- cypherpunks-legacy - lists.cpunks.org

Cypherpunks List Info
by cpunk＠lne.com 30 Nov '03

30 Nov '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Re: Gestapo harasses John Young, appeals to patriotism, told to fuck off
by Major Variola (ret) 30 Nov '03

30 Nov '03

At 07:40 AM 11/30/03 -0800, John Young wrote: >My comment about the SAs having no noticeable body odor >came out the notion that persons on a dangerous mission >emit an easily identifiable smell, a smell not unlike that >emitted by an unwary target when suddently confronted with >danger. Agents have their adrenal innervation snipped.

3 2

Re: Gestapo harasses John Young, appeals to patriotism, told to fuck off
by Anonymous 30 Nov '03

30 Nov '03

>Confirming the allegation about idiot witnesses, I am >sure I would not recognize either agent if I saw them >again. The IDs yes, and the questions, but not the >bland biometrics. You do have right to take pictures in your residence, no ? I am sure that "John Young's real time door webcam" would be a popular URL to look up. Maybe you could even sell some ad space there.

3 2

Re: NSA Turns To Commercial Software For Encryption
by Major Variola (ret) 30 Nov '03

30 Nov '03

At 10:01 PM 10/26/03 -0600, J.A. Terranson wrote: >On Sun, 26 Oct 2003, Eugen Leitl wrote: > ><snip> >> In the case of the NSA deal, the agency >> wanted to use a 512-bit key for the ECC system. This is the >> equivalent of an RSA key of 15,360 bits." > >Am I the only one here who finds this "requirement" excessive? My god: are >we looking to keep these secrets for 50 years, or 50000 (or more) years? In meatspace engineering of life-critical systems, you might design for a few times more than you need under worst-case conditions. Eg, on a bridge: high winds, heavy trucks densely spaced, poor maintenance, poor materials. Remember that bridges fall down when you do something new, like use steel. Or nowadays: planes fall out of the sky because you don't know how composites fail. The NSA might be hedging against future algorithmic improvements. If tomorrow you could factor numbers (or the ECC equivalent) with twice the number of bits, will your spies die? Cf. East German Stasi files, and some south-american files being cracked.

2 1

Disguising the Key length (Was...Has a change taken place in factoring RSA keys)
by Tyler Durden 30 Nov '03

30 Nov '03

"I think that's the source as well - when the most recent of the TWINKLE and TWIRL papers came out, Lucky Green was talking about whether it was still safe to use 1024-bit keys, and $1B for 1 key/day is similar to Shamir & Tromer's estimate of ( http://www.wisdom.weizmann.ac.il/~tromer/papers/cbtwirl.pdf ) $20M upfront plus $10M for a 1 key/year capacity." My first question is, how easy is it for them to estimate the key size of an encrypted message? Can they do this without actually "chewing" on the message for a while? (ie, if it doesn't crack in x minutes then there's a 99% probability of the key being Y in length...) Second question: Is it possible to make a message appear to have been encrypted with a shorter key than was actually used? -TD >From: "Bill Stewart" <bill.stewart(a)pobox.com> >To: <cypherpunks(a)lne.com> >CC: <wk(a)gnupg.org> >Subject: Re: Q: Has a change taken place in factoring RSA keys? >Date: Wed, 29 Oct 2003 14:50:00 -0800 (PST) > > >> In particular a claim was made that recent technology has come to > >> light that allows factoring of 1024 bit RSA keys at $1B (US)/day. The > >> basic gist was that > > > > Adi Shamir's TWINKLE, I guess. > >I think that's the source as well - when the most recent of the >TWINKLE and TWIRL papers came out, Lucky Green was talking about >whether it was still safe to use 1024-bit keys, >and $1B for 1 key/day is similar to Shamir & Tromer's estimate of > ( http://www.wisdom.weizmann.ac.il/~tromer/papers/cbtwirl.pdf >) >$20M upfront plus $10M for a 1 key/year capacity. > (The alternative is that it's people believing the usual FUD sources, > whether they're the pro-government serious FUD sources or the > fun-yanking-people's-chains clueless FUDsters.) > > >> There was some discussion about hacking GPG to generate 8k keys. > >But if 1024-bit keys are too weak, RSA is still near-exponential, >and 2048-bit keys are roughly 2**100 times harder to crack than 1024-bit, >vs. 4-8 times as slow to use. 4096 is a lot harder than that; >even if you allow for Moore's law and medium mathematical breakthroughs, >you're still not going to fit a 4096-bit cracker on the planet. > >Basically, by the time you're interesting enough for them to spend >$10M and a year to crack your machine, you'd better be using 2048-bit keys >for tactical applications and maybe 4096-bit for long-term military >secrets, >and since they're targeting YOU, it's a lot cheaper for them to >black-bag your PC or plant cameras in your ceiling or bribe your janitor. > > > That won't help unless you find a way to get random number as good as > > the keysize. > >Large random numbers aren't that hard if you're using them for >long-term signature keys, as opposed to DH or symmetric session keys; >it just takes a bit longer to generate the bits. >Also, once you're up above the 1024-bit range, incremental quality is >less important, because attacks on the keyspace are hard to combine >with factoring attacks on the keys, especially if you're whitening them. > >But as you say, taking GPG from 4kbit to 8kbit keys doesn't matter, >because it's no longer close to the weakest link by then. _________________________________________________________________ Is your computer infected with a virus? Find out with a FREE computer virus scan from McAfee. Take the FreeScan now! http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

RE: e voting (receipts, votebuying, brinworld)
by Major Variola (ret) 29 Nov '03

29 Nov '03

At 12:56 PM 11/25/03 -0500, Sunder wrote: >Um, last I checked, phone cameras have really shitty resolution, usually >less than 320x200. Even so, you'd need MUCH higher resolution, say >3-5Mpixels to be able to read text on a printout in a picture. > >Add focus and aiming issues, and this just won't work unless you carry a >good camera into the booth with you. Ever hear of Moore's law? How about electronic image stabilization? Piezo gyros optional. Don't you think the cellphone folks will do the more-pixels-game, trying to add features that distinguish their model from the nearly identical other models? Related: There are plans to put a couple of cameras in autos, to check where the driver is looking at, wakefulness, etc. All by 2010. (Src: EETimes) And you thought car telemetry recorders were privacy concerns. (There are *already* dozens of microcontrollers in low end cars, a hundred in high-end cars. So much for TJ Watson's "the world only needs five computers"...)

2 1

US spying, directv, shades of global crossing
by Major Variola (ret.) 29 Nov '03

29 Nov '03

The parent company of DirecTV, the home satellite service, has promised several federal agencies that it can address concerns about foreign ownership of sensitive U.S. communications systems if it wins approval of its proposed merger with Australian-controlled News Corp. ... But the merger also has drawn the scrutiny of the Department of Homeland Security, the FBI and Justice Department divisions in addition to the antitrust department. The deal would bring DirecTV's five satellites and sophisticated communications system under the control of a company based outside the United States. Chief among the U.S. concerns is that a foreign-owned satellite system and communications system could be used for illegal surveillance on U.S. citizens and facilities, according to documents passed this week among Hughes, News Corp. and the federal government. "As the [FCC] is aware, the DOJ, FBI and DHS have taken the position that their ability to satisfy their obligations to protect the national security, to enforce the laws, and to preserve the safety of the public could be significantly impaired by transactions in which foreign entities will own or operate a part of the U.S. communications system, or in which foreign-located facilities will be used to provide domestic communications services to U.S. customers," read a letter filed at the FCC by the three law enforcement agencies last week. The Committee for Foreign Investment in the United States, a group made up of executive departments and representatives from the State, Defense, Treasury and Commerce departments, typically reviews transactions involving foreign ownership of businesses that serve the United States. In September, for instance, the committee approved the reorganization plan for Global Crossing, a telecommunications company being acquired out of bankruptcy by a Singapore-based firm. . http://www.washingtonpost.com/ac2/wp-dyn/A19987-2003Nov28?language=printer

1 0

Re: Now how they do that ?
by Major Variola (ret) 29 Nov '03

29 Nov '03

At 11:12 AM 11/28/03 -0600, Neil Johnson wrote: >Investigators traced the computer to Krastof when he logged onto his own >America Online account at home through one of the stolen computers, White >said. That enabled authorities to connect the computer's Internet Protocol >address, a number that identifies a computer on the Internet, to Krastof's >home address through his AOL account, White said. > >My guess that there was some sort of application (maybe an internally based IM >client) that "phoned home" when the thief started up the computer. Conventionally, only the NIC's MAC is supposed to be unique. Nowadays there are other IDs including disk-drive serial numbers, motherboard SNs, OS SN's, etc. None of these are supposed to be sent upstream, and the NIC MAC ends at the first router. And of course doens't exist if Krastof used a modem. So yeah, a "phone home" app sounds likely ---even an *unintentional* one, like one that automatically checks a "home server" for updates, corporate news, etc. Then you merely snag the IP, find it comes from AOL (rather than your internal network) who looks up who occupied that address at that time. Krastof probably used his meatspace info, subpeona, no-knock, game over.

2 1

Airplane Comedy
by Eric Cordian 29 Nov '03

29 Nov '03

http://www.tshirthell.com/shirts/tshirt.php?sku=a102 I'd love to see John Gilmore wear this on his next airline flight. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

Now how they do that ?
by Neil Johnson 28 Nov '03

28 Nov '03

From: http://story.news.yahoo.com/news?tmpl=story&cid=581&e=3&u=/nm/20031126/tc_n… SAN FRANCISCO (Reuters) - Police have arrested a California man in connection to a burglary in which a computer with sensitive information about Wells Fargo & Co. (NYSE:WFC - news) customers was stolen, officials said on Wednesday. (snip) Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers, White said. That enabled authorities to connect the computer's Internet Protocol address, a number that identifies a computer on the Internet, to Krastof's home address through his AOL account, White said. (snip) My guess that there was some sort of application (maybe an internally based IM client) that "phoned home" when the thief started up the computer. Or at least I hope .... -- Neil Johnson http://www.njohnsn.com PGP key available on request.

2 1