- cypherpunks-legacy - lists.cpunks.org

Re: Is /dev/random good enough to generate one-time pads?
by Steve Reid 17 Dec '03

17 Dec '03

> > Subj sez it all. > Yes, as a matter of fact it is. /dev/random is based on an entropy pool > taken from hardware interrupts and such, thus is a RNG, not a PRNG I expect it would be "good enough", but it is not _perfectly_ random, and so it wouldn't be a true one-time pad. Because it uses MD5, the bits are not all provably independent. You get (very strong) cryptographic security instead of perfect security. The one-time pad is easy to explain in theory, but implementing it perfectly is extremely difficult. Many people believe that quantum events are the only source of perfect randomness, but most methods for harvesting that randomness could introduce statistical properties. For example, a radioactive substance may have exactly a 50% chance of emitting a particle given a certain amount of time, but what happens if your timer isn't perfect? One-way hashes are good at removing such obvious and not-so-obvious statistical properties, but like a PRNG, you can't prove that the bits it produces are all completely independent. It's definately "good enough", but it's not perfect.

2 1

RE: Your Freudian slip is showing
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Bovine Remailer <haystack(a)cow.net> wrote: >On Thu, 28 Nov 1996 jbugden(a)smtplink.alis.ca wrote: > >> Another anecdotal example is in the opening chapters of "Surely You're Joking, >> Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon >> vivant. He describes how his mother introduced a doctor, a general and a >> professor with the same respectful tones indicating to him that a career in >> academia was as highly valued as any other high position in society. > >Your lower middle class slip is showing. Damn right! Everything I have I earned myself. I'm not some pampered child of rich parents. My God, when I think of what my father went through when he was growing up and what he endured to feed our family, I'm amazed that he didn't drop dead in his tracks. The fact that my granfather was a well respected municipal politician didn't insulate them from the effects of the depression. When my father was young he had to walk almost four miles to and from school, and it was uphill both ways. Then when he got home he had to chop wood with a hammer. Of course he could have used an axe, but it was usually dark by this time - they couldn't afford lights - and he found that a miss with the hammer was less likely to cause severe leg trauma. After getting his hand crushed in a printing press as a young man and later, after being layed off after 26 years of hard toil and loyal effort, he wasn't bitter when he was forced to retired on a pension of $650 per year. He was proud to have worked hard all his life and succeeded in his own small but not completely insignificant way. Look where I'm pointing, not at what I'm pointing with. James

1 0

RE: IQ and age
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Clay Olbon II <olbon(a)ix.netcom.com> wrote: >Seriously, you ignore the correlation between performance in college and standardized test scores. There is a reason these are used in admissions - they are actually pretty good predictors of the ability to perform college level work. < This is a commonly held fiction that is not supported by the evidence. As stated in another message, the infomration given out by ETS, who administer the GMAT and SAT, indicate that there is a low correlation between GMAT scores and successful completion of even first year education programs. This also ignores the issue of why other, better, widely available predictors are not used instead. >Oh, I forgot. Only certain racial/ethnic groups are capable of understanding basic mathematical concepts. < There was a good Scientific American article on cultural influences on learning within the last year or two. It examined Asian groups noted achievements in tests and the parental and cultural support for scholastic achievement. Another anecdotal example is in the opening chapters of "Surely You're Joking, Mr. Feynman" by Richard Feynman, the late Caltech professor and general bon vivant. He describes how his mother introduced a doctor, a general and a professor with the same respectful tones indicating to him that a career in academia was as highly valued as any other high position in society. >I happen to feel better believing in the potential for any individual in this country to succeed through hard work. < I do to. But how good are your feelings as predictors of actual success? James

3 2

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Ernest Hua wrote: > > > > It is truly counter-productive to insist on conspiracy theories and > > > > anti-government rhetoric. Sure, there have been conspiracies in the > > > > past. Sure, there have been more than our fair share of atrocities. > > [mucho snippo] > > The danger in conspiracy theories (and you can check the L.A. Times for > verification of this) is that they are often tied in to anti-Semitism > and other forms of racism, and/or provide an excuse to.... > > The fact is, though, that only government possesses the power to ruin the > lives of masses of people, which they have often done, even in this century. > Anyone who says "the conspiracies aren't true" and "anti-government rhetoric > is automatically bad", etc. is just sticking their head in the sand. > > The militias are a necessary correction to government excess, however > negative the implications of militia power might be. > > As far as the difficulty in creating the infrastructure to monitor every- > one, well, it exists and is growing by the minute. All "they" have to do > is listen in, and have smart programs to sort out what they want to look > at (which they certainly do). Think of it as a percentage deal. The > people the govt. most want to monitor are the ones who are the most > active in their travel and communication, therefore, it greatly reduces > the monitoring load. Another new error message. Every other day, a new error. Who's doing this?

1 0

Re: [ANNOUNCEMENT] Enigma
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Tim C[reep] May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. _ {~} ( V-) Tim C[reep] May '|Y|' _|||_

1 0

Re[2]: Sound card as a random number source ??
by Pavel Korensky 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk wrote: > > I`m not entirely sure about the possibility of correlations in any of > these sources but they aren`t really a good idea because all can be > accessed by someone else. eg. Steal your random noise audio tape, > sample dolby decoded sound at the same time as you etc. And what if I will use FM receiver, tuned on some channel where is the noise. If the potentional attacker don't know the what channel was tuned, he is not able to reproduce this IMHO. Of course, maybe it is possible to record the whole spectrum to tapes, but I think that the noise will change when recorded and played back from tape. Bye PavelK -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

1 0

Re: Whitehouse Releases Blueprint...
by Will Rodger 17 Dec '03

17 Dec '03

At 04:08 AM 11/29/96 +0000, you wrote: > > Notably, the emphasis is on the needs of business, not "people." > > We are in an excellent position to observe and document the process whereby > "business" -- that is, organizations motivated primarily, if not exclusively, > by the desire for short-term profits accruing to vested interests -- comes > to dominate and control a technology. The auto and television industries come > to mind as two prior examples. We are about to see the net go the same way. > Take notes. > > "I have to praise the administration and Ira for > reaching out to the private sector for > comments," Computers and Communication > Industry Association President Ed Black said. > "There's a great emphasis on the needs of > business here." > > Even so, privacy activists remained > disappointed with many of the document's > features. "This isn't anything new," said David > Banisar, counsel to the Electronic Privacy and > Information Center. "The privacy stuff is > terrible. They say it's market driven, but > markets don't work with privacy. It's like what > happened with P-Trak." > You bring up a point that is implied - but not explicit - in the article. And it's a good one. Funny thing is, two of the _industry_ folks suggested individuals probably needed to be included in the document more than they were. Neither was keen on being quoted on the record regarding non-business interests, of course. Given the attitude of the folks I talked to, I suspect non-business interests are still fairly important to the White House on this one. And remember: Ira Magaziner won no friends in industry with his health care proposals a couple of years back; some folks think he's leaning in favor of industry at least initially to make sure what happened then doesn't happen again. If Netizens find suggestions from the administration too heavy-handed, my guess is there's still time to move the discussion. Cheers. Will Rodger Washington Bureau Chief Inter@ctive Week

1 0

Counterproductive Dorothy Denning Flames
by mpd＠netcom.com 17 Dec '03

17 Dec '03

William H. Geiger III writes: > Dorthy Denning is a boot-licking fasicist!!! > William Reinsch is a lying bastard. Fucking politions!! > Fucking goverment!! They all deserve a long rope!! It is perhaps a point in Dr. Denning's favor that her most vitriolic detractors can spell neither "Dorothy" nor "fascist". I must admit that I am at a loss to understand the heat which Dorothy Denning generates on the Cypherpunks list, which seems to be second only to the heat generated by posting recipes for roast feline in rec.pets.cats. All of the people I know who have met her find her to be a pleasant person, and the occasional Email messages we have exchanged have certainly been positive and friendly. While she tends to view the Four Horsemen of the Infocolypse as a bit more threatening than the typical Cypherpunk, I don't think her views are so extreme as to justify the continuous screams of "crypto toady", "government suckup", and "wicked witch" which seem to pop up in response to her every utterance. I would even go so far as to say that this list would be a lot more entertaining if she were contributing to it, and sci.crypt is certainly a less interesting place now than it was in bygone days when she was posting there. Perhaps Tim can add his own thoughts to this thread. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 10

Re: Counterproductive Dorothy Denning Flames
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> So, they feel compelled to harrass anyone who's smarter / more > knowledgeable than they are (sometimes using the anonymous remailers) in > an effort to drive all intelligent discussion off their "private mailing > list", so ignoramuses like Bradley can sound like "local experts". I think you might be missing the very succinct and subtle point that all you ever contributed to this list (despite your knowledge of cryptography) was rants about sovok jews and Tim Mays sexual orientation. I happen to be knowledgable about cryptography but even if I`m not an expert I do tend to post things that are of value and interest as opposed to worthless flames. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by null＠void.gov 17 Dec '03

17 Dec '03

I would say that depends on -where- &/or -how- you store the premaster/master, and is dependent on platform threat models rather than attacks on the wire. These are different problem spaces with different solutions, which some contemplated changes to SSL may help address: some tweaks may be useful to support more secure secret management on the platforms. But I would not go so far as to say that these issues make SSL or an implementation insecure per-se, until I did the complete job. If my platform is compromised such that the master or premaster secret can be subverted, then I have problems that go way deeper than SSL or a particular implementation of it. Would you like to propose some fixes? We would be very interested. Ben Laurie wrote .... >SSL requires the keying material to be available at all times. This is rather >different from many applications of cryptography, where one can keep keying >material safely locked away except when it is needed. > >This is the inherent vulnerability. > >Cheers, > >Ben. > >-- >Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk >Freelance Consultant and Fax: +44 (181) 994 6472 >Technical Director URL: http://www.algroup.co.uk/Apache-SSL >A.L. Digital Ltd, Apache Group member (http://www.apache.org) >London, England. Apache-SSL author > >

1 0