- cypherpunks-legacy - lists.cpunks.org

NOISE.SYS Stupid Bugs w/Int13h
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

There's an unpleasant bug in NOISE.SYS, BTW. It doesn't properly return the flags from the Int 13h handler, so disable that for now unless you'd like to do funky things to your disks. Sorry 'bout that. Rob.

1 0

RC4 for HP48
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is the RC4 cipher for the HP-48 calculator. It complements the DES implementation by William E. Sommerfeld. RC4 has a higher throughput than DES, but its key setup is slower. The key may be up to 256 characters (2048 bits) -- the maximum supported by the RC4 algorithm. Here are sample timings for a HP-48GX. The SX will be correspondingly slower. Key Setup (200 bits) 25.18 sec RC4 throughput 5.06 cps String to Array 61.83 cps Array to String 56.12 cps The HP-48 comes with a 2400 baud IR link and a 1200/2400/9600 baud RS232 port. The 48S, 48SX and 48G have 32Kb of RAM, almost none of which is used by the operating system. The 48GX has 128Kb of RAM. With an entry price of ~100$ US, I feel that the HP-48 series would be a good choice for a smart token. Possible uses are as digital cash wallets and authentication tokens, not the mention simple encrypted dumb terminals. Installation: If you have a serial cable, download the code below to your HP and call it 'RC4'. This will create a directory called 'RC4' with four programs in it. If you don't have a cable you can type the whole thing in; it's not too large. Store it as 'RC4' and again it will create a directory. Remember not to type the "%%HP: T(3)A(D)F(.);" -- it's only needed for a serial download. Instructions: These instructions assume that you are familiar with stream-ciphers in general. If you are not, you might want to get _Applied Cryptography_ by Bruce Schneier from your library or book store. Bit streams are represented as one dimensional arrays of real numbers between 0 and 255. Yes, that's right, this cipher uses floating-point! In User-RPL it's the fastest way. To convert between strings and arrays use the commands S2A and A2S. S2A "String" -> [Array] A2S [Array] -> "String" To setup a key, use the SK command. It takes a bitstream representing the keytext and returns the key context. They keytext can be up to 256 bytes long. Additional bytes will not be used. The key context is another bitstream with 256 values in it. Because of time/memory tradeoffs, a key context takes 2082 bytes of RAM to store. If memory is tight, use A2S to compress the key context to a string. SK [Key text] -> [Key context] To encrypt something use the RC4 command. The first argument is the key context, the second is the plaintext or ciphertext, both in bitstream form. It returns the updated key context and the ciphertext or plaintext. RC4 [Key context], [Plaintext] -> [New key context], [Ciphertext] or RC4 [Key context], [Ciphertext] -> [New key context], [Plaintext] Enjoy The Cunning Artificers - -- CUT HERE -- %%HP: T(3)A(D)F(.); DIR SK \<< DTAG OBJ\-> OBJ\-> DROP 0 255 FOR N N NEXT 259 258 PICK + 0 259 4 FOR N OVER PICK N PICK + + 256 MOD DUP 255 - NEG N 4 - DUP2 IF \=/ THEN DUP2 IF > THEN SWAP END DUP2 6 + ROLL SWAP 6 + ROLL SWAP 4 ROLL 5 + ROLLD SWAP 3 + ROLLD ELSE DROP2 END SWAP 1 - DUP IF 260 < THEN DROP 258 PICK 259 + END SWAP -1 STEP DROP2 0 0 258 \->ARRY OVER 2 + ROLLD DROPN "Key" \->TAG \>> RC4 \<< DTAG DUP SIZE OBJ\-> DROP 3 PICK 258 GET 4 PICK 257 GET 1 + 1 4 ROLL FOR N 256 MOD 1 + DUP 5 PICK SWAP GET 3 ROLL + 256 MOD 1 + DUP 5 ROLL SWAP 4 PICK CSWP DUP DUP 5 PICK GET OVER 5 PICK GET + 256 MOD 1 + GET 5 ROLL DUP N GET R\->B 3 ROLL R\->B XOR B\->R N SWAP PUT 4 ROLL 4 ROLL 1 - SWAP NEXT 4 ROLL 257 3 ROLL 1 - PUT 258 3 ROLL PUT "Updated key" \->TAG SWAP "Result" \->TAG \>> S2A \<< DUP SIZE \<< \-> LEN \<< 1 LEN START DUP NUM SWAP TAIL NEXT DROP LEN \>> \>> EVAL 1 \->LIST \->ARRY \>> A2S \<< DTAG OBJ\-> OBJ\-> DROP "" SWAP 1 SWAP START SWAP CHR SWAP + NEXT \>> END - -- CUT HERE -- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzEAEf4AAAEEAMONoLHj5CwKvaM6ch9GOcUjgoVS5sjXa4TzD2ohhtHFYR9l QzNj0vNASBQKE/Mk9Flqg+dtitS7S7B0qZQ+mQmMT73yniun596jt1NCJ5sLBKrM jDvYK3wGbycVX43RBiR3iwJZGq5blfWqNRE7kFdTxgu+bCdtLOFNVew9oBf9AAUR tBZUaGUgQ3VubmluZyBBcnRpZmljZXJz =pf3Y - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQRCWuFNVew9oBf9AQEPJgP/QzwxGIWU0sf+a8Vzj2tXtMqRhRQjG4Qp Pcrwr76WhM/2KnHGNAdC3lKwyEK17cu32zbmPePhOvtdUNyV3L1KZlBioURK5Kxu ZspnOLCmlKo8lbOa5mJl2bmV55W49B96ua+yxst1XaOzhfYDN/KjZsztGRnEbQx9 VovMpLXooLo= =4pzv -----END PGP SIGNATURE-----

3 2

Re: Crippled Notes export encryption
by Alex Strasheim 17 Dec '03

17 Dec '03

> The usual issue: That if a foreign-originated product even appears to be a > standard (so far, none have been), and includes strong crypto, then the NSA > and other agencies will simply change the rules. Thus, if extremely strong > crypto from "Netscape-Zurich" starts to have a significant market presense > in the U.S., then some law will be passed to restrict it. But what would they restrict? The use of strong crypto between two domestic points, or strong crypto where one end is within the US and the other without? We already have the former -- wouldn't it be hard for them to take it away? Especially if the software already has a large installed base, which is your premise? I'm not denying that there are people in the NSA who would want to react that way, but I don't think they'd be able to pull it off. It is true that the National Security establishment has a lot of power and influence here. But there are other groups with power as well, and the security types don't have the ability to do whatever they want without regard to the opinions and interests of those other groups. I think America's commercial interests will carry the day. The NSA isn't capable of achieving its objective, which is to preserve passive surveillance. It doesn't matter what the rules are or what Congress passes. It's over. There are a lot of smart people in the NSA, and some of them have to know that. Big companies like Netscape, Sun, Microsoft, and IBM/Lotus, on the other hand, will almost certainly achieve their objectives if they win the political fight. They'll make buckets of money selling crypto software abroad. And if they lose the fight, they're going to be handing big opportunities to foreign competitors. Who's going to fight harder? You add to that the fact that impartial observers will say, for the most part, that Netscape's right and the NSA is wrong, and the tremendous interest world wide in creating a trustworthy net based infrastructure for commerce, and the NSA starts to look a good poker player with a bad hand. They used to say that "what's good for General Motors is good for the country." A lot of people still feel that way about our biggest companies. When they get their acts together and stare down the NSA in a block, it will all be over. I feel a little strange about constantly playing the corporate shill here. I'm not a corporate person, and all of the companies I talk about here would probably find me unsuitable for employment. I'm certainly not going to participate in the crypto profits that they'll realize. My interest in this isn't the same as Netscape's. But it's going to be Netscape that pushes this thing over the top. Crypto is a big tent issue. Some people want the restrcitions eased so they can make money, some are afraid of the government, some want to protect civil liberties, some love the math and technology, and others just want to thumb their noses at Mr. Freeh. I want to see censorship become technically infeasible. There's very little popular support for that position among the general public; everyone wants censorship as long as they agree with the censor. Arguing for crypto from the vantage point of a civil libertarian is pointless. Even here on cypherpunks the bill of rights doesn't get much respect. The point is that the only guy in the big tent with any clout at all is the corporate manager. When the kids get together on the street and protest net censorship, does anyone care? Is a militia movement argument going to play in Peoria? (I think those are counter productive -- at times I've been scared enough by them to re-examine my own position.) I agree with Noam Chomsky when he says that corporate interests dominate our politics, but I also agree with Milton Friedman when he says its for the best. We should focus our efforts on energizing corporate America for the fight. The best way to do that is to demonstrating to customers that exportable security is nothing more than snake oil under the current rules. Another way it is to explain to people -- journalists and managers alike -- exactly why the current rules are bad for business. Lets develop and popularize arguments against the NSA position, not radical or esoteric arguments, but the kind of arguments that sensible people who go to work and read the paper every day can repeat to one another when they talk about politics. If we can get this stuff onto the editorial page of the WSJ -- which is where it belongs -- we'll be in spitting distance of a victory.

1 0

POT_ktl
by John Young 17 Dec '03

17 Dec '03

3-29-96 NYT reports on the Montana Freemen's competition with the USG: printing money and fostering free market brigandry; building arsenals for terrorizing the weak and suppressing dissent; amassing national security treasure for the protection of the people; and PC education to boot. The USG, looking in the mirror, says such actions are a criminal conspiracy, a "school for crime." POT_ktl

1 0

Re: Random noise from disk drives
by Rich Salz 17 Dec '03

17 Dec '03

**I blew it.** Don's address is don(a)cam.ov.com. Sorry.

1 0

Query over PZ
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

Anonymous User had a question over PZ's politics. PZ has posted to the list and thus has, I believe, his address available to list subscribers. How did PZ answer the question privately when Anonymous User posed the question to PZ on private e-mail? If Anonymous User did not first pose the question to PZ privately, why did he post it to the list publically? -- tallpaul PS: I'm likely to have some followup on these questions, but wanted to pose them to AU first.

1 0

RE: IPSEC == end of firewalls (was Re: (fwd) e$: PBS NewsHour, Path Dependency, IPSEC, Cyberdog, and the Melting of Mr.)
by Pete Loshin 17 Dec '03

17 Dec '03

More to the point, I don't think it's possible to trust the security of the network software USERS in any case. -Pete Loshin pete(a)loshin.com Perry Metzger wrote: >Nelson Minar writes: >> I'm all for the end of ridiculous non-TCP/IP protocols, but does >> anyone believe this point about encrypted IP traffic eliminating the >> need for firewalls? > >There is division in the IETF community on this point. > >Phil Karn (who I have the greatest respect for) thinks IPSEC means we >can get rid of the firewalls. I, for one, don't -- they are there >largely because people don't trust that their networking software is >free of security holes, and cryptography doesn't fix security holes >for the most part. > >Perry

1 0

PZ a Nazi?
by Anonymous User 17 Dec '03

17 Dec '03

Original dated: Jan 21 '96, 09:26 The UK's Sunday Telegraph has today featured an article by Robin Gedye entitled "Neo-Nazis are marching on the Internet" in which apart the the usual nonsense about neo-Nazis being about to take over the world by means of their "Thule Net" accuses the deviser of PGP of being a Nazi sympathiser: "Private communications between neo-Nazis on the network are effected under a program called "Pretty Good Privacy", devised by an American neo-Nazi sympathiser." Robin Gedye (in Bonn) p.23 of "The Sunday Telegraph" January 21, 1996

8 7

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 05:32 AM 3/29/96 -0500, Black Unicorn wrote: >On Thu, 28 Mar 1996, jim bell wrote: > >> At 03:46 PM 3/28/96 -0500, Black Unicorn wrote: >> >Given the significant contempt charges that can follow a refusal to >> >produce items (anonymous or not) this still depends on the absence of >> >initial detection. >> >> You clearly don't understand. You're making the ASSumption that the >> organization keeping the keys can produce them in a form that is "useful" to >> the cops. Escrowing encrypted keys makes them useless to subpoena, and in >> fact it helps the key owner because the escrow agent can (and, in fact, >> must!) be obligated to inform the key owner if his key is requested. > >You clearly don't understand. You are an ass making an assumption that a >court cares or believes that the witness can actually produce the >requested information or not. Fines tend to be imposed regardless. Bullets don't care that a judge was justified in his decisions, either. Ultimately, your repeated argument is simply, "The legal system can be abused by those who work in it." I don't challenge this claim, in fact my position depends on its truth; my assertion is that the current legal situation is out of the control of people faithful to the meaning of the Constitution, and has been so for a long time. One of the main reasons I promote a de-facto (and unofficial) death penalty for recalcitrant politicians and other government employees is because the traditional "checks and balances" system seems to no longer be working for the interests of the average citizen. >> And in any case, I consider it highly doubtful that anybody would contract >> with an escrow agent and identify himself by name > >The same way no one creates Panamanian companies with their own name. So >what? Third parties are still fined heavily. Any specific examples? No? I thought so! In any case, if "third parties" are "fined heavily," that is even more justification for setting up a method to deter out-of-control courts. Remember, freedom is always strongly disliked by authoritarian and totalitarian governments; you need to explain why the hypotheticals you're describing don't indicate that some emergency effort is needed. >>It would be a simple >> matter to operate "escrow agents," just glorified data-holders, who would >> receive data anonymously and send it out just as anonymously, to the person >> who can identify themselves via some sort of encrypted ID system. > >And simpler for courts to fine them out of existance (which happened to >several banks, trust companies and agents in Cayman and Panama. I guess you really don't realize that every claim you make demolishes the justification for your obvious hostility to a system which prevents exactly the kind of abuses you list. (Although it really isn't clear whether you would classify them as "abuses.") > Even >> "detecting" such a transfer is useless because the cops won't be able to >> figure out what the data is, since it's encrypted in both directions while >> being transferred, in addition to being encrypted while being held, with a >> code the escrow agent doesn't know. > >They need only suspect or have reason to suspect it might be exculpatory. _ ^^^^^^^^^^^ Sloppy word usage. I think you meant, "incriminating." Typical for you. >Practically speaking this means convincing a judge. Not hard when the >words "offshore holding company" are mentioned in a brief or hearing. > >> In short, you need to comprehend what you're responding to before you >> express your opinions. You're living down to my expectations. > >In short, go to law school, then try to talk about legal issues. In this day and in this country, "going to law school" is basically synonymous with "learn to get along with the current legal system." It should have been obvious long ago that I don't consider the current legal system to be worth living with. >> >> In fact, I suppose that government operation of the identification system >> >> (drivers' licenses, passports, etc.) in general is also horribly inefficient >> >> and should be attacked on efficiency grounds. >> > >> >You might not like what you get in response. Streamlined and uniform >> >identity documents generated at birth and renewed with tax filings would >> >be the likeliest efficiency improvement. An inefficient government >> >identification system is to the advantage of the privacy seeker. >> >> You seem to be ASSuming that an "efficient identification system" is one >> that will ALSO operate to the benefit of the government, as opposed to the >> individual who wants to be identified for only limited purposes. > >Without getting into semantics, and "efficient identification system" >implies one that identifies people efficently. Blocking government use, >or limiting it to certain circumstances is not efficiency. Only if viewed from the statist perspective, which I suppose is easy for you. An "efficient identification system" identifies me, efficiently, to anybody I _choose_ to be identified to, to whatever level of identification I choose to allow. Nothing more. Read Chaum's Sci Am article, carefully.

2 1

SS Obergruppenfuhrer Zimmermann (NOT!)
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Anonymous User <nobody(a)c2.org> writes: > "Private communications between neo-Nazis on the network are > effected under a program called "Pretty Good Privacy", > devised by an American neo-Nazi sympathiser." > Robin Gedye (in Bonn) p.23 of "The Sunday Telegraph" > January 21, 1996 Before anyone takes this nonsense too seriously, one should realize that the exhibition of such microscopic views of technology by journalists and politicians is fairly common. Who can forget Caspar Weinburger's stirring speech in front of an illegally exported low-end VAX, explaining that the machine was a sophisticated electronic device for the tracking of missiles and troop movements, now in the hands of America's enemies. Then there was the newspaper article which explained in perfect seriousness that "GIF" was a secret computer code used by child molesters to encode images of their victims. Characterizing PGP as a neo-Nazi tool for private communications written by a sympathizer, while absurd in a larger sense, is hardly sillier than the prior examples. And all such scenarios contain a microscopic grain of truth as seen by someone somewhere with a severe case of tunnel vision. The reporter no doubt reports correctly that some neo-Nazis use PGP to communicate privately. Doubtless PKZ supports the right of all people, including those with diverse political views, to conduct legal private conversations which cannot be overheard by their governments, as do most of the people on this list. I suppose in some obtuse sense this is sympathy. It is highly unlikely that anyone who uses Cypherpunk technology is as ignorant as this reporter. So let's just mail the poor guy a clue and move on. Things like this happen often, and it's not really worth a prolongued debate. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 6