- cypherpunks-legacy - lists.cpunks.org

second order homophonic substitution
by peter honeyman 17 Dec '03

17 Dec '03

a faq on this list (and other places) is whether it is possible to encipher a message in such a way that the resulting ciphertext can be deciphered into a different (harmless?) message. i mentioned on sci.crypt that a second-order homphonic substitution does just this, but it seems to have been missed by the cpunx readership. so, just to prove that i can read denning and still type, here is a brief explanation. (not brief enuf, sorry.) a homophonic substitution maps letters from the plaintext alphabet into sets of letters from the ciphertext alphabet. to encipher, you pick an arbitrary letter from the image of each plaintext letter. usually the intent is to disguise single letter frequency statistics. it's still not very strong, since it doesn't disguise digram or trigram statistics. (also, it seems to me that it would be vulnerable to the same sort of attack used on running key ciphers.) need an example? see denning, p. 70. to build a second order homophonic substitution cipher, you construct an n by n table, where n is the size of the plaintext alphabet. (say n = 26). initialize each entry in the table by a unique element from the ciphertext alphabet. (say, the integers from 0 to 26 * 26, permuted arbitrarily.) this table constitutes the key. to encipher a message, select a "dummy" message (say the itar regs). to encipher the i-th plaintext letter, say p sub i, grab the i-th dummy letter, say d sub i, and output table[d sub i, p sub i]. to decipher, find the ciphertext letter (or number, in this case) in the table at row i and column j. to recover the actual message, output the j-th plaintext alphabet letter. to recover the dummy message, output the i-th plaintext alphabet letter. i.e., the rows give the dummy message, while the columns give the actual message. simple stuff. here's an example. table: D E G I N O S T U D 01 02 03 04 05 06 07 08 09 E 10 11 12 13 14 15 16 17 18 G 19 20 21 22 23 24 25 26 27 I 28 29 30 31 32 33 34 35 36 N 37 38 39 40 41 42 43 44 45 O 46 47 48 49 50 51 52 53 54 S 55 56 57 58 58 60 61 62 63 T 64 65 66 67 68 69 70 71 72 U 73 74 75 76 77 78 79 80 81 here is some ciphertext: 64 11 05 32 49 77 57. it's clear how to extend this to n-th order. peter

1 0

The death of the list as we know it (tm)
by Robert J Woodhead 17 Dec '03

17 Dec '03

I've only been monitoring the list for a couple of days, but already it is clear to me that the traffic is _way_ too high to manage as a mailing list. Apart from the volume, the very structure of Email tends to dis-associate message from reply, and make it difficult to do any filtering before reading (one of the great joys of using _nn_ IMHO). A humble suggestion: someone undertake to create alt.cyperpunks and shadow the newsgroup and the mailing list (so that posts to one also go to the other). In my case this would cut my reading time in half and increase my "harvest" by a factor of two. The mailing list would still be available for those who cannot get the group. In addition, as the number of people getting the mailing list would decrease, it would probably delay the death of the net by bandwidth overload for a few hours (currently, it is scheduled for sometime in June 1997, last time I checked). Also, even an unmoderated alt group can be made moderated (and thus, filter out most of the forgery, etc) by appropriate use of technology described in this mailing list. +---------------------------------------------------------------------------+ | Robert J. Woodhead, Biar Games / AnimEigo, Incs. trebor(a)forEtune.co.jp | | AnimEigo US Office Email (for general questions): 72447.37(a)compuserve.com |

8 9

Re: FIDONet Mail filterin
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > J >So how do I prevent what happened to SJG, killer, etc from happening > > J >to me? How do I prevent the LE types from showing up one day and > > J >saying 'hey, did you know there's a meg of kiddie porn on your > > J >machine and we're taking it all away'? Well, keeping things encrypted helps, especially backup disks - one site was being generally harassed and may be convicted because of possible child pornography that the sysop had deleted but was still on backup floppies in his re-use bin. (Police got a 15-year-old kid to log in for them and find some adult material, but dropped that attempt probably because it would have been thrown out as entrapment; the child-porn gave them a much nastier charge to use to steal the computer.) Perry> Censoring your users mail will not lower your risk, so why do it? On the other hand, making sure your users *have* email on the system, especially mail in transit to other systems, is good protection, since the ECPA limits what they can do with it.

1 0

This just in..
by owen＠autodesk.com 17 Dec '03

17 Dec '03

What an incredible coincidence, this is excerpted from the RISKS digest. LUX ./. owen ------------------------------ Date: Thu, 7 Oct 93 08:40:21 -0700 >>From: Tom Hanrahan <hanrahan(a)sequent.com> Subject: Epitope suit uses computer bulletin board >>From The Oregonian (Portland, Oregon), October 7, 1993, by Vince Kohler Epitope Inc. used information subpoenaed from the computer bulletin- board service Prodigy to prepare a $5 million federal lawsuit against a Kidder, Peabody vice president in Kansas City, Mo. Lois Rosenbaum, a lawyer for Epitope, said the company used information from Prodigy Services Co. to track down A. Karl Kipke, who works for Kidder, Peabody in Kansas City, Mo. The lawsuit claims that Kipke used a false name, William Smith, to log onto a Prodigy electronic bulletin board on three occasions in August. Each time, the lawsuit contends, Kipke wrote lengthy commentaries he knew were false and defamatory about Epitope, the company's management practices and its attempts to gain federal approval of an oral device used to detect the AIDS virus. [...] "We certainly believe the price of the stock is lower than it would've been but for these false allegations, Rosenbaum said. "And I think it's clear that the articles were written for the purpose of negatively influencing the price of the stock." [...] Epitope's lawsuit says Kipke and his clients were holders of short positions in Epitope stock. [...] Epitope's lawsuit seeks $5 million in punitive damages from Kipke and alleges defamation, manipulation of security prices, securities fraud and intentional interference with business relations. Rosenbaum acknowledged that the lawsuit's electronic dimension is "a very unusual situation." Submitter note: The omitted sections of text basically say that Kipke was unavailable for comment and explain what holding a "short position" means. -- Tom Hanrahan, hanrahan(a)sequent.com ------------------------------

1 0

Re: The death of the list as we know it (tm)
by Matthew B. Landry 17 Dec '03

17 Dec '03

>We debate this issue every couple of months. Give it up. Or start your >own newsgroup. I'm strongly thinking of doing that. However, I think it would be a shame if we had to operate the newsgroup and the list in paralell, without connections. And frankly, I don't think it would be entirely a disadvantage to have wider exposure. Sure, we would get some more noise (but we're used to noise by now), but we would also get a much larger readership. We would still be preaching to the choir, but we would have a "choir" large enough that it would no longer be a disadvantage. As a compromise solution, perhaps we could have a one-way gateway to a general distribution newsgroup, where posts to the list would automatically go to the newsgroup as well, but posts to the group would only go to the group (unless the person also mailed to the list). The list.cypherpunks group at Msen (where my account was before) was set configured like a moderated group, so all posts got sent to the list, but there's no reason it _has_ to be that way. Really, I think there are ways to solve this so that everyone will get what he needs. -- Matthew B. Landry ml7694a(a)american.edu (Finally!) mbl(a)ml7694a.leonard.american.edu

1 0

secure phone quest
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9310042017.AA26812(a)fegmania.wustl.edu> you write: >vat is available from ftp.ee.lbl.gov. There's no source at the moment >but there are binaries for different architectures. (And the dynamically >linked SunOS 4.1.x versions do work for Solaris 2.x) > >vat is intended for use as a IP multicast multi-user chat program, but I >believe that it is useable for point-to-point communication also. Using >it for IP Multicast may require kernel patches (depending on your OS). There's also nevot, last seen in gaia.cs.umass.edu:~ftp/pub G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

Re: second order homophonic substitution
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

This homophonic cypher sounds interesting. If the authorities demand your keys, you could scramble each row of the matrix (scrambling each row separately), so that only the dummy message can be recovered. Real ascii messages have a character set of about 2^6, so the actual size of the key matrix will be 2^12, and that means that each entry will be about 12 bits. For full generality in handling binary data the character set would be 2^8, meaning a matrix of size 2^16 entries with each entry being 16 bits. This is a 128K byte key, which is pretty cumbersome. Also, the cyphertext is twice as big as the plaintext, which will stand out too. Plus, once the authorities see your decryption algorithm it may be pretty obvious that it was designed for this specific purpose, and whatever pressures they applied to make you reveal the key may now be redoubled until you reveal the "real" key. A one-time-pad has the advantage that the key is the same size as the file, and there is no size expansion in encryption, plus it's a plausible approach to use for high-security encryption. It will take less space and still allows for multiple decryption. Hal hfinney(a)shell.portal.com

1 0

Re: Standard Headers for Anonymous Remailers
by pierre＠shell.portal.com 17 Dec '03

17 Dec '03

> I wrote: > Who qualifies whom, based on what info, and to eliminate whom? > Paul mentions organizational qualification methods > Douglas defends the rights of private groups, and anonymity Yes, I meant that as a pointer to further problems. I did not mean that it is very difficult to find organizational or technical solutions (although in practice, it may very well be), nor was I lashing back at an Orwellian suggestion. (I still get caught in the way email gets read, not that I have much more luck in person :-) Even though there may be technical solutions to "limited access" groups, it is not clear how compatible each of these is with anonymity. And at the same time it will become harder and harder to figure out whether somebody is using hir Real Name or some Assumed Name. The book publishing market surprises people because an author's pseudonym is not obviously a pseudonym. Any "limited access" policy has to address the problem of pseudonyms, and of individuals offering their pseudonym for un-accredited public access. But the problem at hand is not even that... In the case of io.com, and current remailers, the problem is netnews newsgroups that don't like anonymous abuse without really understanding how hard it could be to eliminate it... Netnews, until now, is here to provide open discussion and "publishing" space. The idea of qualification can be implemented via automatic moderation for example, but it has to contend with: 1) votes by the general public, and acceptance by sysadmins who will carry the traffic (although they don't have much of a say about mailing list traffic...) 2) superset groups and cross-posting. If a "qualify"-only newsgroup is created, then a super-set newsgroup could be created that copies everyhting from the "qualified" groups, and adds open traffic. That superset still carries interesting traffic from people who shun administrative overhead. Qualified people who want to pursue the thread they started now read the superset newsgroup. 3) If you publish, and expect email responses, you need to publish your email address. That makes you vulnerable to mail bombing. It does not matter if the newsgroups carries only filtered traffic. And thanks to Owen for posting the description of some of these net.wars. It will take me a while to go through that. pierre. pierre(a)shell.portal.com

1 0

distributed autonomous networks
by hiscdcj＠lux.latrobe.edu.au 17 Dec '03

17 Dec '03

Hi guys, well, after reading through the backlog of spread spectrum stuff, I was surprised to read about the radio-network-on-a-board (Julieboard) article that someone posted. A couple of us here in Australia have been kicking around the idea of a cheap network, running via repeaters in _very_ small boxes tossed all around a city, which would be indestructible through sheer numbers (a la the arpanet). So: anyone got any ideas, schematics, information? The main idea is a huge number of small, low-power and CHEAP nodes which would handle through traffic which anyone with a radio modem could tap into, with the nodes disguised and placed in extremely hard to get to places (tops of telephone poles, buildings, on bridges and overpasses, etc). This would mean that it would cost an awful lot of money to remove each of these things, IF they could be found. Possible power sources: batteries (but they need to be changed) solar power (Australia leads the world in solar power technology, and I know people who know people). Near Field Interaction and EMF pickups (stick 'em near high-frequency power transmission lines). Something that convert heat to electrical energy or combinations of all of the above. The idea being that we would have an untraceable, unbreakable network. Sure, you may have an address (perhaps we could set it up as a FQDN domain?), but that address would not correspond to any actual physical location. And, it would be free, aside from the cost of the equipment. No more phone calls to pay for! I have no idea how this could be done across interstate or international distances, but I'm sure people might have ideas. Bounce signals off satellites (are those big shiny things from the 50's still about?); send stuff encrypted via the internet, etc etc. This could well mean that we would have a truly private network, with strong encryption and no centralised source of transmission (I mean, most of the internet traffic into and from Australia goes via a single link, so far as I know). Comments? Dwayne

4 6

Re: Newbie question on PGP
by lear＠cp10.es.xerox.com 17 Dec '03

17 Dec '03

Thanks all for the pointers (I came back from a meeting to find > 20 messages telling me where to go! Now that's response). Thanks all who responded. Russell.

1 0