- cypherpunks-legacy - lists.cpunks.org

Re: DC 2600 mtg
by dmandl＠shearson.com 13 Nov '92

13 Nov '92

> Perry Metzger writes: > Pardon, but isn't 2600 magazine a magazine by crackers for crackers? No. It's called "The Hacker's Quarterly" and never claims to be anything else. Eric Corley (editor/publisher) is completely above-ground. He even does a computer show on WBAI here in New York, though I haven't heard it. In fact, he was on MY radio show (WFMU) a few years ago talking about hackers. I was initially surprised that he was willing to use his real name on the show; I ended up being almost disappointed by how "apolitical" he seemed. 2600 prints plenty of articles by flamboyant young pranksters on how to break into this or that system, but rather than an editorial line or policy, this is more a result of 2600's view that all this information should be available and uncensored. These are the kinds of guys who uncover holes in multinationals' computer security and TELL THEM about it. (BTW, I'm not involved with the magazine in any way; in fact, I find most of its articles kinda uninspiring or mundane.) --Dave.

1 0

Anonymous return addresses
by nobody＠alumni.cco.caltech.edu 13 Nov '92

13 Nov '92

Here is an example of how to use the cryptographic remailer at <hal(a)alumni.caltech.edu> to implement an anonymous return address. Note: this material is a little complicated, but if you will take it a step at a time you will see that there's not really that much to it. Suppose I want to receive mail at my address of 74076.1041(a)compuserve.com, but I don't want that address to be known. First, I create a file with the following contents. Call it t1: ---------------------- cut here ----------------------- :: Request-Remailing-To: 74076.1041(a)compuserve.com ---------------------- cut here ----------------------- This is the same as what you would normally put at the front of a message to use the remailer. Note that the last line of the file is blank. Now, I encrypt that file, using PGP, with the public key of the remailer (the key is at the end of this message). I use the command, "pgp -ea t1 alumni". I say "alumni" as a shorthand for the address of the remailer on the keyring. This creates a file, t1.asc, which looks like: ---------------------- cut here ----------------------- -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- ---------------------- cut here ----------------------- Now, I edit the file by adding lines saying "::", and "Encrypted: PGP", and a blank line, to the beginning (and I delete the blank line at the end of the file), giving: ---------------------- cut here ----------------------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- ---------------------- cut here ----------------------- The content of this file is my anonymous return address. To use it, I make my posting, anonymously, and I say something like: "Anonymous return address: mail to hal(a)alumni.caltech.edu, with your (possibly encrypted) message preceded by:" and I put in the contents of my anonymous return address file, above. So, to use this anonymous return address, suppose someone wants to send me this message: ---------------------- cut here ----------------------- Hello, I am responding to your anonymous post on cypherpunks. I would like to know more about your anonymous habits. Please post some more. ---------------------- cut here ----------------------- All they need to do is to put the anonymous return address at the beginning, giving: ---------------------- cut here ----------------------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- Hello, I am responding to your anonymous post on cypherpunks. I would like to know more about your anonymous habits. Please post some more. ---------------------- cut here ----------------------- They would then send this to hal(a)alumni.caltech.edu. The remailer would decrypt the PGP block, finding the "Request-Remailing-To" line, and then send it on to me. If I had posted a PGP public key along with my anonymous return address, they could have encrypted their message text as well, and put the A.R.A. in front of it. The resulting message would have looked something like: ---------------------- cut here ----------------------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- -----BEGIN PGP MESSAGE----- Version: 2.01 hIwCqBMDr1ghTDcBA/sGAyloGGHX/CBNRFOkov8RGNxNw/HqehwZ3yT5r0n45qAt AKmETej9GyJVFLZ5Oom7cqFN6+ARaZpp4LFqaxGF7phxC6l9HEPh2zI7w2G1/Df6 pMIwJJ7G+0vk7qBKoctmanNkYVTIb/bKAxJAbK6mUfcXPdRjyUaT/vf2X9RocKYA AAB/sjDjuW2cSN7o3HOKvQ4s+CyqshOGWe7xLRIfSBVyL2PXFOJKx7QMVdRyzDwC HO62PhXswqTlgxqIod0EXDzfEA8kI4Oz2gp45AMy8ElT1nV1jEKjCGC6HWGDU/P5 ZCTPgzOgmLetDNi5Yf8cPDMTHQ3Dcl7vDyNhpMD4+fdFog== =8FPE -----END PGP MESSAGE----- ---------------------- cut here ----------------------- The first PGP message is my anonymous return address, and the 2nd PGP message (which the remailer won't try to decrypt) is the encrypted message for me. If more people will implement cryptographic remailers, you will be able to create more secure ARA's which are "nested" so that they go through two or more remailers, and no one remailer will see the correspondence between your ARA and your real address. How might you use an ARA? You could create a pseudonym, and a public key corresponding to it. You could post anonymously, using our current remailers, to this list or another list. You could sign your messages using the public key of your pseudonym, so no one else could pretend to be you. And you could put an ARA into your messages so people could reply to you. They could reply anonymously if they wanted to, and could supply you with an ARA of their own. People could communicate freely under their online net identities, with cryptographic protection of their True Names, a la Vernor Vinge. Hal P.S. Here again is the public key of the remailer at <hal(a)alumni.caltech.edu>. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.01 mQBNAisCtU0AAAEB/jNOYzN1B2YzOxlK/Zb6axoOaGlPq5I7DV9GH3hcGRN5N6Fi T4sRLhi53Sc5rUdYDa8mFQd4tqvFG6rHcT8LtDcABRG0KlJlbWFpbGluZyBTZXJ2 aWNlIDxoYWxAYWx1bW5pLmNhbHRlY2guZWR1Pg== =K00H -----END PGP PUBLIC KEY BLOCK-----

1 0

Rander box and other stuff
by crunch＠netcom.com 13 Nov '92

13 Nov '92

To Cypherpunks: I think I have a rough description of the hardware serial random generator I want to build. I want to call it the "Rander box" for lack of a better name. It will have two serial connectors, one an input, and other the output, and connect to a modem or serial port. Physically, it should have dip switch to select baud rate, and an on-off switch. When switched on, and a "cr" (or some other character) is sent to it, random bytes will stream out continiously. Another "cr" will stop the byte stream. At least this is ONE approach. If anyone can think of a better way, Pse speak up. Next week, I plan on consulting with another hardware guru and formulate an initial design. I already know what components need to go into it, and now I want to try and eliminate an extra UART if I can figure out how to turn on and off the random stream via software. The internal code of PGP (I am told) uses an internal buffer to hold the random bytes, generated my environmental changes such as key strokes, mouse movements, or other external actions. Some of the Mac implementors are discussing the feasability of not maintaining 100% portability. I suggested that we break up the PGP program into four parts. a) Incryption engine b) Key management engine. c) GUI interface (DOS, MacOS, UNIX, Windows, etc) d) Random number generator (machine dependent, possibly hardware) Parts (a) and (b) are the "portable" parts, and (c) and (d) are the machine dependent parts. Because the Mac is not multi-tasking, we can get around that problem by implementing a random number generator as a driver. Mac drivers provide for "periodic" code to be called as often as possible, and there are plenty of places where this driver can "look for" environmental changes to generate random numbers using the hashing stuff that Phil implemented. Naturally, the IBM-PC and UNIX versions of software random number generation would be different. But as far as the Incryption and Key generators are concerned, all they need to do, is to look into the random "seed" buffer. Implementing the random number generation as a driver also affords the possibility of having total independence of a hardware device, and if one is desired, no changes to the code will be necessary to have one. We just drop an appropriate INIT into the system folder which will contain the appropriate driver. This is the Mac way of doing things. One other problem I am having in participating in this group is the extra phone expenses I will have. I cannot get on Netcom's local lines from here anymore because they are always busy, and there is a lot of other unconsiderate people that hog up all the local lines for many hours at a time, so mail responses to and from me, may take days. For instance, I cannot participate in any IRC chats unless I get local access, as I am unemployed and cannot afford to call out of my area. So please excuse any slow responses you might get from me. John D.

4 5

Hackers, Crackers
by anthrax＠cow.com 13 Nov '92

13 Nov '92

Let's cut out this elitist "crackers" crap altogether. It's just a little bit too PlaySkool, a little bit too "_I'm_ not a third grader! I'm a _fourth grader_!" The people who put so much energy into advertising how they're different tend not to know what the fuck they're talking about, in my experience. >> Pardon, but isn't 2600 magazine a magazine by crackers for crackers? << Beep. Sorry. Thank you for playing. >> 2600 is named after frequency of the disconnect tone used in blue boxes, isn't it? << 2600 is named after the frequency of the disconnect signal used in the telephone system for several decades. But so what? Doesn't PGP violate patent laws (or surely come pretty close)? Why would you want to be associated with PGP and its use, then?

1 0

Re: Rander box and other stuff
by wcs＠anchor.ho.att.com 13 Nov '92

13 Nov '92

John Draper asked for comments on a proposed interface to the Rander box. I would recommend using different characters to start and stop the transmission; if you use one character for both it's easy to get out of sync. ^S and ^Q are traditional, of course, and hardware flow control is another option (Perry's suggestion). Of course, not everybody's machine handles hardware flow control adequately. If you've got a dip switch annyway, you may want to use one switch to choose hardware or ^S/^Q. Bill

1 0

Re: DC 2600 mtg
by Bob Stratton 13 Nov '92

13 Nov '92

> Date: Fri, 13 Nov 92 10:39:23 EST > From: pmetzger(a)shearson.com (Perry E. Metzger) > In-Reply-To: Bob Stratton's message of Thu, 12 Nov 1992 14:25:32 -0500 < > 9211121425.AA32211(a)horton.intercon.com> Subject: DC 2600 mtg > > Pardon, but isn't 2600 magazine a magazine by crackers for crackers? > 2600 is named after frequency of the disconnect tone used in blue > boxes, isn't it? What I'm afraid of is that I will get confused with one > of them -- I'm not sure they are necessarily being misrepresented. In the case of the recent Washington Post article, I know for a fact that they're being misrepresented. I am one of the original attendees of that gathering, and I've been a professional in the computer industry for the past 9 years, not some rodent cracker downloading /etc/passwd files. Most of the people regularly attending that gathering are not involved in illicit acticity, but rather are computer and radio hobbyists, and in many cases are employed in those fields. I can personally attest to the fact that most of the discussions involve new hardware (announcements and purchases), and people's social lives. I'll grant you that 2600 frequently publishes items from miscreants, but the publisher's consistent goal has been to raise public awareness of the risks of various technologies, and their social side-effects. Unfortunately, the media environment in the country seems more oriented to hysteria and glossing over facts. > The tragedies come when idiots raid Steve Jackson Games and sieze > copies of "Cyberpunk" instead of shutting down the infants breaking into > TRW. Blurring the distinction between hackers and crackers is the last > thing we need. That's my point exactly - the media has all but abolished the distinction. They'd rather incite fear of the technically knowledgeable than educate the populace and the legislatures. The upshot of this are things like the "all hackers break into computers" definitions we frequently read, as well as the blatant misrepresentations on the part of cellular service providers that "your calls are private because it's illegal to listen to them". The papers and TV stations don't want to hear the fact that I can take an old TV set and listen to cellular phone calls without modifying it. I spend a lot of time with younger aspiring hackers in the hopes that I can help them establish productive goals, especially as regards careers. I do this for three reasons: 1) It's more personally satisfying to be paid for a job, than to have to look over your shoulder for law enforcement types. 2) The world's a little bit safer for every cracker who gets steered into a productive career. 3) My personal experience is that many of the college graduates with CS degrees these days are code grinders with no understanding or enthusiasm for an aesthetic engineering solution. I'd much rather see people who love what they do designing the things I use every day. I don't want to get too far afield of the topic of this list, so I'll stop here, but I really do believe, based on the precedents with firearms, radio receivers (scanning and paging), and recent law enforcement proposals, that cryptographic technology will be the next example vilified in the press of "things only evil people use". Bob Stratton Engineer, InterCon Systems Corp. strat(a)intercon.com +1 703 709 5525 (W)

1 0

re: Re: (fwd) A Silver Bullet to Limit Crypto?
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 13 Nov '92

13 Nov '92

U> From: gg(a)well.sf.ca.us (George A. Gleason) U> Rapid promulgation of decent user-friendly PKSs looks U> pretty essential at this point. I'm thinking, how about U> approaching Apple to see if they'll include a PKS along U> with their Macs, as bundled software, sort of like U> Hypercard. Even if the PKS which is used, has some U> problem with is, as for instance the old trapdoor-knapsack U> system, **anything** is preferable to nothing at all when U> it comes to getting the public educated. I agree 101% -- I'd rather have a "bad" system in place, with people asking for a good one (and roundly complaining about the short-sighted implementors :-) than to sit and wait until we can implement the "right" system. I'd much rather have email users want privacy and rag about their compromised system. Even a relatively poor one buts some substantial blocks into routine bulk monitoring of traffic... As frequently happens, the real problem is not technical. --- ReadMail * Origin: tomj(a)fidosw.fidonet.org / World Power Systems (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

4 3

Datalink encryption
by avalon＠coombs.anu.edu.au 13 Nov '92

13 Nov '92

Hi, I've started playing around with doing encryption with telnet/telnetd again (I'm cheating and using the rsa/prime number code from pgp-2.0) and I'm stuck on what to use as the encryption for the actual flow of data. (hmm...if it works for telnet/telnetd, it can probably be made to work for the other r-daemons too :-) The idea is telnet and telnetd each choose an rsa pub & sec key, then use rsa to encode a key for the encryption scheme which both ends send and then use that for the base of the link encryption. Whatever I use for encryption of the session data has to work quickly and efficiently and I've got little idea about what to use/how to and would like some opinions on what would make a good choice. Any suggestions ? (Xor seems a possibility but straight Xor is very easy to break). I hope I'm not duplicating work that has already been done :) cheers, Darren

2 1

DC 2600 mtg
by Bob Stratton 13 Nov '92

13 Nov '92

Hi all... I was at the latter part of the Washington 2600 meeting, feel free to ask me questions if you want. By the way, today's article about the event was yet another example of the media promoting hysteria about technologically competent people. The whole article was of the "A hacker is someone who breaks into systems" model. It makes me sick, and I think that the crypto community (the part NOT employed by DoD) is next for this sort of misrepresentation. Cheers, Bob Stratton Engineer, InterCon Systems Corp. strat(a)intercon.com +1 703 709 5525 (W)

2 1

Re: (fwd) A Silver Bullet to Limit Crypto?
by simsong＠next.cambridge.ma.us 13 Nov '92

13 Nov '92

In making public-policy arguments, analogies are dangerous. You need to take time to explain them. The opposition can use other analogies. It's far more effective to argue on the facts. With respect to encryption, the outgoing administration has argued successfully that encryption is the computer equivalent of a saturday night special. That there is no reason to use encryption unless you don't want law enforcement to be able to read what you send. They say that it is only useful against lawful wiretaps, because there are other protections against unlawful wiretaps (ie: the law). The way to attack this is not by making an analogy to photocopiers, but by saying that there are many unlawful wiretaps, breakins, and thefts, and that most of them go unknown and unreported. Argue that most communications that people have an interest in protecting are not about kidnappings but about business dealings. Argue that encryption is vital for communicating with overseas offices, where wiretaps are even more common. Argue that it is important for protecting information on your hard disk which can be stolen. No need to argue with analogy.

1 0