- cypherpunks-legacy - lists.cpunks.org

Re: Don't Kill the Messenger--A New Slant on Remailers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 20 Oct 1995, Timothy C. May wrote: > Drives are cheap. I just saw a 1.2 GB for $195 (internal, PC). I suspect > that anyone sweating over having only a MB to spare shouldn't be running a > remailer. The trouble is, I can't just add a 1.2 GB disk to my ISP and use it, I have to pay monthly for more space. In addition, it would be time-limited to three months or so in any case, as I'm going to be travelling and wouldn't be able to support it. > (Not a slam against Mark, just a statement that there are certain minimal > capabilities I'd expect to see, and not having free disk space is a serious > problem.) Yeah, I was mostly intending it to be a proof-of-concept, not really as an operational remailer at this point. If it was available as a patch for Mixmaster, say, then anyone who wanted to run such a remailer and had the disk space available, would be able to do so. BTW, how would the ECPA apply to, say, bouncing non-PGP messages ? From the sound if it, doing that would be worse from a legal standpoint than not doing it, as it would imply I was censoring the mailfeed in some fashion. Mark

1 0

Re: textbooks
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Perry writes: > Kenshiro writes: > > I am planning to do take an independent study course in cryptography. A > > professor here is interested in doing it with me, but neither he nor any > > other faculty members at this school is very knowledgeable about > > cryptography (hence his interest :). I am looking for good (technical) > > books on cryptography which would work well as textbooks for undergraduate > > computer science majors with scant knowledge of number theory. > > The right place to start is the new edition of Bruce Schneier's book, > Applied Cryptography, which will be coming out within a month. The old > edition will probably do until then. There are a number of other > books, but Bruce's is the One Stop Shopping center, and you can spend > years dredging up the things in the bibliography. > > For flavor and motivation, you might also want to read the (unabridged > hardcover -- not paperback!) version of "The Codebreakers" by David > Kahn. I read this book as a child and I suppose it got me interested > in crypto for life -- the funny thing is, it appears that the same > experience inspired Whit Diffie to go off and co invent Public Key > Cryptography, so it is probably a history maker. However, I'll note > that its fluffy -- all it will do is give you a solid perspective on > how hard it is to do this stuff right and how important it is. I also suggest "A Course in Number Theory and Cryptography, 2nd Edition" by Neal Koblitz, published by Springer Verlag. "Applied Cryptography" is certainly the book of choice, but Koblitz is an excellent secondary reference for covering a lot of the relevant mathematics in more depth. In my opinion, "Applied Cryptography" was written from the perspective of computer science, "The Codebreakers" was written from the perspective of history, and Koblitz's book was written from the perspective of mathematics. They are all nicely complementary. Dana W. Albrecht dwa(a)corsair.com

1 0

The Dr. Fred scandal
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I feel moved to make a couple of comments. o Dr. Fred did get over the edge. His communication style had little to recommend it. o He did make some good and useful comments along with some others. o Some people posting anonymously and otherwise took out of context quotes in an apparently mean-spirited way and slammed the guy. o Dr. Fred reacted o Others reacted o Some people took private email from Dr. Fred and quite unethically replied publicly on this list without his permission. o I see both sides as owing this list apologies. o There are two sides to this whole thing. Fred brought up some concerns about possible holes in software just as many of us have. Most the time things like this result in good discussions on this list and concensus is reached about the holes existing or not and the extent of the holes. Because of Dr. Fred's presentation, he quickly alienated people, and what little discussion there was about his theories was lost in the noise. We'd do better to let it drop. In the future if someone really annoys you in the way they present something, perhaps it would help more if you sent them private email noting that their communication skills are working against them and giving them some helpful pointers about how they could have done things differently. That way you'll be part of the solution instead of part of the problem. It's easier to get your dander up and express your annoyance publicly, but that affects all the rest of us. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Automatic File Wipe Utils for Win95?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Prescript: No, I am not affiliated with any government agency in any way. -----BEGIN PGP SIGNED MESSAGE----- A government agency is looking for something to ensure that files copied from a Windows 95 machine do not contain any data from unused space on the hard drive. I'm curious too. Perhaps a command.com hack that zeroes out any bits outside the actual file? The problem is that existing utilities do not work because Win95 disables direct disk access to preserve VFAT. A delete utility is not sufficient, because they are also worried about temporary files created by Win95 programs. - -rich llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIgf7Y3DXUbM57SdAQEThgQAnEWB7HI2yoxiFCdosQTNG/WxiBLkqTvJ FSf3ni7ThmHSx7acp2KueevIRcrFw89JaGj1gPH68irZj8Vh8PEP1uopQJw+QWDo A5NsTPiZnDooXN+svGNo1KH0k36+73xXh5wybXzKFgwHWz9X4RtE+lZdJ9JDf1z7 O8IT0zG6nqc= =NSyb -----END PGP SIGNATURE-----

1 0

ADMIN: Cypherpunks list meltdown, temporary delay in postings
by John Gilmore 17 Dec '03

17 Dec '03

Somebody started forwarding every new cypherpunks message BACK to the mailing list. Each such message would, of course, trigger yet another message back to the list, resulting in a runaway situation. My guess is that it's caused by a bug in a procmail script being run by one of three people at io.com. We're investigating. Meanwhile to break the loop I am manually screening cypherpunks messages, which will result in multi-hour delays before your posting is seen by the list (since I only look at new stuff every few hours). I've yanked the three suspect users, and can probably turn it all back on sometime on Saturday. If you have urgent messages to go out, cc them to me personally and I'll probably notice them sooner. By the way, Hugh and I will probably be upgrading our version of Sendmail within the next few weeks, so you can possibly expect some further funny behaviour while we test it. I hope it isn't nearly as funny as this last meltdown. Don't worry, I didn't really write this message. The NSA had a few glitches in their MITM impersonation of toad.com, and posting this to reassure you that everything is OK. :-) John

1 0

Sun speaks out - but not to the cypherpunks
by fc＠all.net 17 Dec '03

17 Dec '03

This response came from Sun to Risks: > Date: Mon, 16 Oct 1995 21:22:40 -0700 > From: Caveh.Jalali(a)eng.sun.com (Caveh Jalali) > Subject: Re: Risks in Java > > If we are going to "analyze" java security, let's keep in mind that there is > an important distinction between the language (java) and the machinery which > runs the java program. > > Java is a general-purpose programming language along the lines of C/C++. > So, there is no doubt that its expressive power overwhelms our > theoretician's abilities to predict java-programs behavior -- this is where > we start getting into the halting problem, computability and other black > magic. Basically, i don't think we can "trust" programs written in any > *useful* programming language. Read: We can't trust Java programs. > The area where we can (must) build trust is the computing base. > Traditionally, this has been the OS, but in the case of java, it is the java > interpreter (such as netscape 2.0 and hotjava). The browser is now the TCB > (trusted computer base) for all practical purposes... Read: The Java interpreter is supposed to be a TCB > And, to address the specific concern about applets spamming the net -- from > what I've seen, applets are only allowed to connect to the server that > supplied the applet in the first place (by default). The worst thing one > could probably pull off is to spam oneself. Read: By default only - also note, none of this invalidates attacks 30-49 from the previously posted list. Who here truly believes that the implementations of Java meet the requirements of a TCB? -- -> See: Info-Sec Heaven at URL http://all.net Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

Verisign and MITM
by sameer 17 Dec '03

17 Dec '03

I recently submitted a certificate request to Verisign for my SSL web server. Looking over the process, I don't see how it avoids MITM in any way. The process: A) I send to netscape-cert(a)versign.com the email address and phone number of my webmaster (me) along with the cert request, generated using SSLeay's 'req' utility. B) I fax to Verisign a request letter saying "I have a right to use the name Commmunity ConneXion, etc." and proof of right to use name. (Berkeley biz liscense and Alameda Cty. fictitious bizname statement, in my case.) C) I snail mail them the same thing. I don't see any mechanism in place to avoid an MITM subverting step (A), and putting in his cert request in there. There isn't a strong cryptographic unforgeable relationship between my usmail/fax/proof request and the emailed kx509 cert request. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1

Re: Verisign and MITM
by tcmay＠got.net 17 Dec '03

17 Dec '03

[ssl-users(a)mincom.oz.au deleted from the distribution, as I am not on that list] At 3:40 PM 10/20/95, sameer wrote: > I recently submitted a certificate request to Verisign for my >SSL web server. Looking over the process, I don't see how it avoids >MITM in any way. .... > I don't see any mechanism in place to avoid an MITM subverting >step (A), and putting in his cert request in there. There isn't a >strong cryptographic unforgeable relationship between my >usmail/fax/proof request and the emailed kx509 cert request. An interesting "direct demonstration" of this would be to get a certificate generated for a well-known company, institution, or political candidate. This would demonstrate the flaws in the e-mai/fax/snailmail process like nothing else. (Tangential note: Of course, my fear is always that exposing such flaws shows that "we need a national identity system." After all, what Sameer is describing is implicit in the fact that neither e-mail, nor a fax, nor snail mail, is proof that an entity exists, or that the paperwork represents the entity. That's a tough nut to crack, absent an "is-a-person" or "is-an-institution" credentialling system.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: How can e-cash, even on-line cleared, protect payee identity?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:20 PM 10/22/95, Bryce wrote: >I can imagine a future in which this requirement is not difficult to >meet. Perhaps it will be the case that you can accept a coin, open >up a new ("anonymous") account with the bank, deposit the coin, >withdraw a new coin of the same amount, close the account, and now >have an untraceable coin all in a fraction of a second. Bryce, we'll make you a believer in online clearing yet! This is essentially the point several of us have been making, that if "anonymous bank accounts" are allowed (_technically_, no problem), then Bob can take his "possibly watched" piece of cash, deposit it with his bank in his anonymous account, withdraw the same amount (or more, or less, it doesn't matter if the account is truly anonymous) and neither Alice nor the Bank know who got it. As you note, Bob can even open a new account, deposit, withdraw, close the account. This makes the bank a "digital coin laundry," such as Lucky Greene and others have talked about. If forbidden by law in the U.S., no problem using offshore banks. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

8 11

bernstein results?
by sameer 17 Dec '03

17 Dec '03

So when do we find out what the judge had to say about the hearing on Friday? -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1