- cypherpunks-legacy - lists.cpunks.org

Re: Insecurity of public key crypto #1 (reply to Mandl)
by lefty＠apple.com 17 Dec '03

17 Dec '03

Eric Johnson writes: > > I was suggesting just the opposite. It obviously isn't a security > issue. I believe it is more of a first principles issue; "Thou > shall encrypt thy communications, lest thou draw attention to thy > self, and the right be removed by thine opponents." Am I missing something, or is this equivalent to saying that the way to oppose gun control is by brandishing a gun as much as possible? -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Peace initiative
by Scott Beaudreau 17 Dec '03

17 Dec '03

Hello cypherpunks, Please consider my suggestions. Send flames via anonymous remail to /dev/null. I would like to see the following discussions end: 1. Attacks on Dr. Denning. (She is only an opponent, not Damien Thorn.) 2. Defense of Dr. Denning. (More important topics exist.) 3. Attacks of Ross Perot or his supporters. 4. Attacks on each other. I am more interested in these topics: 1. Corporations, money, and IRS. Sandy and others. 2. Rating systems. 3. Phone and fax security. 4. Clipper chip news. 5. Security software news. PGP Tools, etc. These ideas are simply my opinion. There is too much talent on this group to throw at flames. Casually yours, Scott Beaudreau

1 0

Re: Insecurity of public key crypto #1 (reply to Mandl)
by Eric Johnson 17 Dec '03

17 Dec '03

: Eric Johnson writes: : > : > I was suggesting just the opposite. It obviously isn't a security : > issue. I believe it is more of a first principles issue; "Thou : > shall encrypt thy communications, lest thou draw attention to thy : > self, and the right be removed by thine opponents." : : Am I missing something, or is this equivalent to saying that the way to : oppose gun control is by brandishing a gun as much as possible? : : -- : Lefty (lefty(a)apple.com) : C:.M:.C:., D:.O:.D:. If you replace the word "brandishing" with "carrying", I find nothing disagreeable about your sentence. RKBA and all that. ^ --Eric

1 0

Standard for Stenography?
by Gary Jeffers 17 Dec '03

17 Dec '03

Firstly, congratulations for Sergey Goldgaber's stubborn pushing of this topic, for Bill Stewart's observation: "simple stego-programs, stealthy encryption programs", & for Norman Hardy's notice of the possibility of non-randomness in the low order bits of pixels. Here are my proposed standards & suggestions for stenography. 1. The stenography module is just a simple program for inserting data into a picture. The data is not plaintext! Ideally, stealth pgp is the encryption method. There should be no clever variable positional stenography. No security through obscurity. No "TOWERS of BABBLE". It must be standardized for easy conversation. I agree with Bill Stewart on this: simple stego programs, stealthy encryption programs. 2. The 1st position of the stenography is defined as the 1st pixel transmitted or received. The 1st several pixels should make up the header. The header should be of a fixed size with fixed sized & positioned fields. The header follows: 1____6 7_________17 18>>>>>>> checksum; "STENOGRAPHY"; the encrypted text The numbers refer to pixels. One bit of encrypted data per pixel. The 1st field is a checksum particular to that RSA key. The 2nd field consists of the word "STENOGRAPHY" in caps. The remainder is devoted to the encrypted msg. itself. The checksum is a standardized checksum method that has the same checksum as the RSA key. You need this in case you have given out several public keys. The checksum may also be an integral multiple of the RSA key. The reason for the checksum is in case the recipient has multiple keys, this will help him select the correct one without using huge numbers of cycles. Only 6 bits are used since that would be all that would be necessary & to eliminate the possibility of a huge number that would be large enough to constitute a legal proof. Also, by using a small number, investigators are not given much of a clue. By allowing integral multiples, you allow a fairly large number of keys but also stop small numbers from popping up a lot - no statistical suspensions! The reason for the "STENOGRAPHY" field is to assist your computer in determining if this is a stenography file & that the correct key was chosen without attempting to decrypt the whole file. I know that this presents the possibility of a small "known plaintext attack", but a good encryption system should stand up to such an attack. RSA can ... can't it? 3. No "lossy" picture methods! Two methods immediately suggest them -selves: JPEG & GIF. JPEG is ordinarily a lossy method but I am told that it has a no loss option. GIF is not a lossy method. I hear that JPEG has the ability to carry more bits per pixel than GIF so I would suppose JPEG. Also, while earlier I suggested 1 bit of encrypt per pixel it may be cool to use more. 4. Norman Hardy has suggested something that I have wondered about: are low order bits of pixels really randomly distributed? You graphic/ statistic ace's out there need to check this out & inform us. Possibly, some methods do & some don't? Inquiring cypherpunks need to know! I don't know too much about graphics, so I could use a lot of help. 5. What are the best pictures to use? I would suggest soft focus pin- up girls, mountain ranges, clouds, fields of grain, dense vegetation. Would soft focus help in all these types? note: I think kiddie-porn would be a bad idea. The above suggestions support the stealth method- strong encryption- simple stenography- public key- standardized model. If I have missed anything or you have a better idea, please let us know. Yours Truly, Gary Jeffers

2 1

PC Expo, Mac World, Comdex, etc...
by rarachel＠prism.poly.edu 17 Dec '03

17 Dec '03

If a few of us who have a bit of money to spend on disks and duplication could come together (or work apart) we could just go out infront of PC Expo, or any other expo and simply hand out free disks with stuff like PGP, SecureDrive and whatever else, maybe even include a flyer with info about getting more info on issues like clipper and such... Perhaps some sort of self running hypertext demo to show analogies, say via a caricature of Dorothy Denning or Billary Clingon trying to install bugs in the phones of the viewers, cameras in cable TV boxes, microphones in bathrooms etc, all bearing the word "Clipper" on them... :-) (The distribution method isn't my idea, a dude who runs or works for an internet mail/news only carrier approached me and gave me a flyer...) "Get your free PGP disks here, learn about how Uncle Sam is spying on your privacy, etc..." :-) Now for some rude awakenings to follow... are there any laws against handing out >FREE< disks to people exiting or entering a convention center? (hopefully not too many.) Putting up an informercial will reach a lot of people who couldn't care less. Putting this stuff in the hands of those who have the interests of big business will reach a wider bit of the people we need to reach.

1 0

What's Wrong with the List--Part 2
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

While I'm on a rant about what's wrong with the way the list is going, let me mention another serious problem: * People who want others to "do more." It seems that every few months someone starts loudly whining that others are not doing enough. This is very grating. For example, Detweiler started down his path to neurosis by begging and pleading for folks on the list to do more to help fulfill his vision of a "whisteblowing" group (note that others had discussed this idea, too, so Detweiler cannot claim all the credit). His pleas were eventually answered by Miron Cuperman, who went ahead and newgrouped "alt.whistleblowing" or similar. This is, by the way, now an essentially zero traffic group. More recently, "Xenon" got it into his head that the most important project in the universe was "Stealth PGP." Again, a good idea (and one that Phil Zimmermann, Kelly Goen, and others were calling by that exact same name more than a year ago). But Xenon figured that if he excoriated us enough for not immediately implementing his vision, we'd eventually work on it. He flamed out after a brief stint on the list and says he is now unsubscribed. (Which is too bad, as he had some good ideas. His problem is that he got _too excited_ about some particular ideas. Yes, getting "too excited" can be a problem: when one exhorts others to do the work one cannot or will not do oneself. In other words, badgering, lecturing, and moralizing. Xenon apparently came to see the lack of a rush to his flavor of steganography as some sort of failure of will by the Cypherpunks, and unsubscribed.) These are the dangers. Whenever I feel the urge to exhort others to work harder and longer at some task, I think about this situation. (I have no problem with political rants, exhorting folks to adopt my point of view on something. But I avoid--I hope--asking others to do work that I am unwilling or unable to do. It just isn't right. If one wants others to do something concrete, a less "bossy" approach is called for, and one should be prepared to give something in return.) Closely related to this issue is the habit some have of talking about what "we" have decided "our" goals are and how these goals of "ours" should be fulfilled. (As a sidenote, L. Detweiler kept asking what the "Cypherpunks goals" were and what the "leaders" expected to be done. When many folks told him in no uncertain terms just what kind of anarchy the List is, poor Detweiler just couldn't handle it. I think "control freaks" like Detweiler want plans, want others in harness to fulfill these plans, and want to boss others around.) I'll stop with the rants for now. Take my comments any way you like, but I hope they are taken in the spirit in which they are given--as honest observations of some of the problmes affecting a list with nearly 800 subscribers. Cheers! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

HUMOR: Sternlight on the CPSR Clipper Petition
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Cypherpunks, And now for some humor amidst my rants. This is a post I did that makes light of David Sternlight's bizarre assertion that the anti-Clipper petition of the CPSR contains few valid signatures because he, David Sternlight, asked those who signed the petition to send him e-mail....and he only got 35 responses! QED, the CPSR either faked the signatures or others forged messages. (Sternlight even cites "cypherpunks" as likely culprits, noting that they are skilled at creating phantom identities....I guess Detweiler was listened to by at least one kindred soul.) The methodological flaws in Sternlight's line of reasoning are too obvious to go into here, and Sternlight has sunk to a new low in terms of respect. His claims that he was recently a senior government policy advisor give me new insights into why the government is as screwed up as it is. Finally, I've avoided flaming Sterno in public, and I had some qualms about kicking him while he's so much of a fool over this issue, but my satirical urges got the best of me. Here it is: Newsgroups: comp.org.eff.talk,alt.privacy.clipper,alt.security.pgp,talk.politics.crypto,alt.security.ripem,alt.fan.david-sternlight From: tcmay(a)netcom.com (Timothy C. May) Subject: Re: CPSR Clipper Petition test results Message-ID: <tcmayCM320o.6I0(a)netcom.com> Date: Thu, 3 Mar 1994 09:50:47 GMT Matt Austern (matt(a)physics2.berkeley.edu) wrote: : The US government claims that over 100 million people voted in the : 1992 Presidential election. Fewer than 50 people, however, personally : told me that they voted in that election. : It won't play, fellas. 50 people out of 100 million? Clearly, this : supposed "election" didn't really happen. This effect is far more widespread than you suspect. Several days ago I posted a request in rec.skate for people to send me e-mail if in fact they watched the Olympics--any or all of it. While the pundits at CPSR (Central Polling for Sports Research) would have us belief that _more than_ 100 million Americans (which is "many" but not "most") watched some or all of the Olympics, I received a paltry 3 responses, and one of these was a string of moronic insults, so I really only count 2 valid response. Could 100 million Americans have watched the Olympics if I only received 2 valid responses to my poll? My many years advising the government in senior policy postions, and my Ph.D in statistics tells me "Not on your life." Applying the Black-Scholes significance test (with a quartile scatter factor normalized to the Kolmogorov constant), I have concluded that the actual number of Olympics watchers was 135 plus or minus 7.32. I thus conclude that CBS, the Olympic Committee, the Tonya Harding Kneecapping Club, and the ever-treacherous CPSR are all lying to us! I will, however, not discuss this matter any further! (At least not until I do.) --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Standard for Stenography?
by tim werner 17 Dec '03

17 Dec '03

>Date: Wed, 02 Mar 94 22:32:39 PST >From: Jef Poskanzer <jef(a)ee.lbl.gov> > > In a physical meeting, the talkers would >notice the annoyed looks on the faces of everyone else; Don't forget the pleased looks on the faces of people who are glad to see that Jef P is working on stego. :-)

1 0

Hands On Action
by Greg - Kucharo 17 Dec '03

17 Dec '03

> Thanks for your posts Tim.They really got me motivated.Indvidual action gave > us the rights we now enjoy and are threatned.Invidual action will save them > from extinction.When George Washington got fed up with the British slagging > on his rights he didn't sit around a Mt.Vernon getting stoned with Martha > and saying how nice it would be if those lackeys down in Boston would kick > the Redcoats out.He got his musket,saddled his horse and marched his army to > get them out himself,and make way for The Constitution.I don't have a musket > or a horse,but I do have a computer,knowledge of programming and a Computer > Club.It took awhile,but the DeAnza Computer Club is now educated in PGP and > we now turn to our fellow students.As young Americans we arent as used to > being jerked around by our government,and we don't intend to start getting > used to it.I will probably spend a great deal of my adult life on the network > I'll need my rights in there just as much as outside. > Since I have educated my fellow club members and forwarded List posts to them > we are going to start writing crypto programs for use here on campus and on > our club machine.If everyone takes up Crypto arms,we can drive out the Redcoats > and make George proud.

1 0

DC 'punks meeting
by Pat Farrell 17 Dec '03

17 Dec '03

I'm willing to try to russle up a suitable place for a physical meeting in the DC area in parallel with next Sat's politically oriented left coast meeting. But the number of folks attending will change where I can hold it. If you are interested in attending a DC-area meeting next Saturday, 3PM EST until 5 or so, please send me email. Thanks Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0