- cypherpunks-legacy - lists.cpunks.org

Re: Idle question...
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Roger Bryner wrote: On Tue, 12 Jul 1994, Graham Toal wrote: > Subject: Didn't anyone note the A5 posting? Does anyone have a copy of this posting? Before I get many more requests for this - I'm sorry, I don't seem to have a copy. I could have sworn I saved it but I've spent all morning grepping my disk and it just ain't there. Coincidence or Conspiracy - you make the call ;-) G PS If anyone has a *big* newsspool, look in uk.telecom or sci.crypt somewhere between 17th and 21st June.

2 1

sci.crypt archive ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

There's one at ftp://rpub.cl.msu.edu/pub/crypt/sci.crypt But I just looked and it only has up to April 94. By the way, everybody should check out http://www.quadralay.com/www/Crypt/Crypt.html ftp://furmint.nectar.cs.cmu.edu/security/README.html These are two budding cypherpunks WWW sites. Somebody's been busy. "Cypherpunks weave Webs!" Jim_Miller(a)suite.com

1 0

Re: Gov't eyes public-key infrastructure
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>The U.S. government intends to operate a public-key certification >>system for government users that will also serve the private sector, >>as well. But a report just completed by Mitre Corp. for the National >>Institute of Standards and Technology (NIST) puts the price tag at >>$1 billion for the start-up of the government alone, with a possible >>$2 billion annual operational cost for managing certificate-revocation >>lists. > >All in all, I'd say this is a pretty good argument for PGP's web of trust >model... Especially given that urban folklore about everyone being only 5 hops away on the network of life. I.e. Everyone is a friend of a friend of a friend of a friend of a friend of anyone else. This was sort of troped upon in "6 degrees of Separation", the John Guare movie/play. If anyone had any concrete data about this, then it might be interesting to calculate the optimum number of people you should get to cosign your public key. Anyone remember enough about Ramsey numbers and Graph Theory? -Peter > >Phil

3 2

Re: Idle question...
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

From: Ian Farquhar <ifarqhar(a)laurel.ocs.mq.edu.au> I was compiling a list of crypto algorithms the other night, trying to produce a library of description documents for the algorithms, and an interesting but idle question hit me: what ever happened to RC1, RC3, MD1, MD3, A1, A2, A4, A6, and A7? Just wondering if anyone knows... Ian. Any reason why you left out A5 above? :-) ... >From gtoal Mon Jun 20 14:35:50 1994 To: cypherpunks(a)toad.com Subject: Didn't anyone note the A5 posting? X-Phone: +44 31 662 0366 X-Fax: +44 31 662 4678 X-Organisation: An Teallach Limited Status: RO Didn't anyone notice that someone posted a putative source code for the secret A5 algorithm as used in GSM phones? (It was on sci.crypt xposted to uk.telecom, on Friday). Seems someone was going to give a talk on ways of hacking the algorithm, at some university, and he got stomped on by CGHQ. So another guy has come out in sympathy and posted his reconstruction of the algorithm in C as reverse engineered from a hardware description he received in a plain brown envelope! This is *significantly* more of a coup on the net that the NSA handbook. Now, all I need is for you guys to explain coherently *why* it's a good coup and what the political implications are, and I'll feed the story to the UK press. (I don't think anyone here has it yet...) G

4 3

NSA technology transfer (fwd)
by Dan Harmon 17 Dec '03

17 Dec '03

I'm reposting this in response to a few recent posts inquiring about the NSA flyer. ---------- Forwarded message ---------- Date: Tue, 14 Jun 1994 00:21:30 -0500 (CDT) From: Dan Harmon <harmon(a)tenet.edu> To: cypherpunks(a)toad.com Subject: NSA technology transfer The following was posted on the list in the middle of May. Being curious I called the number list at Ft. Meade. The person on who answered was real shaken, for lack of a better term, that I called, it seems that this was the second inquiry that day. He wanted to know various things, like where did I get the information, was my name Bruce.... After a few minutes he finally took my name and said, to call him in a week to 10 days if I did not here from him. A few day later he called and said I needed to send a letter to expressing my interest in the technology. About 10 ten days after that I called to inquire if he received my letter and what was the next step. It seems that there had been quite a few requests and that they were trying to determine whether or not they were going to allow the technology to be transferred to individuals. The person said to call back in 4 or 5 days. I called today and they said in essence that they were not going to let individuals have a shot at it. They said that they were going to charge stiff license fees, that you would need to show a plan of how you were going to develop the product..... You get the point. It is obvious that they really don't want to transfer the technology. And if they do it will be to someone with deep pockets and who they like. I wonder where the fees that they want to charge will go, to the general treasury or to their own budget? More later. Dan Harmon On Thu, 19 May 1994, Anonymous wrote: > > > Newsgroups: sci.crypt,alt.security,alt.privacy > From: schneier(a)chinet.chinet.com (Bruce Schneier) > Subject: "Interesting Stuff" Checkers at the NSA > Message-ID: <Cq2934.q0(a)chinet.chinet.com> > Organization: Chinet - Public Access UNIX > Date: Thu, 19 May 1994 17:40:15 GMT > > This is from a flyer that NSA people have been distributing: > > NATIONAL SECURITY AGENCY -- TECHNOLOGY TRANSFER > > Information Sorting and Retrieval by Language or Topic > rest elided

3 3

New National ID Card Proposal
by David Banisar 17 Dec '03

17 Dec '03

CBS Evening News just reported that Clinton has "tenatively signed off" on a National ID card recommended to him by a commission on immigration reform. The obstensive reason for the card is for employment and immigration. Each card will contain a name, photo, mag stripe with info and a "verified SSN." It was supported by Senator Alan Simpson of Wyoming, a long-time supporter of id cards. Gov. Pete Wilson of California has apparently offered to make California a test-bed for the proposal. The proposal was opposed by Xavier Beccera, a Congressman from California. A previous effort to impose a national id card was rejected by Congress in 1986. EPIC is working with Privacy International to investigate this report. PI has led successful campaigns aginst national id cards in Australia, New Zealand, and the Phillipines. In Australia, the PI-led campaign led to the dissolution of both houses of the federal Parliament in 1987 after hundrends of thousands marched in protest. The Australian campaign brought together groups from all parts of the political spectrum from the Communist Party to the Libertarian Alliance, farmers and conservation groups, rock stars, academics, large businesses such as banks and mining corporations, but the overwhelming support came from the public who created the biggest civil protest in Australian history. David Banisar (banisar(a)epic.org) Electronic Privacy Information Center 666 Penn. Ave, SE #301, Washington, DC 20003 202-544-9240 (v) 202-547-5482 (f)

1 0

SPA & FBI after Pornographic traitors
by Brad Dolan 17 Dec '03

17 Dec '03

Sandy asked.... Associated Press reports today: Officials at one the nation's three nuclear weapons laboratories discovered their computers were used to store pornography, the Los Angeles Times reported Tuesday. Computers at the Lawrence Livermore National Laboratory contained more than 1,000 pornographic images, said Chuck Cole, deputy associate director of computing at the lab. [...] The computers were shut down after an investigation uncovered software piracy on the Internet, a network of thousands of computer networks originally designed to connect computers at universities and government research labs. It is now used by millions of people. "We are currently tracking over 1,600 pirate sites on the Internet in a joint investigation with the FBI," said Peter Beruk of the Software Publishers Association, which represents major software manufacturers. "It is a very serious and costly problem." [...] ----------------------------------------------------------------- Some people might consider the second paragraph a nonsequitur to the first. However, if one doesn't think too clearly about things, one might get the general message that we need Daddy to help protect us from the pornographers and pirates lurking out there on that internet thing. Brad bdolan(a)well.sf.ca.us

1 0

Re: NATIONAL SECURITY PORN RISK
by Blanc Weber 17 Dec '03

17 Dec '03

-- Excerpt -- One computer expert, who requested anonymity, said there might be more to the incident than meets the eye. The expert suggested that the hard-core pornography may be a cover for an ultra-sophisticated espionage program, in which a "sniffer" program combs through other Livermore computers, encodes the passwords and accounts it finds, and then hides them within the pornographic images, perhaps to be downloaded by foreign agents. -- End excerpt -- Maybe this is all just an excuse to examine the evidence (1,000 GIFs). Blanc

1 0

Encrypted, Chained Reply Blocks
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

I noticed a message posted here, anonymously, with an "encrypted reply block" (ERB) attached to the end of it. Instructions were given that to reply to the message, the block was to be pasted at the very beginning of the reply, which was then to be sent to a certain remailer. The block started with the usual "::", followed by and "Encrypted: PGP" line typically used with chained remailers. While I don't know the specifics of that particular ERB, would it be possible to chain a REPLY through several remailers, such that the body of the reply was sent along in the clear through each link of the chain, but the final destination address was only visible to the operator of the final link in the chain? This would require that after the "Encrypted: PGP" block, any appended plaintext would also be sent along by each remailer and not discarded. Which remailers allow that? Hypothetically, it would seem that one could take an "empty message", using the "CHAIN" utility to chain the "message" through remailers A,B,C,D, encrypting it at each step, placing the resulting block in the message body with instructions that the resultant block must precede any replies, which must then be sent to remailer "A". Alternatively, instead of an empty message, a single, unique, identifying line could be used as the message. This would allow a person to generate multiple ERBs and know which one had been used for any given reply. One weakness I can see in such a scheme is that traffic analysis would be a bit easier, since the plaintext of the reply would be visible at each step. Also, there would be a potential for "hand tracing" the reply to its destination, assuming each remailer operator cooperated, by sending a personal message to operator "A", with the ERB attached, asking him/her to decrypt the next link destination, then forward the message to the operator of the next link with a similar request, and so on, requesting that the last operator in the link report the ultimate recipient's email address to the requestor. This would potentially be easier than tracing a message the other direction, since by the time the message arrived, information necessary to trace it backwards might have been already deleted at one or more of the chained remailer sites. Any thoughts or suggestions? Are there any further obvious weaknesses in this scheme that I may have missed?

1 0

Pseudonymous ID cards?
by analyst＠Onramp.NET 17 Dec '03

17 Dec '03

On the bright side, at least the Clinton administration is trying to stir up interest in privacy issues amongst the general public. Between the administration's support of Clipper, National ID cards, National Health cards and Digital Telephony (have they supported this yet?), there should start to be a lot of public interest in these issues. Personally, rather than _just_ naysay everything that is being proposed (which I will do, strongly), I would like more concrete recommendations and proposals to make on the positive side that use technologies like digital signatures and reputations to *protect* privacy while still allowing many of the familiar sorts of social/economic interactions that we take for granted. Perhaps we can pull an Aikido maneuver on this sudden gov power grab (ok,ok, pretty far-fetched). But, short of tracking down the Scientific American article from a couple of years ago and re-reading it (and I'm sure it's out of date), I'm not really sure what we can do with pseudonymous reputations and whatnot given the current state-of-the-art. So, I'd like suggestions, comments about alternative ways of establishing digital IDs, insurance cards, credit cards, etc. that protect privacy instead of divulge it, while still providing some of the societal controls that we have come to expect (e.g. that drunk drivers will be deprived of a license to drive). Do we have alternative suggestions to make in this dark hour so that we can actually win back some of our privacy? Can these sorts of technologies be implemented in a way that is understandable by the average citizen-unit? -- Benjamin McLemore analyst@onramp,net PS I wonder what exactly Justice and/or the spooks have on Clinton that's so effective? Or are he and Gore actually as stupid as they act?

1 0