- cypherpunks-legacy - lists.cpunks.org

Amazon.com Books -- personal notification service (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

Amazon.com books (which someone mentioned here a few days ago) has a free personal notification service for new books of interest. They also claim not to sell your preferences if you so request. They have Springer-Verlag conference proceedings, and books by Hakim Bey. I spent a while telling them all about whose new books I'd like to hear about, and this came to me today. Adam ----- Forwarded message from eyes(a)amazon.com -----

1 0

Re: macworld crypto articles
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

In article <4444rl$nrh(a)life.ai.mit.edu> Chen writes: > It's truly a deplorable state of affairs. For the next version, include PGP free with every version of Quicken, and have Quicken just "call" PGP. Of course, users can encrypt their files now with PGP. Is there an Intuit bboard where someone could post instructions? -- --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

3 2

Entropy VI: "Shannon's Choice" (with apologies to Wm. Styron)
by adwestro＠ouray.cudenver.edu 17 Dec '03

17 Dec '03

I'm always glad to see stuff here about entropy: it's a topic that comes up in PGP 101 when locals ask, "How long should my passphrase be?" and, as we've seen recently, failure to generate adequate entropy for pseudo-random numbers is often the Achilles' Heel of otherwise solid cryptosystems. I found some info about Shannon's choice of the word "entropy" in an unexpected source lately. I had some free time this week due to the surprise snowstorm here, and used it to type in a few paragraphs. This is intended less for immediate discussion than for the list's archives, so that I can point folks to it in the future. And I'm not going to cite the source, to avoid copyright infringement nastygrams...if you know who the author is, keep it to yourself: you'll only suffer public ridicule and loss of "reputation capital" for Not Watching Enough TV!!! :-) N.B. -- some of this impresses me as pompous bullshit, and I'm not in agreement with it. But the story about von Neumann made it a worthwhile read, as least to me. ================================================================== I want now to turn to another juncture in the cascading bifurcations that mark interpretations of Maxwell's Demon. The juncture occurs when Leon Brillouin and Claude Shannon diverge in their opinions about what the relationship between information and entropy should be. In Brillouin's analysis of Maxwell's Demon, the Demon's information allowed him to sort molecules, thus decreasing the system's entropy; but this information had to be paid for by an even greater increase in entropy elsewhere in the system. For Brillouin, then, information and entropy are opposites and should have opposite signs. He emphasized the inverse connection between information and entropy by coining "negentropy" (from negative entropy) as a synonym for information. To Shannon, an engineer at Bell Laboratories who published a two-part paper that was to form the basis of modern information theory (1948), information and entropy were not opposites. They were identical. When Shannon devised a probability function that he identified with information, he chose to call the quantity calculated by the function the "entropy" of the message. Why he made this choice is unclear. Rumor has it that von Neumann told Shannon to use the word because "no one knows what entropy is, so in a debate you will always have the advantage." One could argue that von Neumann's comment was only one element and that the choice of "entropy" was overdetermined, with multiple factors leading to its conflation with "information." On a conceptual level, an important consideration was the similarity between Shannon's equation for infor- mation and Boltzmann's equation for entropy. Because the two equations had similar forms, it was tempting to regard the entities they defined as the same. On the level of language, entropy was compelling because it was a term of recognized legitimacy to the concept of information. On a cultural level, Shannon's choice anticipated the contemporary insight that proliferating information is associated with the production of entropy. [...] Whatever the reasons for Shannon's choice, it is regarded by many commentators within our scientific tradition as a scandal, for it led to the (metaphoric) knotting together of concepts that are partly similar and partly dissimilar. Typical is K. G. and J. S. Denbigh's reaction in their careful study of the way the quantity defined by Shannon's equation differs from thermodynamic entropy. Recounting the story about von Neumann's advice, they write that thus, "confusion entered in and von Neumann had done science a disservice!" Jeffrey S. Wicken is even more explicit, calling Shannon's choice "loose language" that served "the dark god of obfuscation." "As a result of its independent lines of development in thermodynamics and information theory, there are in science today two 'entropies,'" Wicken writes. "This is one too many. It is not science's habit to affix the same name to different concepts. Shared names suggest shared meanings, and the connotative field of the old tends inevitably to intrude on the denotative terrain of the new." Clearly Wicken's concern is to restore scientific univocality by closing off the ability of the information-entropy connection to act as a metaphor rather than a congruence. Yet at the same time he admits that shared language creates an inevitable "intrusion" into the "denotative terrain" of one term by the "connotative field" of another. The problem is more scandalous than he recognizes, for whenever a heuristic is proposed, it necessarily uses "shared names" that cause scientific denotation to be interpenetrated by cultural connotations. For what else is language but "shared names"? As Wittgenstein has observed, there are no private languages. Moreover, the distinction between denotative and connotative language is itself part of the distinction between language-as-vehicle and language-as-concept which metaphors, and particularly self-reflexive metaphors, bring into question. To turn Wicken's argument on its head, we might say he recognizes that metaphors in general, and the information-entropy connection in particular, directly threaten science's ability to separate ideas from the language it uses to express them. In his anxiety to suppress the metaphoric potential of Shannon's choice, Wicken misses the richly complex and suggestive connections that were instrumental in enabling a new view of chaos to emerge. By the simple device of using "information" and "entropy" as if they were interchan- geable terms, Shannon's choice gave rise to decades of interpretative commentary that sought to explain why information should be identified with disorder rather than order. For the alliance between entropy and information to be effective, information first had to be divorced from meaning (a premise made explicit in Shannon's 1948 papers) and had to be associated instead with novelty. Recall the random number generator, mentioned earlier, that produces a tape we can read. No matter how long we watch the tape, numbers keep appearing in unpredictable sequence. >From one point of view this situation represents chaos; from another, maximum information. Once randomness was understood as maximum information, it was possible to envision chaos (as Robert Shaw does) as the source of all that is new in the world. Wicken is correct in noting that denotative and connotative fields overlap; in the case of information, the connotation that "intruded" upon the denotative field of chaos was complexity. Whereas chaos had traditionally meant simply disorder, complexity implied a mingling of symmetry with asymmetry, predictable periodicity with unpredictable variation. As we have seen, chaotic or complex systems are disordered in the sense that they are unpredictable, but they are ordered in the sense that they possess recursive symmetries that almost, but not quite, replicate themselves over time. The metaphoric joining of entropy and information was instrumental in bringing about these developments, for it allowed complexity to be seen as rich in information rather than deficient in order. Sources cited: K. G. Denbigh and J. S. Denbigh, _Entropy in Relation to Incomplete Knowledge_ (Cambridge University Press, 1985) Jeffrey S. Wicken, "Entropy and Information: Suggestions for a Common Language." Philosophy of Science 54:176-193 (1987) ================================================================== Alan Westrope <awestrop(a)nyx10.cs.du.edu> __________/|-, <adwestro(a)ouray.cudenver.edu> (_) \|-' 2.6.2 public key: finger / servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23

1 0

Kerberos
by beckman＠cs.hope.edu 17 Dec '03

17 Dec '03

We are studying kerberos, the security system implemented by MIT's Athena network. Has anyone started, considered, imagined or completed any similar security systems, preferably using public key cryptography (as opposed to a single 56-bit DES key)? Please mail any responses to beckman(a)cs.hope.edu. -- Peter Beckman Hope College beckman(a)cs.hope.edu http://www.cs.hope.edu/~beckman/

2 1

Forgery
by david＠sternlight.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just sent you a message, forwarding a forged message attributed to me about plonking. It strikes me that to reduce the possibility that some might claim THAT message was a forgery, I might have signed it. Too late. Well, I'll sign this one. Best; David -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: MacPGPv262 iQCVAwUBMRuVP0wgH+NYrQ81AQHXAQP+NYB6xyO24vDDJORyp1PhN9ax0oorgkQu lCUKZ/G5lrCUnrDMTksy4RqA3N1401QKQGAGWmwlVESWNrMoUP1kjFX8orKZej+/ MHefCtRuh4FB6VmAWeC769Mhza0m02Fu7//R+o95em60wUk0z0O0f5KUe85V3T3T aRV47lmDQjg= =w/Nv -----END PGP SIGNATURE-----

2 1

change of address notice for Marc Donner
by donner＠ny.ubs.com 17 Dec '03

17 Dec '03

Dear colleague, friend, or correspondent, My new business address is: Marc Donner Union Bank of Switzerland 299 Park Avenue New York, NY 10171 212-821-6229 You can send me email at: donner(a)ubss.com The destination list for this mail is gleaned from an automated analysis of many megabytes of mail that I have accumulated over the last three years. In some cases you are receiving this not because we are acquaintances or correspondents but because you were a recipient of some piece of mail that I also received and kept. If so, I apologize for the intrusion. I have pruned the list extensively, but some email IDs are sufficiently opaque that I cannot reliably identify the person at the other end. Marc

1 0

Crypto in Wired
by steven ryan 17 Dec '03

17 Dec '03

Good issue of Wired this month (10/95) Vic Sussman has a half page on PGPfone. Asked why he's giving away PGPfone with an inditement hanging over his head Zimmermann says "... I am a cryptographer. This is what I do". Banking with First Virtual by Andrew Leonard Anonymous Speech by Tom Bell Data Dicks by John Whalen Did you know you can recover data on magnetic media that's been written over up to nine times? These guys do - for a living. Wanna Bet by Evan I Schwartz Guess what's going to be the next killer app on the net. Steven Steven Ryan sryan(a)reading.com

1 0

Re: `Random' seed.
by Matt Blaze 17 Dec '03

17 Dec '03

> I've played around with something that Matt posted here a while back > which seems to use the same idea. Matt suggested that this appears to > emit one random bit per second. I've done some very lightweight > analysis and haven't seen anything to suggest that the output is not > random, but I wouldn't make any bets based on what I've done. Here's my current favorite quick-and-dirty true-random-in-software generator. Use at own risk and read the comments carefully... -matt ===================cut here=========================== /* * Physically random numbers (very nearly uniform) * D. P. Mitchell * Modified by Matt Blaze 2/95 */ /* * The authors of this software are Don Mitchell and Matt Blaze. * Copyright (c) 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software may be subject to United States export controls. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. */ /* * WARNING: depending on the particular platform, truerand() output may * be biased or correlated. In general, you can expect about 16 bits of * "pseudo-entropy" out of each 32 bit word returned by truerand(), * but it may not be uniformly diffused. You should therefore run * the output through some post-whitening function (like MD5 or DES or * whatever) before using it to generate key material. (RSAREF's * random package does this for you when you feed truerand() bits to the * seed input function.) * * Test these assumptions on your own platform before fielding a system * based on this software or these techniques. * * This software seems to work well (at 16 bits per truerand() call) on * a Sun Sparc-20 under SunOS 4.1.3 and on a P100 under BSDI 2.0. You're * on your own elsewhere. */ #include <signal.h> #include <setjmp.h> #include <sys/time.h> #include <math.h> #include <stdio.h> static jmp_buf env; static unsigned count; static unsigned ocount; static unsigned buffer; static int tick() { struct itimerval it, oit; timerclear(&it.it_interval); it.it_value.tv_sec = 0; it.it_value.tv_usec = 16665; if (setitimer(ITIMER_REAL, &it, &oit) < 0) perror("tick"); } static void interrupt() { if (count) longjmp(env, 1); (void) signal(SIGALRM, interrupt); tick(); } static unsigned long roulette() { if (setjmp(env)) { count ^= (count>>3) ^ (count>>6) ^ ocount; count &= 0x7; ocount=count; buffer = (buffer<<3) ^ count; return buffer; } (void) signal(SIGALRM, interrupt); count = 0; tick(); for (;;) count++; /* about 1 MHz on VAX 11/780 */ } unsigned long truerand() { count=0; (void) roulette(); (void) roulette(); (void) roulette(); (void) roulette(); (void) roulette(); (void) roulette(); (void) roulette(); (void) roulette(); (void) roulette(); (void) roulette(); return roulette(); } int n_truerand(n) int n; { int slop, v; slop = 0x7FFFFFFF % n; do { v = truerand() >> 1; } while (v <= slop); return v % n; }

1 0

Netscape giving away T-shirts?
by sameer 17 Dec '03

17 Dec '03

My ex-gf just told me on the phone that her boss mentioned that Netscape was giving away T-shirts to people who found holes. Apparently her boss saw this on the news. Interesting. ;-) (For the over-stressed and/or humor-impaired: I'm not implying that netscape is giving away t-shirts, just commenting on the accuracy of the media.) -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

No Subject
by Freedom Remailer 17 Dec '03

17 Dec '03

Post: Spy Agency Hoards Secret $1 Billion WASHINGTON (AP) - The super secret agency that manages the nation's spy satellite program has built up unspent funds totaling more than $1 billion without informing Congress or even its supervisors at the Pentagon and CIA, according to a published report. The Washington Post cited unidentified Capitol Hill sources in Sunday editions as saying the ability of the National Reconnaissance Organization to put away so much money from its classified multibillion-dollar budget reaffirmed concerns that intelligence agencies sometimes use their secret status to avoid accountability. The Post said the funds, called a "pot of gold" by one Senate aide, were discovered after the Senate intelligence committee raised questions more than a year ago about a $300 million new headquarters building the agency was building in suburban Virginia. The committee determined that the agency, not generally known to Congress, was using base operating funds it already had without seeking a specific appropriation for the building. The pool of unspent money accumulated as a result of NRO's practice of having Congress pay in advance for multiyear, billion-dollar-plus satellite programs, the Post quoted CIA Director John Deutch as saying in an interview. Agency managers let incoming funds pile up when spending on contracts took place at a slower pace than planned. Although he said a CIA inquiry found nothing illegal about how the NRO handled the money, Deutch told the Post he put a new chief financial officer in at the agency and ordered a "separate budget scrub" of all its programs. NRO's funding is part of the Pentagon budget, but many of the agency's intelligence programs are under CIA supervision. The Post said one congressional aide put the total of unspent funds as high as $1.7 billion, but that others said it could turn out to be less than $1 billion. It said Deutch declined to put a figure on the unspent money. Story Number: 00598 Story Date: 9/23/95 This material may not be redistributed. Copyright 1995. The Associated Press. All rights reserved.

1 0