- cypherpunks-legacy - lists.cpunks.org

security of constructed addresses
by Karl L. Barrus 13 Jan '93

13 Jan '93

Alert! Hal Finney has alerted me to a problem with the way my script builds an anonymous remailer chain. Simply saving eachheader portion into a seperate file and running pgp on the pieces reveals each link in the chain. The solution (also from Hal Finney) is: hide the intermediate hops until they get to the machine that needs them. (machine1, encrypt1(machine2, encrypt2(machine3, encrypt3(user@dest)))) Here, the entire header is decrypted at each remailer, revealing the next destination to that remailer only. No peeking ahead! The only remailer that will be revealed is the first one, where mail has to be sent anyway. I'll rework the script, provide a ksh version, and write a little help file ASAP. /-----------------------------------\ | Karl L. Barrus | | barrus(a)tree.egr.uh.edu (NeXTMail) | | elee9sf(a)menudo.uh.edu | \-----------------------------------/

1 0

Cascading aliases
by Hal 12 Jan '93

12 Jan '93

I think Matthew Rapaport's point is good that much of the trouble with the automatic assignment of aliases comes from the automatic mailing to the user of a new alias. Most of the remailing servers have a special address or command you can send meaning "assign me a new alias, and tell me what it is". Probably, as Matthew says, they should only mail back the newly assigned alias when one of these special commands is used. I'm still not convinced that automatic alias assignment should always be done when mail goes through a server from a new address. It seems like this might generate so many aliases that it would be too great a load on the servers, especially if remailers become more widely used. But it's hard to say how bad a problem this is. I feel that the main purpose of an anonymous address is to protect the anonymity of the person being addressed, not people who send to him. Just because a person chooses to be anonymous is no reason to expect that everyone who wants to talk to him also wants to be anonymous. I think it would be better to only provide anonymity when asked. Systems that do too much for people sometimes get in the way. Hal Finney 74076.1041(a)compuserve.com Distribution: Cypherpunks >INTERNET:cypherpunks@toad.com

3 2

Crypto Bus to Winter Usenix in San Diego
by hugh＠domingo.teracons.com 12 Jan '93

12 Jan '93

[The Bays (SF and Monteray) area CypherPunks are thinking of takeing a bus to Usenix, if you don't live near the Bays you might want to ingore this message.] Ok a bus will cost about $2500 round trip (keeping the bus in the parking lot for the three or four days of Usenix). If we get 20 people to ride the bus the cost per person is about $125, if we get 30 folks the cost per person is about $83, both of these are ROUND trip prices. If you are interested in rideing the Crypto Bus I need a commitment from you as to a price point. If you are willing to ride the bus at say, $115, then send me <hugh(a)toad.com> (and NOT the group!) email saying what your price point is and if we get enough people then we will do a bus. I need as many commitments as possable this week (before the new year) to get a bus reserved, if you don't read this before the new year then respond on monday or tuesday next week. Late commers will be taken on a first come first served basis, if there are enough folks to do a bus in the next few days. Bus will leave SF Bay area and make a day trip into Mexico, and return to SF Bay area. We get to stop and eat where we want! If you are willing to leave early Sunday, Monday, Thursday or Friday so that we can do a long streach of Mexico coast or something please include that in your email to me. If you have questions please feal free to contact me. ||ugh Daniel Just a 555 acting as a Bus Driver...

1 1

Random number generators
by gnu＠cygnus.com 12 Jan '93

12 Jan '93

> MONTE CARLO TECHNIQUES, > widely used in computer simulations of physical systems, entail the > wholesale generation of random numbers. A new study by scientists at > the University of Georgia (Alan Ferrenberg, 404-542-8460) shows that > even the most advanced random-number generators are biased under > certain circumstances (A.M. Ferrenberg et al., 7 Dec. Physical Review > Letters). Using one state-of-the-art program, the Marsaglia-Zeman > random-number generator, Ferrenberg discovered that a simulated > performance of the two-dimensional Ising model (which models the > behavior of a plane of neighboring spins) did not agree with the > results when calculated exactly by mathematical methods. He traced the > discrepancy to the random- number generator. Other generators tried > had differing faults. > (Science News, 19 & 26 Dec.) Can someone get the paper(s) and/or talk to the researcher? Does he have any programs he can throw into the pot for generating or testing random numbers? John

3 2

Re: Politics of Rmailers
by pmetzger＠shearson.com 12 Jan '93

12 Jan '93

> From: Crys Rides <crys(a)eith.biostr.washington.edu> > > >>>>> On Sat, 9 Jan 93 23:32:18 PST, tribble(a)xanadu.com (E. Dean Tribble) said: > > E.> Date: Sat, 9 Jan 93 17:52:01 -0800 > E.> From: uunet!netcom.com!norm (Norman Hardy) > > E.> I can imagine a system administrator choosing to require that > E.> all mail originating from his machine include a signature that > E.> correctly identifies the local name of the sender. > > E.> I can imagine it, but none exist. This is mostly because the From: > ^^^^^^^^^^^ > E.> field is supplied by the mailer and satisfies that requirement, > E.> whereas requiring things in teh body of the mail message goes against > E.> the grain of how the systems are used. > *Bzzzzt* Wrong answer, thank you for playing. The public access bbs > system running out of Chapel Hill, automatically appends the same signature > to all outgoing messages, and other sites are considering the same measures. Mr Rides; Your rudeness is exceeded only by your apparent incapacity to read. As has been stated, quite clearly, no one is doubting that such systems exist. The "none exist" in the last paragraph refers to REASONS FOR THIS PRACTICE, not to the number of sites practicing it. As was said, the "From:" field satisfies the stated requirement without the need for autosignatures. The notion of an automatic footer when automatic headers exist already that satisfy the identification requirement is without merit. Perry

1 0

share room at RSA conference Thursday?
by phr＠napa.Telebit.COM 12 Jan '93

12 Jan '93

Does anyone have crash space, or need some, at the Sofitel hotel on Thursday night? (I'm not sure if it's all booked up or what the room rates are). I live fairly close to Redwood City but figure that staying at the conference hotel is the only way I'll have any chance of getting up early enough for the 9:00 A.M. session on Friday. I might also be interested in splitting up a room on Wednesday night but the interesting sessions on Thurs. don't start til 10:45 a.m. which is not quite as bad... Please reply by direct email, as I'm not on the list any more. Thanks. Paul

1 0

multiple aliases. It doesn't matter how many
by mjr＠netcom.com 12 Jan '93

12 Jan '93

***** Karl L. Barrus <barrus(a)tree.egr.uh.edu> ***** >I agree with Matthew that not mailing back an ack would help cut down >the flurry of mail, but it still results in all sorts of extra id's. Yes, but so what? That is, why does it matter so long as all the conversion from one to the next takes place automatically. The process strengthens your security as well as that of any respondent. True this may not be necessary, but under the circumstances (the whole point of alias servers) isn't a "lets not take chances" approach best? Lets take an extreme case (not that I'm suggesting things be implemented this way). Imagine that every time you or anyone else originates mail through an Aserver you are given a NEW ID (not just the first time, but EVERY TIME). Again, so long as a relationship is maintained between all your ID's on a given server and their corresponding ID's on the next machine down or up the line, it shouldn't matter to you at all! After a few years you could end up with hundreds or thousands of IDs. What difference would it make? You don't need to know what *any* of them are... matthew rapaport Philosopher/Programmer At Large KD6KVH mjr(a)netcom.com 70371.255(a)compuserve.com

1 0

.Sig suppression
by Hal 11 Jan '93

11 Jan '93

-----BEGIN PGP SIGNED MESSAGE----- Chael> I'm Chael> sure there are a couple, but I agree with your point that most BBS's on Chael> any mail network append an identifying "tagline" or signature. As a Chael> matter of fact, in many nets it is a requirement that your system append Chael> a tagline to all messages. Incidentally, it is preceded often by "--" Chael> on a line by itself. I'd like to hear more about systems which do this. What is the rationale for adding the system name at the end? Do these networks not use Internet-style "From:" headers, so these automatic system-wide .sigs are used for the same effect? I guess there must be gateways between these bbs's and the internet, for this issue to arise. It's too bad that these gateways don't convert the .sig info into a more conventional RFC-822 style Internet header. Hal Finney -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK1F586gTA69YIUw3AQFNogP9FU2W3wrHTnfrZeKtrMOq4Zz5aTUN7+vv 04iMOdV975fCzqdmgR7O758qamewguYV8XHmPVloLSMwgnmbzBNs8zRZkVAwTKnB rpQqeahXPNeC1PVu/ezoiBvc26ujcN2Ga9OuGUWu9RFRvjwQ0rl51mTjHED1fJi+ 7I/TV4kT4Kk= =WeLq -----END PGP SIGNATURE----- Distribution: CYPHERPUNKS >INTERNET:CYPHERPUNKS@TOAD.COM

2 1

constructed anonymous addresses
by Karl L. Barrus 11 Jan '93

11 Jan '93

Had sort of a slow day at work, so I had the chance to crank out this: Here is a rough script which will allow you to route your mail through the various remailers. (However, extropia is not yet supported...I'm working on it). You must have the public key for each remailer on your keyring. Save the file, run it, and it will prompt for 1) mail, or 2) header. Choose 1 to pick a path and send a file, choose 2 to create a header which can be used to reach you. I intend option 2 to be used as follows: create a message to someone you want to remain anonymous from, run the script, pick 2, follow the prompts, and then instruct the script to append the header to your letter. Then your recipient will be able to follow the directions and respond to you. When the script prompts for "And then to (1-3 or address)", to end the process, type the final address you want your mail sent to. Of course, if you are creating a header, you'll want to type your own address. Further improvements include supporting extropia; and rewriting in C, perl, awk, ksh, or any language with arrays! I've tested this script using the remailers at alumni and rosebud, because the turnaround time seems faster. But there is no reason that rebma shouldn't work as well. --------8<--cut here-->8-------- #!/bin/sh # support script for anonymous remailers # allows routing a message through various remailers # NOTE: extropia remailer not supported just yet #find out which mode user wants echo "Do you want to:" echo "1. Create routing and mail a file" echo " This will allow you to specify the route your message will take," echo " and mail a file through that route." echo "2. Create remailing header" echo " This creates an appropriate remailing header, with instructions." echo " Include the generated file in one of your own messages and" echo " someone else can use it to reply to you." read choice #declare remailers mail1=hal(a)alumni.caltech.edu mail2=remailer(a)rebma.mn.org mail3=elee7h5(a)rosebud.ee.uh.edu mail4=remail(a)extropia.wimsey.com #temporary files t1=.anon1 t2=.anon2 t3=.anon3 #set up header echo "::" > $t1 echo "Encrypted: PGP" >> $t1 echo "" >> $t1 #blank out .anon3 cat /dev/null > $t3 #print menu echo "" echo "1) $mail1" echo "2) $mail2" echo "3) $mail3" #echo "4) $mail4" echo "" #get hop echo "Mail to (1-3): " read to #convert from number to address if [ $to = "1" ] then to=$mail1 elif [ $to = "2" ] then to=$mail2 else to=$mail3 fi firsthop=$to notdone=true #begin loop while [ $notdone ] do #find out remailing request echo "And then to (1-3 or address): " read rto if [ $rto = "1" ] then rto=$mail1 elif [ $rto = "2" ] then rto=$mail2 elif [ $rto = "3" ] then rto=$mail3 fi echo "::" > $t2 echo "Request-Remailing-To: $rto" >> $t2 echo "" >> $t2 # echo "remailing to $rto; encrypted for $to" pgp -ea $t2 $to 2> /dev/null cat $t1 $t2.asc >> $t3 if [ $rto = $mail1 -o $rto = $mail2 -o $rto = $mail3 ] then to=$rto else notdone="" fi done if [ $choice = "1" ] then #now include message echo "Message to include? " read msg if [ ! -f $msg ] then echo "$msg not found" exit 1 fi cat $msg >> $t3 elm -s "anonymous mail" $firsthop < $t3 else echo "Append to file: " read msg echo "--------8<--cut here-->8--------" >> $msg cat $t3 >> $msg echo "" >> $msg echo "<To reply, save everything below the \"cut here\" marks above" >> $msg echo "<into another file. Type your reply here (below the blank " >> $msg echo "<line three lines above!) and mail to $firsthop" >> $msg fi rm -rf $t1 $t1.asc $t2 $t2.asc #end of script---------------------------- /-----------------------------------\ | Karl L. Barrus | | barrus(a)tree.egr.uh.edu (NeXTMail) | | elee9sf(a)menudo.uh.edu | \-----------------------------------/

1 0

request digest format
by Richard Childers 11 Jan '93

11 Jan '93

When is this going to be converted into a Digest format ? Without wishing to appear peckish, Christmas would have been a good opportunity ... -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration ... whatever remains, however improbable, must be the truth.

1 0