- cypherpunks-legacy - lists.cpunks.org

Paranoid
by major＠dcd.wa.gov.au 17 Dec '03

17 Dec '03

A nym of no particular repute <nobody(a)Menudo.UH.EDU> writes: > Does PGP compress the text before it is encoded? yes > Does this allow a cracker to search for the compression's signature > after every attempt? There is no "signature". Unix compress(1) leaves a signature but there is nothing in the math of compression which forces a compression algorithm to do so. Major

1 0

No Subject
by m-sh8481＠SPARKY.CS.NYU.EDU 17 Dec '03

17 Dec '03

Dear friends, I am new to this group but interested in cryption and encryption and also about Public keys and Private keys. The only thing I know about them is that I have read their man pages on the Sparc stations. But I donot still know where to look in for the Public and the Private keys and how to change them etc. Could someone be kind enough to give me a little i/p that how should I proceed on to become a cypherpunk on this mailing list. I know it might be awkward for many of you. But I guess I have to start somewhere. ----Thanking in advance Hardayal Singh

1 0

Re: Tim May, Detweiler and Me.
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

> Granted, Mr. Detweiler has been a royal twit. But then, so have many > others on the list in reply to him. Shame on the lot of you. Oh, fuck off. Take your preaching and moralizing to the net. In fact, all of y'all interested in reforming our black hearts: get fucking lost. I want to hear Hal Finney's description of DC-nets, and you are just plain in the way. Nowhere, Man

5 4

ViaCrypt PGP
by norm＠netcom.com 17 Dec '03

17 Dec '03

Congratulations and good luck. I have a Mac and will not be buying you PC version. I might well buy a Mac version especially at the $99 introductory price. I hope you send me e-mail when you have a Mac version. I am impressed with PGP and would be willing to pay for a "legal" version. I have no important secrets but may still buy the program as a matter of principle. I have a couple of (free) ideas you may be interested in. (Consider this a customer request if there are any lawyers about.) As I understand PGP, it generates random numbers by timing keystrokes for at least two purposes, first to avoid known plain text and second to choose large primes for the RSA key. If there were an option to generate those random numbers by a published mapping from input text then the following benefits would accrue: The paranoid could compare the output of your program with others written to the same spec to gain assurance that programs operated to spec. This is especially critical in key generation. I would propose that the spec would be to choose the prime from among an arithmetic sequence A+Bn where A and B are derived from the input text. The paranoid would know that the cipher text contained no covert or subliminal information. Both of these benefits would accrue without having to read the code for either of the systems compared. It would need to assume no collusion to achieve this assurance. Some paranoids would see the threat of exposure as sufficientreason to trust the program. Another advantage is that I could run your PC version on my Mac using SoftPC. I understand that PGP does not get random keystroke timing under SoftPC. Yet another advantage would be to those who wish to keep their private key in their head. This would require remembering and correctly typing about 1000 characters at each computer sesion. An optional text checksum would thus be strategic and not compromise security. I understand that the quality of keyed data may be poor. Shannon estimated that such data could provide about one bit of information per character. It might be difficult to provide a sufficient warning to users unfamilliar with information theory on the dangers of known or guessed sayings as input text. Unlike some cryptographic applications weekness in the random numbers does not induce sudeen failure. The effort in breaking a public key declines slowly with declining quality in the random numbers. Keystroke timing may well be the best default however.

1 0

ID of anonymous posters via word analysis?
by jpinson＠fcdarwin.org.ec 17 Dec '03

17 Dec '03

All the talk recently about multiple fake identities reminded me of a research project I read about a few years ago. A team set out to ascertain if Shakespeare was really one person, or actually several people. The researchers analyzed the frequency distribution of words found in the works of Shakespeare, and compared them to the other writers of the day. I don't recall the results of the project, but that kind of research would have implications for anonymous postings. It is not too difficult to see how certain spelling errors, word frequency (how often do you say 'I':-) choice of wording, and the working vocabulary of an individual could allow you to identify an anonymous poster. This would be particularly easy if the individual also posted under their real name. I suspect that the government has done research on this topic. It would be useful to identify which terrorist made which (written) threat. This brings up the subject of how one can post without leaving an "ASCII fingerprint". I suspect the use of a spelling checker and grammatical checker would help. Perhaps running your text through a language converter, (say English to French) then back would remove many identifying characteristics. Jim Pinson Galapagos Islands PGP key available by finger jpinson(a)fcdarwin.org.ec

2 1

Re: ID of anonymous posters via word analysis?
by James Still 17 Dec '03

17 Dec '03

> I remember reading some time ago that the Nazis had a method of >trapping communists that went like this: > They'd put the suspect in room and carry on a conversation with him >(all males, as I remember). Then, after several hours of conversation >about any and all kinds of subjects, they would tote up the number of >times that the suspect used the word "concrete" -- evidently a favorite >left-wing buzzword in the '30s. If the "concrete" cropped up frequently >.... off to camp went the suspect. This practice is, IMHO, extremely unethical and dubious at best! If the world's experiences are a metaphorical "object" bundled up in a <.lib> somewhere in the cosmos, then *anything* that the Nazi's did should be considered completely bugged code. Why do we want to inherit their flawed algorithm's? The whole point of the cypherpunk cause is to compile code from the ground up--considering the ethics involved with decisions such as rooting out 'nyms. Have we decided that it is now imperative to know the identities of those on 'our' side (further fueling this polarization of 'us' versus 'them')? Let's leave behind this obsession with determining who's who; it has taken us too close to the kluged code of Nazi history! My eye is on the prize... ;) --- still(a)kailua.colorado.edu ------------------------------------

1 0

PGP automation
by holland＠CS.ColoState.EDU 17 Dec '03

17 Dec '03

Right now, it is a complete pain in the ass for me to encrypt or sign messages using PGP. The reason is because I have my email account on one of CSU's unix machines, so I have to do my posting there, while my PGP stuff lives on my PC in my apartment. Usually, I check my mail and read news by calling CSUNet over my modem, but if I want to encrypt, decrypt, sign or check the signature of a message, I have to zmodem the message to my machine, log off, decrypt or check the message while offline (or at least shelled into DOS), type up a reply, manually encrypt it and finally get back into my term program and zmodem the reply back up to CSUNet and mail it. I don't really want to run PGP on CSUNet, since I don't trust their machines like I trust mine, but I am thinking about doing that and generating a key which I would be wiling to use for less secure stuff. Anyone here have any other suggestions on making encryption less of a pain? Doug | Doug Holland | Proud member of: | holland(a)beethoven.cs.colostate.edu | Mathematicians Against Drunk Deriving | Finger for PGP 2.2 key |

4 4

PGP automation
by Graham Toal 17 Dec '03

17 Dec '03

In article <9310281940.AA28085@beethoven> holland(a)cs.colostate.edu writes: > Right now, it is a complete pain in the ass for me to encrypt or sign > messages using PGP. The reason is because I have my email account on > one of CSU's unix machines, so I have to do my posting there, while > my PGP stuff lives on my PC in my apartment. Usually, I check my mail > and read news by calling CSUNet over my modem, but if I want to encrypt, > decrypt, sign or check the signature of a message, I have to zmodem the > message to my machine, log off, decrypt or check the message while > offline (or at least shelled into DOS), type up a reply, manually encrypt > it and finally get back into my term program and zmodem the reply back > up to CSUNet and mail it. I don't really want to run PGP on CSUNet, since > I don't trust their machines like I trust mine, but I am thinking about > doing that and generating a key which I would be wiling to use for less > secure stuff. Anyone here have any other suggestions on making encryption > less of a pain? This may seem a little excessive, but the only sensible way to use pgp in environments like yours or prz's (heh heh) is to set yourself up with your own site at home, either with a dialup SLIP/PPP feed or a plain and cheap uucp feed. Both of those options are becoming much cheaper than they used to be, and you can run suitable software on all sorts of computers - whatever you're using to dial in to your timeshare service at the moment would probably do, as long as its not just a dumb terminal. DOS, a free unix or linux, Amiga, Atari - they can all handle at least uucp if not tcp/ip too. If you don't have suitable hardware, you can surelu find a 286 dos box with an old 20Mb drive and plain text- only display secondhand somewhere for $200 or less... that'll run UUPC or even KA9Q. If you care about privacy in your email, you *have* to run it all the way into your own machine. G

1 0

Re: ID of anonymous posters via word analysis?
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't see anything wrong or unethical about using software. It is true that the Nazis used gas against the Jews in WW II, so are you not going to use gas? I hope this doesn't sound insensitive, but part of studying anonymity and the pseudonymous experience is finding out what sort of techniques can be used to discover someone's nym. I pointed one out earlier - watching for double postings, one by nym, the other by actual identity. If studying writing patterns is a viable method for discovering the true identity of a nym, then by all means try it. If someone were to discover my identity, I would use it as a learning experience. I'm going to be as careful as possible, but I would not advocate ignoring software if it exists, no matter what its historical significance. Wonderer -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNF+hh1kTJuroDD9AQG96QIAo5JEYTSOAwaAdFDs9AOEbbq27Uho3b8r T1corhWKdZVmESMYLKTCaIcxlkABUcCcZfyCS8bLlud7P4HlCSq3dw== =RKfn -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Duplicate key in keyring?
by J. Michael Diehl 17 Dec '03

17 Dec '03

Lately, when I use pgp -ka, I get the following message: warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' I'm using the keyring from the key-server. This really annoys me. Is there any way to fix this? Thanx in advance. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

2 1