- cypherpunks-legacy - lists.cpunks.org

SUFFERANCE remailers
by Gary Jeffers 17 Dec '03

17 Dec '03

SUFFERANCE REMAILERS Definition of SUFFERANCE REMAILER: A remailer that exists only so long as the U.S. Feds get around to outlawing it.; a sitting duck remailer. ; a remailer whose physical location may easily be found.; a remailer whose operator is vulnerable to the State's gun argument.; currently, the only kind of remailer there is. Definition of FORTRESS REMAILER: A remailer whose physical location cannot be found. ; a remailer that does not require the consent of the State. ; a Freedom remailer. Anybody got any idea at all how to build a Fortress remailer? PUSH EM BACK! PUSH EM BACK! WWWAAAYYY BBBAAACCCKK! BBBBEEEAAATTTT STATE!

2 1

Mighty quiet lately
by unknown＠example.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Today I received four whole messages from the cypherpunks list. Is it my system or are things mighty quiet lately. Maybe the roundup of us chronic dissidents has begun. <grin> ----------------------------------------------------------------------------- Fido: Sam Kaplin 1:282/1018 | "...vidi vici veni" - Overheard Compuserve: 75240,131 | outside a Roman brothel. samuel.kaplin(a)warehouse.mn.org | 75240,131(a)compuserve.com | Change is the only constant in the For confidential communications use PGP | Universe..."Four quarters, please." ----------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAgUBLokINwpnimeWAf3FAQELDQP/SMoIlXiVk69ulJlYegYvO4FbLgC5Xiou 2PQuMs7eRgEX0Qko+VBXVQw2zU1Fd+MLGsDCTzLJEyduPQtTSXsBFHjFfIJ7ecsV 55iZ3gi1r+aafO6MhzMQ2UIRUVrOiRrFmAG8hAAxurSuSpFn6YoEB61rvY5YUhdQ RkvFj92lnEU= =2PaT -----END PGP SIGNATURE-----

1 0

alt.fan.tv-serial.bikinis
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

merriman(a)metronet.com (David K. Merriman): Subject: Beach Clash first edition review Sandy's H.E.A.T was hard enough on my poor 'D' key; I hope the Cypherpunks list is not mutating into alt.fan.tv-serial.bikinis... ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: First Virtual
by peter honeyman 17 Dec '03

17 Dec '03

> Does anybody know anything about a new company named "First Virtual"? I > know they got NSB from BellCore and a couple of other researchers. nsb will be giving an invited talk at the winter '95 usenix conference in new orleans. Speaker: Nathanial Borenstein Affiliation: First Virtual Abstract: Traditional approaches to introducing commerce to the Internet focus on using the Internet to facilitate the sale of goods and services. However, these approaches require either encryption or a closed system in order to safeguard payment. By restricting our focus to information commerce -- transactions not involving physical goods or service -- we can radically simplify the underlying commerce model, with extremely important consequences for the usability and democracy of the Internet's payment infrastructure. http://www.citi.umich.edu/u/honey/usenix.html has general info on the winter '95 usenix conference. peter

1 0

Viacrypt PGP for Windows
by Adam Shostack 17 Dec '03

17 Dec '03

I just got (snail) mail from Viacrypt announcing 2.7 for windows. $124.98, now shipping. Includes a "dll for certain Key mgmt functions" a windows shll, and 2.7 for Dos for crypto functions. This flyer also announces a mid-October ship date for 2.7 for the macintosh. Supports Apple events and Applescript. Contains online documentation, and will encrypt/decrypt and sign the contents of the clipboard. Same price. Viacrypt is 602 944 0773, or viacrypt(a)acm.org. Adam

1 0

Re: TIS, SKE, & CyberCash Inc.
by Carl Ellison 17 Dec '03

17 Dec '03

>From: wfgodot(a)iquest.com (Michael Pierson) >Date: Tue, 27 Sep 1994 19:05:54 -0600 > (E) shall preserve the functional ability of the government > to interpret, in a timely manner, electronic information > that has been obtained pursuant to an electronic surveillance > permitted by law; This really bothers me. If the government today has a functional ability to interpret in a timely fashion information it has obtained, that is purely an accident (that the communicating parties chose not to encrypt) and the pure accident is likely to remain (because they will continue so to choose). However, the government has been trying to establish an enforceable right to succeed at gathering intelligence by surveillance and it has never been granted that right and should never be. Giving it a right to tap deals with gov't actions (permitting tapping). Giving it a right to understand what it taps deals with citizen actions (prohibiting encryption). Citizens have always had a right to try to keep a secret from the gov't and on this one point, we should not yield one micron. There should be *no* move at all toward establishing a right of the gov't to understand what it taps. Sorry -- I realize I'm preaching to the choir -- but this is *the key issue* to me and I wanted to push it. - Carl

1 0

Apple patents OTP reuse!
by nobody＠leri.edu 17 Dec '03

17 Dec '03

Like a lot of people, I often get angry when I read US patents. At best, I'll get confused or bored. Tonight, probably for the first time ever, I found comic relief in the otherwise sterile pages of a patent. Check out US Patent 5,345,508, "Method and Apparatus for Variable-Overhead Cached Encryption", by Lynn, Zweig and Mincher, assigned to Apple Computer, issued September 6, 1994. These guys have patented the notion of reusing one-time pads. That's right, reusing one-time pads! To "cut the computational overhead", they say, they generate a PN sequence once and then reuse it by XOR with successive packets until a "use limit" is reached. Quoting: "When the maximum count value specifies that the PN sequence is to be used only once, the security afforded by the present invention will be high, but a new PN sequence must be generated for each message sequence transmitted and so the computational overhead will also be high. If the maximum count value specifies a maximum count value [sic] greater than one, the PN sequence stored in the cache will be reused to encrypt the maximum count number of message sequences. The resulting ciphertext messages will be more vulnerable to statistical cryptoanalytic attack as the maximum count value increases..." No shit! Talk about missing out on some absolutely fundamental concepts... There may actually be a silver lining to this utterly silly patent. Although I've only looked it over briefly, it seems to unintentionally cover the TIA's so-called voice "privacy" technique for TDMA digital cellular -- i.e., generating a pseudorandom sequence at the beginning of a call and then reusing it for every frame. Maybe Apple could be persuaded to agressively sue everybody so cellular will switch to *real* encryption... :-)

1 0

Datacom watchdog set up in INDIA
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Datacom watchdog set up in India -------------------------------- The Forum for Rights to Electronic Expression (FREE) has been formed in India as a body dedicated to extending fundamental rights to the electronic domain. FREE owes its creation to an attack on Indian datacom by the Indian government, in the form of exorbitant licence fees (a minimum Rs. 1.5 million = US$50,000 each year for a BBS, much higher for e-mail). The Indian government also dug up the 1885 Indian Telegraph Act, a legacy of our British colonial masters, and used it to reserve for itself the right to uplink to a satellite, as well as to require the provider of any telecom value-added service to ensure that no objectionable or obscene messages are carried on the network. Value added services covered under these guidelines include e-mail, voice mail, BBSes, video conferencing, etc. Any specially authorised officer of the government, "if satisfied that it is necessary or expedient to do so" in the interests of security of the State, friendly relations with foreign states, or for preventing incitement to the commission of an offence, may also tap into the system. As yet, FREE does not have any office bearers or staff. All discussions are carried out by the entire membership on the FidoNet echo FREE. Posting to the echo makes you a member of FREE, unless you specifically ask not to be made one. Decisions on what may be published as a FREE document are taken by consensus. The first document that FREE published was a letter to the Indian government making suggestions relating to telecom policy. All published FREE documents and related material are available by Gopher to mahavir.doe.ernet.in and will soon be available at the EFF Gopher/Web/FTP site: gopher://gopher.eff.org/1/Groups/FREE http://www.eff.org/pub/Groups/FREE/ ftp://ftp.eff.org/pub/Groups/FREE/ To get the FREE echo on FidoNet or for any other correspondence with FREE, send mail to free(a)arbornet.org. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: 3DES
by GRABOW_GEOFFREY＠tandem.com 17 Dec '03

17 Dec '03

>Quick question. There's a brief mention in Applied Cryptography that >triple DES uses: > > Eabc(x) = Ea(Db(Ec(x))) > >as opposed to: > > Eabc(x) = Ea(Eb(Ec(x))) > >in order to preserve some symmetry properties. Can anyone give a >better explanation? I thought it goes like this: Eab(x) = Ea(Db(Ea(x))) Anyone? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | "What we demand are rigidly defined | | Oyster Bay, New York | areas of doubt and uncertainty!" | | | -------------------- | | grabow_geoffrey(a)tandem.com | Clipper, SkipJack & Digital Telephony | | | JUST SAY NO!!! | |----------------------------------------------------------------------| |PGP 2.6 fingerprint = AA 9E 35 12 F8 93 72 8D 1C E5 D5 BC 74 BE 49 D3| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Mandatory email verification
by Dr. D.C. Williams 17 Dec '03

17 Dec '03

Greetings: Is anyone aware of a way to modify sendmail to require a verified digital signature for all mail sent? This subject came up after a discussion of the possible repercussions of forged email through port 25. Even a good PGP user can't use manual encryption on a message-by- message basis as a defense for false mail attribution. For example, someone forges a defamatory message and signs your name to it. The recipient brings it to public attention and you try to claim "it doesn't have my PGP sig, therefore I didn't send it". The obvious counter is that you purposely failed to sign it to preserve your plausible deniability. The only way this would work is if the system you're on won't accept mail unless accompanied by a digital signature, which would allow the user to claim innocence if it wasn't his sig. The mailer would also have to check the sig to ensure that it belongs to an authorized user on the system to prevent people from creating one-time keys just to appease the mailer and prevent their real sig from being used. Running this version of "SIGmail" (<-- note flashy new marketing name) on your system would seem to be a reasonable defense against claims of false attribution. Has anyone done any work along these lines? Is there an obvious fault with a system which would operate in this manner? Please don't misconstrue this as an attack on anon mail, which obviously needs to be preserved. What I'm interested in avoiding is mail forged with another user's name. All that's required to do a convincing job now is an account on the user's home system and some knowledge of ESMTP. Seems to me like this is a potential disaster waiting to happen. Maybe the H.E.A.T. crew can solve this one . . . Fabio, we need you! =D.C. Williams <dcwill(a)ee.unr.edu>

6 7