: Feedback Installation reports Suggestions Comments Criticism Feature requests Source code patches Donations Are all very much welcomed. And criticism is more useful to me than praise. My sincere thanks to everyone who has participated so far by installing, testing, providing feedback, spreading the word, and donating. And finally I just received word from SourceForge that the project registration for Lucrative has been approved. Regards, Patrick -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com> mQGiBD5ECKcRBADUvjXHwLtxIyS4AyjBs/dFtN6rdeP18Fhzh1hD5fJwkFevqY9Z I1ASROTh6eXYF7pU5sEvbcPshHyTB41ZtTqZvQvpwWN0fUzOuutuI0mtC5UPp9Rz j47SdWLdEXNHjwnHDCYSyqtqZu8GujGRQybR0eP3NIh/NwbSDUKdgz7IjwCg//Jo UtjP3zUFobm/0UYA+CJ5krED/091x9Js0gwNwvjbzM8DqO+r8qNz0kXI13FkrPRk QNd37lxt6m2m8HZD1WYM2wKwtMzHSwJcWzaDZ/tNc+ppYjzpw0EQCh9FqjGs8Vau guF6PA1M8lJTCcLKaL4e7ynic+PAw5Xa/tdOYgFCG+eLMU5RLvzRCYoOLIjgMJLJ yG98BACAMlDmFVYgC/UKvzZmHfZ5CtCKd8sPfCXrYLu5NeFRE0LR6D6zjzmhi1xX okfreR5o3T/y78VBM98js+m2/+7Z0AElqydeW/RnV1zqwDGjDr9z2MgARf3yLAbs n3BU8Fz61RwvHy6cRkT+2dR2f69QQUSpkupvLwZIGX/iwm4uKLQdUGF0cmljayA8 cGF0cmlja0BsZmNnYXRlLmNvbT6JAE4EEBECAA4FAj5ECKcECwMCAQIZAQAKCRBb mvb9yuOVfaA2AKDAu5tDj9F2KI8cJMrKKkQRAcUyxACg6/bei7lUJH+E5igJqGRx SjKrRA65BA0EPkQIpxAQAPkYoH5aBmF6Q5CV3AVsh4bsYezNRR8O2OCjecbJ3HoL rOQ/40aUtjBKU9d8AhZIgLUV5SmZqZ8HdNP/46HFliBOmGW42A3uEF2rthccUdhQ yiJXQym+lehWKzh4XAvb+ExN1eOqRsz7zhfoKp0UYeOEqU/Rg4Soebbvj6dDRgjG zB13VyQ4SuLE8OiOE2eXTpITYfbb6yUOF/32mPfIfHmwch04dfv2wXPEgxEmK0Ng w+Po1gr9oSgmC66prrNlD6IAUwGgfNaroxIe+g8qzh90hE/K8xfzpEDp19J3tkIt AjbBJstoXp18mAkKjX4t7eRdefXUkk+bGI78KqdLfDL2Qle3CH8IF3KiutapQvMF 6PlTETlPtvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ +PVZX9x2Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarT W56NoKVyOtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY72 88kjwEPwpVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy 1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XrPdYX AAICD/wKwtF7Y4NKBe8PQ6jDbjWziiTv9Ac/EnRTJDQEoqgLa2LyE+6Ahw/VPGvp mfxkD2MKxC9E7kYVmasn6sHnSpvAv3e7O1Bqbo/qLzzCcJQ5VCurZ+elRM1GZ4Oc fM19FPKutb0/JFEv0nrqS4BGkF7WFBbu5dKYl/GIO7Co1mAerFIb719dOwMPVEIz OT08u8uB9jyR8gEElf+CVuNfOUkrUGg4HS4SbmTTrCSz3/8n5PkquSuAyjCB/dwM ZsZwA0/TTR8sDYlmlf9xPj5PGpGnV9OUwfig6eE0eWtRFeasmz0uiX+yp45ABtNh 6EXP/PFaBgXi9omXXjeeFYfpDvmfA6izvTIQfXTV6V9ZWrBfXarM+GQ+6guXWVbd 9fXvmCr982LkzuKQrK1OpRXBMUapXL+tOy/LYzz91InqKKhgPNGa12fvotZ4LzlM iqoM+Hpz5L9B5We1Ph0lD6RBVXDCqd+P8extnY/7AaDy7tC0UghaAaUuEZXJQPIc oQ3QGbpjM0nGe/VZN5EZhljau0NNENFaU56cOpvOhcO04gLGNNc2NS+rIpTMsaHh o1CG90c5zZZJuUbyx0mIHriNQXDgEwunSZPQorKK9KSppyyjeuOyi5F/mBBPXeyT weLhLqLvAr9se/+Z3aQvMADJi8zUZtGggLTw+N9R5XSwtSh2R4kARgQYEQIABgUC PkQIpwAKCRBbmvb9yuOVfWayAKC+mBhHdn1XZ5uH0RocAyJ32hx2kgCePyhB+IqM TjWLDLarQxcPYhbkFi4= =nx1M -----END PGP PUBLIC KEY BLOCK----- --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

RE: thoughts on one time pads
by Trei, Peter 06 Jul '18

06 Jul '18

You missed the old standby - the microwave oven. The disk remains physically intact (at least after the 5 seconds or so I've tried), but a great deal of pretty arcing occurs in the conductive data layer. Where the arcs travel, the data layer is vapourized. The end result is an otherwise intact disk in which the data layer is broken up into small intact islands surrounded by clear channels. It might be interesting to try a longer burn, in which case you might also want to put a glass of water in with the disk(s) to preserve the microwave's electronics. This is probably less effective than the other methods you've described, but its very fast and leaves no noxious residues. It also uses a very commonly available tool. Peter Trei -----Original Message----- From: owner-cryptography(a)metzdowd.com [mailto:owner-cryptography@metzdowd.com] On Behalf Of Peter Gutmann Sent: Saturday, January 28, 2006 2:25 AM To: cryptography(a)metzdowd.com; jthorn(a)aei.mpg.de Subject: Re: thoughts on one time pads Jonathan Thornburg <jthorn(a)aei.mpg.de> writes: >Melting the CD should work... but in practice that takes a specialized "oven" >(I seriously doubt my home oven gets hot enough), and is likely to >produce toxic fumes, and leave behind a sticky mess (stuck to the >surface of the specialized oven). For no adequately explored reason I've tried various ways of physically destroying CDs: - Hammer on hard surface: Leaves lots of little fragments, generally still stuck together by the protective coating. - Roasting over an open fire: Produces a Salvador Dali effect until they catch fire, then huge amounts of toxic smoke ("fulfilling our carbon tax quota" was one comment) and equally toxic-looking residue. - Propane torch: Melts them without producing combustion products. - Skilsaw: Melts them together at the cutting point, rest undamaged. - Axe: Like skilsaw but without the melting effect. - Using the propane torch and hammer to try and drop-forge a crude double- density CD: Messy. Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[silk] "Unshredding" documents
by Udhay Shankar N 06 Jul '18

06 Jul '18

Very cool, and very thought-provoking. Shades of both Brin's Transparent Society, and the librarian from _Snow Crash_ in here. Just like digital data is only considered safely erased when the substrate (e.g, a hard disk) is irrecoverably destroyed, so too, here. Anybody recall the last line from _The Dead Past_? ;-) Udhay http://www.thestar.com/News/article/295655 Reassembling a puzzle with 600 million pieces Husband spying on wife among secrets revealed by `unshredder' chewing through East German secret-police files Jan 20, 2008 04:30 AM Brett Popplewell Staff Reporter Nineteen years ago, as the Berlin Wall crumbled and democracy swept through communist East Germany, STASI agents members of the secret police worked feverishly to destroy millions of top-secret documents in an effort to keep them from Western eyes. Attempting to shred some 45 million items as quickly as possible, the agents fed page after page into shredding machines. The equipment quickly jammed, leaving the agents to tear up the materials by hand and throw them into garbage bags meant to be incinerated. But with East Germany quickly falling into the hands of the west, the agents were stopped before they could burn the shreds. Some 600 million pieces in 16,000 bags became the property of the current German government. They have remained, for the most part, in that state. Then, in May 2007, the German government revealed the world's most sophisticated pattern-recognition machine, the $8.5 million dollar (U.S.) E-Puzzler, which can digitally put back together even the most finely shredded papers. Developed in Berlin by the Fraunhofer Institute of Production Facilities and Construction Technology, the E-puzzler is a computerized conveyor belt that runs shards of shredded and torn paper through a digital scanner. Scanning up to 10,000 shreds at once, the machine links them together by their colour, typeface, outline, shape and texture not unlike how the average human might try to piece together a puzzle. The machine then displays a digital image of the original document on a computer screen. "The task to automatically reconstruct 16,250 bags full of torn documents using a technical system . . . presents an enormous technological challenge," says Bertram Nickolay, the lead inventor of the machine. During the Cold War, East Germany's Ministry for State Security STASI was regarded as one of the most formidable secret police forces of its day. Using a vast network of civilian informants, the STASI kept files on up to 6 million of East Germany's 16 million citizens through an estimated 400,000 informants from all walks of life. For decades, neighbours spied on neighbours, priests spied on their flocks, husbands spied on their wives and even children spied on their parents. They reported their discoveries to the 90,000 STASI agents keeping tabs on the population. Prior to the creation of the E-puzzler, a team of 15 Germans had laboriously been putting the pieces together by hand. But they managed to rebuild only 10,000 documents from 300 bags during 12 years. The German government estimated it would take a further 600 to 800 years to finish the job. But having uncovered heartbreaking stories of espionage like that of Vera Lengsfeld, a 54-year old German politician who was shocked to learn she had been spied on by her husband for 11 years the German public demanded the files be put together more quickly. An estimated 3.4 million Germans have officially requested to see the information the STASI gathered on them. With the E-puzzler, Nickolay says the government will be able to un-shred the remaining documents by 2013. Nickolay acknowledges his machine's importance in helping millions of Germans to piece together their former lives. But says his machine is even more significant to the rest of the world. In addition to piecing together shreds of paper, the machine has been used by Chinese archaeologists to reconstruct smashed Terracotta warriors found in the tomb of Emperor Qin. And the equipment has deciphered barely-legible lists of Nazi concentration camp victims. There is only one E-puzzler in operation, but Nickolay's team has received interest from other former Eastern Bloc countries looking for a way to get at their own state secrets of the past. "It's no longer safe to shred a document," Nickolay says. "The only safe way to destroy something is by burning it." -- ((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com)) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0