- cypherpunks-legacy - lists.cpunks.org

Seeking Position
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Long time cypherpunk reader seeks position. Class of 1996/J.D.: Top 10 U.S. Law School. B.A. International Affairs: Top 25 U.S. University. Highly proficent in modern fieldcraft, intelligence operations and communications security. Will sit for bar exam of employer's choice. Expert pistol, advanced tactical carbine, master level tactical driving abilities. Significant previous international clandestine fieldwork experience in developing and Eastern European countries pursuant to political risk analysis projects. Extensive legal expertise in white collar criminal investigation, national security law, bankrupcy, U.S. taxation of international and expatriot income, corporate governence, antitrust, 10(b), 10b-5 and misappropriation insider trading issues. Ideal canidate for high level position in emerging or existing security/economic/political risk analysis department of international firm, field agent for political risk consultant or to address the discrete needs of private client. Most rigorous international travel regime welcome. Serious inquiries only. TLA's need not apply. No wet work. Illegal proposals will be ignored. Borderline proposals considered with interest. Submit position description along with firm/client CV to: an436533(a)anon.penet.fi -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCPAzE3Z7oAAAEEAMClYX8ZIZ/3iwlH96s/JssxRPdmoh6fQcpBLFL8kLkthgkr bXo+Hh/gAKYmYYgDgT/SKfbpAE7qIMg+Ra8WvpMoBuhKNcCt7D7aruxGvId+l7nq KFfSLy6lVviQyVSPjCNxnCvbACIpEtXC1NnyxlShE+l6RvuVA/HuoJlH4LbVABEB AAG0FmFuNDM2NTMzQGFub24ucGVuZXQuZmk= =D7tQ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Certificate validity issues
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

some hairboy ;) writes: > I don't see any that there could be any sort of automatic way to > distinguish between the necessity for recipient-signed vs. > recipient-unsigned certificates; One would assume that recipient-unsigned > certificates would be effective only when issued from a high-reputation > source. > > Some method should be required to allow user decisions as to this, but > whatever system is designed should definitely allow for both types, and > *require* relevant software to handle both types. I think this is a policy issue, not a technology issue. In general, key owners should be able to sign certificates that say arbitrary things, regardless of whether or not some third party agrees that the statement being signed is "true". Unless you believe in libel, slander, etc., which raises policy issues of a different sort entirely. The John Birch Society can sign something claiming that I'm a member. A policy that says that's sufficient information to conclude that I *am* a John Bircher is a broken policy. A policy that requires both the above and a signature by me on the same certificate, among other things, is viable. > There's actually a third sort of important certificate the system should > handle: > > (3) I might be a member of a secret society; I might need a membership > certificate to get access, say, to certain web sites. The system > should allow a "secret certificate," readable only by the issuer. Your description is a bit ambiguous. Do you really mean "readable", or do you mean "verifiable" ? If the former, it sounds like this could be handled by distributing signed certificates encrypted with the issuer's public key. If the latter, you could distribute signed certificates but not the public key needed to verify the signatures on the certs. It might be handy to use a hybrid approach, such as distributing signed certificates that refer to encrypted entity names (suitably padded with random bytes to avert trial encryption of plaintext guesses). -Lewis "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" (Joni Mitchell, 1972)

1 0

Re: PARTY PICTURES!
by stevenw＠best.com 17 Dec '03

17 Dec '03

>> http://www.c2.org/party/masquerade/ > >OK, nice pictures of some interesting-looking people. >But the only globally known participant featured is >Eric Hughes; he is also the only one presented with >a second name. For the others, it would be nice if >you wrote clarifying texts, including crypto-anarchic >relevance, in the way of: [sniperoo] > >Asgaard Maybe it wasn't made clear that all the pictures have been postprocessed with an experimental version of PGP* to optically anonymize them, thus protecting the identies of both the innocent and the guilty without bias. Software problems triggered by Eric's neckware prevented the anonymizing process from working properly in his case. Sources tell me that PRZ himself was in many of the pictures, very nicely rendered as a classic marble and rought-iron fireplace. Steve * PGP = Pretty Groovy Party ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

2 1

Re: Cryptoanalysis
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>(I am amazed how little exists on the web on the topic.) I had seen a >few of the books at a local bookstore, but I was uncertain of their quality. >(They also had a number of snake-oil crypto books.) Well, as soon as people can charge a cyber-dime/quarter/or buck to read/ download you will see a change. Most authors make little (like $1.00/copy) from book sales so if made cheap enough so that is easier to download than pirate you will see a big change. >The author has failed to call me back. I do have some serious concerns >about the code. (There is not a single XOR used, except to clear >registers!) Why bother (kind like reinventing ASCII), we have good, proven crypto algorithms, some even in public domain. Is easy to code. Hard part is making it fast and easy & available anywhere (what I like about the PGP enclyptor). Another hard part is good key management. Like computer viruses in which there is nothing interesting about the propagation (what makes a virus a virus), the crypto part is a done deal, have had good stuff for years. > I am starting to suspect that it is based on a mathematical >progression based on the numbers 40, 28, 36. Ah yes, being hearing impaired I always wanted a watch that would poke. My 1968 Seiko "Bellmatic" is close - ringing the bell makes it vibrate. >I am trying to convince him of the futility of the task. (It is hard as his >ego keeps getting in the way.) I just want to give him reasons why it is >weak and not just glittering generalities. Not futile, just already done. Should concentrate on things that are "impossible" 8*). Warmly, Padgett

1 0

Re: Web of Trust vs other models
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:48 AM 3/1/96 -0500, you wrote: >There are a pool of 1 million keys. Each of those keys is signed by between > two and 5 other randomly chosen keys in the pool. > Each signature implies a trust relation between the key and the signer. >Given that, determine mean, min, and max path lengths for purposes of > "certification". >Has anyone done this experiment? Probably been done, though not necessarily in a PGP context. The problem is equivalent to analyzing a randomly selected directed graph, and some Operations Research or CS grad student has probably done it. Meanwhile, Don Kitchen at one point collected all the data off the MIT keyserver for analysis, which is a much different problem than random signatures. I found that the chain from some middle point, such as Phil Zimmermann's or Derek Atkins's key was about 12-14 levels deep, averaging about 6, which compares interestingly with the default PGP depth limit of4. From my key, it was pretty deep, especially since my certification from Phil Karn was from one of his older keys, which is why I asked Derek to sign my key... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

New PRNG method!
by Olcay Cirit 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello, All! I was just thinking about how to generate random numbers, when I hit upon an interesting idea: If the internet is so huge and complex, why not, say, use the least significant bits of ping times from random internet hosts as seeds for a PRNG? (Practical Random Number Gen.) You could then break the resulting binary value into 128-bit blocks and modulus/xor each with a stream of random numbers taken from a keyboard timing. After all this, you could wash it with a secure symmetric cryptosystem such as idea in CBC mode. Any thoughts, comments? -olcay - -- "For he who lives more lives than one, |) Olcay Cirit -- olcay(a)libtech.com more deaths than one must die" (| http://www.libtech.com/olo2.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTh9pCoZzwIn1bdtAQGuDAGA1QM1KyGQ2i6n9LLF00HrVn7OvBftesA9 +Jsu4W3yZothdL1pFQLt2v5l9mjgTspW =2x/g -----END PGP SIGNATURE-----

3 2

NYT login
by David Lesher 17 Dec '03

17 Dec '03

At one point, some kind souls were entering "username: cypherpunks" logins for all the various "free" www sites. Did anyone catch the www.nytimes.com one? If so, what password? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: Truelly Random Numbers
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Timothy C. May wrote: [..] > Now, is the modulus, n = pq, any more factorable than if a "more > random" source of p and q were used? > > (I am actually asking this as a real question. Does anyone know if > factoring is significantly easier for such not-completely-random > numbers? I would expect that in theory it is, but in practice this is > not a useful point of entry into factoring n. Just a hunch.) > Only if I can have a good enough idea of the non-random method for generating numbers, or if I can find some useful statistical correlations in your numbers. (And then again, what do you mean by "significantly easier"? Knowing 1 bit reduces the work by half, but with orders or thousands of bits, it's not much help.) Whether I can realisitically reproduce or work with that non-random method of key generation is another matter, though. Rob. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTkHYCoZzwIn1bdtAQHdSgGAzgoS4Y1BQuI5hzlsLsfnoKyzVALJD3TR Mm5Dmu/I5N3Rnk9TxNviwLFjKp6Fd35Z =UnWo -----END PGP SIGNATURE-----

1 0

Mainstreaming PGP on Usenet
by Bruce Baugh 17 Dec '03

17 Dec '03

I'm surprised nobody has brought this up before.... FIRST CALL FOR VOTES (of 2) moderated group soc.culture.russian.moderated <snip> 6. Individuals in the database of known readers may post freely to the group, subject to the conditions in sections 1-4 above. If need arises, the robomoderator may perform PGP verification of the identity of the known reader and, if the reader requests so, automatically reject all the submissions from the reader without a valid PGP signature. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

4 8

art-stego
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

The recent discussion "Chaff in the Channel" got me thinking about an alternative to hiding random bit streams in picture files. The goal of steganography, as I see it, is to provide plausible deniability. The problem with hiding bit streams is that you can never be sure if the opponent has developed an analysis technique to prove a particular file contains a suspicious bit pattern. The alternative to hiding bit streams is to not hide them. Use them to generate pretty pictures. For example, modify a fractal image generator to accept a bit stream as input. Use the bit settings to influence the values used to iterate the fractal function. You don't have to use fractals, any function that produces pretty pictures would probably work as long as there was a way to extract the bit stream from the final picture. Brute force would probably work fast enough for humans. One possibility is a screen saver that produces an "infinite" variety of pretty pictures by generating a pseudo-random bit stream and using it to help generate the next background picture. Occasionally, the picture might be so cool you will want to send it your friends or post it on the Net or just keep it around to look at. The goal is to create an innocent reason for passing around unique images that contain random bit streams so we don't have to worry if somebody finds the bit stream. If you live in a country that doesn't outlaw abstract art you have plausible deniability. Jim_Miller(a)suite.com

5 4