- cypherpunks-legacy - lists.cpunks.org

Bug in PGP MPI library
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Someone please prove me wrong, but I think there is a bug in the function mp_modexp_crt (RSA decryption and signing) in PGP23a's MPI library. Attached to this message is a program which demonstrates the bug. While testing Magic Money for lingering bugs, the client gave the error "Coin from server has bad signature!" I tried again with different coins, and the program worked. The proto.dat file had been cleared as the coins were read, so there was no way to repeat the error. I set up a batch file to repeatedly cycle coins between the client and the server, backing up proto.dat each time. After an hour or so, the error happened again, and I started tracing it. There didn't seem to be any bug to find. For this particular coin, the unblinded coin was garbage. For any other coin, the program worked. I wrote this test program, bug.c, to find the error. It uses the same coin, blinding factor, public, and secret key as Magic Money was using when it crashed. The program first blinds the coin, then signs it, then unblinds it, decrypts the RSA signature, and displays the results. If you just run "bug", Here's what happens: >bug e=0001 0015 n=A8DF 1E61 234B E660 800A 4167 40A9 102D FC01 6962 AD6C BE39 2664 92AE E8B4 CE3A 93EB F4BE FFD1 104A DB81 2F95 684E C188 0901 379C 99BC 5E24 7EC2 660B 1463 139F d=4612 D56D AA0A B760 3561 60C6 EE7A 5CE8 A74B D0C9 501E D7B1 C145 D654 3B38 E90A 6FF4 BC13 221E E354 345D B789 38D6 3427 DA7A 48D6 570C 3860 FC86 0B8F AB80 FCE5 p=C737 3481 985A B4B3 4E0F 0ECB 8E58 1B49 74F4 70D4 0B81 CF2C F858 781F D70F 79EB q=D901 B376 D73A 2163 56D8 3B7B EE02 73F8 9A3F E7FD AC56 F4D9 E072 CECF 85B1 CC1D u=825E FE26 ED64 7E91 6256 A8E8 3DC7 C8E5 0E52 46FE 56B0 B3C9 3559 2C03 BFA1 C06B original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D31 blinded coin=797B A351 2280 62DC 1D02 84F8 1812 52E8 152B A421 D7C8 8CD1 E061 776C 138A 9776 E2D6 5764 AF64 4C21 D589 176D 0FD2 F346 7A45 5EB9 7E1F 964A 189C 55BC FD53 0775 signed coin=9994 B5AF A3A5 7B30 9058 5D76 C531 3EF2 81F6 B973 3805 2673 C8D3 C4A8 051A 4979 7882 F598 BB66 57C8 8104 76BB 06D7 F85D 4AA1 AEF3 18EC A105 C8B2 64D4 96ED 6BE4 final coin=2EF9 8656 2799 3071 692A D693 3EF3 AF4D D296 B6AE E3A3 A283 94B1 242E 43BD 9042 086A CCED 5A0A A4F4 F4A9 C1FE B3D0 5C22 BF60 D14D 717F C188 4701 57E5 C9E1 5A77 Notice that the final coin is gibberish. By running "bug b" it increments the blinding factor by one, then performs the same calculation. >bug b original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D32 blinded coin=7010 DE32 C491 A343 F041 2779 BA9B BEF3 C394 3DAE 2B48 8110 2260 7D18 876A 820F AFB1 9913 6E77 4D95 185E 17F7 2496 7137 8212 5509 B641 D3BD F67A 685A 0A20 8B9B signed coin=2879 A082 C7DE 2BFC C39D 8E21 F245 17B7 96DC 2458 A201 4756 DA93 8D09 23F2 7741 964C 1984 5A15 AC6F 4AD7 50AB CE98 5E12 CDC6 C1F8 5F14 8699 3FB7 036F B439 F39A final coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 The final coin is now correct. By running "bug c" the coin itself is incremented by one, but the blinding factor is not incremented. >bug c original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C81 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D31 blinded coin=5F91 E5B7 95F7 C37B 5CE6 F0A3 A7CC A51B 7C0E ED85 2E2D CE1F F8E8 75B0 1559 7945 0CA5 BE69 AD2E A75E 5F4E 1D8E 0704 DA3B 8957 D63C E195 1078 5E75 0F31 7E7C DA68 signed coin=4A0B EA0E C336 DE7E 3BC6 0448 9B4B 6185 9964 91BD 3A5E E424 520D 2AEF BF9A 7FBA 382C 136C 0FA4 9D58 A237 8160 C00C EE76 5817 D39E 92B6 BD6F 05DD 91CE 4C97 CB85 final coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C81 Again, the final coin is correct. By running "bug r" everything happens as though you just ran "bug". Neither the blinding factor or coin is incremented. But, the program uses the slower mp_modexp instead of mp_modexp_crt to perform the signature. >bug r original coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 blinding fact=005B 52D8 BA8D 6AE9 4652 8C2D 5CBB 4BEB D0C7 80C9 48BC 797A CDEE BDE0 E53D 4329 9E7A 00B3 8FF1 5BA4 E78B 81C8 C99A 9C16 CFA7 33A3 93D0 A5C0 7604 8F85 87D9 4D31 blinded coin=797B A351 2280 62DC 1D02 84F8 1812 52E8 152B A421 D7C8 8CD1 E061 776C 138A 9776 E2D6 5764 AF64 4C21 D589 176D 0FD2 F346 7A45 5EB9 7E1F 964A 189C 55BC FD53 0775 signed coin=6613 B2B0 75FD 398B 30EE C3FD 6A84 9E7D 39D2 738A 387B 4100 CD3F 0DFD C8A7 1D13 7941 0CA7 BE13 1C5E 1E9F 7174 648F 494E B57B 32BA 585E DC04 45DF C40A 468E 32BC final coin=0001 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF FF00 3020 300C 0608 2A86 4886 F70D 0205 0500 0410 14C1 A83C 1B84 FCAD 472F 6425 3F74 7C80 The final answer is right, and the signed coin is different from the signed coin in the first example. That pins down the error to mp_modexp_crt. Maybe I'm missing something, but it appears there are a few values for which this function just does not work right. If you want to try it, here's the program. Pr0duct Cypher =========================== cut 8< here ================================= /* bug.c Strange bug demo - "bug b" increments blinding factor "bug c" increments coin "bug r" uses regular mp_modexp instead of mp_modexp_crt Compile with mpilib and mpiio, define DEBUG for mpiio */ #include <stdio.h> #include <stdlib.h> #include "usuals.h" #include "mpilib.h" #include "mpiio.h" typedef unit unitarr[MAX_UNIT_PRECISION]; /* Multiplicative inverse - used for finding d */ void mp_inv(unitptr x,unitptr a,unitptr n); char e_string[]="0001,0015h"; char d_string[]="\ 4612,D56D,AA0A,B760,3561,60C6,EE7A,5CE8\ A74B,D0C9,501E,D7B1,C145,D654,3B38,E90A\ 6FF4,BC13,221E,E354,345D,B789,38D6,3427\ DA7A,48D6,570C,3860,FC86,0B8F,AB80,FCE5h"; char n_string[]="\ A8DF,1E61,234B,E660,800A,4167,40A9,102D\ FC01,6962,AD6C,BE39,2664,92AE,E8B4,CE3A\ 93EB,F4BE,FFD1,104A,DB81,2F95,684E,C188\ 0901,379C,99BC,5E24,7EC2,660B,1463,139Fh"; char p_string[]="\ C737,3481,985A,B4B3,4E0F,0ECB,8E58,1B49\ 74F4,70D4,0B81,CF2C,F858,781F,D70F,79EBh"; char q_string[]="\ D901,B376,D73A,2163,56D8,3B7B,EE02,73F8\ 9A3F,E7FD,AC56,F4D9,E072,CECF,85B1,CC1Dh"; char u_string[]="\ 825E,FE26,ED64,7E91,6256,A8E8,3DC7,C8E5\ 0E52,46FE,56B0,B3C9,3559,2C03,BFA1,C06Bh"; char original_coin_string[]="\ 0001,FFFF,FFFF,FFFF,FFFF,FFFF,FFFF,FFFF\ FFFF,FFFF,FFFF,FFFF,FFFF,FFFF,FF00,3020\ 300C,0608,2A86,4886,F70D,0205,0500,0410\ 14C1,A83C,1B84,FCAD,472F,6425,3F74,7C80h"; char blinding_factor_string[]="\ 005B,52D8,BA8D,6AE9,4652,8C2D,5CBB,4BEB\ D0C7,80C9,48BC,797A,CDEE,BDE0,E53D,4329\ 9E7A,00B3,8FF1,5BA4,E78B,81C8,C99A,9C16\ CFA7,33A3,93D0,A5C0,7604,8F85,87D9,4D31h"; main(int argc,char *argv[]) { int rflag; unitarr e; unitarr d; unitarr n; unitarr p; unitarr q; unitarr u; unitarr dp; unitarr dq; unitarr original_coin; unitarr blinding_factor; unitarr temp; unitarr blinded_coin; unitarr signed_coin; unitarr unblinded_coin; unitarr final_coin; set_precision(MAX_UNIT_PRECISION); /* Load all the values */ str2reg(original_coin,original_coin_string); str2reg(blinding_factor,blinding_factor_string); str2reg(e,e_string); str2reg(d,d_string); str2reg(n,n_string); str2reg(p,p_string); str2reg(q,q_string); str2reg(u,u_string); /* Increment variable if condition entered */ if(argc==2) { if(*argv[1]=='b'||*argv[1]=='B') mp_inc(blinding_factor); if(*argv[1]=='c'||*argv[1]=='C') mp_inc(original_coin); if(*argv[1]=='r'||*argv[1]=='r') rflag=TRUE; else rflag=FALSE; } /* Display them to check */ mp_display("e=",e); mp_display("n=",n); mp_display("d=",d); mp_display("p=",p); mp_display("q=",q); mp_display("u=",u); printf("\n"); mp_display("original coin=",original_coin); /* Raise the blinding factor to the power e */ mp_modexp(temp,blinding_factor,e,n); /* Blind the coin */ stage_modulus(n); mp_modmult(blinded_coin,original_coin,temp); printf("\n"); mp_display("blinding fact=",blinding_factor); printf("\n"); mp_display(" blinded coin=",blinded_coin); /* Sign the blinded coin */ if(rflag) mp_modexp(signed_coin,blinded_coin,d,n); else { mp_move(temp,p); mp_dec(temp); mp_mod(dp,d,temp); mp_move(temp,q); mp_dec(temp); mp_mod(dq,d,temp); mp_modexp_crt(signed_coin,blinded_coin,p,q,dp,dq,u); } printf("\n"); mp_display(" signed coin=",signed_coin); /* Invert the blinding factor */ mp_inv(temp,blinding_factor,n); /* Unblind the coin */ stage_modulus(n); mp_modmult(unblinded_coin,signed_coin,temp); /* Decrypt the signed coin */ mp_modexp(final_coin,unblinded_coin,e,n); printf("\n"); mp_display(" final coin=",final_coin); return(0); } #define swap(p,q) { unitptr t; t = p; p = q; q = t; } #define iplus1 ( i==2 ? 0 : i+1 ) /* used by Euclid algorithms */ #define iminus1 ( i==0 ? 2 : i-1 ) /* used by Euclid algorithms */ #ifdef OLD_MPINV void mp_inv(unitptr x,unitptr a,unitptr n) /* Euclid's algorithm extended to compute multiplicative inverse. Computes x such that a*x mod n = 1, where 0<a<n */ { /* The variable u is unnecessary for the algorithm, but is included in comments for mathematical clarity. */ short i; /* unit y[MAX_UNIT_PRECISION], temp[MAX_UNIT_PRECISION]; unit gcopies[3][MAX_UNIT_PRECISION], vcopies[3][MAX_UNIT_PRECISION]; #define g(i) ( &(gcopies[i][0]) ) #define v(i) ( &(vcopies[i][0]) ) Major stack space hog! */ unit *y=safemalloc(sizeof(unit)*MAX_UNIT_PRECISION); unit *temp=safemalloc(sizeof(unit)*MAX_UNIT_PRECISION); unit *gcopies[3]; unit *vcopies[3]; for(i=0;i<3;i++) { gcopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); vcopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); } #define g(i) gcopies[i] #define v(i) vcopies[i] /* unit ucopies[3][MAX_UNIT_PRECISION]; */ /* #define u(i) ( &(ucopies[i][0]) ) */ mp_move(g(0),n); mp_move(g(1),a); /* mp_init(u(0),1); mp_init(u(1),0); */ mp_init(v(0),0); mp_init(v(1),1); i=1; while (testne(g(i),0)) { /* we know that at this point, g(i) = u(i)*n + v(i)*a */ mp_udiv( g(iplus1), y, g(iminus1), g(i) ); mp_mult(temp,y,v(i)); mp_move(v(iplus1),v(iminus1)); mp_sub(v(iplus1),temp); /* mp_mult(temp,y,u(i)); mp_move(u(iplus1),u(iminus1)); mp_sub(u(iplus1),temp); */ i = iplus1; } mp_move(x,v(iminus1)); if (mp_tstminus(x)) mp_add(x,n); mp_burn(g(iminus1)); /* burn the evidence on the stack...*/ mp_burn(g(iplus1)); mp_burn(v(0)); mp_burn(v(1)); mp_burn(v(2)); mp_burn(y); mp_burn(temp); #undef g #undef v free(y); free(temp); for(i=0;i<3;i++) { free(gcopies[i]); free(vcopies[i]); } } /* mp_inv */ #else /* !OLD_MPINV */ /* Faster mp_inv, based on "Fast Multiplicative Inverse in Modular * Arithmetic", J. Gordon, in Cryptography and Coding, edited by * Henry J. Beker and F.C. Piper, 1989. * The mapping from the variables in that paper to our variables is, * roughly, M->n, X->a, HCF->u(iminus1), U->u(i), temp->u(iplus1), * INV->v(iminus1), V->v(i), temp->v(iplus1). We rotate the assignment * to temp and INV in their 2nd block of code. */ void mp_inv(unitptr x,unitptr a,unitptr n) /* Euclid's algorithm extended to compute multiplicative inverse. Computes x such that a*x mod n = 1, where 0<a<n */ { /* The variable u is unnecessary for the algorithm, but is included in comments for mathematical clarity. */ int shifts; int i; int enterloop; /* unit vcopies[3][MAX_UNIT_PRECISION], ucopies[3][MAX_UNIT_PRECISION]; #define u(i) ( &(ucopies[i][0]) ) #define v(i) ( &(vcopies[i][0]) ) Stack space hog deleted */ unit *ucopies[3]; unit *vcopies[3]; for(i=0;i<3;i++) { ucopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); vcopies[i]=malloc(sizeof(unit)*MAX_UNIT_PRECISION); } #define u(i) ( ucopies[i] ) #define v(i) ( vcopies[i] ) i = 1; /* Modify this to do one division at the beginning. That makes it faster. mp_move(u(0),n); mp_move(u(1),a); mp_init(v(0),0); mp_init(v(1),1); mp_init(v(2),1); */ mp_move(u(0),a); mp_init(v(0),1); /* Init U to n%a, V to -n/a. */ mp_udiv(u(1), v(1), n, a); mp_neg(v(1)); mp_move(v(2),v(1)); do { enterloop = 0; shifts = -1; if (mp_compare(u(i),u(iminus1)) > 0) /* if U > HCF then */ mp_init(u(iplus1),0); else { enterloop = 1; mp_move(u(iplus1),u(i)); /* temp := U */ while (mp_compare(u(iplus1),u(iminus1)) <= 0) { /* temp<=HCF */ ++shifts; mp_shift_left(u(iplus1)); /* leftshift(temp,1) */ } mp_shift_right_bits(u(iplus1),1); /* rightshift(temp,1) */ } mp_sub(u(iminus1),u(iplus1)); /* temp := HCF - temp */ mp_move(u(iplus1),u(iminus1)); i = iplus1; /* V := tempV, tempV := INV, INV := V, */ /* U := tempU, tempU := HCF, HCF := U; */ /* (All simultaneous) */ if (enterloop) { while (shifts--) mp_shift_left(v(i)); /* leftshift(V,shifts) */ mp_sub(v(iplus1),v(i)); /* temp = temp - V */ } mp_move(v(i),v(iplus1)); /* V := temp */ } while (testne(u(i),0) && mp_compare(u(i),u(iminus1))!=0); mp_move(x,v(iminus1)); if (mp_tstminus(x)) mp_add(x,n); mp_burn(u(0)); /* burn the evidence on the stack...*/ mp_burn(u(1)); mp_burn(u(2)); mp_burn(v(0)); mp_burn(v(1)); mp_burn(v(2)); for(i=0;i<3;i++) { free(ucopies[i]); free(vcopies[i]); } #undef u #undef v } /* mp_inv */ #endif /* !OLD_MPINV */ =========================== cut 8< here ================================= -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVmP6MGoFIWXVYodAQHBdgP7B9n/nep0Y1hV2ze3GMJoBpZvq0BKfT3y EjLFvk2+z9Y3kRTqsA42lGFV0rcQwgkm588VbE7JmT/b0AvGoOm4Hqp9wEzYMfFz iMy8fVRitUHT2VFryLpzCdRtwPzDkW62yIQUMgWcgpW05Vu+GMEgtgD70CpJbKfb GuIT2jH6Tzc= =UcS4 -----END PGP SIGNATURE-----

2 1

Re: CYPHERPUNK considered harmful.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:43 AM 9/13/95, Peter Trei wrote: > "CYPHERPUNK" considered harmful > > I would like to propose that we, the 'cypherpunks', are making a >strategic error, which will make it far more difficult to achieve the >goal we share. Discussing some goals we might share, or ought to share, is certainly not out-of-line. Indeed, this discussion has come up many times on this list, though perhaps not much in the past year. (Those C coders do seem to be having their way...:-} ). > Our error lies in our approach to encouraging the widespread use of >crypto. It is an error of hubris - overweening pride. I think many people here are doing a lot to encourage wide use of encryption, remailers, etc. They write hooks to popular mail programs, they give public talks, they fight against restrictions and regulations, and they deploy new systems. That some folks have very occasionally mentioned "Joe Sixpack" does not mean that much. in my opinion. > > We too often think of ourselves as an elite - smarter and better in >various ways to our non-cpunk neighbours. We refer to these others as >'Joe Sixpack" and other such derogatary terms. > > The problem is that in doing so we are marginalizing ourselves. > > We call ourselves 'cypherpunks'. While this is derived from the SF >term 'cyberpunk', consider the image we are creating for ourselves: > > A 'punk' is a marginalized young adult, one who rejects the norms >of his or her society, and takes delight in irking those around him with >his or her rejection. The older of us will think of James Dean in 'Rebel >Without a Cause', or Brando in 'The Wild One'. Later, you get images >such as Peter Fonda in 'Easy Rider', and more recently, Sid Vicious and >other icons of the 'punk rock' movement. While I have had some qualms about the name, on balance I think it has been good for us. After all, it's not as if _other_ groups don't already exist! In particular, the British branch of Cypherpunks disliked the name "Cypherpunks" so much that they used a different name for themselves, the "U.K. Crypto Privacy Association." It doesn't seem to exist anymore, for whatever reasons. But the name may have been a factor, at least. Similarly, there's the Libertarian Party, with similar themes to our own, the International Association of Cryptographic Research (or somesuch), and even several nascent groups like "Terra Libre" and "DigitalLiberty" which purport to have a similar focus to what we have. And of course there are _several_ groups devoted specifically to lobbying for various sorts of cyberspatial rights, laws, etc.: EFF, EPIC, CPSR, VTW, and the ACLU. All of these groups have a different focus than we have. If I were to pick one that matches Peter Trei's proposed organization, it would be the EFF. Thus, I suggest Peter and others of like mind look into helping out the EFF in its worthy causes. I mean no disrespect here to Peter's views, nor am I suggesting he leave this list. Plenty of room for support of the EFF and being on this list. I'm a member of the EFF, for example (though their computer has me as "Tim Mat" for some reason). But for some reason--draw your own conclusions--the Cypherpunks list has a membership of something like 600-800 subscribers, more if you count folks who subscribed for a while, or who read it in other places. I don't think "Terra Libre" or "DigitalLiberty" are quite as successful and visible. We fill a certain niche which is useful to have filled, a more radical facet of things. If we didn't exist, or renamed ourselves "Concerned Citizens for Cryptographic Protection," CCCP, then somebody would have to _invent_ the Cypherpunks! I addressed the issue of our name, pluses and minuses, in an early chapter of my Cyphernomicon (http://www.oberlin.edu/~brchkind/cyphernomicon/) 2.4.10. "Where did the name 'Cypherpunks' come from?" + Jude Milhon, aka St. Jude, then an editor at "Mondo 2000," was at the earliest meetings...she quipped "You guys are just a bunch of cypherpunks." The name was adopted immediately. - The 'cyberpunk' genre of science fiction often deals with issues of cyberspace and computer security ("ice"), so the link is natural. A point of confusion is that cyberpunks are popularly thought of as, well, as "punks," while many Cyberpunks are frequently libertarians and anarchists of various stripes. In my view, the two are not in conflict. - Some, however, would prefer a more staid name. The U.K. branch calls itself the "U.K. Crypto Privacy Association." <check this> However, the advantages of the name are clear. For one thing, many people are bored by staid names. For another, it gets us noticed by journalists and others. - - We are actually not very "punkish" at all. About as punkish as most of our cyberpunk cousins are, which is to say, not very. + the name - Crypto Cabal (this before the sci.crypt FAQ folks appeared, I think), Crypto Liberation Front, other names - not everybody likes the name...such is life -------- Getting back to your suggestion that "we" change the name to something more respectable. How could "we" do this, given that "we" are an effective anarchy? I can't imagine a vote on this, and the endless debates on what "we" ought to call ourselves would be a waste of time. Fortunately, there's an elegant solution: form your own group. Form your own group, your own mailing list, with a catchy name, something like "The Privacy Education Foundation," or "The American Civil Liberties Union" (whoops, taken), or "The Society for the Preservation of Cyberspatial Liberty." Then announce it on our list, and elsewhere. People will vote with their feet. If your "meme" is catching, your list will rapidly gain members. Maybe this Cypherpunks list will even atrophy away. Evolution in action. The market in action. A better approach than trying to get the name and the charter changed. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Unknown address
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! Could you tell me why I receive this message?!? I *never* sent anything to your place... What is it that is wrong? The cypherpunks remailer? Your site? (how?) ========== original e-mail from you ================ >From warehouse.mn.org!postmaster(a)kksys.com Mon Feb 12 04:06:24 1996 Return-Path: <warehouse.mn.org!postmaster(a)kksys.com> From: postmaster(a)warehouse.mn.org (Postmaster) Subject: Unknown address Date: Sun, 11 Feb 1996 22:19:49 GMT Organization: The Warehouse BBS To: jf_avon(a)citenet.net ) >The user this message was addressed to does not exist at this site. Please >verify the name and domain in the original message that follows. >Message was addressed to: SAMUEL.KAPLIN(a)warehouse.mn.org > > ----- Original Message follows ----- > >From: jf_avon(a)citenet.net (Jean-Francois Avon (JFA Technologies, QC, Canada)) >To: cypherpunks(a)toad.com >Date: Sun, 11 Feb 1996 23:41:06 -0500 >Subject: Re: "Rights" > >Ed.Carp(a)linux.org, ecarp(a)netcom.com wrote: <various blah blah from me snipped> ========= end original message from you ================ **** NEW PGP 2.6.2 KEY ********* 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

6 6

Meeting Logs
by Robert A. Hayden 17 Dec '03

17 Dec '03

If anyone is interested, I do have some logs from tonights Cypherpunks virtual meeting. It's not a perfectly clear file, as it has lots of help requests in it (I don't know MOO too well, but the substance is still there. If you want it, just drop me a line and I'll get it right off to you. It is about 90k big. ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> In the United States, they \/ Finger for PGP 2.3a Public Key <=> first came for us in Colorado... -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

"national security" exception to wiretap laws
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

* * * * * 18 USC s 2511(2)(f): Nothing contained in this chapter or chapter 121, or section 705 of the Communications Act of 1934, shall be deemed to affect the acquisition by the United States Government of foreign intelligence information from international or foreign communications, or foreign intelligence activities conducted in accordance with otherwise applicable Federal law involving a foreign electronic communications system, utilizing a means other than electronic surveillance as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978, and procedures in this chapter and the Foreign Intelligence Surveillance Act of 1978 shall be the exclusive means by which electronic surveillance, as defined in section 101 of such Act, and the interception of domestic wire and oral communications may be conducted. * * * * * [From USCA annotations for 18 USC s 2511] 13. Executive powers This chapter providing that nothing therein should be deemed to limit the constitutional power of the President to protect the United States against any clear and present danger to the structure or existence of the government did not constitute a grant of power and was not intended to expand, contract or define whatever presidential surveillance powers existed in matters affecting national security, but was only intended to make clear that this chapter should not be interpreted to limit or disturb such power as the President might have under the Constitution. U.S. v. U.S. Dist. Court for Eastern Dist. of Mich., Southern Division, Mich.1972, 92 S.Ct. 2125, 407 U.S. 297, 32 L.Ed.2d 752. Former Attorney General was entitled to qualified immunity in civil damage action based upon wiretaps, where sufficient facts were alleged to place wiretap in rational national security context. Ellsberg v. Mitchell, 1986, 807 F.2d 204, 257 U.S.App.D.C. 59, certiorari denied 108 S.Ct. 197, 484 U.S. 870, 98 L.Ed.2d 148. Former national security council staff member's admission that he had access to option papers discussing possibility of Cambodian bombing operation, secret talks with North Vietnamese, and withdrawal of troops from Vietnam, as well as contingency planning in event that such steps might be taken, together with evidence that staff member had roomed with reporter who wrote article reporting classified bombing raids on Cambodia, was sufficient to establish reasonable national security grounds for wiretap of staff member's phone so as to entitle government officials who ordered wiretap to qualified immunity defense in civil damage action brought by staff member. Halperin v. Kissinger, 1986, 807 F.2d 180, 257 U.S.App.D.C. 35. Those provisions of this chapter which, in the context of pure intelligence- gathering activities, would frustrate the constitutional power of the President, cannot be applied to such surveillance. (Per Wright, Circuit Judge, with three Judges concurring and three additional Judges concurring in the judgment.) Zweibon v. Mitchell, 1975, 516 F.2d 594, 170 U.S.App.D.C. 1, certiorari denied 96 S.Ct. 1684, 1685, 425 U.S. 944, 48 L.Ed.2d 187. Restrictions upon the President's power which are appropriate in cases of domestic security become artificial in the context of the international sphere. U.S. v. Brown, C.A.La.1973, 484 F.2d 418, certiorari denied 94 S.Ct. 1490, 415 U.S. 960, 39 L.Ed.2d 575. Whatever constitutional power lies without scope of this chapter and is invested in chief executive to authorize warrantless surveillance for sake of "national security," necessary prerequisite to administration of such power is express approval by President or Attorney General. U.S. v. Kearney, D.C.N.Y.1977, 436 F.Supp. 1108.

2 1

Re: Testing
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

May very well be the net software - I've also been getting lots of empty messages. Is toad.com disk full or something?

1 0

Hacking commercial systems.
by hallam＠w3.org 17 Dec '03

17 Dec '03

Hi, A number of people have been proposing hacks on commercial payment systems. Could I point out that this is not necessarily a good idea? One vendor I spoke to has a contract clause with sublicensees which requires a legal response in such situations. His opinion was that attempting such a crack on a "live" system consitituted conspiracy to commit fraud and organisation of the same could involve RICO penalties. It would seem prudent to approach such projects with a little caution. If a request were made for a sample of material to work on most companies would oblige and a refusal would provide protection against legal tactics. Most sensible companies would see the advantage of offering a reward. Phill

2 1

Speakers needed.
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

Anybody want to visit Fermi lab? I wish I could. -=Xenon=- Forward:

1 0

RE: Dorothy Denning at it again
by Dave Hart 17 Dec '03

17 Dec '03

---------- | From: Robert M. Solovay <netmail!solovay(a)math.berkeley.edu> | Subject: Dorothy Denning at it again | Date: Thursday, February 10, 1994 9:20AM | | Question: How does one access RISKS 15.48 >From the RISKS digest: Date: ongoing From: RISKS-request(a)csl.sri.com Subject: Info on RISKS (comp.risks), contributions, subscriptions, FTP, etc. The RISKS Forum is a moderated digest. Its USENET equivalent is comp.risks. PLEASE read it as a newsgroup if possible and convenient for you. Undigestifiers are available throughout the Internet, but not from RISKS. Contributions should be relevant, sound, in good taste, objective, cogent, coherent, concise, and nonrepetitious. Diversity is welcome, but not personal attacks. CONTRIBUTIONS to risks(a)csl.sri.com, with appropriate, substantive "Subject:" line; others may be ignored! Contributions will not be ACKed; the load is too great. **PLEASE** include your name & legitimate Internet FROM: address, especially .UUCP folks. If you cannot read RISKS locally as a newsgroup (e.g., comp.risks), or you need help, send requests to risks-request(a)csl.sri.com (not automated). BITNET users may subscribe via your favorite LISTSERV: "SUBSCRIBE RISKS". Vol i issue j, type "FTP CRVAX.SRI.COM<CR>login anonymous<CR>YourName<CR> CD RISKS:<CR>GET RISKS-i.j<CR>" (where i=1 to 15, j always TWO digits). Vol i summaries in j=00; "dir risks-*.*<CR>" gives directory; "bye<CR>" logs out. The COLON in "CD RISKS:" is vital. CRVAX.SRI.COM = [128.18.30.65]; <CR>=CarriageReturn; FTPs may differ; UNIX prompts for username, password. WAIS and bitftp(a)pucc.Princeton.EDU are alternative repositories. IF YOU CANNOT GET RISKS ON-LINE, you may be interested in receiving it via fax; phone +1 (818) 225-2800, or fax +1 (818) 225-7203 for info regarding fax delivery. PLEASE DO NOT USE THOSE NUMBERS FOR GENERAL RISKS COMMUNICATIONS; as a last resort you may try phone PGN at +1 (415) 859-2375 if you cannot E-mail risks-request(a)CSL.SRI.COM . ALL CONTRIBUTIONS CONSIDERED AS PERSONAL COMMENTS; USUAL DISCLAIMERS APPLY. Relevant contributions may appear in the RISKS section of regular issues of ACM SIGSOFT's SOFTWARE ENGINEERING NOTES, unless you state otherwise. --- davehart(a)microsoft.com --- Not a Microsoft spokesperson.

1 0

T.A.Z.
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

Can someone remind me where to pick up T.A.Z by Hakim Bey by ftp? I archived the information accidently and it is hard for me to access now... I recall trying to get it, but the node was down and I haven't tried again. Paul E. Baclace peb(a)procase.com peb(a)well.sf.ca.us

2 1