- cypherpunks-legacy - lists.cpunks.org

Re: Why escrow? (was Re: How would Leahy bill affect crypto
by jim bell 17 Dec '03

17 Dec '03

At 04:15 PM 3/13/96 +0000, Deranged Mutant wrote: >Since when is the government intentionally going to let any bill or >policy go through that isn't friendly to themselves??? (You don't >have to be an anarchist to figure that out!) Well, it's not surprising, of course, but it DOES seem to be making these assumptions. I wonder what they're gonna do when they start discovering that "all" voluntary escrow system in place have protections far beyond what they've anticipated? That's why I'm more than a little disturbed about the one really bad portion of the Leahy bill: The one that makes using encryption to thwart an investigation a crime. As Mr. Junger observed, and as should be obvious to most of the rest of us, such a section of the bill could turn a key-escrow holder into a criminal if he fails to disclose an encryption system that protects a key, or (worse!) even if he structures his business in such a way as to avoid having the decrypt key for the escrowed key at all. Previously, legally, he could probably have claimed innocence because he had no decrypt-key to disclose, but Leahy's bill would make him guilty even if there was nothing he could do to give them a key. >Nothing is safe from abuse, by the goverment or non-government fols >alike. There's always more loopholes to clean up. (Not that this >means we shouldn't clean them up... obviously bad policies should be >fixed...). Just as no crypto is 100% foolproof, no legal system is >100% abuse-proof. If I were trying to detect government investigation in such a situation, I would buy a crypto phone, open an "escrow account" on a totally voluntary basis, give them a phony key, and then (as part of the (presumably?) enforceable escrow agreement) insist that they inform me if anybody asks for the key. There is nothing in Leahy's bill which appears to prohibit the escrow agent from informing the key holder of a request/demand for the key; (I would greatly prefer if that was an actual legal requirement that they do inform the key user.) The question is, is this merely an oversight on their part, or are they planning something, or are they assuming an existing law would cover his? The answer doesn't look good. Jim Bell jim bell(a)pacifier.com

1 0

CD-reading for random keys
by knapper＠bga.com 17 Dec '03

17 Dec '03

Doe anyone know where sample code exists to enable one to read the digital stream from an audio CD? If so, I'd appreciate some pointers to it via email. It seems to me like an Audio Cd would make the perfect one-time crypto system. You merely start reading at a specific spot, tossing away bytes using a reproducable random number generator, then permuting those to form a XOR one time key of any length you want. All that would be required to decrypt it would be a CD, the starting point, and the encryption/decryption software. The first step is to be able to read an arbitray sequence of digital samples from an arbitrary spot on a CD. I'm currently looking for software (perferably source) to enable me to do that. Cheers Woody -- Woody Baker Postscript consultant/ hired software gun /flintknapper knapper(a)bga.com woody(a)knapper.cactus.org "If you ain't bleedin' you ain't knappin'" -->go ahead, ask me!

3 2

Release of PGPdomo version 0.2
by Bill Stewart 17 Dec '03

17 Dec '03

We've recently discussed PGP-enhanced majordomo, and just by coincidence, there's a new version. >Return-Path: <majordom(a)hawww.ha.osd.mil> >Date: Fri, 15 Mar 1996 14:29:07 -0500 >From: phollins(a)hawww.ha.osd.mil >To: majordomo-workers(a)greatcircle.com, pgpdomo-announce(a)hawww.ha.osd.mil, > pgpdomo-users(a)hawww.ha.osd.mil >Subject: Release of PGPdomo version 0.2 >Cc: >Sender: owner-pgpdomo-announce(a)hawww.ha.osd.mil > >-----BEGIN PGP SIGNED MESSAGE----- > > >PGPdomo version 0.2 is now available as Public Domain freeware at: > > ftp://hawww.ha.osd.mil/pgpdomo/pgpdomo.tar.Z > ftp://hawww.ha.osd.mil/pgpdomo/pgpdomo.tar.Z.md5 > ftp://hawww.ha.osd.mil/pgpdomo/README > >PGPdomo is an integration of PGP and Majordomo 1.93 allowing you >to manage encrypted mailing lists from any UNIX platform. > >PGPdomo contains perl source replacement programs (and config files) >for Majordomo 1.93. You must have PGP and Majordomo 1.93 functional >before installing PGPdomo. > >Version 0.2 adds new commands, more logging, tweaks, and bug fixes. > >Comments and suggestions welcome! > >Patrick Hollins >phollins(a)hawww.ha.osd.mil > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQCVAwUBMUm9uWYiTeh15gbBAQHysAP/W6rvXRTd437ISOoo/piCsn2gESceSA92 >jiVarMl6XqhRAvf1mpqsQiTa3uywqbuEpyu0EmnZ/cUIYbgpwMi/RCO7AqUFmb7I >hL6RDt9X1fhg4BGS/NiHJ1tG9GHWR1zlzj+KHaK1oPT4YGdNnBgwGQUZdmAmRYp+ >nCoDJdZZ6jk= >=QAay >-----END PGP SIGNATURE----- > > #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

2 1

How to use markov3 writing style changer? Origional URL?
by qut＠netcom.com 17 Dec '03

17 Dec '03

I've got the markov3 binary and source at: ftp://ftp.netcom.com/pub/qu/qut/bin/markov3 ftp://ftp.netcom.com/pub/qu/qut/src/markov3.6/ I downloaded it from a url that was posted here recently. But I can't find instructions on how to run it. Can that URL be posted again or instructions on how to use markov3? -- Have you ever brought your group into disrepute?

2 1

Re: Beat Remote Monitor Snooping?
by jim bell 17 Dec '03

17 Dec '03

At 12:18 AM 3/16/96 GMT, John Lull wrote: >On Thu, 14 Mar 1996 21:54:10 +0100, Gary Howland wrote: > >> NTSC (TV video) modulation is done by phase modulation of the 3.579545 MHz >> subcarrier. > >This is not correct. I'd suggest you go back and re-read your NTSC >references. If that's not correct, what is? And it's been years since I read NTSC; I don't even know if I now have ready access to the information. Merely saying that it's wrong isn't particularly informative, especially if you choose to copy it to the list. Jim Bell jimbell(a)pacifier.com

2 1

(Fwd) BACKGROUNDER: Internet Censorship FAQ
by Deranged Mutant 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- From: telstar(a)wired.com Subject: BACKGROUNDER: Internet Censorship FAQ Yesterday I received some friendly email from Jonathan Wallace, a subscriber to this list. Jonathan pointed me toward his Web site, where I found the following list of Frequently Asked Questions (FAQ) about Internet Censorship. It's a great background document which contains many pearls of insight, so I'm redistributing it here with Johnathan's permission. Jonathan , by the way, is also co-author of "Sex, Laws and Cyberspace," a new book on Internet censorship from Henry Holt. Spread the word! --Todd Lappin--> Sedtion Editor WIRED Magazine ================================================= The Internet Censorship FAQ http://www.spectacle.org/freespch/faq.html [..] +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+- This transmission was brought to you by.... THE CDA INFORMATION NETWORK The CDA Information Network is a moderated mailing list providing up-to-the-minute bulletins and background on efforts to overturn the Communications Decency Act. To subscribe, send email to <majordomo(a)wired.com> with "subscribe cda-bulletin" in the message body. WARNING: This is not a test! WARNING: This is not a drill! +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+- Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: Rumor: DSS Broken?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:05 PM 5/19/96 -0800, jim bell wrote: >At 08:33 AM 5/19/96 -0400, Robert Hettinga wrote: >>At 9:41 PM -0400 5/18/96, Bill Stewart wrote: >>> MD5 is at least weakened, maybe broken; there's an abstract by Hans >>>Dobbertin >>> that says something about generating collisions, and gives an example >>> (though the abstract doesn't say how general the method is.) >> >>That's what I get for not reading the DSS stuff when it came out. I'd heard >>lots about the MD5 stuff, but I didn't put the two together. >> >>It also looks like I'm behind in my reading. Time to buy another edition >>of Applied Cryptography... > >It should occur to all of us that if the NSA was actually doing the job we >are vastly over-paying them to do, it is THEY who should be finding, >exposing, and correcting these kinds of cryptography faults. Has anybody >ever heard any evidence that the NSA has ever acted in this sort of >responsible role? I was rather impressed by NSA's role in the creation of DES. The strengthened it against an attack which was not publicly known, and didn't, in the process, reveal the attack. (See AC2.) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: The Crisis with Remailers
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:01 AM 5/20/96 -0400, E. ALLEN SMITH wrote: >From: IN%"frantz(a)netcom.com" 17-MAY-1996 15:56:36.35 > >>Perhaps what is needed is a non-profit, charitable 501c foundation to >>encourage anonymous communication. Those who support the idea could make >>tax deductible contributions which would be used for grants, public >>education etc. etc. to encourage anonymous communication. It could be >>called, "The Federalist Foundation" because the Federalist Papers were >>published anonymously. > > Hmm... I wonder if it would be good for this Foundation to itself >operate some for-pay remailers, in order to make some money from sources >besides contributions? Possible disadvantages: > A. It could get sued, and thus lose funds > B. If its prices were set too low, it could wind up driving other >remailers out of the market (combination of low price with likelihood to still >be there), and thus become a vulnerable point. In general, I think this foundation should limit itself to: (1) Supporting the creation of techniques for anonymous communication (e.g remailers, nym servers etc.) This could include grants for theoretical work and grants for the production of out-of-the-box public domain systems. (2) Public education on the need and value of anonymous communication. (3) Demonstration projects to help create a market where none exists. Whenever there is a market, the foundation, like governments, should not participate as a competitor. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: My meeting with Chaum (Also: ecash full anonymity and a legal question)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 17:13 5/20/96, Jüri Kaljundi wrote: >BTW why isn't some other company besides DigiCash selling similar software >product as the Ecash mint & client? Not that I am aware of. David Chaum (DigiCash) holds the patents on the blinding technology that lies at the core of Ecash. >Public domain ecash software would be an interesting effort to accomplish. >In case of full source availability it should be possible to develop >commercial systems based on public software, it might even be more secure >than commercial software which source is available for review to only >certain persons. Coin based software that uses blinding would infringe on DC's patents. >There is also a problem with Digicash licensing: they licence only to >banks, and usually only to one bank in each country. That is not the case. At this time, there is only one Ecash issuing bank in each country that has an Ecash issuing bank. There is no reason why there might not be several Ecash issuing banks in a given country in the future. >I believe there are >also many companies that are not banks, who would also like to issue ecash >for specific purposes. Such companies could negotiate a deal with one of the current Ecash issuers in which the company gets exclusive use of one of the many currencies that all Ecash mints are capable of issuing. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: The Crisis with Remailers
by jim bell 17 Dec '03

17 Dec '03

At 09:32 AM 5/20/96 -0700, Ian Goldberg wrote: >I mentioned this to Chaum, and he didn't really seem agree with the need for >something lower-level... > >Another problem with postage in Mixmaster: the minimum ecash payment is >$0.01. Do we want to charge that much for email? Need we consider >micropayments? Absolutely! Given the exponentially increasing rate of data transmission ease, and corresponding cost reduction per bit, any "reasonable" minimum payment today becomes an unreasonable one tomorrow, and a hilariously outrageous one 10 years from now. Suppose the US Government had put a "information storage tax" on hard disks in about 1980, of about $10 per megabyte which would have worked out to be about 1/20 of the retail value at that time. Today, a 1.6 gigabyte hard disk would cost about $1850, which would be $250 for the drive and $1600 for the tax... Any more questions? Many months ago, I suggested using the idea of "probabilistic payments," in which a person could make a very tiny purchase with a large coin, by in effect "gambling" with the payment: You could buy a 0.1-cent email with a 1-cent coin, in which the likelihood of actually paying is 10%. Statistically, both myself and the vendor will be happy in the long run. An advantage of this system is that the payments can be made arbitrarily small and of indefinite granularity: I can pay you 0.3156893 cents with only 1-cent coins. I would be surprised if I was the first to think of such a system, at least in the ecash world, but I never heard anything to the contrary. Jim Bell jimbell(a)pacifier.com

1 0