- cypherpunks-legacy - lists.cpunks.org

FW: Hiding Encrypted Messages
by Stu Klingman 12 Mar '93

12 Mar '93

FWD'd from a secure redirector, Raf sez: Someone wrote: > b) If it's played and recognized - one can trace your source (a CD, a > tape of radio broadcast, whatever) and do a comparison. Then the > file containing of all the LSBs is cryptanalyzed... Actually, this is not really a problem. The odds of being able to resample, even using the same source and come up with the same byte string is infinitesmal. You've got chaos theory on your side here with massive "Sensitive Dependence on Initial Conditions." The exact byte string you got depends on: 1) volume 2) sampling device used 3) playback fidelity of your reproduction 4) the exact microsecond you clicked "record" (cause you'll be hitting different points in the same wave form) Just make sure to an application like Shredder or Flamefile to permanently erase your initial sample, and nobody should be able to tell. (unless they are aware of the trick beforehand) Rafial

2 1

Re: Unacceptable slander by dclunie
by mbrennan＠netcom.com 12 Mar '93

12 Mar '93

>Date: Fri, 12 Mar 1993 09:34:53 -0600 >To: cypherpunks(a)toad.com, mbrennan(a)netcom.com (Michael Brennan) >From: matt(a)oc.com (Matthew Lyle) >X-Sender: matt(a)ra.oc.com >Subject: Re: Unacceptable slander by dclunie > >It is not appropriate for someone to post a 3600 line "junk" file to a >mailing list. UNDER ANY CIRCUMSTANCES! (Think about those sites that are >paying hard cash for e-mail transfers!) It is reasonable for such actions >to be reported to the administrator of a system. I don't agree it was appropriate to notify the administrator. This could all have been handled far more elegantly considering the circumstances. >So far as getting off the cypherpunks list, there are a number of other things >to try if cypherpunks-request isn't working. Send mail to root(a)toad.com. >Send mail to the administrative contact listed in the WHOIS database for >toad.com (John Gilmore, in this case). Talk to your local systems >administrator and ask his assistance. What ghabrech did is something I >would expect from an immature freshman. (who knows... maybe he is one) Thank you for this information. I will attempt these courses of action. Perhaps if someone had attempted to offer helpful information from the outset, this problem never would have reached this level. Instead certain individuals chose to post arrogant promises of "retribution" against others, rather than trying to be constructive in this. >Retaliatory strikes aren't right either, of course. I agree wholeheartedly, and I am glad this discourse now finally seems to be moving onto a level-headed and constructive level. I appeal to all of the cypherpunks to keep it this way! Let's figure what's going wrong here and resolve the situation instead of playing one-upmanship with mail bombs and threats of "dirty tricks". ----- Michael Brennan - mbrennan(a)netcom.com

1 0

Re: Unacceptable slander by dclunie
by matt＠oc.com 12 Mar '93

12 Mar '93

At 1:24 AM 3/12/93 -0800, Michael Brennan wrote: >> [ Mail from David Clunie to ramapo.edu systems admin deleted ] > > [ abridged quote from metioned user's posting deleted...] > >Think about this scenario for a moment: dclunie sends mail to the system >adiministrator of an institution complaining of the mail sent by a >particular user. The system administrator confronts the user, who then >explains the situation. He explains that he has sent numerous requests to >be unsubscribed from the list, but they continue to send large volumes of >mail. Out of frustration, he sends an 80K file to the list hoping it will >get someone's attention. The mail continues, and several members of the >list makes threats of "dirty tricks" and "mail bombs" against him. Now one >of the "cypherpunks" is sending libelous mail to the system administrator. >The system administrator now understands the situation; an educational >institution on the net is made aware of a rapidly developing campaign of >harrassment and vandalism by the cypherpunks. So what happens now? Are the >cypherpunks winning? Libelous mail?? Hardly. It is not appropriate for someone to post a 3600 line "junk" file to a mailing list. UNDER ANY CIRCUMSTANCES! (Think about those sites that are paying hard cash for e-mail transfers!) It is reasonable for such actions to be reported to the administrator of a system. So far as getting off the cypherpunks list, there are a number of other things to try if cypherpunks-request isn't working. Send mail to root(a)toad.com. Send mail to the administrative contact listed in the WHOIS database for toad.com (John Gilmore, in this case). Talk to your local systems administrator and ask his assistance. What ghabrech did is something I would expect from an immature freshman. (who knows... maybe he is one) >Are you people blind to what you are doing? What fools!!! Retaliatory strikes aren't right either, of course. -- Matthew Lyle (214) 888-0474 OpenConnect Systems matt(a)oc.com Dallas, TX "...and once you have tasted flight, you will walk the earth with your eyes turned skyward, for there you have been, and there you long to return..."

1 0

Unacceptable slander by dclunie
by Stephen Dunne (+44) 71-538-5656 12 Mar '93

12 Mar '93

Forgive me if I appear slow over this but I don't see any problem with Davids response.. Mailbombing a mailing list like cypherpunks with 80K of dross is not acceptable behaviour (whether it was through ignorance or malice) and in those circumstances contacting the site postmaster seems a reasonable thing to do. I do agree with another post who suggested that the admin side of the list does need to be tightened up so that future incidents like this do not occur. However we are in danger of blowing this up out of all proportion. Stephen -- +--------------------------------------------------------------------------+ |Stephen Dunne DoD#767 sdun(a)isma.demon.co.uk | |International Securities Market Association I speak for me,thats all| |Voice (+44) 71-538-5656 Fax (+44) 71-538-4902 PGP key available| |We are not affiliated to any other Demon.Co.Uk site. | +--------------------------------------------------------------------------+ ----------------------------- Note follows ----------------------------- Message-Id: <9303120919.AA11896(a)netcom.netcom.com> Date: Fri, 12 Mar 1993 01:24:48 -0800 To: cypherpunks(a)toad.com From: Michael Brennan <mbrennan(a)netcom.com> Subject: Unacceptable slander by dclunie >Date: Fri, 12 Mar 93 17:41:03 CST >From: dclunie(a)pax.tpa.com.au (David Clunie) >To: Postmaster(a)ultrix.ramapo.edu >Subject: Unacceptable behaviour by ghabrech >Cc: root(a)ultrix.ramapo.edu, ghabrech(a)ultrix.ramapo.edu, cypherpunks(a)toad.com > >>From one of the very popular mailing lists I received the following posting [shortened even more] Think about this scenario for a moment: dclunie sends mail to the system adiministrator of an institution complaining of the mail sent by a particular user. The system administrator confronts the user, who then explains the situation. He explains that he has sent numerous requests to be unsubscribed from the list, but they continue to send large volumes of mail. Out of frustration, he sends an 80K file to the list hoping it will get someone's attention. The mail continues, and several members of the list makes threats of "dirty tricks" and "mail bombs" against him. Now one of the "cypherpunks" is sending libelous mail to the system administrator. The system administrator now understands the situation; an educational institution on the net is made aware of a rapidly developing campaign of harrassment and vandalism by the cypherpunks. So what happens now? Are the cypherpunks winning? Are you people blind to what you are doing? What fools!!! ----- Michael Brennan - mbrennan(a)netcom.com

1 0

Secret messages in images...
by Peter Wayner 12 Mar '93

12 Mar '93

I wrote a quick little version to stick bits in the LSB of a file. It runs in the Macintosh as an added feature to a popular program, NIH Image. (The source code and frequent revision are published at the major ftp sites.) It is very easy to add a function to handle this process because all of the file i/o and format decoding are already present. If anyone would like a copy, they're welcome to write to me. I'll send them instructions and a short file. Alas, it only handles 8 bit images. Also, you can also request Mimic function code for hiding messages in text with a grammar. -Peter Wayner (pcw(a)access.digex.com)

1 0

Unacceptable behaviour by ghabrech
by dclunie＠pax.tpa.com.au 12 Mar '93

12 Mar '93

>From one of the very popular mailing lists I received the following posting by one of your users. While I can understand his frustration at having difficulties unsubscribing from a relatively high volume list, or his ignorance at not being aware that such requests should be directed to the "x-request" alias not the "x" list, this is no excuse for such a long and unpleasant post that has consumed considerable expensive bandwidth for no good reason ... I am surprised you tolerate students with such a childish attitude on your system and they do no credit to your institution's reputation. This is an abridged version of George A. Habrecht's 3264 line post ! > From cypherpunks-request(a)toad.com Fri Mar 12 16:48:53 1993 Date: Thu, 11 Mar 1993 14:59:21 -0500 From: ghabrech(a)ultrix.ramapo.edu (George A. Habrecht) To: cypherpunks(a)toad.com Content-Length: 74877 Hello? I have asked several times and am starting to get pissed off!!!! So do as follows!!!!! Unsubscribe me!!!!!!!! Unsubscribe me!!!!!!!! ... ... Unsubscribe me!!!!!!!! Unsubscribe me!!!!!!!! Get the message?!? Thanx ghabrech(a)ultrix.ramapo.edu

1 0

Tagging data to detect thieves
by Hal 12 Mar '93

12 Mar '93

Mark Ringuette asks about schemes to detect which copies of some proprietary information were used to resell the data. I recall reading a paper on this in the proceedings of one of the crypto conferences within the past several years. Unfortunately, I don't have a more accurate reference handy. The authors referred to this problem as "digital fingerprinting" (i.e. adding a "fingerprint" to each copy of a document). As I recall, the idea was to twiddle bits in such a way that any subset of copies up to a specified size would have a certain number of identically twiddled bits. The thiefs who cross-correlate 64 (or however many) copies will not know about the bit twiddles which were common to all 64 copies. Their output will still contain those common bit-twiddles, and this information allows the thiefs to be caught. The paper shows a formula for the number of possible bit-twiddle-places and the number of bit-twiddles per copy needed, as a function of how many copies you are defending against the bad guys getting. It was basically just a combinatorial/counting argument. I do seem to recall that if the bad guys could get a lot of copies the number of bits needed grew exponentially. I don't know whether defeating an attack with 64 copies was practical using this scheme. Mark also asked about secret sharing. The classic secret sharing paper is "How to Share a Secret"; I think it was by Shamir, in an old CACM from the 70's. As I recall, he proposed encoding the data as a K-1 degree polynomial in some modulus field. Give each person a point on the polynomial. K points are required to recover the polynomial. I don't recall how the encoding of the data as a polynomial was to be done, but the author showed that K-1 points gives you no information about it. Hal 74076.1041(a)compuserve.com

1 0

Re: HIDE: embedding msgs into snd & graphics
by blojo＠sting.Berkeley.EDU 12 Mar '93

12 Mar '93

> I would have it take a GIF file and a > binary file to be embedded, and produce an output GIF with the low order > bit of each byte changed to be the next bit of the embedded binary file. I've been thinking about writing this too, but, alas, I have been too busy. If you write this program, I would encourage you to support encoding/decoding in more than just GIF files. My main reasoning behind this is something like: if there is one piece of software that is commonly used to hide data in noise bits, and it only supports one format, then things in that one format are automatically suspect-- it's almost as bad as not hiding the data. I'd encourage you to support JPEG and sunaudio formats (though the info density one could store in each of these is probably a lot lower than what you could pack into a GIF), as well as some less-used formats like tiff and rast. Hmm... and if you can figure out how to pack a useful amount of data into an XPM, I'll be really impressed. I don't know if you actually know GIF format (I don't) but I know that you'd have to do some reasonably intelligent churning of the data. For one, it's just not going to be as easy as dropping a noise bit from each n-byte set; GIF format is fairly compressed as I understand. Also, if you're not careful, you'll end up with a picture that chokes displays after encoding that worked fine before encoding. (Many machines have 8-plane displays, which means a 256-color colormap. If you mess with the noise bits on a GIF that has 200 colors, you're going to come up with one that has 400 colors. Many display programs (like xv) will compress the colormap when they see this; the X server will also slide colors together when you allocate things and the map is full. BUT, such high-colormap-size gifs would basically have "I AM A CONTAINER FOR ENCRYPTED DATA" tattooed on the backs of their necks. -J

2 1

Re: CYPHERPUNKS=EMAIL HARASSEMENT?
by Mark C. Henderson 12 Mar '93

12 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: CYPHERPUNKS=EMAIL HARASSEMENT? On Mar 11, 21:16, Michael Brennan wrote: } Subject: Re: CYPHERPUNKS=EMAIL HARASSEMENT? } } Brushing this matter aside as a non-issue and pretending there is no } problem will not make the problem go away! UNSUBSCRIBE REQUESTS SENT TO } CYPHERPUNKS-REQUEST ARE BEING IGNORED!!! Well, sending a 3000 line file to hundreds of people, wasn't the correct response to the situation. But, to add something constructive, why don't we use majordomo to handle list additions and delections automatically? Mark - -- Mark Henderson mch(a)squirrel.wimsey.bc.ca markh(a)wimsey.bc.ca -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK6A2sPfE/ap/JEqpAQEK6AQAqejFaX3122HwrkLibTYr/rEGEoL6qpSv sSn2oVxoOJXc+R52P8RCZzfp/X0O5tp92tUf4sAL2YKIlb72W2y9rXZ9TXMxpmxi AgRqqpts1uoKAfUMBaM9Lr0QJ2V7fnMRjOJiu2mU/bSbC4Tzr15reKjmhkQDDZXo FoybTVchSEw= =3DYZ -----END PGP SIGNATURE-----

1 0

Re: HIDE: embedding msgs into snd & graphics
by tcmay＠netcom.com 12 Mar '93

12 Mar '93

Matt Thomlinson writes: >The idea of using a DAT tape as a mode of transport, however, doesn't >appeal that greatly to me. To send a message, I have to pull out one of my >prevoiusly recorded DAT host-tapes, then record over the 5th song with my >mix of host/message pair, then fed-ex it (or hand-deliver it) to my >target. If I take this signal and push it across internet, I no longer >have the passive-looking DAT tape in my DAT music collection. Instead, I >have a 900k sound file that I push across the net. Since the net is >usually not used to push the latest Michael Jackson tune, it might raise a >flag. > >Tim's comments are valid and definitely help solve problems on the >physical level: now how about cyberspace? Granted, a DAT can carry more data in the LSBs--about 80 MB, about the length of 10 Bibles--than one really needs. The GIF option I mentioned allows a widely disseminated image file to contain about 32 KB in just the LSBs of a 512 x 512 x 8-bit gray scale image. A color image could easily hold three times more (LSBs in each color channel). And some GIFs are much larger than 512 on a side. So, a fairly long message could be inserted into the "noise floor" bits of a scanned or frame-grabbed image, or of a piece of "original art" and then posted worldwide in one of the GIF groups. Who knows what evil messages are even now being sent in GIFs of Cindy Crawford and Claudia Schiffer? Use your imagination and you'll see there are several other easy ways to hide messages. (Again, we're talking steganography--check the "Glossary" in the soda.berkeley.edu archives if this is new to you.) -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

2 1