- cypherpunks-legacy - lists.cpunks.org

mailing list <-> newsgroup ?
by gtoal＠an-teallach.com 19 Aug '93

19 Aug '93

In article <9308181850.AA10702(a)toad.com> newsham(a)wiliki.eng.hawaii.edu writes: > How many people are subscribed to this list right now? How many > people have read it before and dropped off only due to bandwidth > problems? This list easily generates more traffic than any of > the newsgroups I read. If the number of people on this list is Then use better tools! I easily cope with this list -- and another one which averages 300 letters a day. I set up separate accounts for each list and gateway them into local 'mail.*' newsgroups. Admittedly, if it comes in with your real mail it would be a pain. But I'd rather keep it as email than news just to keep that cretin Sternlight out :-) G === Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

network parallel decryption amateur style
by nobody＠alumni.cco.caltech.edu 19 Aug '93

19 Aug '93

Recent postings have gotten me to thinking: If we wrote a easily portable UNIX program to decrypt DES in parallel across our many machines, how fast could we go? Perhaps we could make use of the anonymous remailers to hide our cooperation. How many computers do we have? I have account on somewhere between 10 and 20 Sparcstation IIPX's which are very lightly loaded at night...someone else said they have 1500... PC gurus might want to also make versions for high-speed PC's on the net. It wouldn't even need to be very difficult, just maybe having one complex server which assigns keyranges to every person who mails in a request, and gets mailed back the range to check. It doesn't really have to be automatic, although that would be nice. What do y'all think? -(signature removed, because, this is a dangerous idea. That's why I like it ;)

2 1

APS-0.3 - anonymous posting software for the masses
by khijol!erc＠apple.com 19 Aug '93

19 Aug '93

FYI - I have released the source code for APS-0.3 out to alt.sources. If anyone wants the sources but doesn't have access to alt.sources, they can email me and I'll be glad to email them the software (it's fairly small). -- Ed Carp, N7EKG erc(a)apple.com 510/659-9560 anon-admin(a)khijol.uucp If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever"

1 0

Anon: remailer list
by M..Stirner＠f28.n125.z1.FIDONET.ORG 19 Aug '93

19 Aug '93

* Reply to msg originally in CYPHERPUNKS Uu> Q1: What cypherpunk remailers exist? Uu> 1: nowhere(a)bsu-cs.bsu.edu Uu> 2: hh(a)cicada.berkeley.edu Uu> 3: hh(a)pmantis.berkeley.edu Uu> 4: hh(a)soda.berkeley.edu Uu> 5: 00x(a)uclink.berkeley.edu Uu> 6: hal(a)alumni.caltech.edu Uu> 7: ebrandt(a)jarthur.claremont.edu Uu> 8: remailer(a)rebma.mn.org Uu> 9: elee7h5(a)rosebud.ee.uh.edu Uu> 10: hfinney(a)shell.portal.com Uu> 11: remail(a)tamsun.tamu.edu Uu> 12: remail(a)tamaix.tamu.edu Uu> 13: remailer(a)utter.dis.org Uu> 14: remailer(a)entropy.linet.org Uu> 15: remail(a)extropia.wimsey.com OK. It seems that remail(a)extropia.wimsey.com (#15) is down. This is a shame, as it was the _only_ remailer that would function as an anonymous remailer for me. It worked beautifully while it was up. Its apparent demise has been reported by other users as well, . Several of the remailers listed (2,3,4,5) have _never_ worked using standard cypherpunks syntax: :: Request-Remailing-To: . All other cypherpunks remailers, reliable or not, retain the footer addresses automagically inserted by the host box here & are therefore not in any way anonymous for my purposes. There was a discussion of a "cut line" syntax before I temporarily lost access to cypherpunks, but as far as I know there was never any agreement or implementation (I shall be pleased to be corrected if this is not the case). . Penet.fi will no longer work for me since the forced-password implementation due to an apparent header conflict with the X-Anon-Password: line & local host/gate software. . Why am I depressed? . ~ . M. ********************************************************************* * <m..stirner(a)f28.n125.z1.fidonet.org> - PGP Key D30909 via servers * * > What country can preserve its liberties if its rulers are not <* * > warned from time to time that their people preserve the spirit <* * > of resistance? Let them take arms!" - Thomas Jefferson, 1787 <* ********************************************************************* ... Organization: Concerned Norwegians Against Lutefisk, S.F., CA ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

2 1

no subject (file transmission)
by Timothy Newsham 19 Aug '93

19 Aug '93

>From nowhere(a)bsu-cs.bsu.edu Tue Aug 17 15:28:39 1993 Return-Path: <nowhere(a)bsu-cs.bsu.edu> Received: from bsu-cs.bsu.edu ([147.226.112.101]) by hemp-imi.hep.anl.gov.noname (4.1/SMI-4.1) id AA01228; Tue, 17 Aug 93 15:28:35 CDT Received: by bsu-cs.bsu.edu (5.57/Ultrix3.0-C) id AA07310; Tue, 17 Aug 93 15:32:24 -0500 Date: Tue, 17 Aug 93 15:32:24 -0500 Message-Id: <9308172032.AA07310(a)bsu-cs.bsu.edu> From: Anonymous <nowhere(a)bsu-cs.bsu.edu> To: EDITED X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> X-Ttl: 0 X-Notice: This message was forwarded by a software- automated anonymous remailing service. Status: R Introduction to BlackNet Your name has come to our attention. We have reason to believe you may be interested in the products and services our new organization, BlackNet, has to offer. BlackNet is in the business of buying, selling, trading, and otherwise dealing with *information* in all its many forms. We buy and sell information using public key cryptosystems with essentially perfect security for our customers. Unless you tell us who you are (please don't!) or inadvertently reveal information which provides clues, we have no way of identifying you, nor you us. Our location in physical space is unimportant. Our location in cyberspace is all that matters. Our primary address is the PGP key location: "BlackNet<nowhere(a)cyberspace.nil>" and we can be contacted (preferably through a chain of anonymous remailers) by encrypting a message to our public key (contained below) and depositing this message in one of the several locations in cyberspace we monitor. Currently, we monitor the following locations: alt.extropians, alt.fan.david-sternlight, and the "Cypherpunks" mailing list. BlackNet is nominally nondideological, but considers nation-states, export laws, patent laws, national security considerations and the like to be relics of the pre-cyberspace era. Export and patent laws are often used to explicity project national power and imperialist, colonialist state fascism. BlackNet believes it is solely the responsibility of a secret holder to keep that secret--not the responsibilty of the State, or of us, or of anyone else who may come into possession of that secret. If a secret's worth having, it's worth protecting. BlackNet is currently building its information inventory. We are interested in information in the following areas, though any other juicy stuff is always welcome. "If you think it's valuable, offer it to us first." - trade secrets, processes, production methods (esp. in semiconductors) - nanotechnology and related techniques (esp. the Merkle sleeve bearing) - chemical manufacturing and rational drug design (esp. fullerines and protein folding) - new product plans, from children's toys to cruise missiles (anything on "3DO"?) - business intelligence, mergers, buyouts, rumors BlackNet can make anonymous deposits to the bank account of your choice, where local banking laws permit, can mail cash directly (you assume the risk of theft or seizure), or can credit you in "CryptoCredits," the internal currency of BlackNet (which you then might use to buy _other_ information and have it encrypted to your special public key and posted in public place). If you are interested, do NOT attempt to contact us directly (you'll be wasting your time), and do NOT post anything that contains your name, your e-mail address, etc. Rather, compose your message, encrypt it with the public key of BlackNet (included below), and use an anonymous remailer chain of one or more links to post this encrypted, anonymized message in one of the locations listed (more will be added later). Be sure to describe what you are selling, what value you think it has, your payment terms, and, of course, a special public key (NOT the one you use in your ordinary business, of course!) that we can use to get back in touch with you. Then watch the same public spaces for a reply. (With these remailers, local PGP encryption within the remailers, the use of special public keys, and the public postings of the encrypted messages, a secure, two-way, untraceable, and fully anonymous channel has been opened between the customer and BlackNet. This is the key to BlackNet.) A more complete tutorial on using BlackNet will soon appear, in plaintext form, in certain locations in cyberspace. Join us in this revolutionary--and profitable--venture. BlackNet<nowhere(a)cyberspace.nil> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAixusCEAAAEEAJ4/hpAPevOuFDXWJ0joh/y6zAwklEPige7N9WQMYSaWrmbi XJ0/MQXCABNXOj9sR3GOlSF8JLOPInKWbo4iHunNnUczU7pQUKnmuVpkY014M5Cl DPnzkKPk2mlSDOqRanJZCkyBe2jjHXQMhasUngReGxNDMjW1IBzuUFqioZRpABEB AAG0IEJsYWNrTmV0PG5vd2hlcmVAY3liZXJzcGFjZS5uaWw+ =Vmmy -----END PGP PUBLIC KEY BLOCK-----

3 2

Physical to digital cash, and back again
by hfinney＠shell.portal.com 19 Aug '93

19 Aug '93

Anonymous points out problems with managing and using digital cash: > (1) customer reads ad about cool net.service > (a) they contact directly (but this ruins privacy) > (b) they contact independent distributor of > PGP key and anon-remail address generating software. > (but how does customer trust _them_?) > (2) vendor sends key & address generators (via e-mail or floppy), > and physical-mail-security instructions > (3) customer sends in money order (from mail drop or without > return address!) along with chosen anon e-mail address and public > key. > (4) vendor sets up account and e-mails the d-cash. > (5) we still need a physical mail drop or bearer bank > account for withdrawals, refunds, etc. of physical cash. It's true that this is a lot of steps. This is one reason why we should push to make anonymous mail easy to use. If you start with an infra- structure where you can communicate securely and anonymously across the net, with return messages that don't reveal your true identity, you have a good start on steps 1 and 2 above. Another simplification would be to split the users of the digital cash into customers and vendors, along the lines of the triangle diagram Tim suggested. In my experience, I make many withdrawals from my bank, but often only two deposits a month as my paycheck comes in. Applying this to the digital bank model, customers would mostly make digital cash with- drawals to buy things on the net, with occasional physical cash deposits to keep their balance up. Customers would thus primarily turn real cash into digital cash which they send to vendors; the vendors then turn the digital cash back into real cash. Customers can remain anonymous even without physical mail drops, while vendors have less anonymity. In this model, a customer sees some new software being sold on the net. He normally keeps enough digital cash on hand for such spending, so he sends the cash to the seller, including one of his standard anonymous return addresses for the return software. If this lowered his stock of digicash below the amount he likes to keep around, he sends another check to the bank and gets another batch of digicash. (This would be analogous to carrying cash in your wallet, and when it gets low you stop by the ATM and withdraw more. How often do you find yourself depositing cash back into the ATM? I suspect customers of the digital cash bank would similarly not need to turn their digicash back into real dollars very often.) With an infrastructure like this, using digital cash does not have to be complicated. > Also, the issue of which parts of these schemes are *legal* > is critical, but being completely overlooked. I once posted some excerpts from the Code of Federal Regulations involving the tax requirements of barter agencies. These are organizations in which their members exchange their labor without the use of regular cash. Often they use some scrip as a substitute for cash, or they may just keep records in an accounting system. It appeared to me that virtually any form of digital cash would fall under this definition. Barter agencies are not illegal, but there are many rules about reporting transactions and members. It would definately not be possible under the current tax code for a barter agency to have anonymous members. Therefore it looks like anonymous digital cash would not be legal in the U.S. at this time. I don't know about Duncan's suggestion to use an offshore bank. Paul Robichaux wrote, regarding the NetCash proposal: > Collusion between the service provider & the currency house can > produce a record of exactly what I bought, but I don't know that > blinding can do much better. Actually, blinding can do better. Collusion between the bank and the vendor can not break customer anonymity in a cash system using Chaum's blinding protocols. This is one of the things I found so surprising about the NetCash proposal. I am surprised they dare to call their idea an implementation of digital cash when it does not even provide this bare minimum of customer anonymity. This anonymity is why we call it "cash", as distinguished from other forms of money. The NetCash proposal is more like cashier's checks. Bill Stewart writes: > If you're sending non-accountable-by-sender cash, you need some way to get > a receipt. If you're mailing a check or digicash, you have a way to > repudiate the transaction or at least make a claim against them, > or if you can go in to the bank in person for the transactions with cash. This is a good point, and is another reason why blinding is so important. If you don't mind it being known in general terms that you are a customer of the bank, you can send a check with instructions to turn it into digital cash to be sent to your email address. There will still be no way that the bank can figure out when or where you spend that digital cash. And they are no more likely to just cash your check and pocket the money than any other mail order business would be. Hal Finney hfinney(a)shell.portal.com

1 0

No Subject
by Peter shipley 19 Aug '93

19 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- ># The audience would probably be bigger as as well. > >and quality would degrade. News and mail may look the >same, but the social effects are quite different. > ># Any counter arguments? > >Yeah. Gene Spafford often says that newsgroups are no way to get >things done. However I think that mailing lists can be rather >effective. > >I think you're saying that your problem is that your newsreader is a >lot better than your mailreader. Perhaps you can fix the problem... > I agree completely -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLHKh3XynuL1gkffFAQHdzQH5ARdbgWXiIQ2wwpWzXoXZpByPBoSmEh52 BC+7A4NL5FjlVYp0uG7fRf4w/MPTYeZOHbqpgZLoNZuFVUHTeNeXHg== =RvvN -----END PGP SIGNATURE-----

1 0

META: on topics
by Eric Hughes 19 Aug '93

19 Aug '93

A message from your list maintainer. I try not to interfere with topic selection too much. I have only once or twice specifically requested that some topic not be discussed. Today, however, I want to offer a specific guideline about a group of topics. The guideline is as follows: Do not discuss topics on cypherpunks which are already frequently discussed on sci.crypt or alt.security.pgp and do not directly relate to cypherpunks concerns. To illustrate this guideline, the recent thread on parallel DES cracking has been well discussed on sci.crypt. This initial announcement was interesting, and maybe one round of short comments were appropriate, but the discussion should be held on sci.crypt. There is already a forum there, please use it. The list is large and getting larger. There are, by my guess, maybe four times as many people who were previously on the list than those who are on the list; most of these dropped out for volume, from the comments I get. I echo the call for self-restraint made earlier. Others have recently written on what cypherpunks, the list, is about. I have some comments myself, which are long, and go back to original purposes, and such. I will not elaborate too far in this message. _Pace_ Tim May, I do think that there should be some guidelines about list content. Cypherpunks is not all cryptography to all people, and parallel DES-cracking particular cryptography is totally mainstream. Cypherpunks is not totally mainstream. Cypherpunks is about implementations of cryptography, particularly disapproved-of cryptography--not just the privacy of epistles but the privacy of the structure of society. There can be no hard separation of topics between the newsgroups and this list; I don't intend to enforce one. Nevertheless, some things clearly belong better elsewhere. The existence of gray areas does not prevent the existence of clear ones. I do understand the concerns that some members of the list are new to cryptography as well as cypherpunks. Cryptology is a large and increasingly technical field; there is no substitute for some hours of study. I myself have logged hundreds of hours reading technical cryptography, and while I don't expect that many of the members of the list will ever do that, I do expect that those who want to learn will do some proactive reading. You can't be spoon fed a working knowledge of anything; working knowledge is the result of working. Since meta-discussion can easily bring down a group, I will appreciate it if responses to this position are short, cogent, and thoughtful. Eric

1 0

Cypherpunk Chip
by technopagan priest 19 Aug '93

19 Aug '93

I suppose the biggest problem with a Cypherpunk chip is actually getting it designed and built. I think it is difficult to imagine anyone with a real job having the time and money to put it together. However, it is not out of the realm of possibility for a graduate project, except one must run the question of whether there is enough novelty in such a device to make it an appropriate project. I'm not sure if IDEA has been implemented in silicon yet, but clearly it will be more difficult to implement in a fast way than DES. Then there is the issue of patents...DES is the only freely usable algorithm in the concept. One would probably have to contact the IDEA people to ensure there are no problems with us using the technique. RSA, well, we know the problem there. Finally, even if implemented as a MOSIS device under NSF or other grants in a university research situation, we'd have to find a foundry to go into mass-production. This would not be possible without ironing out all legal problems. Of course, I think PKP might be on our side about Clipper, and might be very willing to license the Cypherpunk chip at a reasonable rate. I've done a couple of analog chips through MOSIS...and no, my advisor wants me doing silicon models of auditory cortex, not crypto, but I'll mention it to any incoming grad students here who want to do some digital stuff. -Thomas

1 0

Re: World record in password checking
by peter honeyman 19 Aug '93

19 Aug '93

why doesn't this impress me? i'll tell you why. with o a stock version of des (dennis ferguson's), which is written in c, and not optimized for any particular chip or vector hardware o a no-name 50 Mhz 486, which you can buy for under $1,000 at fry's o netbsd, a freely available general purpose operating system i have measured 29,000 des crypts per second. now give me a "1,024 node" machine made of of these -- admittedly unwieldy, but no doubt a hell of a lot cheaper than a 1,024 node CM/5 (and a hell of a lot more useful, imho) -- and i can run at three times the "world record" rate. peter, inveterate iconoclast

7 6