- cypherpunks-legacy - lists.cpunks.org

Re: SAFE Bill / Fuck You (an inch at a time)
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

William H. Geiger III wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > In <199705020430.VAA16643(a)fat.doobie.com>, on 05/01/97 at 10:30 PM, > nobody(a)huge.cajones.com (Huge Cajones Remailer) said: > > > We put up with crap from our government that we wouldn't accept from > >someone trying to sell us a mouthwash. The reason that we're not all > >drinking the "New Coke" is that D.C. has siphoned off all of the spin > >doctors/brainwashers from the corporate advertising industry. > > Well there must be a few spin-doctors left as we are drinking "New Coke". > :) > > The whole "New Coke/Orriginal Coke" was one of the best con jobs I have > ever seen. The Coca-Cola Company had a small problem, the cost of sugar. > It's compitition was using corn suryp as a sweetner in their products which > was much cheaper than the sugar Coca-Cola was using in theirs. > > Now how were they going to switch from sugar to corn suryp in Coke without > lossing a portion of their customers because of the change in taste? NEW > COKE!! > > Here is what they did: > > Come out with NEW COKE which was a major formula change. > Drop OLD COKE at the same time. > Wait a few months while the natives are restless over the change. Bring > back "OLD COKE" due to customer demmand (making Coca-Cola Inc. the "good" > guys). Don't tell anyone that you have switched from sugar to corn suryp > (the sheep will never notice). > > Vola!! Now Coca-Cola has dramatically increased their profits and won a > major PR campain (they care about their customers) sales are up costs are > down and the sheep are happy. > > Now I have NEVER seen the neanderthals in DC ever pull off somthing this > good. :) I guess that if their spin-doctors had been involved in the cypherpunks list takeover, that we would all have golden images of Sameer on our computers. CokeMonger

1 0

A Letter from the Smithsonian
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Dear Dr. Dimitri Vulis, Thank you for your latest submission to the Institute, labeled "211-D, layer seven, next to the clothesline post. Hominid skull." We have given this specimen a careful and detailed examination, and regret to inform you that we disagree with your theory that it represents "conclusive proof of the presence of Early Man in Queens County two million years ago." Rather, it appears that what you have found is the head of a Barbie doll, of the variety one of our staff, who has small children, believes to be the "Malibu Barbie". It is evident that you have given a great deal of thought to the analysis of this specimen, and you may be quite certain that those of us who are familiar with your prior work in the field were loathe to come to contradiction with your findings. However, we do feel that there are a number of physical attributes of the specimen which might have tipped you off to its modern origin: 1. The material is molded plastic. Ancient hominid remains are typically fossilized bone. 2. The cranial capacity of the specimen is approximately 9 cubic centimeters, well below the threshold of even the earliest identified proto-hominids. 3. The dentition pattern evident on the "skull" is more consistent with the common domesticated canine (dog) than it is with the "ravenous man-eating Pliocene clams" you speculate roamed the wetlands during that time. This latter finding is certainly one of the most intriguing hypotheses you have submitted in your history with this institution, but the evidence seems to weigh rather heavily against it. Without going into too much detail, let us say that: A. The specimen looks like the head of a Barbie doll that a dog has chewed on. B. Clams don't have teeth. It is with feelings tinged with melancholy that we must deny your request to have the specimen carbon dated. This is partially due to the heavy load our lab must bear in its normal operation, and partly due to carbon dating's notorious inaccuracy in fossils of recent geologic record. To the best of our knowledge, no Barbie dolls were produced prior to 1956 AD, and carbon dating is likely to produce wildly inaccurate results Sadly, we must also deny your request that we approach the National Science Foundation's Phylogeny Department with the concept of assigning your specimen the scientific name "Australopithecus spiff-arino." Speaking personally, I, for one, fought tenaciously for the acceptance of your proposed taxonomy, but was ultimately voted down because the species name you selected was hyphenated, and didn't really sound like it might be Latin. However, we gladly accept your generous donation of this fascinating specimen to the museum. While it is undoubtedly not a hominid fossil, it is, nonetheless, yet another riveting example of the great body of work you seem to accumulate here so effortlessly. You should know that our Director has reserved a special shelf in his own office for the display of the specimens you have previously submitted to the Institution, and the entire staff speculates daily on what you will happen upon next in your digs at the site you have discovered in your back yard. Dr. Vulis, we eagerly anticipate your trip to our nation's capital that you proposed in your last letter, and several of us are pressing the Director to pay for it. We are particularly interested in hearing you expand on your theories surrounding the "trans-positating fillifitation of ferrous ions in a structural matrix" that makes the excellent juvenile Tyrannosaurus rex femur you recently discovered take on the deceptive appearance of a rusty 9-mm Sears Craftsman automotive crescent wrench. Yours in Science, Harvey Rowe Curator, Antiquities

2 1

Re: SAFE Bill discussion
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Mac Norton wrote: > On Fri, 2 May 1997, Shabbir J. Safdar wrote: > > By attacking the supporters of the bill, you're attacking CDT, the ACLU, > > EPIC, VTW, EFF, Eagle Forum, Americans for Tax Reform, and PGP Inc. You're > > saying that all the Internet advocates have turned against crypto? > > Criticizing the bill is not the same thing as "attacking" its > supporters. Criticizing the arguments of those supporters in > favor of the bill, and questioning seeming inconsistencies > therein, is not the same thing as "attacking" those supporters. > Nor does such criticism imply an accusation that all, or > even some, of those supporters "have turned against crypto." > > The illogical equlvalence you set up, however, does seem to > be characteristic of these supporters' arguments.:) Nor does citing a litany of 'Libertarian Approved Sources of Good and Righteousness" reduce the size of the stick getting shoved up one's butthole, or the right and responsibility of those who oppose this action to speak up. These fine, upstanding organizations that Shabbir speaks of have all become a part of the system. They have learned to play along with the compromise game, just like would-be terrorists who give up their hostages one-by-one to the 'negotiators'. The secret of hostage negotiation is to convince your opponent that you are his 'friend' and to convince him/her to be 'reasonable'. (Read "compromise.") I recently had a lawyer who suggested that I take the 'deal' that the prosecution was offering me, because it was a 'good one', even though I was innocent. Fuck him. I acted on my own behalf and tore the prosecutor a new asshole in court. The irony is that my lawyer, in the words of the judge, herself, was "one of the better lawyers" in the community. Fuck the "CDT, the ACLU, EPIC, VTW, EFF, Eagle Forum, Americans for Tax Reform, and PGP Inc." And fuck Mother Teresa if she wants me to support the SAFE bill. I don't care how many children she's saved, it has nothing to do with my decision to fight against bad legislation. TruthMonger

1 0

Re: SAFE Bill discussion
by Lucky Green 17 Dec '03

17 Dec '03

At 09:47 AM 5/2/97 -0400, Shabbir J. Safdar wrote: >By attacking the supporters of the bill, you're attacking CDT, the ACLU, >EPIC, VTW, EFF, Eagle Forum, Americans for Tax Reform, and PGP Inc. You're >saying that all the Internet advocates have turned against crypto? > >I don't think so. I think you're sense of perspective is out of whack. I think the members of the privacy coalition suffer from the EFF syndrome. The same syndrome that got us Digital Telephony, because the EFF got suckered into believing that it "was the best deal we could get". Yeah, right. The government managed to sucker the EFF then. Now, they are suckering the members of the "privacy" coalition into supporting a law that will gain us *nothing* we don't already have while potentially putting citizens away for five years for the most minor offenses. SAFE must be either completely rewritten (unlikely) or defeated. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Booby traps, but no anarchist writings
by Lou Poppler 17 Dec '03

17 Dec '03

>From today's NYT http://www.nytimes.com/yr/mo/day/news/national/ny-explosives.html [N] EW YORK -- A Bronx man who booby-trapped his apartment with homemade bombs accidentally blew his left hand off Thursday morning, the police said, [snip] Just what Saperstein -- who has a criminal record dating back to 1983 for weapons possession, disorderly conduct and drug possession -- was doing with all the explosives puzzled investigators. "There's no indication he was involved in any group," said a police investigator, who spoke on the condition of anonymity. "There were no rantings or anarchist writings of any kind." [snip] [end of quoted material] Good thing this guy didn't have a folder of old cypherpunks messages on a hard drive! Then he'd *really* be in trouble I guess.

2 1

High Ranking Reprsentative pulls support of SAFE...
by Jonah Seiger 17 Dec '03

17 Dec '03

Looks like the FBI and thier allies have been playing hardball, and have managed to convince a high-ranking Republican member of Congress to buy into their ani-cryto reform arguments. Solomon is the Chairman of the House Rules Committee. This fight just got a lot tougher. Jonah ---- May 1, 1997 OPPOSE HR. 695 "SAFE ACT" Dear Colleague: Earlier this week, after meeting with officials from Defense and FBI, I removed myself as a cosponsor of HR 695. Allow me to explain some of their concerns about this bill. The Department of Defense believes that HR 695 would increase the export threshold for encryption software to a level which would effectively remove existing controls. This would make unbreakable encryption technology widely available and "have a negative impact on national security, effective law enforcement and public safety". The FBI opposes the bill because, "It would be irresponsible for the U.S. to adopt a policy that consciously unleashes widespread, unbreakable, non-key recovery encryption products that undermine law enforcement in the United States and worldwide." I also met with Ambassador Aaron (OECD), who pointed out that many of the major industrial countries have already approved encryption safeguards and the rest are waiting for the United States to act. He believes HR 695 would send the worst possible signal to our allies. Lastly, Assistant Attorney General Andrew Fois stated in a letter to Chairman Coble, "... the bill would severely compromise law enforcement's ability to protect the American people from the threats posed by terrorists, organized crime, child pornographers, drug cartels, financial predators, hostile foreign intelligence agents, and other criminals... It is difficult enough to fight crime without making criminals' tasks any easier." In addition to the FBI and DOD the legislation is opposed by the Justice Department, Central Intelligence,. the NSA, the National District Attorney's Association, the International Association of Chiefs of Police and the National Sherrif's Association. Again, I would ask you to oppose HR 695. Sincerely, [signed] GERALD B. SOLOMON Member of Congress. * Value Your Privacy? The Governmet Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crytpo.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager +1.202.859.2151 <jseiger(a)cdt.org> PGP Key via finger http://www.cdt.org http://www.cdt.org/homes/jseiger

2 1

The Virtues of Extremism
by Tim May 17 Dec '03

17 Dec '03

It seems to me we're seeing an obvious manfestation of the classic "inside the Beltway" mentality. The vocal SAFE suporters are so closely aligned with the legislative process that they can't see the forest for the trees. I won't even speculate too much about the dynamics of why this is so, but it's been seen time and time again. Maybe it's that their vision becomes tunnel vision, sort of like the way a pilot focusses on his altimeter, tapping it and not quite believing it, as his plane crashes into the ground. Maybe this is the only world they know, the world of lobbying. Maybe they do truly believe it's "the best deal we can get." Well, I am not inside the Beltway, and I don't think much of _anything_ Washington does. I refused to renew my membership in the National Rifle Association when it became clear they were "playing the game," going along with repressive, gun-grabbing legislation because "this is the best deal we can get." The NRA lost a lot of members with this stance, and saw gun ownership rights eroded at every turn. The new leadership, elected after this fiasco, pledged that no longer would they "work with" repressive legislation. We'll see what happens. Meanwhile, as with the Cypherpunks movement, vastly more radical steps are needed to sanction the gun grabbers like Swinestein and her leftist allies. (Hint: the more extremist organizations I now work with are probably one of the areas I'm apparently committing putative felonies in. We don't treat the gun laws as valid, and will defend our rights against any gun grabbers. That we use PGP means we could easily face the maximum CDT-approved sentence. As Marc Rotenberg reminded us, the CDT wrote: ""CDT strongly urges you to report H.R. 695, the SAFE Act, out of the Courts and Intellectual Property Subcommittee without amendment." Fuck Congress, and fuck CDT.) "Extremism in the defense of liberty is no vice." Now more than ever Cypherpunks need to take action. If SAFE becomes law, every single organization which supported it should be held accountable. That means PGP, Inc., if indeed PGP, Inc. supports this repressive legislation. Perhaps we should think about sending letters, summarizing the points we've been making here, to all of these organizations which signed the letter supporting SAFE. Perhaps many of the organizations spent little time thinking about the issues. Perhaps Roger Schlafly should speak to his mother (head of the Eagle Forum, as I recall) about the chilling effects of criminalizing crypto use when any of the tens of thousands of Big Brother-defined "prosecutable offenses" are allegedly committed. Perhaps we should ask Phil Zimmermann why PGP, Inc. supports this. Or perhaps he'll finally see the light when some of his anti-nuke friends are charged with using his own product, PGP, in connection with their "prosecutably offenses" at the Nevada Test Site! That would be ironic indeed. It's time we simply give up on Washington and its criminal actions. Washington is a cancer than can only be cured with a few megatons of nuclear disinfectant. --Tim May, still a felon, and soon to be even more of a felon if he uses crypto in support of his activities There's something wrong when I'm a felon under an increasing number of laws. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: TWO Letters on SAFE
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 12:07 5/02/97 -0400, Jonah Seiger wrote: >This is indeed true - CDT sent a separate letter and signed the IPC letter. > >As Marc Rotenberg knows very well, the legislative process is complicated. >Marc also knows that Goodlatte, Coble, Lofgren, and the other subcommittee >supporters of SAFE chose not to consider any amendments at the subcommittee >markup, but rather to take up our concerns at the full committee. You obviously meant, "ignore our concerns" rather than "take up our concerns," right?!? Because that is, more accurately, what they did and will do. >Goodlatte's staff and the other sponsors of SAFE had worked very hard to >prevent any amendments, hostile *and* friendly, at the subcommittee vote >for fear of hostile amendments from the Administration and opponents of >SAFE in the congress. A bill isn't worth much when it gets to the full >Committee if it gets gutted at the Subcommittee. Goodlatte wanted to get >some momentum behind it before going into the expected all out fight at the >full committee. I see a issue that's not being addressed. Presumably, in legislative negotiations the theory behind including such a provision (the criminal provision) is that there are people "out there" who would support it with that provision present, but who would oppose it with that provision removed. (Moreover, the theory would suggest that somebody believes that this bill would be MORE likely to pass with the provision present than absent.) Who, exactly, are these people? Aside from a few government thugs, I really don't see the groundswell. Numerically, I think I'm safe in concluding that there are in the citizenry, by far, more people who would support the SAFE bill only with the provision removed than those who'd support it only with the provision present. We should insist on a bill which reflects the desires of the public, NOT the government. One more thing. That idiot Clinton can easily veto this bill if he chooses to do so. The only way this bill is going to turn into law, I think, is if he _doesn't_ veto it, and that will mean that he prefers getting its "positives" (positive to him, at least), the criminal provision, and all those "legitimate needs of law enforcement", and tolerating its "negatives" (again, to him, at least.) He may publicly oppose it, but I think that position is a fraud. Jim Bell jimbell(a)pacifier.com

1 0

Building a Tempest Interceptor (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

This was on the Surveillance List... by Frank Jones aka SpyKing(a)thecodex.com http://www.thecodex.com Copyright 1997 The is very little public knowledge about TEMPEST. Most infomation, including how to safeguard against monitoring, has been classified by the government. You can view an article I wrote on TEMPEST at: http://www.thecodex.com/c_tempest.html and another at: http://www.thecodex.com/rise.html In order to protect computers and CRTs from electromagnetic emission monitoring (interception, recontruction and viewing) it is necessary to use shielding. This shielding is available in several forms but that is another article... Once the shielding is installed, how do you test it for leakage? It is necessary to see if you can monitor the device yourself. Since TEMPEST monitoring equipment is normally very expensive and hard to come by, here is a simple way to construct a simple monitoring device that will help you detemine if your computer can be snooped on by outside sources... this device was designed for defensive purposes and should NOT be used offensively... it does not have the distance capability of my DataScan device but it WILL work as a laboratory benchtop demo device... Like Van Eck and Moller, I have deliberately flawed the article for the technically challenged... After all, we dont want everyone to have one of these, do we? TEMPEST Interceptor - Follow my instructions... You need to learn something about electronics to make this happen. The first lesson will be to construct a sync generator to drive the computer monitor without any signal or video. To start this you must take your spectrum analyzer, turn off every appliance in the area. Put the analyzer near the computer monitor, turn on the monitor but NOT the computer. Start searching around 15Khz. You should get a strong signal somewhere between 14Khz & 17Khz. Log that frequency. Next try looking around 30Hz to 60Hz. Which is stronger 30 or 60? Log that. Next were gonna build a computer sync generator (video gear will not work). Most technicians who have tried to build a TEMPEST interceptor have been trying to use off-the-shelf products. Don't believe what you read or hear, they won't work. Youve got to build a computer sync generator. It isn't really so hard to do. Get yourself a copy of the "CMOS Cookbook". It's around. In there it shows how to build a 555 timer. It is a small and simple circut. Maybe 5 components. The 555 has in it all the clock and electronics to make a timer from 1Hz to 10Mhz. Follow the instructions and make a variable timer (it is really simple). Make the first one run at the exact frequency of the monitor, say 16 Khz. Next make a seperate one at the second frequency say 30 Hz. Then tie them together with a .o1 Mfd cap. The output should drive your monitor (generator is done). Two minor things I forgot to mention. The output of the 555 is about 5 to 12 volts. You will need to attenuate it to about .3 volts. Several resistors will do. The other thing is that you need a negative pulse out of the 555. The normal output of a 555 is a square wave. On and off . You must vary the duty cycle to create a square wave which is most of the time on and the sync duration off. You now need a seperate dedicated computer monitor. Open the input plug and find the shielded cable inside. Attach the output of your circut to the center-conductor and the battery minus from your circut to the shield. You have a solid black screen on the monitor. Turn up the brightness. There should be no rolling and weaving. If so... adjust the pot in YOUR CIRCUIT not the monitor, to stop it. Next step. Collect the signal you hear and see on your anaylzer/receiver. Take the output of your reciever tuned to those frequencies. Connect the output through a .01 mfd cap to the output of the sync generator and viola you should start to see the monitors radiated signal on your monitor. Shielding your viewing monitor from the recieving monitor and small adjustments in your generator frequency should do it. In fact no adjustments should still do it. The antenna that you use is critical. Make sure you use the right one... ;-) ************************************************************************** Send Postings to: spyking(a)con2.com with "Post" in subject field with subject ************************************************************************** Subscribe to: spyking(a)con2.com In the subject field type: subscribe-surveillance list e-mail address **************************************************************************

1 0

chained stego & interfaces to remailers
by Adam Back 17 Dec '03

17 Dec '03

Introduction (Skip down to "Chained Stego" if this intro is obvious for you) Some users are in countries where crypto is illegal, and would still like the ability to communicate with others on topics which are considered illegal in their countries (an example being documenting civil rights abuses). For them using encryption is not an option unless they combine with steganography. Also in countries where using crypto is legal, people still would like to have the ability to discuss topics which are considered illegal in their country (an example exporting cryptographic code, perhaps) For these users they do have the option of using encryption. However for some serious users of crypto, they may wish to hide the fact that they are sending encrypted communications to anyone at all, as well as hiding _who_ they are communicating with via mixmaster remailers, and hiding the contents of their communications via the use of encryption. Using remailers and using encryption shows up under traffic analysis even in freer countries, and if you were using steganography, you would be above suspicion, apparently never having sent an encrypted message at all, or at least not having sent one during the time in question. A useful capability to address the needs of these classes of users would be to be able to send messages to a remailer by steganographically encoding them in publically published material, Examples being: messages posted to USENET, messages posted to mailing lists, material made available on web pages (text, images, audio files), CUSeeMe video streams, etc. Such a system would allow a person in a country where crypto is outlawed to participate anonymously in discussions in the remaining free parts of the world without appearing to be using cryptography. The simple approach is to set up stego to remailer gateways which scan newsgroups and mailing lists. (It might be a useful to integrate this function into the Eternity server, as it is already doing quite a bit of scanning of newsgroups, and scanning newsgroups is relatively expensive, so we may as well scan for multiple message types while we are scanning). So, to send an anonymous message, a person PGP encrypts their message, and manipulates the encrypted message to remove the statistical properties identifying it as a PGP message (by removing "-----BEGIN..." headers, the fixed PGP formatting inside that, and the bias caused by the use of RSA), PGP stealth version 2.x would be suitable for this purpose. Next a suitable steganographic encoding is required. A simple method would be perhaps an in-your-face approach, to include a randomly distributed, randomly changing .sig: == Use a random number, go to jail, so lock me up already. QGRjcy5leC5hYy51az4gKEhpZ2ggU2VjdXJpdHkpiQCVAgUQMli+7B98EdWB2LS9 AQFF0gQAjiAOPPCs7s0VCHoFI2IWMEcAeQInmnl2p+6rpsvIxjX1v3wBqqstgBu5 aCLY9Uns+iKjzcnt5DTj6NPhJ8EOlefwgHUssiBLTsw7tOvT9fQwcIXOE5ikGP7j RObTq3a2Vtz4/O/YgN0KQnWcqTDuadeP17cJ2bbaWJpZiGDyWGSJARUDBRAySOsk The stego remailer gateway has to be able to put back together the multiple parts in the correct sequence. The Date: field from the post would be enough information to allow this. Chained Stego However there is another problem: the remailer gateway knows the identity of the stego users. The stego users therefore have to trust the stego gateway not to tell the authorities in their country. They also have to trust that the gateway is not actually be run by their own countries censorship board. The price for misplacing trust and revealing your use of encryption may be death in some of these countries. It would be nice if we could chain the stego function, so that the amount of trust required of each element could be reduced, in a similar way to chaining through remailers acheives this. So (here we get to the actual content of this post, the above having been introduction), we could arrange that the stego user encrypts with a selection of stego gateways public keys. The steps to send to gateways A and then B are: 1. encrypt with B's public key, normalise output (with pgp stealth) 2. encrypt with A's public key, normalise output 3. encode normalised output from 2 into an innocuous looking USENET post The process by which the stego message is recovered is then more complex, and has higher overhead. Each stego gateway has to scan newsgroups for stego messages, and forward it's potential partially decrypted stego messages to the other stego gateways. Then each of those remailers decrypts, and if the result is more stego noise, again forward back to the other stego gateways. The problem here is when do we stop! Remember if we pick a message, and apply our stego decoding method to it we get something which looks indistinguishable to a stego message whether there exists a stego message or not. Also how much of USENET do we scan? The stego gateways will be sending a lot of partially decrypted potential stego messages between themselves. One potential solution to the infinite loop problem is to include with the message a note to the gateway stating how many times this has been decrypted. After a few hops it can be discarded. If the max hops is 2, and there are 3 gateways A, B and C. The messages created by the single encrypted message are: round 1: A, B, and C decrypt and forward to each other round 2: B, and C decrypt C discards the output; B forwards the message to the requested remailer (We presume that multiply encoding to the same remailer is not useful, if A can decode by denormalising and decrypting twice, you may just as well have addressed it to A normalised and encrypted once). B does not know which person's USENET post this came from. He does not know where it is going (to another USENET group via a chain of remailers, or to an indivdual) However B does know that remailer A knows who the message is from. Presume there are n remailers. For hops which go through h remailers, collusion is required by all h remailers to obtain the identity of the poster. If the attacker owns k of those remailers, that is k of the remailers are colluding to discover the identity of the stego user, then the if k < h the attacker will never discover the identity of any posters using chains of length h. If k >= h the attacker will discover the identity of a stego user only in cases where the chain includes all of the hops. (C(n,k) is choose k of n function computed with n!/((n-k)!k!) k!(n-h)! Prob = C(k,h)/C(n,h) = -------- n!(k-h)! Some sample values, n = 8 values of h = hops, and k = no of rogue gateways h= \k| hops\| 1 2 3 4 5 6 7 --------------------------------- 1 | .13 .25 .38 .50 .63 .75 .88 2 | .00 .04 .11 .21 .36 .54 .75 3 | .00 .00 .02 .07 .18 .36 .63 4 | .00 .00 .00 .01 .07 .21 .50 5 | .00 .00 .00 .00 .02 .11 .38 6 | .00 .00 .00 .00 .00 .04 .25 7 | .00 .00 .00 .00 .00 .00 .13 Now interestingly it seems to me that this figure is per stego message, so if you chose different gateway chains on each message your cumulative chance of being caught would be worse than if you just chose a chain and stuck to it. You're trying to minimise your cumulative chance of being identified. If you use a chain, and the jack boots don't kick down your door for a few weeks, you hope it is a good chain. Of course there is a chance that gateways could be taken over and your chain would then become a compromised chain. An additional danger if a gateway is compromised and it's key is revealed, the attacker can then go back through it's saved messages and look for messages which came from the newly acquired gateway, or went to it, to see how many more chains this compromises. It would seem like a good idea for the gateways to ensure forward secrecy by re-keying reasonably frequently. To do better than this, we could make the stego gateways to act like middlemen remailers. That is a gateway will always communicate with other gateways via a remailer. Now gateway B does not know which of gateways A or C decoded the message from the newsgroup. So he has to attack them all. Better still, the gateways can be completely hidden. They can use a message pool to communicate. This has higher overhead, but now the fact that gateway B knows either A or C decoded the message does not help much because gateway B can't physically locate A and C. An alternative to the suggestion of including a count of the number of decryptions that have taken place so far to avoid infinite loops, is to do the job probablistically. Say that each remailer says that it will only accept mesages where the low order 3 bits after decryption are "101". This rule doesn't apply to the first hop, which knows that the message hasn't circulated anyway, as it has just pulled it from the newsgroup. So the first gateway decodes, forwards to the other gateways. Each gateway decodes, and if the desired bit pattern comes out, sends the decrypted message to the other remailers. This way we place no restriction on the number of hops, avoid revealing who the first hop is explicitly, but ensure that the messages which are not stego at all die naturally, and don't propogate for ever between the gateways. Also the "101" is likely enough to come up quite by chance, and the number of actual stego messages is small compared to just ordinary USENET posts that seeing a "101" doesn't prove anything conclusive after 1 hop. However after several hops (if an attacker owns several of the gateways), the probability of getting multiple "101"s in a row points increasingly to a stego message, whereas if we relied on a header stating how many hops, no information would be leaked by the attacker handling multiple hops in the middle of the chain. So it's a trade off between lower overall overhead whilst allowing multiple hops, whilst increasing the susceptability of the system to leaked information to an attacker who owns multiple rogue gateways. However these are all very high overhead because they have DC net like overheads, you send a copy to everything to everyone always, so you have a perfect mix. You can trade off this security to obtain lower bandwidth. Here's one suggestion of how to do this. Obviously we can't include with each partial decryption instructions on who to remail it to (because if you found some instructions, that would reveal immediately that it was a stego message). However, we can interpret the random bit patterns as remailer instructions. Say there are n gateways, we can number the gateways consecutively and take the decrypted message mod n - 1 to produce the index number of a gateway to send to next. We can include a count of decryptions so far to reduce overhead. Another way to avoid infinite loops with this variation is to take the decrypted message mod ((n - 1) + j), anything over n-1 gets discarded. Messages naturally die out statistically at a speed determined by the ratio of j / n - 1, after h hops there is probability: (j / n - 1) ^ h that the message will get discarded. Provided the stego users account for a small amount of traffic, their use would likley be lost in the large pool of noise even if they stuck to a particular chain. Or they could themselves use normally distributed selections of random chains. However if they did this, their cumulative chance of sending through only rogue gateways on one post would increase. Interestingly this setup has different properties to mixmaster mixes, with this arrangement traffic analysis gives you nothing, as the inputs are hidden, and the traffic is perfectly normally distributed. (Presuming that the stego users create random chains also). Cover traffic between gateways adds nothing. You probably need cover traffic on output however, so that the gateways send constant, or at least evenly distributed amounts of traffic off into the remailer net, so that one persons posting can not be correlated with exits from the gateway network. Some delay in the gateway network would help also. Random delay is different to mixing in this instance because there is already lots of mixing going on, the point is to ensure that an exit from the gateway network is not observable at fixed time periods after posts from particular suspected stego users. If there are many users this should average out. Note also, that when a message does decode to a message, the gateway should generate a random replacement message and forward that to a random remailer with the same probability as for other non-decoding messages, otherwise receiving a message would skew the statistics. Given that the stego user has an interest in sticking to a chain, this is less secure than sending copies of partially decrypted potential messages to all gateways. Either he doesn't stick to his chain, thus increasing his odds of being detected, or he uses his fixed chain and runs the risk that this statistic shows through. If there are many stego users each with different fixed randonly chosen chains, the fact that chains are fixed would be less likely to reveal information as the random chains would tend to cancel out, and themselves have the same normal distribution as the non-stego traffic. Comments? More efficient ways to get around the weakness of a single remailer gateway hop? Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0