- cypherpunks-legacy - lists.cpunks.org

Re: Rumor: DSS Broken?
by Robert Hettinga 17 Dec '03

17 Dec '03

At 9:41 PM -0400 5/18/96, Bill Stewart wrote: > MD5 is at least weakened, maybe broken; there's an abstract by Hans Dobbertin > that says something about generating collisions, and gives an example > (though the abstract doesn't say how general the method is.) That's what I get for not reading the DSS stuff when it came out. I'd heard lots about the MD5 stuff, but I didn't put the two together. It also looks like I'm behind in my reading. Time to buy another edition of Applied Cryptography... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: The Crisis with Remailers
by Bruce Baugh 17 Dec '03

17 Dec '03

At 01:06 PM 5/18/96 -0700, Dimitri Vulis wrote: >hence my comments from here from time to time that the technological >problems of anonymity are not the true obstacle to widespread use. >there are deeper problems that cpunks skirt around but fail to grasp >because of numerous prejudices. While I hate to lend support to anyone as much a twit as Vulis is, he's got a point here. I don't think most cypherpunks realize how anonymity is perceived out in the net at large. Take news.groups, a fairly important group I happen to read regularly. With the exception of Rich Graves' presence, _all_ the uses I see there are for cowardly abuse in a way that lets the poster escape having to answer for his views. I'm not talking about presenting important information where wrong-headed authorities could engage in reprisals, either, but baseless accusations of theft, child abuse, and just plain torrents of obscenity. That's _all_ it's used for (again, with the exception of Rich). There's a problem here. It's one thing to say that the benefits of anonymity outweigh the problems. I'm inclined to that view myself. But it's much harder to defend that view in a forum where anonymity is used so commonly for problematic ends, and to offer anything in the way of constructive solutions. It would be pleasing to see more cypherpunks actively dealing with these problems out there in net.land. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

2 1

News from Burma
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ASIA 'Excommunication' An anglo-Burmese businessman friendly with pro-democracy leader Aung San Suu Kyi has been sentenced to thre years in jail for owning unauthorized telephones and fax machines. James Leander Nichols, also known as Leo Nicholas, was punished for having two fax machines and a telephone switchboard with nine lines in his home, a spokesman for Suu Kyi's political party said. In an effort to discourage contact between Burmese citizens and the outside world, Burma's military government requires people to get permission to own a fax machine, satellite dish, or sophisticated phone system. News Services The Atlanta Constitution/The Atlanta Journal Alec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ9ArCKJGkNBIH7lAQFrrAQAw7g/OeEU0IbK+4haxL4r7CWez9R1MqH6 W0Zq1l59XlRDkCCPj34HqrXGchg1Wnnw6LMK7B41JMRl68jvkVLmLnZ9FHwehZ9V R2WzRM+VzHwcpxQ4Fha1pwdq4Lm5naeS+3FiTQDcbTATT7hpBSiLOXhMNSlxFcBP G2KtNA2iZAM= =g8jc -----END PGP SIGNATURE-----

1 0

Re: Interactive Week exclusive - White House to launch "Clipper III"
by rodger＠interramp.com 17 Dec '03

17 Dec '03

On 5/18, Tim May wrote: >A question for Will Rodger: Is this "White Paper" ("The newest proposal is >contained in a 24-page White Paper, a draft of which hit Capitol Hill >earlier this week") related in any way to the one being prepared by Herb >Lin and a bunch of other folks? It was due out about this time, and the >topic seems similar. A bunch of us gave input to Herb and his panel at the >CFP in '95...if this is the same White Paper, looks like we might just as >well have saved our breath. Don't know. This did have full input from security agencies, however. >I read the stuff at the URL, and at first blush it looks to say nothing >about _domestic_ (within the U.S. and Canada) encryption. I'll be anxious >to see what the White Paper says about domestic encryption. > No restrictions domestically nor in Canada. Even so, these CAs and the policy body above it clearly give the govt. more of a role in controlling crypto. >However, as with other proposed crypto laws and "trial balloons," there are >several questions which arise: > >1. Will there be pressures put on the browser companies (Netscape, >Microsoft, etc.) and the e-mail companies (Qualcomm, Microsoft, Claris, >Lotus, etc.) to produce a "world version" that meets export standards with >a single shrink-wrapped package? > >(Recall that last fall some of the various companies stated as their goal >having a single package that could be shipped worldwide. Some of them >claimed having two versions, a domestic U.S. version and an international >version, was too onerous. I am skeptical of this, given that they have >multiple platforms to support, multiple operating systems, etc. But they >claim it is.) > >2. Interoperability. How will U.S. users exchange messages with >international users? Will a U.S. user have to register with the Authorities >to get the proper credentials, protocols, etc.? No indications they would. Idea is each authority could talk to the other and request escrowed keys or info. a la interpol. Of course, as today, there's no guarantee that agreements will always be in place, nor honored. > >3. With products like PGP, there are already international users (lots of >them). Thus, no "export laws" are involved. So, will I be able to >communicate with them using my existing PGP methods? Under the White Paper, yes. > >And if U.S. users can continue to interoperate with international users as >they are now doing, this puts the lie to claims about how key escrow will >be useful for law enforcement. Which makes it look a lot like the old proposal. > >4. And of course there is always the issue of _superencryption_. How a >GAKked program can detect that superencryption is being used has never been >adequately explained (to my satisfaction at least). Entropy measures won't >do it, and forbidding any encryption of messages already containing "BEGIN >PGP" will clearly just be a klugey bandaid. > >5. What about U.S.-based corporations with offshore offices? Is a company >supposed to replace its entire intranet corporate network with a GAKked >system if even a single user is outside the U.S.-Canada? If it's legal now, the paper suggests it should be legal in the future. > >6. What about U.S. persons travelling abroad? > >7. What about packets zinging around the world? Lots of complications if >GAK is insisted upon. And lots of new avenues for "packet laundering." > >8. The issue of why other countries would insist that their citizens GAK >their keys when U.S. citizens don't have to!! >("Yes, Herr Glomlutz, we are insisting that all Germans using Netscape 4.0 >must deposit their keys mit der Key Authority. No, we are not requiring our >own citizens to do this." I don't think this will fly too well.) > >I can't see how other countries will go along with this. The Paper is quite unclear on this, as well. Presumabyt other countries will have equally spiffy stuff they will require be escrowed for export under COCOM. ALl of this, of course, assumes cooperation from OECD, et al. > >And what about the usual problem of "rogue nations" like Iraq, Iran, North >Korea, Israel, and Liberia? Same as before. > >9. Many other issues. (They never answered the similar questions raised the >last time, so I doubt they will this time.) > > >Clipper III, if it turns out to be another worthless proposal which is >laughed out of Washington, will be no real threat. If Clipper III actually >outlaws or places limits on domestic use of crypto (as I think it must, >else it can be too easily circumvented completely), then it will be a >rallying cry which will likely see our membership increase still further, >the anti-Washington rhetoric escalate, and likely some new developments in >the war. Stay tuned.... Will Rodger Washington Bureau Chief Interactive Week.

1 0

Re: Sendmail Question (was: SMTP Server for sending to anonymous remailers?)
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:09 AM 5/19/96 -0700, you wrote: >If you use popmail (like Eudora), then just tell it the server to use in >"SMTP Host". > > -Lance > I have been following this with no little interest. Using Eudora Pro when I attempt to replace host: smtp1.abraxis.com with *SMTP Host*, I receive the message *Attempting to resolve host: SMTP Host*, and dat's all until I stop the send command. Thanks Alec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZ9PJyKJGkNBIH7lAQGamwP/e1L3bWlOxCLfcEcSCUK7L2NPyDn3lNoe n4omNWrcUUOzBpQXg2fxPgmfsBDvao84neqbnkLv4HlPdFqDT/WgbNKzaJILYazS 2W2XsuDY5fxDNizKPmv+BSiPCYCMqCdD96g+Pl52Im1F6D9oEYkbe1Kvpb+iZTOj UyQUePJKtbk= =70bm -----END PGP SIGNATURE-----

1 0

Re: Interactive Week exclusive - White House to launch "Clipper III"
by Dave Farber 17 Dec '03

17 Dec '03

The "White Paper" (if it exists) from the White House is different from the National Research Report. The NRC is independant from the White House and the Government. Dave >From my IP mailing list: Date: Fri, 10 May 1996 08:50:41 -0700 Reply-To: farber(a)central.cis.upenn.edu (Dave Farber) To: interesting-people(a)eff.org (interesting-people mailing list) Subject: The National Research Council Study of National Cryptography Policy Please post this message widely I am writing to let interested parties know about the imminent release of the NRC's study of national cryptography policy. If all goes well, we hope to release it on May 30, 1996. However, prior to that time, we won't be able to comment on its contents. For current information on release, visit the web site http://www2.nas.edu/cstbweb/220a.html When you visit that site, you'll have the opportunity to be put onto a mailing list so that we can inform you by e-mail when the report is available in print and/or electronically, as well as any public events associated with the report (e.g., public briefings). Herb Lin Cryptography Policy Study Director Computer Science and Telecommunications Board National Academy of Sciences/National Research Council 202-334-2605

1 0

Re: The Crisis with Remailers
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:00 PM 5/18/96 EDT, dlv(a)bwalk.dm.com (Dr. Dimitri Vulis) wrote: >> 2. there is no good way to deal with spams or other so-called "abuse" >Nor should there be. What's one person's abuse is another person's >free speech. Internet traffic should not be censored based on contents. I disagree - when I was running a remailer, I found several varieties of abuse, and some of them were worth blocking. Usenet, in particular, is divided into newsgroups so material can be directed to the groups where the readers want to find it, which is filtering, not censorship. * The most common was spammers sending lots of mail to a specific person who didn't want it; that's easy to block, and keeping up with that was a major part of traffic on the remailer-operators news groups. * Another was spammers who were sending out large volumes of spam; my remailer would shut down if it got too much volume (operator-settable), but usually I blocked senders like this based on remailer-operators notices from other remailers that were being spammed through. * Another was inappropriate news postings; most of the complaints I got were from phone sex ads in the pictures newsgroups, where they're unwanted (as opposed to misc.forsale or other group where they're in scope). They're a minor annoyance, and I didn't censor them; there'd probably be less of them from 2-way remailers, since people who objected could spam back. In general, these were posted to many newsgroups, and reducing the number of newsgroups that a message could be crossposted to would probably have helped, though it might have just resulted in multiple postings. * The nastiest spam, which I wasn't able to block, was to sign someone else's name on flamebait hate postings. Blocking by content (e.g. blocking postings with the address of someone who had complained) would cut down on repeat postings, but it only takes one or two postings to get thousands of flames sent to the victim. The damage could be reduced by putting disclaimer notices at the beginning and end of the text, reminding the reader that it may be a forgery, etc.; simple mail headers don't seem to get the attention of enough readers, even those whose newsreader software doesn't discard them. Similar spams can be done to mailing lists... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Rumor: DSS Broken?
by jim bell 17 Dec '03

17 Dec '03

At 08:33 AM 5/19/96 -0400, Robert Hettinga wrote: >At 9:41 PM -0400 5/18/96, Bill Stewart wrote: >> MD5 is at least weakened, maybe broken; there's an abstract by Hans Dobbertin >> that says something about generating collisions, and gives an example >> (though the abstract doesn't say how general the method is.) > >That's what I get for not reading the DSS stuff when it came out. I'd heard >lots about the MD5 stuff, but I didn't put the two together. > >It also looks like I'm behind in my reading. Time to buy another edition >of Applied Cryptography... It should occur to all of us that if the NSA was actually doing the job we are vastly over-paying them to do, it is THEY who should be finding, exposing, and correcting these kinds of cryptography faults. Has anybody ever heard any evidence that the NSA has ever acted in this sort of responsible role? Another question: If the government provided DSS, and it's now toast, and it provided Clipper... Somebody ought to ask The Wicked.... er... Dorothy Denning how she thinks we should be willing to trust the government's vetting of anything like Clipper when DSS may be flawed...and the government didn't find the error! Think about it. Jim Bell jimbell(a)pacifier.com

1 0

New Remailer (hidden)
by middle-man-admin＠alpha.c2.org 17 Dec '03

17 Dec '03

NOTICE: A new type of remailer has just gone into business! It's called a "hidden remailer-in-the-middle". The address is middle-man(a)alpha.c2.org. This new type of remailer uses a combination of Lance Cottrell's Mixmaster remailer and Raph Levien's premail program. Advantages: * The remailer is completely hidden. Attempting to discover the actual identity of the remailer site is virtually impossible. * The remailer uses both Type-I and Type-II remailer technology for handling remailer traffic. * Random remailer chains are selected separately for every outgoing message. * The remailer is designed to answer to a chained nym. * All Mixmaster administrative commands are also chained through multiple remailers. (i.e. remailer-help, remailer-key) How it works: The actual address of the remailer is hidden behind a chained nym. The plan is for the reply-block for middle-man to change approximately every 48-72 hours. This will be transparent to the net but will help to foil traffic analysis. The new remailer operates under a modified Mixmaster. The code has been modified so that outgoing messages are passed to premail to allow padding of extra remailer chains. Each outgoing message will have two type-I remailers randomly padded to the end of the chain based on the current status od Raph Levien's remailer reliability list. If you have any questions or would like more information, please contact middle-man-admin(a)alpha.c2.org. middle-man-admin(a)alpha.c2.org

1 0

Virtual machines?
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Hi. Pardon my ignorance, but I had a few questions haunting me since a while. Is there a way to have a remailer de-localize itself and relocalize itself over the internet? For example, could there be several machines around the worlds that, when you send an e-mail to it, is routed to differents physical places of the world depending on where the actual remailer process is actually running? Could there be such a thing as a virtual machine runing a remailer that gets to hop from physical machine to physical machine around the world? Just an idea to avoid jurisdiction problems. Just asking, probably quite futilely... Thanks JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

2 1