- cypherpunks-legacy - lists.cpunks.org

Re: Lack of PGP signatures
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:38 PM 7/5/96 -0400, "Mark M." <markm(a)voicenet.com> wrote: >OK, now the point of this message: somebody pointed out that if a binary was >clear-signed using an option that would strip it down to 7 bits, the binary >would be corrupted and therefore, such an option on PGP would be a Bad Thing. >Then, I pointed out that not only would there be no point in a clear signature, >since that would make the binary useless to someone without PGP anyway. It >is best to sign a binary and extract the certificate to a separate file, which >you noted above. So an option that would strip data down to 7 bits would not >affect the ability to sign a binary. Such an option would probably be a Good >Thing. Not everybody limits their language to the 96 characters supported by ASCII; many people use languages that have umlauts and cedillas and accent marks and haceks and other inkblots above/under/around their letters, or symbols like section markers and Yen and British Pound currency symbols. A signature form that trashes files down to 7 bits would not only annoy these people, but also their readers :-) One readily obvious alternative - hashing only the lower 7 bits of each letter, but not damaging the letter itself - is probably worse, because the message can be altered by changing high bits without changing the signature, while the shred-them-all method at least leaves you sure what you're signing. But they're both pretty bad.... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

Re: Word lists for passphrases
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:43 PM 7/8/96 -0700, you wrote: >If the purpose is for use with "Crack" or some similar program, it might be >better than you would think. You won't get the "unusual" words, but you >will also get the words in common usage that do not appear in dictionaries. >(Such as fnord, jedi, killfile, and the like...) "fnord" is in _my_ dictionary - can't you find it in yours? :-) >Another thing to look for when choosing dictionaries/wordlists for crack is >not sticking to english. If you have a userbase that is known to have a >certain percentage of people of a non-english background, you will want to >find lists of words from that background. (I had a sysadmin asking me about >Yiddish and Hebrew wordlists for just that reason.) These can be a bit >harder. (Especially for unusual languages.) Grady Ward has his Moby Words databases with some of this kind of information. In addition to the usual sets of languages, it's useful to include any available lexicons of Elvish, Klingon, Unix, and other popular hacker-languages, plus any names you can scam off MUDs, etc. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

3 2

Defend Mail Bomb
by Jerome Tan 17 Dec '03

17 Dec '03

Is it possible to defend mail bomb? If not, detect who they are?

1 0

Organized Crime Home Page - Four Horsemen, No Waiting
by Charley Sparks 17 Dec '03

17 Dec '03

Well, with the UCMJ ( Uniform Code of Military Justice ) and the Oath of Allegiance Military Personnel take on induction being re-written to Support and defend the United Nations and to accept direct and lawful orders from UN personnel, this doesn't surprise me.Soon, UN Secretary-General Boutros Boutros-Ghali, or someone like him will repeal more of the amendments to our constitution. First our guns, then our code. I'll give up my pass phrase when they pry it from my cold dead fingers ! >Date: Sun, 14 Jul 1996 18:22:00 -0700 >From: Alan Bostick <abostick(a)netcom.com> >Organization: Arrogant Opinions 'R' Us >To: cypherpunks(a)toad.com >Subject: Organized Crime Home Page - Four Horsemen, No Waiting >X-URL: http://www.mywebsite.com:1080/cgi-bin/bvolmgr.cgi?BVpage=management >Sender: owner-cypherpunks(a)toad.com > >Cypherpunks interested in establishment scaremongering are invited >to take a look at the Organized Crime Home Page >(http://www.alternatives.com/crime/index.html) sponsored by a group >called The Committee for a Safe Society, about the world-wide threat >of organized crime. Apparently every evil known to post-Cold-War >society, even the bad weather in Chicago, is the responsibility of >organized crime. Now you know why governments need GAK. > >Alan-Bob says check it out. >-- >Alan Bostick | [Spielberg's] latest is TWISTER, a film that >mailto:abostick@netcom.com | gives whole new meaning to the phrase "giant >news:alt.grelb | sucking sound." -- Patrick Taggart >http://www.alumni.caltech.edu/~abostick > >

1 0

Questions from a Wannabe
by Charley Sparks 17 Dec '03

17 Dec '03

Hi all, I have been reading all of the posts for a few days now and I have a couple of questions, if someone has time. In the event of GAk, how can we be forced to register our keys ? We could always scrounge some old outdated but functional TEMPEST equipment .... and could someone please explain ITAR in a simple way for me ? One last thing.. If I have the US PGP and a friend uses the export version, I assume we are compatible, yes ? Thanks all, Charles E. Sparks<sparks(a)bah.com> In God we trust, all others we encrypt ! http:/www.clark.net/pub/charley/index.htm Public Key At http://www.clark.net/pub/charley/cp_1.htm

1 0

Re: Can't block caller ID in Massachusetts?
by Bill Stewart 17 Dec '03

17 Dec '03

>> > That is interesting as I don't recall ever being offered a choice of >> > toll free or being billed when I dial an 800 number (sometimes the only >> > number offered for a company). >> I haven't noticed too many business telephones that don't appear in >> Directory Assistance. >That is assuming that you know which area they are located in. There are businesses that _only_ list their 800 numbers, and you can't find out the real phone number associated with them through directory assistance. It's especially annoying when they've got an in-state or other non-nation-wide 800 number, or when you're calling from outside the US, especially when they're a business you'd like to be able to reach from anywhere, any time, like the travel agent your office uses :-) But it does make it hard to call them directly for ANI-avoidance as well. And they may _only_ have the bank of phones that's got ANI service on it, and not have other phones. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

Re: CDT Policy Post 2.27 - No New News on Crypto: Gore Restates
by Arun Mehta 17 Dec '03

17 Dec '03

At 10:17 14/07/96 -0700, David Sternlight wrote: >At 7:05 AM -0700 7/13/96, Deranged Mutant wrote: >>On 12 Jul 96 at 18:23, Bob Palacios posted: >>> * Called for the liberalization of export controls provided computer >>> users participate in a "global key management infrastructure" >>> designed to make personal encryption keys accessible to law >>> enforcement. >> >>This is particularly problematic... >Your best shot would be to make sure the part about the system being >voluntary was hard-wired into any legislation or rule-making. Unless and >until ITAR is modified by Congress, the USG has what Mark Twain called "the >calm confidence of a Christian with four aces" on this matter. International agreement on this issue won't happen this century. People don't understand the problem (or why it needs regulation), are suspicious of the US and its motives -- in any case international negotiations take forever. As for the "concession" regarding liberalisation of export controls of crypto -- big deal. The stuff is available anyway outside the US, so the only people helped are US industry -- why should the rest of the world care? Without international agreement, the whole key escrow idea doesn't have a leg to stand on, and I doubt US industry will be willing to wait that long before they can use strong crypto in their international products. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org check out my new page at http://www.cerfnet.com/~amehta/ The protestors of Tiananmen Square will be back. Next time, the battle will be fought in cyberspace, where the students have the more powerful tanks...

2 1

Re: Metered Phone
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:19 PM 7/7/96 +0800, you wrote: >Does anyone have any ideas about this metered phone? >I am from Philippines and heard some news that it will be >existing in 1997. Quite a big problem! Every dial will be counted, >every seconds will be measured... That sounds like you're getting newer telephone technology. In the US, most areas with newer telephone switches offer you the choice of flat rate service (you pay a constant price per month for calls in your city or other local area) or measured service (you pay a lower price per month plus a few cents per minute for local calls.) In many places with measured service, the phone company measures how much time you use for local calls, but doesn't record who you call, only how many minutes. For long-distance calls, which always charge for time, they do record what number you call. For computer users, there are two issues - - recording who you call is, of course, bad - if you have flat rate telephone service, you can stay connected to your Internet provider full time, instead of calling up every N minutes or when you have mail. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

2 1

Re: Markoff on Clipper III
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:35 PM 7/14/96 -0700, David Sternlight wrote: >Did you miss the part in the Constitution about "provide for the common >defence" That's a meaningless part of the Preamble. And in any case, it's a statement of why "the People of the United States" wrote the Constitution. It's not an oath of the President. >and about the President's associated responsibility to "take care >that the laws be faithfully executed"? There is no law that specifically controls export of crypto, is there? I was under the impression that is an item on a list of regulated items drawn up by bureaucrats and could be changed any time the Executive Branch chose. a reg isn't a law. >And what oath do you suppose binds him because "The President shall be >commander in chief of the army and navy of the United States"? That's a job title. It doesn't command him as to what he should do in the job. In fact, the Commander In Chief is not under the Uniform Code of Military Justice and so can do anything he wants with that particular "office" subject only to impeachment and the willingness of the armed forces to obey him. It certainly doesn't require him to adopt any particular regulatory strategy. President Browne could legalize the export of all crypto by executive order on January 20th 1997 without violating his oath. That's one of the effects of a "strong executive." DCF

2 1

Opiated file systems
by Deranged Mutant 17 Dec '03

17 Dec '03

On 14 Jul 96 at 12:48, Adam Back wrote while high on Ritalin: > Some more thoughts on encrypted file system design criteria. > A wish list: > > - Choice of secret key encryption algorithms (IDEA, 3DES, MDC, Blowfish) Nice in theory. Awful in practice. Requires code for managing keys, encrypting and decrypting for ea. algorithm be resident in memory. For some systems (MSDOS), free memory is at a premium... (one of the reasons SecureDrive is popular is because it takes only 2.5k). It's not worth wasting memory for handling several algorithms when only one is going to be used in most cases. > - Multiple architectures (MSDOS, Win31, Win95, WinNT, Unix, Mac) Ok... > - High performance (hand optimised assembler for each architecture) So much for maintaining code across platforms. > - Compression Not worthwhile. Use a Stacker or JAM driver over the encrypted partition on a PC, for instance. Keep compression and crypto separate utilities... keeps bugs from one interfering with another and reduces complexity of both drivers; also, if one wants crypto w/out compression or compression w/out crypto, no wasted memory (see above about RAM being at a premium). > - Ability to chain algorithms (IDEA and then 3DES for example) Why? Doesn't necessarily increase security, esp. considering the performance hit (memory... see above, time, key management). > - Possible to have encrypted file systems on separate partitions, or > > - Encrypted file system located in a file in another file system > (much like DOS stacker drives) this is an ease of use criteria -- I > suspect re-partitioning drives would put off many potential users. Nothing new there. > - Ease of use. Graphical user interface for setup and administration > functions, with a very simple set of configurations options > displayed by default, with more advanced configuration options > available in "expert" mode. A common problem with much crypto these days. > - All directory and FAT information should be encrypted, so that > it is not possible to discover even number of files, or percentage > of disk used without the key Do you understand how such systems work?!? Every sector is encrypted in such systems. That's not even an issue for most encrypted file systems (at least on the PC). > - Facility for duress key, with the real data hidden in the unused > space of the first encrypted drive. To increase the plausible Huh?!? > deniability all unused blocks within a file system should be filled > with garbage, so that it is not possible to tell if there is more > data there. If the algorithm is good, this shouldn't matter. The only way a person could tell if a sector is unused is if that person was able to mount the partition already. > - File system steganographically hidden in files on another file > system (encrypted or not). Support for a wide selection of file > formats (Aiff, Wave, Midi, JPEG, GIF, RGB, MPEG). Now this is getting nutty!!! Never mind the size, compleixty and amazing slowness of such a driver... you'd have to have audio or video files of gigabytes in size to be able to store anything of use. > - Ability to use stegoed file system in files on an unencrypted > file system, and boot from a floppy to access stegoed file system, > with no other traces left on hard disk. Why? The authorities would wonder why you have an 8 Gig JPG on your disk and figure you're using it for stego, or you're crazy, or both, and have you committed. Rob.

5 9