- cypherpunks-legacy - lists.cpunks.org

subscribe me
by habs＠acf3.NYU.EDU 06 Dec '92

06 Dec '92

subscribe me -- habs(a)acf3.NYU.EDU habs(a)gnu.ai.mit.edu habs(a)well.sf.ca.us habs(a)panix.com

1 0

remailers
by nobody＠soda.berkeley.edu 06 Dec '92

06 Dec '92

Remailers are proliferating! Several more will be coming on line soon! Two thoughts: Remailers should keep a directory of other remailers, along with their keys. They should, at random intervals, send messages to other remailers, selected at random. They should have a field like Purpose: traffic-analysis If a remailer on this "ring" sees this field, it will have, say, a 90% chance of remailing to another remailer in the ring, again, encrypted and with the traffic-analsysis field. This will cause a certain amount of random traffic between remailers. A traffic-analysis message could bounce around many times before finally ending up in the great /dev/null. We need two other things: overseas remailers (for those of us who live under US law). Domestic (US) remailers could have their archives searched with a searchwarant. However, if your mail has gone accross the oceans a few times, it would be pretty much impossible to get the neccessary warrants and cooperation in all the countries its been through. I'll set up a European remailer if someone else will. The other thing we need to do is make a list of remailers and their keys and put it up for ftp on soda.berkeley.edu in ~ftp/pub/cypherpunks. In fact, there could be an automatic service, whereby remailers automatically send mail to a remailer at soda, listed their keys and protocols, and the soda remailer automatically updates a remailer directory. e

1 0

Hardware RNGs
by Joe Thomas 05 Dec '92

05 Dec '92

I just joined the list (rather loudly, I'm afraid), but I've already seen several writers complain about the quality of RNGs and PRNGs for the purposes of cryptography. PGP stores up keystroke-derived random bits in a file, which has been pointed out as a possible security hole. But requiring random keystrokes every time one wishes to send a message seems an inconvenient tradeoff, to say the least. Someone posted a plan for a Zener diode-based hard RNG on sci.crypt a few weeks ago. I'm not much of a solderer normally, but this seems like a good idea if anyone out there has tried it out and tested the output for nonrandomness. (Of course, ideally we'll have alpha-decay-based RNGs --guaranteed random by the laws of physics-- but I'll settle for thermal noise on the cheap for the moment). Anyone tried these yet? More to the point, does anyone have some code patches for PGP to use a hard RNG preferentially over other random bitstreams? (Yeah, it would be pretty easy, but there's no sense in duplicating effort if we could get something standardized, pretty and portable agreed on.) Joe P.S. Sorry about the wasted bandwidth last week. My fingers were moving faster than my brain, but I should have recognized this address as a probable mailing list. Thanks to all who politely directed me to the -request address.

1 0

First digital money?
by edgar＠spectrx.Saigon.COM 05 Dec '92

05 Dec '92

Following cross-posted from Extropians: To: gnu.ai.mit.edu!Extropians Date: 02 Dec 92 11:31:59 EST From: Duncan Frissell <szebra!CompuServe.COM!76630.3577> Subject: If I only had $100K Bankers Trust has started a Global Settlement Fund to allow securities traders to make free funds transfers 24 hours a day. The Chicago Mercantile Exchange now accepts GSF shares in addition to cash and T-bills for settlement purposes. GSF shares will pay interest and there are no transactions charges for transfers. For now, the account minimum is $100,000 and participating institutions must have a link to Bankers Trust's New York operations center. The company plans to open similar funds denominated in Yen and Pounds Sterling. It also plans a BBS system which will allow traders to arrange forex exchanges with the holders of other currency shares 24 hours a day. Bankers Trust has targeted the Fed Wire that does 60 million transactions worth $200 billion a year but is slow and expensive. Now once such a system reaches the *retail* level we'll really have something. Duncan Frissell ******************************************************************************* * DUNCAN FRISSELL Attorney at Law, Writer, and Privacy * * CIS 76630,3577 Consultant since the Nixon * * Internet 76630.3577(a)compuserve.com Administration * * Easylink 62853962 * * Attmail !dfrissell * * TLX: 402231 FRISSELL NYK * * * * * Clinton Inaugural Sale - Any Question Answered for $9.99 * * * * ******************************************************************************* -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0

test
by nobody＠soda.berkeley.edu 05 Dec '92

05 Dec '92

This is a test of my new anon-remailer based on Hal's code. It does not yet feature pgp (pgp is having a hard time compiling on soda, but that will change soon...) To use it, just use the Anon-To: field in the header and mail to hh(a)soda.berkeley.edu There will soon be an even fancier remailer at soda (and not running out of my account). Details as they become available. sincerely, nobody

1 0

getting .hqx files with ftpmail
by fnerd＠smds.com 05 Dec '92

05 Dec '92

A note for fools like me trying to get Mac .hqx files through "ftpmail"... USE ASCII MODE! Otherwise it defaults to adding an extra layer of "btoa" encoding on the file (or you can switch it to uuencode, but why uuencode an .hqx file--it's already plain text). "btoa" files start like this: xbtoa begin wef9a87eg8a9wery8s7arg87gae8g7waeo87rwe8r(garbage)... as opposed to uuencoded files like: begin fred.txt aewhgp9ergu90ser890syuer98gse98r(garbage)... or .hqx files (this is from memory): (This file has to be decoded with BinHex 2.0) k9wegesz9p8rgy89serg9oser98ser98(garbage)... I don't know where to find "btoa," and ftpmail's help message just says to ask my local wizard. He never heard of it. --- Example request to ftpmail --- connect mac.archive.umich.edu cd mac/util/encryption ascii get macpgp2.0.sit.hqx -fnerd fnerd(a)smds.com (FutureNerd Steve Witham)

1 0

Another remailer
by nobody＠cs.Buffalo.EDU 05 Dec '92

05 Dec '92

I have set up another reamiler... the address is babani(a)cs.buffalo.edu Be warned: There is no PGP ability as of yet. Let me emphisize that: THERE IS NO PGP ABILITY ON THIS REMAILER. I have not gotten the pgp program up and running as of yet. But... if you want to bounce mail through the remailer... it shouldn't be to much of a problem. Just use one of the other remailer keys and encrypt your message with that. Just add the usual lines to your message. For example: ----Begin fake message to a remailer---- :: Request-Remailing-To: remailer(a)rebma.mn.org --------BEGIN PGPv2.0 MESSAGE------ (endcoded with rebma's key) blah blah --------END PGPv2.0 MESSAGE------- ----End fake message to a remailer------ Report any problems to me or to any of the other remailing sites. -- +==== Internet: babani(a)cs.buffalo.edu ===+======== Amateur-Radio: N2LYC ======+ ! Bitnet: V078LNGT(a)ubvms.BITNET | UUCP: rutgers!ub!babani ! ! Alternate: an173(a)cleveland.freenet.edu | Plsure dpnds on the othrs prmison. ! +When you finally discover all of lifes answers, they'll change the questions.+

1 0

usenix
by Eric Hollander 05 Dec '92

05 Dec '92

A list for discussion of the crypto-bus to usenix has been formed. To join, send mail to usenix-crypto-bus-driver(a)soda.berkeley.edu. e

1 0

Re: digital banking
by norm＠netcom.com 04 Dec '92

04 Dec '92

As I understand Chaum's Digi-Cash scheme the bank customer is protected both against bank fraud and merchant fraud but not against collusion between the two. The customer need not be unknown to the bank in order that her purchases with bank notes be unknown to the bank. This is where blind bank signatures come in. Neither need the merchant be unknown to the bank. Remailers are unnecessary to hide connection between the merchant and his customers. The bank knows both but has no way to associate them. This being the case, the bank customer is protected against a false denial of deposit. When one deposits Digi-Cash in a bank he presumably waits for an indication from the bank that the cash was still valid (not previously deposited). The customer retains this indication as a receipt which is signed by a private bank key. A bank's positive reputation is useful but not necessary at this point. Another concern is the false denial of payment by the merchant. If the merchant's customer is willing to reveal to a judge that she paid the merchant, and she retained the note with which she paid, and the bank retains a record of the merchant's deposits then she can argue that it was she that caused the bank to mint the note since only the person for whom the note was minted and the merchant who had cashed it (and the bank) should know its bits. This would require that the bank respond to the judicial query "has bank customer M deposited note x?".

1 0

FTP site
by Eric Hughes 04 Dec '92

04 Dec '92

We have an anonymous FTP site. It's at soda.berkeley.edu. The directory is pub/cypherpunks. Right now there's not much in it. A few miscellaneous documents are in the misc/ directory. There's an empty directory for listings of ftp sites in other places that hold crypto software of various forms. But most importantly the source code to the remailer as currently running is in there. I'd like to see even more remailers than three. And if you can't put up a remailer (because, to take one of the few good examples, you don't run Unix) I'd still like people to study the code. We'll eventually have weekly digests of mail traffic from the list, but those aren't created yet. Enjoy! Eric

2 1