- cypherpunks-legacy - lists.cpunks.org

Re: Linux security issues
by frantz＠netcom.com 17 Dec '03

17 Dec '03

>>Actually keeping the pass phrase out of swap space is fairly easy (although >>I havn't looked at the PGP code to see if it actually does this). >>... >>However, the pass phrase is not the only dangerous information. >>... >>N.B. This problem affects all virtual memory operation systems. > >Not all of them. In at least one (VMS) you can pin pages in physical >memory, Good point. Too bad the invocations of pinning aren't portable. Maybe in the next POSIX. >Actually, any OS that does I/O directly to user pages has that capability in >the kernel... All the OSs I am familar with pin the pages only for the duration of the I/O operation. After the I/O has completed, the page can be swapped out. What you really need is to pin the page in memory (with an implicit contract with your OS that it won't be written to swap space while it is pinned), put the sensitive information in the page, use the information, wipe the information, and un-pin the page. I wonder if NSA has built a virus to collect PGP keys? Bill

1 0

Re: Questions for Magaziner?
by John Kelsey 17 Dec '03

17 Dec '03

> From: Robert Hettinga <rah(a)shipwright.com> > To: cypherpunks(a)cyberpass.net; cryptography(a)c2.net; dcsb(a)ai.mit.edu > Subject: Questions for Magaziner? > Date: Thursday, September 17, 1998 11:38 PM > Anyway, In light of more recent crypto-shenanigans from Billary, and the > fact that this thing's a small crowd, I figured I'd ask if anyone on these > lists had a question they wanted me to ask him. Here's a question I would like to ask, in a rather rough form: There has been a lot of talk by the administration about ``striking a balance'' between citizens privacy concerns and the interests of police and spy agencies. Can you give us some concrete examples of what tradeoffs between these two you consider reasonable? For example, what benefits to society would be worth making all private communications available to the FBI or NSA? Would it be a worthwhile trade to the citizens of the US if we could double the street price of cocaine, at the cost of essentially all phone calls being recorded and subject to monitoring at any time? How about cutting the (already barely measureable) risk of dying from a terrorist act in half? My complaint with their rhetoric is that they always talk about these tradeoffs and about striking a balance, but we never seem to see any balance being struck. Striking a balance means acknowledging that some societal benefits aren't worth giving up our privacy. Will doubling the street price of cocaine improve my life much? It sure doesn't look like it will to me. How about cutting my risk of dying from a terrorist act? This is already much smaller than my risk of dying in a plane crash; how much lower does it need to go? (There is also the issue of whether any claimed set of benefits can be accomplished by key-escrow, or for that matter by putting a videocamera and microphone in every home. But that's a different issue.) Of course, there are a bunch of problems with trying to analyze violating fundamental individual rights for some perceived social benefit, but I don't think their basic argument can work, even if we grant that this sort of tradeoff is a legitimate thing for governments to do. The tradeoffs we've seen offered have not given much weight to citizens' desires for privacy. Consider the Clipper chip, the continued use of export controls to slow down deployment of encryption in the US and worldwide, the FBI's CALEA demands (including their demand a few years ago to be able to listen in on 1/2% of all ongoing calls in urban areas), etc. We haven't seen any attempt to strike a balance so far, just an attempt to claim some bureaucratic turf. > Cheers, > Bob Hettinga --John Kelsey, kelsey(a)counterpane.com / kelsey(a)plnet.net NEW PGP print = 5D91 6F57 2646 83F9 6D7F 9C87 886D 88AF

1 0

Technology: The Great Deregulator
by rah＠shipwright.com 17 Dec '03

17 Dec '03

St. Pete (Peter Huber, that is) Speaks! Cheers, Bob Hettinga --- begin forwarded text Date: 27 Oct 1995 14:23:50 GMT From: khh(a)access4.digex.net () (by way of rah(a)shipwright.com (Robert A. Hettinga)) To: rah(a)shipwright.com Subject: Technology: The Great Deregulator Organization: Express Access Online Communications, Greenbelt, MD USA Path: sundog.tiac.net!daily-planet.execpc.com!news.moneng.mei.com!uwm.edu!chi-news .cic.net!newsfeed.internetmci.com!in2.uu.net!news3.digex.net!access4.digex.n et!not-for-mail Newsgroups: alt.politics.economics Lines: 91 NNTP-Posting-Host: access4-2.digex.net X-Newsreader: TIN [UNIX 1.3 950824BETA PL0] X-Newsreader: Value-Added NewsWatcher 2.0b27.1+ Following is an article by Peter Huber. More articles by Mr. Huber can be seen at http://khht.com/huber/home.html. ----------- The sun is finally setting on a dismal century of economic commissars. Not Russia's, ours. I mean the people who, for most of this century, controlled price and output in markets for trucking, air travel, railroads, telephone service, cable TV, natural gas and electricity. Until recently, these mammoth industries, representing a sizable fraction of the U.S. economy, had about as much to do with free-market competition as the steel industry in Stalingrad. It started with the Interstate Commerce Commission. Established in 1887, the ICC was to be the federal antidote to rapacious railroad monopolies. Perhaps it was, for a while, but in the end it drove them into bankruptcy. Meanwhile, local, state and federal legislators set up baby ICCs left and right on the assumption that highways, pipelines, phone wires and power grids all required much the same handling as railway track. In track-like industries, monopolies were natural. Competition was wasteful. Commissions were smart enough to run things better. Most of the people who believed such things died years ago, but the government pyramids they built have endured. A great decommissioning of economic life in America is now under way. The job is almost finished for airlines and trucks. It's inching ahead in the communications arena. Electricity is just getting started. We'll find out in due course whether Newt Gingrich and Bob Dole can deregulate as boldly as Ted Kennedy and Jimmy Carter, who kicked off serious economic deregulation in the 1970s. As the Kennedy/Carter legacy confirms, the impetus for change isn't hatred of government. Nor can the decommissioning of America be blamed on right-wing capitulation to big business. We've just learned the hard lessons of commissariat collectivism, in much the same way as the Hungarians and the Czechs. Consumers end-run the regulators. Fed up with prices that force them to subsidize residential consumers, factories and hospitals cogenerate electricity in their heating plants. They install "private branch" telephone exchanges that displace about one-third of the phone service they'd otherwise buy from the local phone company. Landlords set up rooftop satellite dishes on apartment buildings and sell "private cable" service to tenants. When you mow your own lawn, regulators get trimmed too: There's no income tax for them to collect, no maternity leave to grant, no minimum wage to enforce. Technology outwits the regulators. Hub-and-spoke routing and yield-maximizing pricing schemes concocted on supercomputers that shattered the old Civil Aeronautics Board's point-to-point vision of how air travel should operate, and at what price. The FCC's vision of "local" broadcasting provided by a few, community-based stations collapsed when Ted Turner began bouncing his UHF station off a satellite and back down to cable systems nationwide. And billions of dollars of commission-prescribed prices will soon have to be rejiggered because smart-aleck programmers have worked out how to transmit two-way voice conversations live over the Internet. The commission's policy is to price voice connections about $ 4 an hour higher than "date," but digital technology obliterates the distinction. Regulators are cannibals. As commissions proliferate, they undercut each other. Long distance phone companies and "access providers" like Teleport expand under lenient federal control -- at the expense of local phone companies kept on a tighter leash by state commissions. Wireless phone service has been almost completely deregulated by its federal regulators, so it grows far faster than service by way of telephone pole, which remains heavily regulated under the price regulation maintained by one bureau of the FCC. Direct broadcast satellite, cable's competitor, is booming under the hands-off watch of another bureau of the same federal commission. Regulators invest badly. They direct utilities to put billions in overpriced power plants, inefficient wires and extravagant service out to the very last ranch at the end of nowhere. Cost is no object; it just gets dumped in the "rate base." Competition, when it arrives, is devastating, just as the fall of the Berlin wall was devastating to the factories that built Trabants. In these times of radical technological change, utility monopolies are as unstable as politburos. Many of the old-guard enterprises may still grow and prosper, but only if they learn to sell to a whole new class of buyers. Consumers, not commissars. -- Copyright 1995 by Peter Huber. Electronic copies of this document may be distributed freely, provided that this notice accompanies all copies. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Anonymity: A Modest Proposal
by Pierre Uszynski 17 Dec '03

17 Dec '03

kelso (kelso(a)netcom.com) suggested: [Let's split the message, get both parts independently to the end-recipient and let him sort it out] Thomas Grant Edwards (tedwards(a)Glue.umd.edu) continued: [Well, let's just get it there still encrypted] I'll continue in this direction: My understanding is that it is a Good Thing for the last stage remailer to be able to claim: "I received high entropy stuff. There is no way I could tell what it was. I just forwarded it. I just make sure I do not forward low entropy stuff." Furthermore, it would help everybody if end-recipients were somehow able to signal whether they are or are not willing to read clearly anonymous material (and are suckers for pseudonyms :-) The problem is that it is currently the last stage's responsibility to decipher most messages, and it is very difficult (at best) to go back and modify all mail and news readers so their user can shield himself from anonymous stuff. We could however provide servers that make it "Very Easy" or at least easier for the end-recipient to make sense of split or still encrypted email messages: (In broad lines, depending on the remailer type.) The end-recipient may receive one encrypted message, or k split parts of a message that say, prominently at the top (ni the message body so that braindead mail readers show it to their users): "If you are the end-recipient for this email message, you can get it decrypted by forwarding it as is to a Handyserver such as handyserver(a)well.known.site. Don't worry about formats, the server knows what to do. If you received several such messages, forward all of them one by one or together. They may all be parts of one message. The server remembers parts for a week, while waiting for more parts, and will respond when done." Now, we need a way for this to work for the end-recipient but not for the last stage remailer. How about the message sender sending, through the remailer network, to the Handyserver (How about Johnnyserv as an other possible name :-), the decryption key, the end-recipient email address and name, and the first few bytes of the encrypted messages. The Handyserver authenticates service requests with some heuristic based on name and email, and knows which key to apply based on the message's first few bytes. That's extremely weak authentication but it usually takes no effort by the end-recipient and the last stage remailer can now say "I cannot attempt to get all my traffic through Handyservers. Not only it would be very time consuming, but I would have to illegally forge the recipient's address and the Handyserver would forward the decrypted version directly to the end-recipient anyway." The Handyserv can also keep a list of tokens publically posted for the sender to be able to confirm whether his message was or was not decrypted (that's an acknowledgement for a successful transmission through the remailer system, too.) In summary, the Handyserver provides a "mild" function: Its logs could permit the identification of the last stage remailer, but so what, the end-recipient had this info already. The last stage remailer now is safer. And the end-recipient has to choose and voluntarily get the message decrypted. That could take care of email. Maybe something similar is possible for news (more or less the way rot13 worked, way back then, in the good old times when it was deemed sufficient to protect sensitivities.) Pierre. pierre(a)shell.portal.com

1 0

Re: CJR returned to sender
by Anonymous User 17 Dec '03

17 Dec '03

In article <> bal(a)martigny.ai.mit.edu wrote: > Date: Wed, 25 Oct 1995 09:08:15 -0700 > X-Sender: tcmay(a)mail.got.net > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > From: tcmay(a)got.net (Timothy C. May) > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > At 6:35 AM 10/25/95, Timothy C. May wrote: > > > >(* Hal Abelson of MIT says there are possible export problems with the MIT > >Press book on PGP, and MIT dropped plans for a version in a special OCR > >font. So, I agree that _some_ books cross the line and look like pure > >software. However, I continue to maintain that a badly-printed barcode is > >just a joke, nothing more.) > > Brian LaMacchia sent me e-mail saying the MIT book _was_ published with the > OCR font as originally planned. No response to their CJR request, submitted > in Jan or Feb. > >[Blatant plug for MIT Press...] > >For reference, the title of the book is "PGP: Source Code and >Internals", ISBN 0-262-24039-4, hardcover, $60.00. There are links to >the MIT Press pages from my keyserver home page (http://www-swiss.ai.mit.edu/~bal/keyserver.html) or you can go to MIT >Press's site (http://www-mitpress.mit.edu/) and look under >Books/Computer Science. Orders accepted over the net using either HTML >forms (SSL) or e-mail (PGP). > >MIT Press is also selling "MIT PGP" T-Shirts, but I don't have pricing >or size information on them yet. They have the logo from the book cover >on the front & back. Front says "Mind your own business," back has a >copy of MIT Press's PGP public key (in ASCII-armored form). > > --bal Its worth 60 buckx because the book has the old version without the weakness in it. they are probably assuming that people will look at the book instead of the ftp source code and then get lazy and complie the code off the ftp instead of typing or scanning the book.

2 1

Conference in Eugene, OR - 11/3 and 11/4
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One of the professors at the U of Oregon School of Law here in Eugene, Keith Aoki, has put together what looks like a pretty good conference. As far as I can tell, it's going to be something of a sleeper - lots of good speakers, and probably not very many people in the audience who'll be able to appreciate what they're seeing. Folks on the west coast interested in law and technology policy might do well to pop up to Eugene for the weekend. I've got limited floor space for people who need a place to crash and don't want to pony up the $ for a place in Eugene. (I'm in Springfield, the redneck town across I-5 from Eugene - I'm about 15 mins from campus by car, and can give folks a ride over if they're willing to stay for the day.) Motel rooms ought to run between $30 and $80 per night in Eugene, depending on whether or not knife marks on the headboard and the smell of old cigarettes bothers you. :) Eugene is 2 hours (~ 110 miles) south of Portland on I-5 and 8 or 9 hours north of the Bay Area by car, up I-5. There's an airport here, so it's possible to fly in - some rocket scientist planners put the airport way north and west of anything interesting in town, though. The conference is Friday, November 3, and Saturday, November 4. Speakers include (in no special order): John Perry Barlow James Boyle Rosemary Coombe Steven Winter Rudy Rucker Tim Sloan A. Michael Froomkin Marc Rotenberg Lee Tien Cait Clarke Gary Glisson Rex Heinke Eric Hughes Matthew Ghourdjian Benjamin Kaminash Barry Schrader Vibeke Sorenson Dhruv Khann Jerry Kang Peter Jaszi Jessica Litman David Peterson Brian Stine Alfred Yen Richard Stallman James Love Pamela Samuelson Jerry Berman Shari Steele E. Wally Van Valkenburg Margaret Chon Folks who want to stay with me (you should be at least dog-tolerant) or who want help getting picked up at the airport/finding a motel/whatever are welcome to give me a call (503 744 2713) or send E-mail. I think there's some charge to get in (not for law students, so I haven't been especially attentive to it) but Keith said that we can probably waive that if folks are interested and can't pay. If that sounds like a problem, send mail, and I'll see if I can get him to issue some Cypherpunk passes. (The idea is to extract $ from working attorneys without scaring away interested non-attorneys.) It ought to be quite a conference. By all means, if you can make it, come on up (or down). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMJMtEH3YhjZY3fMNAQHSBQP/R4OdjIQIYbpcR0sloIBc+ZVeR8hzQ81w c8o2NyKncO0P/Hthxx+peCAUwN2S7RJr8k/jNvY0ah5Qcy4lmPnhn3uBVZFeY9O4 7I+NPimj38xNjvYdnUYrQT1HuEyVknnwi1s/2VsSGCVvbfJkHOWkuc0nR8JCX1cI sc5GsGR2zzk= =W/r5 -----END PGP SIGNATURE-----

1 0

Re: MD4-derived hash functions
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9510261603.AA26221(a)zorch.w3.org>, <hallam(a)w3.org> wrote: > > 3DES with only two independent keys is only slightly more secure than > DES, consider a variant of the meet in the middle attack exploiting > the fact that the constraint network is reductible to two equations > in one unknown. > Huh? Are you sure you're not thinking of 2DES? 2DES is known to be not much more secure than DES: 2DES can be broken with 2^56 operations and 2^56 space. (The space requirements can be eliminated without too much extra cost in time.) Could you post a reference for your claim that 2-key 3DES is insecure? Or post an attack? Or anything? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMJLJdSoZzwIn1bdtAQFFRQGAgPceMs6vYCq4nGQQ5QT9tOLIgiGAoY8M B71KIQDP75TMiF1rgvorSWQsNZjzjhbm =3bH5 -----END PGP SIGNATURE-----

1 0

Digicash will not fly
by James A. Donald 17 Dec '03

17 Dec '03

While Chaum is a brilliant cryptographer, he is an incompetent businessman He has demonstrated this in numerous ways. The latest being "Cash" where the bank skims off 4% to 10% every time. No one is going to use digicash under these kinds of terms and conditions. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

ques. regd. STT
by Mahesh Prakriya 17 Dec '03

17 Dec '03

Hi. A group of us at the U. of Penn. are doing a presentation on STT. I would like to know if you have any suggestions for us. I've taken a look at the Visa & MS home pages and have a good amount of information on STT. I'm esp. interested in finding out about the potential weaknesses in STT. thanks, Mahesh +-----------------------------------------------------------------------+ Work Home ------- ----- 1717 Arch St., 3E4 1801 JFK Blvd., #512 Phila., PA 19103 Phila., PA 19103 (215)-466-5476 (215)-567-2006 Internet: prakriya(a)gradient.cis.upenn.edu http://www.cis.upenn.edu/~prakriya/home.html PGP fingerprint = 6A EC 5B F3 D4 33 F6 D1 4C DA 99 11 F9 D9 89 A7 +-----------------------------------------------------------------------+

1 0

Austin E-Commerce Conf -- BOF?
by Stephan Somogyi 17 Dec '03

17 Dec '03

If there are any other cypherpunks-readers attending the e-commerce conference in Austin on Monday and Tuesday, it might be fun to get together for an impromptu BOF either at lunchtime or later in the evening. Email me if there is interest. _______________________________________________________________________ Stephan Somogyi Senior Editor Digital Media

1 0