- cypherpunks-legacy - lists.cpunks.org

Second Annual Cypherpunks Conference
by hughes＠ah.com 08 Sep '93

08 Sep '93

ANNOUNCEMENT ============ Second Annual Cypherpunks Conference Saturday, September 11, 1993 12:00 noon Cygnus Support, Mt. View, California, USA One hear ago this month, the first cypherpunks meeting was held in Oakland, CA. Therefore, the September Bay Area meeting is megalomaniacally named The Second Annual Cypherpunks Conference and Banquet (but really, we'll just go out to dinner afterwards like normal.) The theme this year is Where are my turnips? Visions of cypherpunk futures and Paths to implementation Agenda ------ In no particular order -- Tim May, "We are in a cryptographic arms race." -- Other visionary statements from other attendees -- Inspirational reading from _Temporary Autonomous Zone_ written by Hakim Bey. -- An as-yet unverified presentation on patent law. I encourage people to prepare short position statements to be read aloud at the meeting. Topics should center around what you want out of a cypherpunk future and how you'd go about getting there. Tim has already explicitly scheduled his time; others may do so as well by sending me mail (hughes(a)ah.com) Eric Hughes DIRECTIONS ========== [Directions to Cygnus provided by John Gilmore. -- EH] Cygnus Support 1937 Landings Drive Mt. View, CA 94043 +1 415 903 1400 switchboard +1 415 903 1418 John Gilmore Take US 101 toward Mt. View. From San Francisco, it's about a 40-minute drive. Get off at the Rengstorff Ave/Amphitheatre Parkway exit. If you were heading south on 101, you curve around to the right, cross over the freeway, and get to a stoplight. If you were heading north on 101, you just come right off the exit to the stoplight. The light is the intersection of Amphitheatre and Charleston Rd. Take a right on Charleston; there's a right-turn-only lane. Follow Charleston for a short distance. You'll pass the Metaphor/Kaleida buildings on the right. At a clump of palm trees and a "Landmark Deli" sign, take a right into Landings Drive. At the end of the road, turn left into the complex with the big concrete "Landmark" sign. Follow the road past the deli til you are in front of the clock tower that rises out of one of the buildings, facing you. Enter through the doors immediately under the clock tower. They'll be open between noon and 1PM at least. (See below if you're late.) Once inside, take the stairs up, immediately to your right. At the top of the stairs, turn right past the treetops, and we'll be in 1937 on your left. The door is marked "Cygnus". If you are late and the door under the clock tower is locked, you can walk to the deli (which will be around the building on your left, as you face the door). Go through the gate in the fence to the right of the deli, and into the back lawns between the complex and the farm behind it. Walk forward and right around the buildings until you see a satellite dish in the lawn. Go up the stairs next to the dish, which are the back stairs into the Cygnus office space. We'll prop the door (or you can bang on it if we forget). Or, you can find the guard who's wandering around the complex, who knows there's a meeting happening and will let you in. They can be beeped at 965 5250, though you'll have trouble finding a phone. Don't forget to eat first, or bring food at noon! I recommend hitting the burrito place on Rengstorff (La Costen~a) at about 11:45. To get there, when you get off 101, take Rengstorff (toward the hills) rather than Amphitheatre (toward the bay). Follow it about ten blocks until the major intersection at Middlefield Road. La Costen~a is the store on your left at the corner. You can turn left into the narrow lane behind the store, which leads to a parking lot, and enter by the front door, which faces the intersection. To get to the meeting from there, just retrace your route on Rengstorff, go straight over the freeway, and turn right at the stoplight onto Charleston; see above. See you there! John Gilmore

1 0

REMAIL: pasting
by nobody＠Menudo.UH.EDU 08 Sep '93

08 Sep '93

-----BEGIN PGP SIGNED MESSAGE----- Earlier, a question about pasting arose. The cypherpunks remailers to support an outgoing pasting token: the double hash (##). It will paste text into the outgoing mail header. For example, this message was sent through the remailer elee9sf(a)menudo.uh.edu: - -------------------- :: Request-Remailing-To: cypherpunks(a)toad.com ## X-Pasted-By: Karl Barrus <text of this message> - -------------------- So there should be an "X-Pasted-By:" in the header somewhere! I'm not sure about pasting in reply fields to override behavrior. That dependes on precedence between "From:" and "Reply-To:", etc. Basically, I'm not real familiar with the appropriate RFC :-) -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLIy/G4OA7OpLWtYzAQHbGgP/alyO+uY6pkzEr9nPKVzYKiB0DcopcKDJ 3tV937CjldyC48K0g3iJ9San6bk6KGLstALQwMSvWIW5kSq1GRxFAgxBuZ9vnT/X 3gN+vn+8jao/H7H20tRilz5nzIW/AhRhc//46Xr4QafPcXI6BXRvsEY0SkzHEkYV 9D5xakEYhiM= =kf83 -----END PGP SIGNATURE-----

2 1

Re: Who generates AOCE keys?
by collins＠newton.apple.com 08 Sep '93

08 Sep '93

Christian D. Odhner writes: >what keeps people from [getting certified] keys with somebody else's name The The relation between the preferred signature authority for the installation, and that installation. From the documentation: >Some companies authorized to issue approval files to their employees may >require that you sign a printed request form and have it notarized by a >notary public. (To create a printed request form, choose Print from the File >menu.) Note: If you are going to use your Signer as an individual or in a >small business, look for the insert that came with this package for >instructions on using an outside approval authority. >Print your request and send it, with a copy of the Request file on disk if >necessary, to your approval authority. See the insert that came with your >package for details. Assuming that your request form has been completed >properly, the approval authority will send back your Signer Approval file. ...which would seem to put the lie to (the general application of) my ealier statement: >[the key] can be mailed automagically to RSADSI Which turns out to be true only for the 'low assurance' RSA Persona Certificate Authority (currently handing out certificates for free) which does no verification of the user<-->id link. CAs with more stringent policies have stronger prerequisites for the issuance of a certificate. Hope this helps, Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

2 1

Re: Who generates AOCE keys?
by lefty＠apple.com 08 Sep '93

08 Sep '93

Christian Odhner wonders: > >Well, what keeps people from makeing keys with somebody else's name/user >id on them and sending them in to be certified? Where is the >authentication from the key certifier's point of view? The pass phrase. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1

The origin of spread spectrum (a true story)
by ccat＠netcom.com 08 Sep '93

08 Sep '93

I have an interesting perspective on spread spectrum encryption, because one of the inventors of this interesting technology was my father. My father,George Antheil,was an avant garde composer living in Hollywood in the late 30's and early 40's. One of his best friends was Hedy Lamarr, the movie actress.One of the facts about Ms. Lamarr that many people were unaware of,was that she was also very intelligent.(She had also just been married and divorced from a Czeck arms magnate,and had spent much time listening to her ex-husbands and friends 'shop talk'.) Anyway, she and my father were very concerned about the Nazi's rise to power,and their U-boat harassment of international shipping.My father, a composer who was fascinated by machines (his composition,"Ballet Mechanique" was one of the very first uses of machines in music.) was working on a composition for several player pianos at the time...This led them to the idea of using two rolls of randomly punched tape to synchronize a receiver and transmitter in a radio controlled torpedo.Using this technology (frequency hopping) their torpedo would be able to be remotely controlled,with virtually no risk of enemy jamming or detection.And there you have it.I have the patent drawings..which were done by both of them.. Theyre simply marvelous.. Several years ago, a guy who was writing a book on the history of encryption called my half-brother to ask him about this story..Correct me if I'm wrong,but I think this was the absolutely first use of spread spectrum encryption... The patent was issued in 1940, and expired in 1957. In 1960 Sylvania, (I think) started manufacturing a radio controlled torpedo ... Hedy Lamarr is still alive and living in Florida, my father died in early 1959. Neither of them ever saw a penny from their pioneering patent. Chris Beaumont (Nutrient Cafe wholesale) - Chris Beaumont ccat(a)netcom.com ccat(a)casa.stanford.edu public key available via finger

1 0

Spread Spectrum- how it works
by You cannot conquer a free man, a man whose mind is free. The most you can do is kill him. 08-Sep-1993 1013 08 Sep '93

08 Sep '93

From: US3RMC::"clark(a)metal.psu.edu" "Clark Reynard" 8-SEP-1993 01:59:18.22 >Then the receptionist returned, and told me that the person from >the engineering department who took care of the phones had indicated >that not even the government had the technology to monitor these >phones. > >Upon asking how and why the government might do this, I received >a rather chilly notification that the engineering department, >was, of course, unwilling to reveal these secrets. Well, it was >worth a try. Actually, they aren't telling you, but SS techniques are published widely in the technical literature. For a relatively accessible and understandable introduction, try the ARRL's book "Spread Spectrum Sourcebook", which describes not only the theory but also the results of the ARRL's experimentation with spread-spectrum technology for radio communications. It's about $30 from any reputable ham radio supply house, and you can mail-order it. [very succintly, SS works by adding a pseudorandom modulation to the transmitter carrier that modulates the signal far far MORE than the actual informational modulation. For example, a 16-bit CRC register feeding back on itself can be used. The output of the CRC register (or any other pseudo-random-number-generator (PRNG) can be used as a modulator in two ways: 1) Frequency hopping: the bits in the CRC or PRNG determine (via a lookup table ("hop set") the new center frequency that the transmitter will send on. This freqency may hop a hundred times or more per second. a) ease of detection: easy- you hear a "click" whenever the transmitter hops onto the freqency you're monitoring b) ease of interception: very hard- if there are a few thousand such signals around, you have to splice together 10 millisecond slices from a thousand different sources- and that's a combinatorially prohibitive problem. You need to know the "hop set" and the particular polynomial or psuedorandom sequence to easily recover the signal. 2) Direct Sequence: the single low-order bit in the CRC or PRNG determines whether the output signal from the transmitter's primary oscillator (already modulated with the user's voice) is inverted or not. This translates to massive phase modulation. If the CRC is clocked at a reasonable rate (say, 1 MHz) then the output signal ends up with a bandwidth of about twice the clocking freqency. a) ease of detection: difficult- the SS signal shows up in a conventional reciever as broadband noise- easy to not notice. b) ease of interception: very difficult- I haven't the foggiest about how to go about it. In either case, to demodulate the signal, one recieves the entire bandwidth, then either hops their first-stage local oscillator (for frequency hopping) or phase-inverts (for direct sequence) the incoming signal. The result is a second-stage signal that can be demodulated by conventional means. The only big trick is to synchronize the PRNG on the reciever to the PRNG on the transmitter. Another advantage to SS is that it tends to "ignore" strong signals in the band- any signal that does not correllate against the PRNG modulation is "spread out" over the entire band by the demodulation operation, while the correct signal energy is concentrated into a small channel. This gives what's called "process gain" and allows a weak spread-spectrum signal to work even in channels that may be dominated by strong conventionally-modulated signals. The ARRL did find that if they knew the bandwidth of the signal they were looking for they _could_ direction-find on it, using wideband recievers and notch filters to remove known conventionally-modulated signals from the signal; once they were close enough to be in the "near field" of the transmitter standard direction-finding techniques were adequate to DF, even if they couldn't understand what was being transmitted, they could find the source. (this was the basis for the FCC's OKing of the use of SS modulation by hams on the 440 and higher bands- that some form of accountability was being preserved). ----- Note that if the PRNG in a direct-sequence SS is replaced by a true random number source, we have the equivalent of a one-time pad and (I believe) complete security. However, since the typical demands of a direct-sequence system for phase information are in the megabits per second, the logistics of "key management" may be utterly impractical. ----- So, if CM was using either modulation method, and used some reasonable PRNG (i.e. one with remappings and hopsets determined by user-genned random numbers) then it is quite possible that the government does not have the technology _deployed_ in the field to intercept them. But if they need it, I'm sure they will figure out how to do it. -Bill

1 0

Super Phones?
by Clark Reynard 08 Sep '93

08 Sep '93

Excerpted from "Wired," August 1993 Playboy (Not THAT Wired) Reprinted without Permission Spread Spectrum technology was developed for the military to allow for high-security communications with crystal-clear reception. Now Cincinatti Microwave has introduced the Escort 9000 ($400), a cordless digital phone with Spread Spectrum that operates on the recently approved 900 MHz radio frequency (that's 20 times higher than the frequency conventional cordless phones use). This marriage of technologies gives the Escort 9000 a remarkable range of about a half maile, superior reception and complete privacy. "Previous attempts to bring Spread Spectrum to the consumer market have been too costly and too bulky for personal use," said Cincinatti Microwave president Jacques Robinson, who sells the phones directly to the public. (Call 800-433-3487 for more information or to order one.) Another company, Cobra, incorporates CM's Spread Spectrum technology into its latest 900 MHz model, and AT & T will introduce a 900 MHz Spread Spectrum phone in the fall. Tropez and Panasonic also offer 900 MHz phones (without Spread Spectrum). It is rumored that the range for some 900 MHz phones could be increased in the future to up to seven miles, which means that one could serve as an around-town alternative to a cellular phone. ---END EXCERPT Now, here's my problem with this nice-sounding product. I called the 800 number to ask for an explanation of this product, which immediately aroused my suspicion. >From my conversation with the receptionist on the other end of the phone, which was somewhat less than informative, the idea of Spread Spectrum technology is that the signal is spread out into individual packets on different wavelengths, then reconstituted at the other end, using some sort of session key generated at the beginning of each transaction. Considering the rather lax security of high-ranking government and military officials with phone technology, recent eavesdropping on Air Force One and the White House most glaringly, I find it difficult to accept as kosher any security scheme created by the government and then offered to private industry. More chillingly, the receptionist told me that no one would be able to perform surveillance on me "except the government." Alerted to this possibility, I immediately asked whether it had the Clipper Chip or the Capstone, or whether there was some sort of key escrow involved. This got me put on hold for a couple minutes. Then the receptionist returned, and told me that the person from the engineering department who took care of the phones had indicated that not even the government had the technology to monitor these phones. Upon asking how and why the government might do this, I received a rather chilly notification that the engineering department, was, of course, unwilling to reveal these secrets. Well, it was worth a try. I gave them my address so that they could send me further information. More reports forthcoming. You can contact Cincinatti Microwave by telephone at: (800) 433-3487 or by snailmail at: Cincinatti Microwave 1 Microwave Plaza Cincinatti, OH 45249 ---- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiyKoFQAAAEEAL22Al/Xil0UER1V7AlS4+eJmOQ6ruIojmq1XCSE7mCqLw3Q ILHBGlcCOl9S20N/8gdge2PfMS9BK794P2r/J3GUjwZw/emKuVm9SXDBpXfdgWax 7jdAGfohRthw/q1+x/z5nJ7gP2C7AZSlsa+XCYYRZbTR2fpaLXzs8jiGc9glAAUT tClSb2JlcnQgVy4gRi4gQ2xhcmsgPHJjbGFya0BueXguY3MuZHUuZWR1Pg== =vJ53 -----END PGP PUBLIC KEY BLOCK-----

3 2

double-blind vs single-blind
by baumbach＠atmel.com 08 Sep '93

08 Sep '93

> ------------------------------------------------------------------------- > To find out more about the anon service, send mail to help(a)anon.penet.fi. > Due to the double-blind, any mail replies to this message will be anonymized, > and an anonymous id will be allocated automatically. You have been warned. > Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. I have a remailer question. I see a letter posting an offer on the net. The person making the offer is not anonymous. I wish to be anonymous, so I decide to use a remailer to reply. My reply includes a anNNN reply address. If the original poster replies back, an anonymous id will be allocated to him. This isn't any good. When the reply arrives, I will see the new anonymous id of a user whos real username and address I know! My pen-pal would compromise his ability to post anonymously in the future. How can I send an anonymous message that allows a reply that is not anonymous? Keep in mind my pen-pal may not know anything about remailers yet. (I have yet to use them myself :-) Peter Baumbach baumbach(a)atmel.com

3 2

News.cs.indiana.edu
by M..Stirner＠f28.n125.z1.FIDONET.ORG 08 Sep '93

08 Sep '93

Uu> news.cs.indiana.edu oes not appear to be working as an Uu> anonymous news posting gateway. A recent post through my remailer to Uu> alt-security didn't work. I had a similar experience during testing this week. On the other hand, you should have mailed it to alt.security@ rather than alt-security@, according to the latest FAQ. I did successfully test group-name(a)pws.bull.com however. . ~ . M. -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0

news.cs.indiana.edu *does* work
by sameer＠netcom.com 07 Sep '93

07 Sep '93

The person using my remailer to send news through the posting server incorrectrly used hyphens instead of periods to post news. Sorry about not verifying a simple error like that before posting about it. -- Sameer sameer(a)netcom.com

1 0