- cypherpunks-legacy - lists.cpunks.org

Re: AMEX and Netscape
by ethridge＠Onramp.NET 17 Dec '03

17 Dec '03

>American Express Platinum card holders might want to look at the bottom >of their statement: > >CARD USE ON THE INTERNET -- Cardmembers should only conduct transactions > >(Any Gold or Green card holders have the same notice?) Green - yes. allen

1 0

Re: Remailer passphrases
by Bill Stewart 17 Dec '03

17 Dec '03

>Bill Frantz writes: >> One of the reasons classical (government) crypto users change keys >> frequently is to minimize the amount of data compromised by a broken key. >> We keep hearing about NSA decrypting 20 year old cyphertext and showing >> more of the workings of the atomic spy rings operating in the 40s and 50s. The NSA's decryption of old cyphertext that's been publicized, other than World War II cyphers such as Enigma and Purple, has primarily been Russian "One Time Pads". OTPs are perfectly secret - if they're made with real random numbers and only used once, which the Russians were sloppy about. Minimizing exposure is good. perry(a)piermont.com replied >Signed Diffie-Hellman key exchanges have the property known as >"Perfect Forward Secrecy". Even if the opponent gets your public keys >it still will not decrypt any traffic for him at all -- it just lets >him pretend to be you. Thats one reason why protocols like Photuris >and Oakley use the technique. DH key exchange is really only Exponentially Good Forward Secrecy, and in its primary use (exchanging keys for symmetric-key algorithms) the system is at best Good Enough Forward Secrecy. The difference between exponentially good and perfect is exponentially small, which is fine if your keys are long enough. On the other hand, cracking a symmetric-key algorithm is generally the weak link, unless you're using 112-bit or better secret keys, and even 112s might be crackable during the lifetime of the current universe. How much information leaks if you reveal (say) 128 bits of a 1024-bit Diffie-Hellman key? Does it tell you anything at all about any of the remaining 896 bits? Is it safe to use 8 slices of the 1024-bit key if 7 are revealed? Does RSA have the same problem? This is partly an efficiency hack (cutting the number of big slow calculations by 8) and partly a question of other uses one might make of the bits, such as stealthing PGP headers. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

2 1

Backyard RF Weapon
by John Young 17 Dec '03

17 Dec '03

Excerpt from congressional hearing on RF weapons: Mr. David Schriner is the Principal Engineer directed energy studies with Electronic Warfare Associates and a recently retired engineer with the naval weapons testing facility at China Lake. He has numerous patents, has received superior service awards, and given technical presentations over 42 years of civil and military service. He will discuss the difficulty in building a RF weapon and the terrorist threat. [Excerpt] In support of the information presented in this testimony and taking advantage of the winter's need to work indoors, a unit that uses oil spark-gaps was designed, built, and tested. The materials for it were mail-ordered at a cost of about $500 and about one week was needed to fabricate the mechanical hardware. It use two ignition coils and a battery for power, an automobile fuel pump and filter for the oil circulation, and commonly available transformer oil. An additional week was required to work out all of the electrical wiring, the oil lines, and the general finishing details. This unit was ready for testing in two weeks after starting the effort. The signal radiated from the unit was measured and found to be a very significant power level that can be compared against available vulnerability and susceptibility levels of military equipment. When the weather permits, this unit will be tested against a set of infrastructure targets at an official test range. >From the measurements and known signal levels, this unit is expected to be consistently deadly to many types of infrastructure items at ranges suitable for terrorist usage. This quickly-developed low-cost system could easily be placed in a small van and used in a parking lot or directed at buildings that the van was driven past. It is highly likely that this type of device would be a very effective terrorist system and the findings of its design could be factored into another either a larger, higher powered device, or a more advanced design each with significantly greater effectiveness. The net result of all of this design, experimentation, fabrication and measurement proves that such a weapon system could be made by anyone with an engineering degree or even a bright technician with good hardware experience. The technical information required can be found in open sources, if not just from good common engineering sense. The materials needed are nothing special and if the effort is made, advanced concepts can be made using everyday hardware such as automotive ignition systems. The testing to date has been very limited but the results of this testing have provided considerable insight to just what is vulnerable in infrastructure systems. This insight and work leads to a firm opinion that a terrorist would have little trouble developing such technology and that he would have a high probability of success in the use as an RF weapon against our infrastructure elements found in any city or near facilities around the country. This work has been done within the proper security guidelines since: 1.The models made in my home laboratory/workshop used off-the-shelf materials and open-source references. 2.The laboratory tests of this hardware were made in a controlled environment with the proper security in place. 3.The results of these tests, the data capabilities, and the target set identities are kept in a facility cleared for classified storage. 4.The development of any of this hardware is reported on a regular basis to those with whom I relate at a classified level to assure that they are informed of the work and are able to apply this to their interests and efforts if necessary. Any of this hardware can be used by them for any determination of utility to military interests. Work in this area will be continued and an aggressive test and evaluation of these "back yard" techniques and methods will be accomplished. This process will be done in cooperation, and if requested, under the direction of agencies with an interest in this non-military weapon related process. The author of this report will, if requested, provide to the Committee further details at a classified level in the proper security environment. ----- Full hearing testimony: http://jya.com/rfw-jec.htm

1 0

Re: Crypto Exposure
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:05 AM 3/13/96 UTC, an534774(a)anon.penet.fi wrote: >A few questions concerning the access to crypto >software from foreigners living in the US: > >- Suppose that an ISP (or a University) provides an account to >a foreigner (i.e. the foreigner can access a few UNIX machines >that are property of the ISP). Suppose now that PGP (for >example) is installed on these machines, then the ISP expose >the foreigner to crypto software, right? Is the ISP (or >University) punishable by law? There isn't a good answer to this, but it's probably a bad idea for any US-based school or ISP that permits foreigners to access its files to provide crypto capability, unless it limits it to Yankees (e.g. though Unix group permissions.) It's certainly a bad idea for any _small_ organization, or organization with a small legal budget, to do so. >- Which version of PGP is the foreigner allowed to use in the >US? He would violate export restriction if he uses the US >version and he would violate the RSA copyrights if he uses >the internation version, right? No - this one there _is_ a good answer to :-) US Law doesn't restrict use of encryption by foreigners located within its borders (except maybe special circumstances like agents of foreign governments; I'll pass on answering that) - only on whether US persons can give them munitions, and of course patents. The clean approach is for the foreigner to bring a copy of the US version of PGP into the US, either on magnetic media or by downloading from ftp.ox.ac.uk or other free-world site. >- What if the foreigner actually write crypto code while in >the US? Does he (or the Uni/ISP) violate export restrictions each >time he access the source code or execute his program if they are >stored on a public (Uni/ISP) machine? The foreigner isn't a US person, so he doesn't violate the law by reading the code himself. If the Uni or ISP knows that it's providing encryption software to the foreigner, it may be liable, but without scienter it's tough to have guilt. Probably the foreigner should not keep encryption software on University or ISP machines - floppy disks should do just fine :-) Encryption material used only for authentication, of course, is just fine, at least unless the foreigner is from a country the US State Department considers to be an enemy, like Cuba. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

2 1

Radio Frequency Warfare Hearing
by John Young 17 Dec '03

17 Dec '03

We offer the lengthy prepared testimony at the Joint Economic Committee hearing February 25 on "Radio Frequency Weapons and Proliferation: Potential Impact on the Economy." http://jya.com/rfw-jec.htm (112K) Or zipped: http://jya.com/rfw-jec.zip (39K) It provides descriptions of the RF weapons, their development, research and testing, global spread, and threat to the infrastructure and national security. The Internet availability of Carlo Kopp's paper on the E-bomb and similar RFW information is cited as evidence of the spread of the threatening technology. The hearing evolved from JEC hearing testimony in June 1997 which described the threat from RFW, especially that developed by the Former Soviet Union: Magnetohydrodynamic Generator Frequency (MHDGF) Explosive Magnetic Generator of Frequency (EMGF) Implosive Magnetic Generator of Frequency (IMGF) Cylindrical Shock Wave Source (CSWS) Spherical Shock Wave Source (SSWS) Ferromagnetic Generator of Frequency (FMGF) Superconductive Former of Magnetic Field Shock Wave (SFMFSW) Piezoelectric Generator of Frequency (PEGF) Superconducting Ring Burst Generator (SCRBG)

3 2

Re: How's that again?
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:52 PM 3/12/96 -0800, Sandy Sandfort wrote: >Jim and interested C'punks, > >In response to a Jim Bell post I wrote: > >> >Hey, Jim, don't forget me. You are the only person I have ever >> >specifically UNinvited to one of my parties in over a decade of >> >hosting same. I guess that makes you special. > >To which Jim replied: > >> You're confused. You're describe YOUR reaction to ME, not MY reaction to >> YOU. And I am unaware of being invited to a "party," and now that I've >> discovered what a sleazy person Alan Olsen and his merry band are, it is >> really doubtful that I would have enjoyed what was advertised as a >> cypherpunks meeting, but which you now claim was a "party." Your level of >> "honesty" is showing. > >A) It is you who is confused (see below) > >B) I'm not Alan Olsen (nor a member of his merry band, so I have > no idea what you are talking about. Wrong area of the country. My branch of the Illuminati only controls the area around portland. >C) There was a Cypherpunk meeting followed by a party. The > pictures are on the Web. A party which I missed. (It looked like ALOT of fun!) >D) It is your level of honesty that is showing. As can be seen > from the two messages (below) I sent you at the time. They > quote you in pertinent part. [quoted text removed for space] I found out along time ago that Jim only sees what Jim *WANTS* to see. This whole tantrum of his is because I challenged his views on the list and happened to mention a "cunning plan" on his. Jim demanded an apology for treating him differently than what he wanted to be treated. (He felt that I owed him some sort of "respect", something I lost for him when I met him in person.) He never once wanted to deal with it in a civil manner. Instead he wanted to vent in public and get some sort of emotional satisfaction. (Something I would guess he does not recieve in real life.) Since that time, he has taken every opertunity to slander me on this list. (And, for the most part, I ignore him.) I have found that the best way to counter any idea that Jim has is to just let him go on about it. His lack of tact, his refusal to deal with any argument against his closely held convictions, his habit of ad hominem attacks with little or no information, and his general loonieness make any ideas he may have easlly discardable as being from a certified crank. (And he does an even better job at it in person!) I do find it quite humerous that he feels that I somehow have control over those who think he is a twit. It shows just how disconnected he is from anything resembling reality. (Maybe he should spend more time on alt.conspiracy. He might find a few people who will humor him.) If I had such unwavering control over then, more of them would post on the national list! Well, I have better things to do than rant about Mr. Bell's more pavlovian responses and you have better things to do than reading them... Back to more productive things. | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: steganographic trick
by tj_lists＠prado.com 17 Dec '03

17 Dec '03

** Reply to note from Alan Horowitz <alanh(a)larry.infi.net> 03/09/96 7:13pm -0500 > Vladimir, > > Imagine you're an FBI agent or something like that. You've been assigned > to investigate some guy, to include sniffing out any data he may have > stored in encrypted format to keep private. > > You de-crypt the data from some elaborate stego scheme, and find - a > recipe for chocolate cookies. > > The federal agents I know, are clever enough to say to themselves: > "what's wrong with this picture?" Really? I'm sure some of them are, but I remember reading in G. Gordon Liddy's "Will" that FBI Agents were assigned to check up on novelist Nelson Algren ("Man With the Golden Arm") who was living with Simone de Beauvoir at the time. Seeing both names on the mailbox of the residence, the agents filled in the surveillance form with Subject: Nelson Algren, alias Simone de Beauvoir. cc: Alan Horowitz <alanh(a)larry.infi.net>

1 0

Ecash press release
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Comments: Authenticated sender is <paul(a)digicash.com> From: "Paul Dinnissen" <paul(a)digicash.com> Organization: DigiCash bv To: ecash(a)digicash.com Date: Wed, 13 Mar 1996 11:24:54 +1 Subject: Ecash press release Reply-to: paul(a)digicash.com Priority: normal Sender: owner-ecash(a)digicash.com Precedence: bulk Release date: Contact EUnet Amsterdam: Wednesday, March 13, 1996 Mr. Graham Wilson Amsterdam, The Netherlands Tel: +31 20 623 3803 Fax: +31 20 662 4657 Contact DigiCash Amsterdam: email: media(a)EU.net Mr. Paul Dinnissen http://www.eu.net/ Tel: +31 20 665 2611 Fax: +31 20 665 1126 Contact Merita Bank Helsinki: email: press(a)digicash.com Mr. Timo Nikinmaa http://www.digicash.com/ Tel: +358 0 1654 2471 =============================================== Europeans Can Now Make Cash Purchases on the Information Superhighway =============================================== First European Electronic Cash System Opens for Business on the Internet Today EUnet, Europe's leading provider of Internet services, and DigiCash, the leading innovator in electronic payment technology, have launched a system that lets consumers make and receive payments over the Internet--using an electronic form of cash. The "ecash" technology gives even very small payments of a few cents the level of security once reserved exclusively for large-value wire transfers, while providing users with the familiar irrefutability, privacy, and person-to-person payment capability of paper money. The system is first being launched in Finland, the country with one of the highest number of Internet connections per person in the world. Merita, Finland's largest bank, already provides over 3,000,000 account holders with access to its Solo payment service. This now allows users to visit a "virtual ATM" on the World Wide Web, and withdraw money directly from their bank account into their ecash "purse". With this money they can make electronic payments to each other as well as to on-line merchants. The merchants already accepting ecash on launch day range from popular magazines and newspapers, to those selling stock quotes and GSM paging through email. Soon, while travelling anywhere in Europe, you will be able to dial a local number and pay for your Internet access, via EUnetTraveller, using ecash. Following a successful launch in Finland, EUnet, working with major banks, intends to roll out the service during 1996, in more of the 41 countries in which it operates. "We are delighted to be the first Internet Service Provider in the world to make the benefits of ecash fully available to Internet users" says Wim Vink, EUnet's Managing Director. "We see the ecash system as a major enabling technology that will make electronic commerce into an effective new way of doing business. Its simplicity and security features mean that users can make purchases electronically with confidence, convenience and privacy." "We are happy to contribute to the development of a variety of secure payment systems on the Internet," says Matti Karvonen, First Vice President of Merita Bank. "Electronic commerce is likely to increase as users are able to choose a payment system that suits them best. Merita has around 200,000 customers who already use terminals for their daily banking. We believe that the number will increase further with the introduction of ecash and Solo payments." "This launch and EUnetTraveller are really exciting new uses of ecash. As transaction costs drop, low-value payments will be catalytic to growth in electronic commerce" says Dr. David Chaum, the inventor of electronic cash and Managing Director of DigiCash. "This will let the unique advantages of ecash shine through: protecting the interest of society better than paper money, while helping people protect their own interests and enjoy the privacy and freedom they are accustomed to with cash." * * * (DigiCash and ecash are registered trademarks and should always be referred to as such) -- end -- DigiCash Background ------------------- Since beginning operation in April 1990, DigiCash's mission and primary activity has been to develop and license competitive payment techniques that show the true capability of technology to protect the interests of all participants. Dr. David Chaum, Managing Director of DigiCash, received his Ph.D. in Computer Science from the University of California at Berkeley, then taught at New York University Graduate School of Business Administration and at the University of California, and headed the Cryptography Group at CWI, the Dutch nationally-funded centre for research in mathematics and computer science, before taking his current position. He has published over 45 original technical articles on cryptography and also founded the International Association for Cryptologic Research. EUnet Background ---------------- EUnet is Europe's leading commercial Internet Service Provider, offering the full range of Internet Services, serving over 100,000 customers and over 750,000 users in 41 countries. EUnet, which manages its own dedicated network infrastructure, offers full local support services in each country of operation. Outside Europe, EUnet has developed an expanding network of national and regional service providers, with the aim of continually extending the services it offers to customers world-wide. Merita Bank Background ---------------------- Merita Bank Ltd was formed in June 1995 from the merger of the largest commercial banks in Finland, Union Bank of Finland Ltd and Kansaills-Osake-Pankki. In Finland, Merita provides a full range of finance, payment and asset-management services for households, companies and institutions. The retail bank serves some 3,000,000 personal customers and over 100,000 small and medium-sized businesses. At the end of September 1995, the total consolidated assets of the Merita Group stood at FIM 283 billion. Merita Bank's market share of total Finnish markka lending was 43.5 per cent, and its market share of total Finnish markka deposits was 43.3 per cent. The number of employees was 16,870. Companies That Welcome Ecash in Finland --------------------------------------- City Magazine -- City Magazine is the most popular magazine among Finland's 18-35 year-olds. With interviews, fashion, the latest trends, current affairs and local events, City's nationwide circulation is 225,000. Over the last eighteen months, City Magazine's online service, `Surf City', has grown to a consistent 30,000 hits per month. Now, when placing a classified ad in either the paper or the online magazine, customers will be welcome to pay with ecash SOM -- SOM, the Finnish Securities and Derivatives Exchange and Clearing House, established in 1987, serves as a neutral integrated securities and derivatives exchange and clearing house. SOM offers real-time financial market information on stocks, options and futures via the Internet, with invoices payable in ecash. Somtel for Windows -the application that offers real-time feed, as well as simulation and position-analysis functions-, is already available via leased line. "The use of money makes stock trading less complicated, with money acting as a practical intermediary between the transactions." states Asko Schrey, President of SOM. "However, since stock trades, as well as the shares themselves, are electronic nowadays, this conventional transmission of money has actually become a bottleneck and a threat to the development of the financial world. Therefore, SOM actively participates in projects to promote and improve the efficiency of payment traffic. We believe that electronic money will offer interesting new possibilities." Yomi Media -- Yomi Media Ltd., a part of KSP Phone Companies Group, offers solutions in the field of digital media, information networks and multimedia. Yomi Media has opened a virtual shop which sells phone accessories and other telecommunication-related products via the Internet. And they are pleased to accept ecash. Yomi Media will provide ecash transaction services for other companies in the near future. Finnish Keltainen Porssi -- Finland's third best-selling paper, Keltainen Porssi now accepts ecash payments. "Keltainen Porssi's business has two features that make ecash the perfect means of payment to us" explains Ari Ahola, CEO of Infosto Group. "Firstly the large number of transactions (some 500,000 weekly readers for the printed media) and secondly the low cost of each transaction. The large number of small transactions is most easily managed using DigiCash's ecash." Ahola concluded "Keltainen Porssi features some 80,000 classified ads per week in two printed issues. The advantages of Dynamic Database Publishing are very attractive in our type of media: The ability to crosscheck and analyse data, enter and browse the ads in real time are just a few of the new features which will be introduced in our Internet edition." added Ahola. MTV3 Internet -- MTV3 Finland is a nationwide commercial TV channel which, with 43% share of the audience, is by far the most popular TV channel in Finland. Since the autumn the MTV3 Web service (http://www.mtv3.fi/) has been developing a media that combines news and entertainment with the possibility to include advertising. With ecash it is now possible to do real-time shopping at the MTV3 Marketplace. MicroMedia -- MicroMedia is a private Finnish direct marketing service house specialized in business-to-business marketing. The Address File lists 300,000 Finnish decision makers at 135,000 offices. How does ecash work? -------------------- Using ecash is like using a virtual ATM (Automatic Teller Machine). When connecting to it over the Internet, you must first authenticate your ownership of the account, and then request the amount of ecash you want to withdraw. But instead of putting paper cash in your wallet, your software stores the digital cash it receives on the hard disk of your PC. When you want to make a payment, you simply confirm the amount and the payee (you can add a description of the items bought, or services wanted, if it is helpful) and then your ecash software transfers coins of the correct value from your PC direct to the payee. Merchants, (ranging from casual participants in the global Internet bazaar to mega-retailers), can deposit the digital coins they receive into their ecash accounts. Behind the user interface, your computer actually creates some 'serial' numbers for the electronic coins based on a random seed. Then it hides them in special encryption envelopes, sends them to the electronic bank for signature and, when they are returned, removes the envelopes while retaining the bank's validating digital signature on the 'serial' numbers. This way, when the bank (eventually) receives the coins you spend, it cannot recognize them as coming from any particular withdrawal because they were hidden from the bank by the envelopes during the withdrawal process. Therefore the bank cannot know when or where you used a shop, or what you bought. The number of each signed coin is unique, allowing the bank to be sure that it never accepts the same coin twice. In case you wish to identify the recipient of any of your payments, you may subsequently decide to reveal the unique coin number and use your ecash software to prove that you created it. How safe is ecash? ------------------ Security is fundamental to electronic cash. The cryptographic coding that protects every 5 cent ecash payment is the same as that routinely relied upon for authenticating requests to move huge sums between banks and even for national security. But in principle ecash goes beyond such communications security to achieve true multiparty security: no one (buyer, seller, bank) can cheat anyone else, no matter how they might modify their own software. Even if two parties collude, they cannot cheat the third. Replacing paper and coins with ecash would make life much harder for criminals. Because the payer's computer chooses the serial numbers of the coins, he or she can later irrefutably identify blackmarketeers, extortionists, and acceptors of bribes--were they to accept ecash. Paper notes, briefcases full of which can be passed from hand to hand without leaving any record, allow money laundering and tax evasion today. With ecash, however, all the amounts each person receives are known to their bank. Significant criminal activity could thus be thwarted by completely replacing paper money; moreover, the privacy of ecash would be essential to widespread acceptance of any electronic payment system. For more information on ecash please contact DigiCash. info(a)digicash.com, http://www.digicash.com/, fax: +31 20 6651126 +-----------------------------------------------------+ Join the new ecash mailing-list! Mail to ecash-request(a)digicash.com and type 'help' or 'subscribe' in the first line of your message +-----------------------------------------------------+ // Paul Dinnissen, DigiCash bv, http://www.digicash.com/ // Experience is what you get, when you don't get what you want --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Beat Remote Monitor Snooping?
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

I know that monitors emit RF signals that can be detected and decoded for a considerable distance. I have a question about this. Obviously, the difference between black and white (white text on black background, or vice versa) would be the most detectable, because the difference in signal levels would be the greatest. Would it be possible to reduce or prevent this kind of snooping by using color schemes that all use the same signal levels? For example, the color purple uses the red and blue color guns, and yellow uses the red and green color guns. Would purple text on a yellow background be able to be read by a remote snooper? If not, then perhaps these color schemes could be used to echo pass phrases--assuming the user isn't worried about someone looking over their shoulder. Any comments? Jonathan Wienke

5 4

Re: [PGP] Passphrase security
by Secret Squirrel 17 Dec '03

17 Dec '03

Dolt Vulis K[ancer] Of The Moment has been fired for stealing office supplies. ,/ \, ((__,-"""-,__)) `--)~ ~(--` .-'( )`-, Dolt Vulis K[ancer] Of The Moment `~~`d\ /b`~~` | | (6___6) `---`

1 0