- cypherpunks-legacy - lists.cpunks.org

Re: CIA & Espionage
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 10:02 AM 8/30/95, Dar Scott wrote: >In responding to Hadmut John Young seems to have quoted IWR Daily >Update in writing, >> UNITED STATES - CENTRAL INTELLIGENCE AGENCY (CIA) >> >> President Clinton has ordered the CIA to make economic >>espionage >> against our trade rivals a top priority. [sources: Los >>Angeles Times- >> Washington, by James Risen, 7/23/95; Kyodo - Los Angeles, >>7/23/95] > >Are we to assume both black and white? > >Will the CIA have access to escrowed keys in exported software? Perhaps if economic espionage is such a high priority, then we'll have to start using more secure keys in the future. After all, any international corporation limited to using limited bit encryption schemes is just asking for its rivals to start grabbing the traffic and stealing their information. Jonathan

1 0

Re: "Morphed" child porn case ruling text (FSC v. Reno)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Mike Duvos wrote: > While I suspect the typical citizen is unlikely to have a particularly > strong reaction one way or the other to sexual depictions of children, as > long as it is not a photographic record of an actual child being treated > abusively, there is a obvious subset of frothy pointy-headed individuals > who should be shielded from such material at all costs, or they may be > completely unable to control their behavior. > > They are of course the self-appointed "child protectors", none of whom > could care less about what rights children really need or want, as long as > no one appears naked. Question: "If someone did a study that conclusively proves that free availability of child pornography leads to a substantial decrease in the amount of child abuse taking place, will our legislators and our ministers support the legalization of child pornography? Answer: "Right... And I'm the fucking pope..." When did protecting abused children become such a high priority for the fascists? When people told them to shove their fascism under the banner of "moral values" up their ass. If we wipe drug abuse and child abuse from the face of the earth, the fascists will decide that pictures of naked people cause tooth decay, and launch a "War Against Bad Dental Hygiene." Of course, this will mean that Law Enforcement will need the power to check inside our mouths at their every whim, and imprison people who have dental cavities. PopeMonger "I am not a mushroom..."

1 0

PGP on UK TV
by Sherry Mayo 17 Dec '03

17 Dec '03

Sorry if someone has already posted this but I didn't think I had seem it on the list: Found this on Uk.misc: ========================== alecm(a)coyote.uk.sun.com (Alec Muffett) wrote: >> >> Sunday 3rd September. 7:00pm on Channel 4. Equinox. >> >> "Cybersecurity" - an investigation into cryptography, the >> Internet, civil rights, Phil Zimmerman, PGP (and should we be >> permitted to use it?) and so forth. >> >>I, for one, am going to be videoing it. >>Let's just hope they get it right. > >Having seen a preview trailer of the program I am glad to say that it >comes down on the _right_ side (ie right to privacy, etc). > >It also refers to cipherpunks as "rebel programmers" - I dunno but >I quite like this description of them :-) Has a sort of cult-hero status >about it. ========================== Sherry ps Can't watch it cos I'm in Oz let us know if it was any good.

1 0

Re: NIST Key Escrow meeting
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 7:51 8/30/95, Flame Remailer wrote: >Subject: NIST Key Escrow Meeting Discussion Papers > >Key Escrow Issues Meeting, September 6-7, 1995 >Discussion Paper #1 [Old and new GAK requirenments elided] >With your input, we are hopeful that this effort will lead to >definitive criteria, which will facilitate the development of >exportable products and help minimize the time required to obtain >export licenses. The Administration seeks to finalize such >criteria and make formal conforming modifications to the export >regulations before the end of 1995. > > >Note: These issues will be discussed at the Key Escrow Issues >Meeting to be held September 6-7, 1995 (9:00 a.m. - 5:00 p.m.) at >the National Institute of Standards and Technology (Gaithersburg, >Maryland). The meeting will be open to the public, although >seating is limited. Advance registration is requested, please >contact Arlene Carlton on 301/975-3240, fax: 301/948-1784 or e- >mail: carlton(a)micf.nist.gov. Will any Cypherpunks attend this meeting? I sure hope we get to make our ideas know. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: Is the book Network Security any good?
by Rich Salz 17 Dec '03

17 Dec '03

>It does have some very irritating assertions concerning ASN.1 however, >specifically concerning its use in Kerberos. I consider Kerberos's use of ASN.1 >to be far superior than the alternative suggested which is pure lossage. What was the alternative suggestion? Many KRB5 folks, including Ted T'so, have said that using ASN.1 is the biggest mistake in the KRB5 protocol. >Lambasting the use of ASN.1 is fair game but arguments over wasted bytes miss the >point of ASN.1 and the BER encoding entirely. Hunh? The points of ASN.1 and BER (DER? -- a little mavros joke :) *are* irrelevent to Kerberos. Wasted bytes in your security protocol should most definitely be a concern. Charlie and Radia are hot-shits; I don't know the other guy. /r$

1 0

Mixmaster Security Issues
by hroller Mixmaster 17 Dec '03

17 Dec '03

Apart from thwarting traffic analysis attacks, how does the security of a Mixmaster Type II remailer packet compare to that of a PGP-chained Type I message? For example, is each remailer in the path limited to knowing only the next remailer in the path? Is there any way for a remailer (except for the first and last in the chain) to know how many hops have already occurred or how many remain? Is there a session key chosen via an RNG? If so, how random is the RNG? Is it seeded from a pseudo-random source that's at least as secure as measuring keystroke latencies, as PGP does? Lance Cottrell's original "remailer essay" which proposed the Type II concept envisioned, if I'm not mistaken, the use of PGP technology to do the actual encryptions. Now it seems that another, seemingly proprietary, implementation of RSAREF was used, instead. What was the reason for this change? Would any security be lost if Type I and II technology were combined and a PGP-chained Type I packet were initially sent via Mixmaster? This would would seem to provide the necessary protection against traffic analysis while bypassing any *POSSIBLE* hidden weaknesses in Mixmaster. IOW, if the outer Mixmaster "envelope" were "steamed open", perhasps based on some hidden weakness in Mixmaster, the inner, nested PGP envelope(s) would remain intact. BTW, what volume of message traffic is the Mixmaster network of remailers currently handling? Is much cover traffic necessary to minimize delays while providing enough reordering to thwart traffic analysis? (IOW, so a remailer with a reordering pool size of five messages, and averaging one REAL message a day, wouldn't have to keep a message for an average of five days before sending it on its next hop, as a worst-case scenario). Is my math correct in surmising that chaining a message through five remailers, each with a reordering pool of five messages, could mean that the message eventually leaves the chain as one of 5^5 (3125) possible messages? (My math is a bit weak, so please feel free to correct my methodology, if necessary.) If so, does that work in reverse? Could a given output message that finally surfaced in the clear be narrowed down to one of 3125 Mixmaster input messages through traffic analysis? Or would the fact that the attacker didn't know the exact number of hops utilized significantly increase the odds against identifying the sender? What effect, if any, would increasing the number of available remailers have on traffic analysis?

2 1

Re: SSL search attack
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Scott Brickner <sjb(a)austin.ibm.com> >>If the segments are shuffled before they are handed out then this attack >>becomes impossible, since the attacker has no way of knowing when >>segment 0x1bad will be handed out. > >An excellent point. One I'd missed. I agree that a random shuffle >of segments is appropriate. Problem is, though, if *each* segment is shuffled, or shuffled in groups of 10 or 25 or 50 or what? brutessl is designed for sequential search through a block of segments. I was pulling down blocks of up to 40 segments each, for each machine I was running. Of course, with brloop running I won't be in such a bind (I have yet to see that it really works though..) but still it also represents a coding problem as to handing out sequential segments within shuffled blocks. Hey, by the way Piete, is there gonna be a ego list (rankings) like there was with the RC4? Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMETbAMLa+QKZS485AQFU7QL/WTljlZyetr0x+L9eBJnrYUNNY1BHfTJn C83wiJgPO5cpR6b/Vn8hYPnMRXnEhaxRJ062TcRitdngsUND1W+6d04Ph1gg/Qj8 US6FtoP+Yk9BhcYlYfogh3YSOxcgIvbu =UiWq -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

3 2

Re: Remailer hating Nazis (was Re: The BIG Lie (Jesus Confesses))
by Anonymous 17 Dec '03

17 Dec '03

At 12:54 PM 8/15/97 +0200, you wrote: > Strange that this claim should come from a variety of sources at >the same time the government is facing the embarassment of having to >whitwash the actions of heavily armed, camouflaged Marines who felt >so threatened by a goat-herder with a .22 rifle that they slaughtered >him with their M-16's, despite the fact that the child was an American >citizen, doing what he had every right to do, on American soil. FWIW, those murdering bastards got off the hook, because the jury believed they were "good soldiers", and I thought "Goodness must now mean how many innocents you kill while waiting to shoot a stoned Mexican carrying a bag of pot walking across the border. > The drug cartels are having such little trouble getting drugs into >the U.S. that cocaine and heroine are cheaper than a bottle of good >Scotch, yet, according to the government, they have decided that it >is necessary to perform actions which will "force" the government >to 'crack down' on border terrorism with increasing use of armed >force. Right... Hell, why not just declare martial law!? If were going to use marines as police, what next? The war on Goat-Herding Cartels!?!?!? I myself have never heard of a bunch of Heavily armed mexicans running over the border with explosives, automatic weapons, and Molotov Cocktails burning down houses, shooting marines, or blowing up buildings. >GiveMeAFuckingBreakMonger >"There is something wrong when U.S. armed forces murder American > schoolchildren on American soil, under an increasing number of > unconstitutional laws." KillThoseMurderingMarineBastardsMonger "There's something wrong when we replay prohibition and kill innocents in the process."

1 0

RSA Secure (disk encryption)
by Mike Ingle 17 Dec '03

17 Dec '03

RSA's home page (http://www.rsa.com) has a demo version of RSA Secure. This is a disk/directory encryption program that serves the same purpose as Secure Drive and SFS. According to their description, it allows you to select only certain files to be encrypted, and uses 80-bit RC4. The demo/export version is only 40 bits. It also has optional key escrow. You can choose to escrow a key by secret-sharing it and giving pieces to various people. There is a threshold system so m of n people have to cooperate to decrypt it. Mike

1 0

Re: McVeigh to die, quotes Brandeis
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > <B>By SANDY SHORE<P> > <B>Associated Press Writer<P> > DENVER (AP) - Timothy McVeigh was formally sentenced to death > today for the Oklahoma City bombing after he quoted Supreme Court Justice > Louis Brandeis that the government "teaches the whole people by its > example." And the morning news anchor on CBS tells the country, "McVeigh's statement is open to a wide variety of conflicting interpretations." (I guess he hasn't been following the news too closely.) Did anyone else on the CypherPunks list interpret McVeigh's statement to mean that the people should lie, steal, and oppress others, or am I the only one who interpreted it this way? Or perhaps he meant we should murder anyone who claims to be Jesus, as well as the men, women and children who believe in him. Been there, done that... Pontius Pilate

1 0