- cypherpunks-legacy - lists.cpunks.org

Re: Graphic encryption
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> I am currently working for a company that has a graphic encryption > product called PrivaSoft. I was wondering if there were other products > or engines that also provide graphic encryption. (graphic encryption is > the use of a encryption algorythm to scramble an image taken of a > document.) Is there anything particular in graphic encryption? I usually encrypt graphics and document images as regular files with regular encryption... Hadmut

1 0

Re: subjective names and MITM
by jbaber＠mi.leeds.ac.uk 17 Dec '03

17 Dec '03

This discussion can be divided into two separate situations. The first of which is exemplified perfectly by Hal: hfinney(a)shell.portal.com writes: >m5(a)dev.tivoli.com (Mike McNally) writes: > >hfinney(a)shell.portal.com writes: > > > This situation with the MITM is actually about the same as if you were > > > communicating insecurely in the first place. You are exposed to all of > > > the same risks. > >The only way to achieve the level of security offered by physical face > >to face communication with a person is to have a physical face to face > >conversation at some point. If you only ever communicate via > >electronic means, you are always subject to the risk of dealing with a > >synthetic entity. (I think.) >I don't think so, or at least the risk can be minimized much more than in >the model where we just say that we're communicating with keys, therefore >a MITM is perfectly legitimate because it's just a matter of who holds >the keys. Suppose I want to talk to PC Magazine columnist John Dvorak. >Suppose I find a VeriSign certificate for his key, with his name and >employment information. I've never met him. We've never had a face to >face conversation. Yet I claim I can communicate with considerable >security with Dvorak using this certificate, certainly more than if I >just use any old key which is lying around with his name on it, one which >may be owned by a MITM. Here the wish is to communicate with a 'real' person. A person that actually exists and has an in-built reputation that is separate from his key. This is very much a real life situation and is very similar to the first time that you meet someone - it is very hard to know that someone is who they say that they are, few people ask for ID and even ID is possible to fake (an old key that is actually owned by a MITM). In this case the person is known (of) and not the key - therefore it makes sense to attempt to ensure that the link between the key and the person is a strong (trustworthy) as possible. However this is not the case in the second situation: I could say that know that I enjoy reading mail from some people on the list, that I agree with some people on the list or that some people on the list hold very strong opinions on certain subjects. However this would not be correct as I have not met anyone else on the list in person (we do not all live in the US). It would be more correct to say that I enjoy reading mail from some addresses on the list (etc.) - I have no real idea whether hfinney(a)shell.portal.com is Hal or actually Tim expressing different views. If I mail Hal therefore I am actually mailing the entity that sends mail to the list from that address and I would do so being pretty sure that I was communicating with the person who mails here - but I would have no idea whether he is actually male, female, blond, brunette etc apart from what I chose to believe from others. Now mail is far easier to fake/intercept than a digital signature/encryption - at least I hope so. Therefore if Hal where to sign all of his messages I could check the signatures with a public key obtained from anywhere at all and if they passed then I could be confident that the messages were all written by the entity with control of the secret part of the key - at least far more confident than I am at all of the mail from hfinney(a)shell.portal.com actually comes from there. So instead of me getting the idea that hfinney(a)shell.portal.com posts interesting messages I get the idea that the holder of the secret key posts interesting messages - I would probably still use the mail address as keys are less convenient with current mail readers but that is an implementation problem. Hals reputation is therefore transfered to they key - no matter where I got the key from. So if I send encrypted mail to the person with the private part of Hal's key I can be sure that it can only be read by the person who actually sent the messages pertaining to be from Hal. So the MITM problem is 'defined away' in the case where a reputation grows with a key but is still a major problem where you want to transfer a ready made reputation to a key (as in the first example). In effect the key becomes a pseudonym and you can be sure of communicating with the pseudonym safely but can not be sure of anything about the pseudonum that you have not experienced yourself without trusting someone else (VeriSign in the first example). Thus the problem is more reputation transfer than anything else. Jon C. Baber jbaber(a)mi.leeds.ac.uk http://www.chem.surrey.ac.uk:80/~ch02jb/

3 3

Graphic encryption
by privsoft＠ix.netcom.com 17 Dec '03

17 Dec '03

I am currently working for a company that has a graphic encryption product called PrivaSoft. I was wondering if there were other products or engines that also provide graphic encryption. (graphic encryption is the use of a encryption algorythm to scramble an image taken of a document.) Also if any of ya'll are famillar with graphic encryption, I am looking for opinions as to its strengths / weaknesses. Steve O. Mgr. Tech. Services ************************************************* PrivaSoft TM * 1877 Springfield Ave PO BOX 600 * Maplewood NJ 07040-0600 * Tel. 201-378-8865 Fax. 201-762-3742 * Http://www.privasoft.com/privasoft * E-mail: privsoft(a)ix.netcom.com * *************************************************

2 1

Re: LACC: Account sharing leads to false imprisonment
by J. R. Valverde (EMBL Outstation: the EBI) 17 Dec '03

17 Dec '03

Amazing! If I'm allowed to express my opinion! >Thought you might like another perspective: > >... >> A GORRIE STORY >> >> Here's the background: in October of 1994, Hirsh's stepbrother, a U of > What I find so amazing is the fascinating arguments exposed here. Let's see... First, let me say I start from a different point of view. I see the University as a place for forming people and distributing ideas, not juts the ideas of the "Establishment", but all kind of ideas. A place for the free interchange of all ideas and the formation of new persons. Now, all your message transpires a special horror against the dispersion of "anti-establishment" ideas. Of things that one could find "disturbing" from some point of view... Oh well, I wonder what it would have been if the arabs in Spain had only translated the Koram in the middle ages, instead of translating all the ancient wisdom and preserving it for all of us. Even if it conflicted with *their* beliefs. It would have been great not to have Aristotles or Plato at all. Just the Koram. >From your message, it looks like you want instead the Spanish Inquisition back: if someone distributes strange ideas -anarchist, communist, etc...- that person is a risk for the stablishment and should be punished. Isn't it? >Ignorance of the law is no excuse, and being easy to catch doesn't make >you innocent of a crime. > Yeah, but not showing volunteer to hide, expressing opinions openly, is not being easy to catch, it's being confident in one's freedom of speech and on the democratic system to protect it. Even in spite of overzealous system administrators. >> facility computer, received a complaint from someone at the University >> of British Columbia about The Anarchives being posted to net news. The >> person wanted it stopped. > >Interstate transport of stolen (presumably copyrighted) property, possible >violation of national laws of both nations. Unauthorized use of the >computers at the University of British Columbia. > Well, I don't know if that was copyrighted property. But, if it was, it was up to the (C) holder to decide what actions if any to take. BSD-Unix is copyrighted code, but I wouldn't say that all the copies around are illegal, or stolen. Unauthorized use? May I say that if that person asked someone (whomever) for permission, then it is whoever gave permission (if any) who should be pursued instead? I guess that if a poor guy is sold the Golden Gate, it is not that poor guy's fault as much as the "seller's". Ah, but that guy was distributing "anarchistic" information: he must have been pretty bad intentioned then. No one should have "unauthorized ideas" and even less dare to distribute or share them. I see. Great that if someone complains about the distribution of 'X' kind of ideas there's always a willing sysadmin to hunt the witch instead of defending freedom of speech. Great. >> have different last names, Gorrie concluded a larger hacker conspiracy >> was afoot. > >Reasonable assumption. The only way to find out different would be to >violate the users' privacy by reading their mail, etc. > What? May I suggest that, if the account has a owner, and a system manager, and all that, those people should be asked prior to jumping to conspiracy theories? The same kind of reasoning lead many innocents to die with the Spanish Inquisition: hey, they were plotting with the devil against god laws. Sorry, but I think a phone call to the implicated persons can easily clear all those doubts without "electronic surveillance" as you propose. >Collected possible evidence. A good idea. Allerting potential criminals > Yeah. I suppose that if they were expressing distrubing ideas, they were "potential criminals"... What else could they possibly be? >If he turned out to be a terrorist who was planning to blow up a >building, you would have called this a tremendous piece of police work, >they could have written a million-selling book, and you would hail the >sysadmin as a computer age hero. > Great! I guess that prettily summarizes all: "if" he had turned to be a "fill in your fears here". Just the same as it was with the Inquisition, if they were good guys they shouldn't fear torture or dying for God. And it was better to torture innocents than allowing any "potential bad guy" to get along. >So Hirsh agreed that he had been illegally using the computer system >and the case was settled with a monetary fine. > I bet so. Under torture many innocents also confessed. And faced with a multimillion dollar trial which, if you can't afford- will take you to jail (which can be a real torture), I guess that most innocents will prefer to go along with a smaller fine. It's often better to be alive and free than being the dildo of a homsexual homicidal maniac in jail. Or visiting the dungeons of the Inquisition. Of course, if instead of distributing 'X' files he had just killed his wife and her lover, and were multimillionaire, it would have been quite different. Wouldn't it? >> After subjecting Hirsh to complete and devastating public humiliation, >> U of T was now pleading for discretion. > >After Hirsh broke the law, he is trying to get even for being caught by >harassing the people who caught him. > So, after one person was faced with an humongous bill, dispropor- tionate, faced to an expensive trial he couldn't afford and forced into an agreement that's being sold as a confession, and being publicly given a walk around the city dressed as a damned heretic, he shouldn't have even the right to complain. Obvious. We don't want the faith in the Inquisition to diminish, do we? --- Look, I don't really know about the case. But I do really understand one thing: if this guy hadn't posted what some person considered were "pernicious ideas" he would have never been tracked down, villipendiated and taken to trial. I don't care about if he was using public resources for something they shouldn't be. That's something else to be discussed. Is it wrong to use a University to spread ideas, specially when the mainstream media avoid them? I won't comment on that. But that someone can start a witch hunt 'cos some other one is posting some special kind of information... Let's say, I can't consider that justification enough. So. I think you have made a great point for the defense of cryptography: if we want to have free thought and free speech, and avoid a new Inquisition, that's the only way. But I'm sure that if these guys had encrypted their messages that would have been taken more as a demonstrationof their *evil* purposes. After all, if they had nothing to fear, why hide? Why avoid torture? But they didn't hide, and we have seen... yes. Long life to thought control! jr -- These opinions are mine and only mine. Hey man, I saw them first!

3 2

Re: Graphic encryption
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 6 Oct 1995, Lucky Green wrote: >And by the way, "proprietary" algorithms are generally junk and should not >be relied upon by security concious individuals and businesses. Only >algorithms that have undergone extensive peer review should be considered >for use. It's OK, when these guys were spamming Usenet a few weeks ago with their product announcement (admittedly, they did at least keep it to comp groups) they said it was export-approved. Therefore, it can be pretty much written off from a security standpoint - it's at best as good as 40-bit RC4, and I sure wouldn't use that for secure communications. I'd still like to know how it works so we can see just how insecure it is, though. Mark

1 0

Open Market, Inc. Announcing security products
by Harry S. Hawk 17 Dec '03

17 Dec '03

Open Market, Inc. Is announcing "free software and services that will help hundreds of Internet-based businesses and millions of users protect themselves from potential security breaches." I don't know any more info.. I'll send more when available. -- Harry Hawk Manager of Computer Services Warwick Baker & Fiore 212 941 4438 habs(a)warwick.com

1 0

Re: Who knows the story on Elementrix OTP??
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:37 PM 10/6/95, MINITERS(a)citadel.edu wrote: >Aclaim is being made to having a technique for utilizing OTP with a spiffy key >generation technique that requires no transmission over an unsecure link. >Who knows the details of the approach and the particulars on the developers? This has been discussed in great detail on the list. I hate to chide Syl publically, but people need to be reminded that they should not skip the messages and then ask questions that have already been covered in gory detail. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

European Crypto
by T. Bruce Tober 17 Dec '03

17 Dec '03

Anyone with names and contact information for any of the Council of Europe representatives who deliberated and/or voted on the recent recommendations on crypto, e-mail me that information. Likewise any information on any further actions by the EU in this regard. Working on an article for a computer magazine. tbt -- |Bruce Tober - octobersdad(a)crecon.demon.co.uk - B'ham, Eng| | Publisher/Editor of The Write Byte monthly newsletter | | WebSite address to come shortly | | TWB - The computer newsletter specifically for Writers |

1 0

Re: Graphic encryption
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> Is there anything particular in graphic encryption? I usually > encrypt graphics and document images as regular files with regular > encryption... I believe graphic encryption outputs a valid image file that is apparently white noise until you perform the decryption transformation on it. An obvious way to do this with a non-lossy file format is to encrypt pixel vales with a stream cipher. Another way to make the image unviewable would be to shuffle the pixels or rasters with a PRNG. andrew

3 2

Who knows the story on Elementrix OTP??
by MINITERS＠citadel.edu 17 Dec '03

17 Dec '03

Aclaim is being made to having a technique for utilizing OTP with a spiffy key generation technique that requires no transmission over an unsecure link. Who knows the details of the approach and the particulars on the developers?

1 0