- cypherpunks-legacy - lists.cpunks.org

Re: Where is PGP 2.4?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> What's PGP 2.4 ? There are several PGP 2.4's around. The ViaCrypt commercial version calls itself 2.4, and if I'm not mixing it up with something else, the SGI internal-use version (which uses a licensed RSA) also calls itself 2.4.

1 0

Bruce Sterling's Speech
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

I greatly enjoyed Bruce Sterling's speec/rant/assessment of the entire CFP conference on Saturday afternoon. Does anybody know if he will be posting the text of that speech on-line (as he has of other presentations he has made) or if somebody w/ access to one of the tapes of the speech will post a transcription? If someone can get me a bootleg, I would be willing to do the typing. -john. -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 PGP public key available upon request. KILL YOUR Privacy in the information age is a right, not a privilage. TELEVISION Information = Power = Control. Fight the centralization of information.

1 0

Re: cfp '94 transcript
by ag588＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

> > > >On Tue, 29 Mar 1994, Jack King wrote: > >> Mike Godwin stated that the FBI agent said something like " >> "we can lie to you, but you can't lie to us." That has always been true >> under 18 U.S.C. 1001. But now you can't even answer one of their questions >> with a "no" if the truthful answer would be "yes." You should read up on >> this, it's scarier than Clipper and the digital telephony proposal combined. > >Of course you can still refuse to say anything which is what you should >have always done in any case. > >I wonder that if you tell the agents that you reserve the right to lie -- >in other words disclaim an oath. Swear to lie. If you can beat such a rap. > >DCF > > > > Don't try to be clever when you're talking with the Feds. Your best bet is simply to demand a lawyer and then shut up. -- ------------------------------------------------------------------------- I am an attorney, seeking a position in the area of Computer Law. If you know of such a position available, or of someone who may know of such a position, please send e-mail! Thanks.

1 0

Web of Trust?
by Hal 17 Dec '03

17 Dec '03

One of the key concepts widely used to describe PGP is the "web of trust". This brings to mind a network of connections between people who know and communicate with each other. Two people who want to communicate can do so securely if there is a path of connections in the form of signed keys that joins them. But this is not quite right. The fundamental fact about PGP key signatures, which is often misunderstood, is this: You can only communicate securely with someone whose key is signed by a person you know, either personally or by reputation. In other words, if I want to communicate with joe(a)abc.com, I can only do so if one of the signators of his key is a person I know. If not, I have no way of judging the validity of his key. This belies simple interpretations of the "web of trust". I may have signed A's key, A has signed B's, B has signed C's, C has signed D's, and D has signed Joe's, but this is of no value unless I know D. Only then can I trust Joe's key. This means that, in the "web" picture, I can only communicate securely with people who are at most two hops away in the web of connections. I can communicate with the people I know, and I can communicate with the people they know, and that is it. This is unfortunate, because the simple web model ties into some famous research which suggests that any two people chosen at random are only about half a dozen steps apart in the web of who-knows-whom connections. (This result is where the title of the movie "Six Degrees of Separation" comes from.) If you had a system which actually supported communications via such a web model, it actually would have hope of letting two people communicate who did not have a very long chain between them. But PGP, with a maximum chain length of two, will not allow this. What would have to be added in order to allow a true web of trust model to be used in a program like PGP? Basically what is needed is some way to judge the trustworthyness of signatures by people you don't know. This would most plausibly be provided by the people who had signed their keys. For example, if there were another type of key signature which did not only vouch for the person's identity, but also for his trustworthyness and care in signing keys, then a chain of such signatures could serve as the basis for a true web of trust. Obviously such signatures could not be given out nearly as easily as the kind we have now, where a glance at some stranger's drivers' licence is often all we get, but they could be given to close friends and those we know and trust. More elaborate systems might include numerical ratings of trustworthiness which would help to estimate the strength of any given path. The main point is that some information of this kind would be needed in order to allow communication with people distant in the web of connections. Without this, I think we will continue to have problems with PGP being unable to validate keys of people we want to communicate with. People will collect huge laundry lists of signatures in the hopes that whoever wants to commu- nicate with them will know one of those people. Centralized key validators will appear (as in the case of the SLED service being started now, which will sign a key based on a signed check with your name on it). The result may be a choice between using an unsigned key or using one signed by some faceless bureaucracy, which is no better than the original PEM conception. (People may be confused by this essay because they thought PGP worked this way already. PGP does have a follow-the-web model, but that is only for following signatures. In the example above, where I wanted to talk to Joe and there was a chain to him through A, B, C, and D, we have to first sup- pose that I know and trust all of A, B, C, and D. Given that, what PGP can do is to determine whether I have valid keys for all of those people. It will notice that A has signed B's key, so it is valid. I know B and told PGP he was trustworthy, and he signed C's key, so therefore that one is valid. Sim- ilarly, I know C and I know D so PGP can follow the chain through them. Fin- ally we come to Joe, whom I don't know, but because I know D and PGP followed the web to determine that D's key is valid, PGP can determine that Joe's key is valid. But again, that was only because I knew D and everyone else in the chain. The bottom line is still that I can only communicate with people who know someone I know.) Hal

1 0

the rest of the key
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was just wondering.... If the NSA could get it's hands on half (40) of any particular clipper key, wouldn't that just leave 2^40 to compute? Even with brute force, it's trivial even next to DES. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLZmvbtCcBnAsu2t1AQE5MwP9E46rrqaqqDRASdd5EHuRgkvGmax3y/3n RQ7xIRT+ixXBfKMnSDdcScdV9OqR6JcQJFru88zynqj4XaU6u1olYKPKJhjpO1ry nE8vHi4UO8qkg4B3cnf2XZVlkwrICTzGGhZjHuqws0R3C++1AGmVBA/UrlHQxwZn h9jU4GRUHQI= =xVfX -----END PGP SIGNATURE-----

3 2

Secure MPEG ???
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Hello, does anyone know what's "Secure MPEG" and how it works? Of course it must have something to do with security and mpeg compression, but I am looking for details and specs. thanks Hadmut

1 0

Re: The President's Analyst
by Jef Poskanzer 17 Dec '03

17 Dec '03

Indeed, President's Analyst was an instant classic and ahead of its time. The tpc.org domain is a reference to it. See .sigquote below for another prescient James Coburn meme. --- Jef Jef Poskanzer jef(a)netcom.com jef(a)well.sf.ca.us "An *actor* as President??" -- In Like Flint, 1967

1 0

Re: Not. [Was Re: Federal Reserve Bank is ILLEGAL?]
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:57 PM 11/11/1996, "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami. wrote: > On Tue, 12 Nov 1996, Doug Renner wrote: >> article nearly head-on. However is it true that what you are saying is >> that two fundamental premises in the article you refer to as "rabid" are >> incorrect? Namely: >> "ARTICLE 1, SECTION 8 OF THE CONSTITUTION STATES THAT CONGRESS SHALL HAVE >> THE POWER TO COIN (CREATE) MONEY AND REGULATE THE VALUE THEREOF. > The above is a true statement. Note however that "congress" cannot > operate the mint. It must -- **MUST** -- delegate this duty to the > executive branch (or someone outside the legislative branch, cf. Chadha > v. U.S.) if it wants it done. Congress is free to select the type > of agent it wants to do this. Indeed, if Congress chose to license > private mints, that would, IMHO be legal. The point here is that the > states don't have the power to coin money. During the Free Banking Era, banks and companies issued their own dollars. I believe that at that time the dollar was defined in terms of a certain weight of gold. The value of any dollar you might be holding was related to the level of confidence in the institution that issued it. Books were published which recorded the "exchange rate" between each kind of dollar. This is very similar to Congress licensing private mints. Peter Hendrickson ph(a)netcom.com

1 0

Re: How Many Games of Chess?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

> >This is tangentially related to crypto. I've been reading A.K. Dewdney's > >_The New Turning Omnibus_ recently to refresh my memory of all that stuff > >I learned in undergrad that I'm going to see again on the Comp Sci GRE > >shortly. :-) Anyway, I was glancing through the chapters on complexity, > >computabilty, and minimax trees, and I got to wondering something: how > >many possible games of chess are there? I know that it has to be a finite > >number, but I'm not sure how to go about finding this number. Any > >pointers would be appreciated. > >First, I think there are a finite number of games only if all stale-mates >are are required to terminate. There is that curious rule that ends a game when the same board position occurs three times in the course of the game. I wonder if there were any real cool endgames where the underdog was able to manipulate the overdog into repeating the position three times? Peter Wayner * 4129 Roland Ave. #1B, Baltimore, MD 21211-2038 410-366-1452

1 0

Re: Left, Right, Up, Down--Libertarian Ideas
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Tim May writes: > >In fairness to my left-leaning friends (Dave Mandl as a good example), > >the questions in the Nolan Chart test are designed to make almost > >anyone appear to be a libertarian. Only if you try hard to be inclusive and get people to answer "yes"; if your spin when asking/explaining the question are "no", you can often conclude that most people are statists and drive away all but the really hard-core libertarians... I have found, though, that it's biased toward getting a reasonable spread of answers from average-American types - it doesn't work very well for people who have a non-mainstream agenda (giving it at a Socialist Scholars' Conference was *very* interesting, and anarchists tend to either like or hate it or say "so what - you haven't asked any of the *interesting* questions!") It's a lot more useful for getting people who haven't thought much beyond the simplified left-right vote-like-(or against)-your-parents view that the media and mainstream politicians seems to use to think about what their political views imply, or whether the labels they and their politicians have been using really match. And if you don't like it, you can always chuck it and let the discussion go on from there. David Mandl writes: > I responded the way I did to John Kreznar's post precisely because it > looked identical to standard Republican-style leftist-baiting, which I > unfortunately see too much of every day on the net. John cleared this up :-) I was surprised to see you two arguing, since you're both anarchists or variants thereon. As Sandy points out, for the purposes of keeping crypto legal, people who support that can be our friends, and people who oppose it are opportunities for education or maybe targets for pressure. Bill Stewart

1 0