- cypherpunks-legacy - lists.cpunks.org

Re: using pgp to make an otp
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:31 PM 11/6/95 EST, Derek Atkins <warlord(a)MIT.EDU> wrote: >> PGP output is not random enough to be used for a one time pad. >> The security of a OTP is *entirely* based on the quality of the random >> numbers; they should come from some strong generator. Building good >> one time pads is tough, and usually not worth the effort. > >No, however the output of "pgp +makerandom=XXX filename.dat" _IS_ >random enough for an OTP. The problem then becomes distributing this >data. amp had written: | my point here is that _if_ pgp output is random enough, i wouldn't need | hardware. even i, with my extremely limited programming skills could create | a .cmd file or program that could be used as input for a stream cypher. The output of PGP should be random enough for your application, as long as you don't think you're getting a cryptographically-correct OTP out of the deal. PGP uses its randpool stuff in its random number generation, so there are likely to be at least 24 bytes of real randomness kept around, maybe more depending on the size of your randpool, but the rest of your security comes from algorithm quality and is theoretically crackable like any pseudo-random sequence (albeit requiring exponentially-large crackwork.) It's using IDEA in a feedback mode, so it's better than just repeated MD5s. The output of PGP +makerandom probably is secure enough for most applications, depending on how many bits you're using, what you're doing with it, and how paranoid you need to be. Check out the code to be sure. You may have special applications such as amp's stream cypher for which it's more convenient to XOR the makerandom instead of using PGP, but watch out for attacks like known-plaintext, which can really bite you in secure-voice systems where there's a lot of near-silence. Careless protocol work can spoil really decent random numbers.... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: DejaNews all over again
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 7 Nov 1995 lmccarth(a)cs.umass.edu wrote: > your True Name (verinym) from your name on the net. > Many will want to use > tentacles (*), er, separate pseudonyms for discussions in different parts of > the net. After all, I might not want the c'punks to hear about my past life > as a control freak (pun intended) in alt.config. Just a reminder.... > > (*) Speaking of tentacles, Dejanews reveals that my name is on the long list > of people whose signatures have been appropriated by Detweiler ;) You too, eh?? I wish that Detweiler could (seriously) go back to wherever he came from. Hopefully this time, he can make the attempt ... backwards. I no longer become incensed at his type of spoofing. I understand that a message may look like it appears to come from a site, but it in fact doesn't. Who really knows?? Even a message that is PGP signed isn't guaranteed to be from the person who apparently signed it. Someone might have a web server that asks Netscape Navigator (very politely) to send out someone's secret PGP keyring, or asks Navigator to monitor a person's keystrokes when they enter their password, or heaven forbid their electronic daytimer. Once you have that, it's easy to send a forged PGP SIGNED email. Even worse, most readers of email will tend to believe that an electronic signature is prima facie evidence that a message is from who it appears to be from. It just doesn't work that way. You have to look at the message and use "fuzzy" logic to determine how probable it is that a given message is from the person who it represents itself as coming form. And sometimes, you'll be wrong. Just like the good old, "Dr. Frederick B. Cohen", who posted to this list. Is he really the Dr. Cohen, noted international computer virus expert, the very man who coined the term "computer virus", or isn't he? Is he the man who the US military approached to verify whether missile guidance systems could be compromised by a foreign power utilizing a trojan horse or virus, or not. Do we believe his web page?? Even if we do, do we place a greater degree of trust in his words, than that of say, yours truly, Alice de 'nonymous, or of someone who claims to be Tim May when they BOTH say that there are very serious flaws and deficincies in the Netscape Navigator product? Or do we infer that a "no comment" coming from AT&T and Netscape, acts as confirmation that the *information* in the post is reliably correct. It's impossible to say with certainty. Maybe if someone on this mailing list attended Dr. Cohen's talk today at the Hilton Hotel, in Washington, D.C., and fills us in with what he said, (if we can trust _that_ poster) and we independently verify for ourselves whether what _he_ (Dr. Cohen or Mr. Confirmation) is saying *seems* to be reasonable, then we _might_ be able to say that we _may_ be reasonably certain, that we DO have an international celebrity amongst us and posting to this list, and notifying the world of a serious problem. I mean what would you expect, a Press Release?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: Statism/Theocracy What's the difference--LDS
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

So Snow, Should your parents be (have been) allowed to pass curfew laws along with the rest of the community so that their wishes about you not going out could be enforced? Ryan ---------- Previous Message ---------- To: attila cc: cypherpunks From: snow @ smoke.suba.com @ smtp Date: 10/06/96 01:11:58 AM Subject: Statism/Theocracy What's the difference--LDS Attila said: > In <v03007808ae7af10d0afb(a)[207.167.93.63]>, on 10/04/96 > at 09:03 AM, "Timothy C. May" <tcmay(a)got.net> said: > Frankly, we do not wish curfews, and there never were curfews > before the immense immigration into the area, mostly from So. CA, > However, these people, Mormons (some good, some inactive) and (inactive=bad?) > well, that prompted the curfew, but they found it also > maintained the semblance of peacful family oriented community > among the lost and alienated families --so it is apparently here > to stay. other than the fact we are telling tparents who do not > wish to manage their children they must keep them home or take them > somewhere, what does the law do? <snip> > >.Telling people when they > >.can be on public streets and when they cannot is no different than telling > >.them what they can read and what they cannot. > that was my initial reaction -you wouldn't tell me that! but > consider the right of society to legislate and regulate in the > common good, despite both my and your abhorence of law in an of > itself. GAK is for the "common good", after all, it is only the people who are doing wrong that will be hurt by having their data scanned by the Government, it is just maintaining decency standards. > > it is an effective means of forcing parents who do not seem to > care, or parents who wish to shift their responsibilities to social > workers who are not available, they have a responsibility. what > happens to the violators --few are arrested, they are asked to go > home. there is no great wild-west roundup of teenaged cattle! any > who resist or commit minor vandalism are taken to the center --but, For most of my life I have had insomnia, and when I was in my early to mid teens, I used to wait until my parents had gone to sleep, and go out and wander the neighborhood, Mostly alone, sometimes until 2 or 3 in the morning (during the summer, not when I had to be at school). Why _shouldn't_ I be allowed to do this? In my case, it was against my parents wishes, but I still harmed nothing, commited no crime (there was no curfew where I lived). My father almost caught me (he knew I did it from time to time, but figured as long as I wasn't causing trouble, he wouldn't be able to stop me). Just because other children cause trouble, why should _mine_ be restricted? Just because it gives the APPERANCE OF MORALITY? I'll say that again, THE APREARANCE OF MORALITY. Forcing someone to follow a given set of rules doesn't make that person moral, it makes them a slave. Morality only comes in when there is choice. Also, the waters are calm on the surface, but what about underneath? What is going on behind closed doors? Here in the outerworld, we have fornication on the streets, but we know who is doing it, we _know_ who the problems are. Do you? > unlike every other city I have seen, they do not mix the > 'miscreants' with the juvenile delinquents, repeat offenders, and > the teenagers who are obviously on their way to the dead end. Almost all teenagers are on their way to a dead end. It is called "Adulthood", which if you look at it a certain way looks a lot like A Dolt Hood. I don't necessarily think it is a bad idea to mix kids (mid to late teens) picked up for "real" crimes in with "real" criminals, but then I don't think that staying out late should be a crime. Fear can be a powerful motivator. > what is the penalty? call their parents for a ride home. they > are not fingerprinted and mugged, etc. very few are required to > even see a social worker. consistent repeat offenders eventually > enter the system --as they should. Really, I should be in "the system" because I like wandering around at night? Real libertarian of you. > >.I still urge Attila to rethink his enthusiastic support of state-enforced > >.curfews, or state-imposed bans on alcohol (not that I recall him supporting > >.this particular law), etc. > actually, the curfew laws are local laws, and I reluctantly > decided to support curfew laws for minors after looking at the > means and results --it does provide an early point of intercepting > behavioral patterns with the *parent* being the judge and warder, > and hopefully give those parents a wakeup call they need to guide > their children as they are fast approaching adulthood where they > are fully accountable. Mr. May's usage of "state" means "governing body" rather than "state of the union". But you knew that. There are many other "interception" points that can be utilized to identify children whose parents are not providing them with the state approved ideological underpinings, Let's take a look at some shall we? Your children do well in school correct? Straight A's in most classes? it is obvious that you are driving your children too hard, teaching them tp be overacheivers. You shouldn't push them so hard, they should stay at the level of their classmates. Ok, that was hyperbole. Seriously tho', if you talk to many "social workers" <pardon me--*spit*> they can give you certain behavior patterns that indicate a child is being abused in the home. They could (and I am sure some would like to) go so far as to include certain types of religious and political indoctrination as abuse. If the state (city/county) mandates it, and it gives the apperance of "stopping crime", or simply provides a smooth surface, is it worth it? alcohol is available at any large grocery store; it has not been > banned to any extent since prohibition, but not necessarily avail- > able in rural areas. Not in your area, and maybe not my LDS's, but try Pell City Alabama. Same mentality, different name on the church house door. > I do not think you can prohibit anything from adults --drugs, Can, or should? Let _me_ run the DEA, and give me a good budget, and I will stop it. Yeah, people will die, but they are dying anyway. > certainly we are justified in ranting against any abridgement of > our right to freely (and privately) communicate, freedom of > *peaceful* assembly, a truly free press --certainly not the New > World Order blinded press printing the official line dictated by > political/economic Boss Tweeds of what is effectively an oligarchy > --they do not possess common principles sufficient to even be > called 'national socialists' (fascists). Yet you argue for the abridgement of freedoms based on age. Does the state know better than a parent when a minor is old enough to be out after midnight? > or, there is a government like Washington where they are trying > to, and may anyway, implement President Hillary's "It takes a > Global Village" so the state can dictate everything and raise a new > generation of robots in the mold of their revisionist history which > we are now suffering by attrition.... Which really only pisses most people off because it is a different revisionist history than they want taught. > If Bubba and the President are reelected with a Democratic > Congress, we will not recognize our once almost free country in Or, he will push too far, too fast, and it will snap back in his face. Remember, Klinton can't do it without congressional approval. Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

Re: picture encryption
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 04:04 PM 10/4/96 -0400, you wrote: >Sometime back someone mentioned a program that would hide messages inside a >picture, by replacing the LSB of the color with the message. There are several such programs. The general term is "Steganography", which means "hidden writing", so you'll see programs with names like stego, jsteg, mandelsteg, etc. Look in the usual archive locations such as ftp.ox.ac.uk and ftp.funet.fi. Also, for Romana Machado's stego programs, look at her home page on www.fqa.com. >I was thinking that if they outlawed high strength encryption (non GAK >approved), not letting them realize that you were sending encrypted >information would be an excellent alternative. It's not an _excellent_ alternative, but if it's all you can get, it's all you can get. It helps to use encryption algorithms that don't have special forms, e.g. don't begin with "----- BEGIN PGP" or other easy-to-spot headers, don't limit their output to printable ASCII, and (tougher) don't have other subtleties such as the statistical properties of RSA keys or checksums that can be tested without decrypting. There's been a lot of discussion on the subject here, and there are some stealth-PGP versions that obscure PGP's form. One difficulty with stego'd encrypted data is that it's tough to use it for applications like encrypting voice between your cellphone and the cellphone company, since _they_ won't be implementing it. One suggested place to stash encrypted data is in the low bits of compressed voice on an internet phone product. It's difficult - you need to pick a voice compression algorithm that has room to substitute bits without messing up the voice quality a lot, which means you need to work closely with the compression algorithm. For 64kbps PCM, this is easy (some of the T1 standards already do this to send signalling bits, which is why data is often limited to 56kbps.) ADPCM and Delta Modulation can probably handle it fairly well, though they're generally used only down to speeds of 16 kbps. Tighter compression algorithms have less room for noise, are much more sophisticated, require much more computation, and are probably a lot tougher to use, but they're where most of the internet phone products are. And then there are applications like CU-SeeMe (low-speed video conferencing) which are generally flaky enough that you could toss in the occasional stego frame and blame it on your cheapo camera or the overloaded reflector :-) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Can we kill single DES?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 07:50 AM 10/6/96 -0700, Declan McCullagh <declan(a)eff.org> wrote: >> >1. Is this a good idea? What will happen if DES becomes perceived >> > as insecure? >> That's Declan's department (and other non-clueless journalists - [...] >This is the meme I've been trying to spread -- that 56-bit DES is *not* >secure. In particular, it's N>>20 years old, the NBS originally certified it for five years, and kept recertifying it primarily because triple-DES was too slow on the popular bank computers of the time (e.g. cash machines and then PCs), and hardware implementations of 56-bit DES would need to be replaced if the algorithm were decertified. Public-key encryption was developed a few years after DES, with a solid mathematical background that lets it remain secure today. It's far more secure than DES but far slower, so it's only been practical the last few years. Newer encryption technology which is several times faster and much stronger than DES has been developed over the last decade. >This cuts through all the rhetoric about differences between key >recovery and key escrow, who's going to be in this industry alliance, etc. "Key Recovery" is the latest sleazy meme from the Government. The only difference from so-called "Key Escrow" is that it's deliberately obscure about who gets to keep your master keys, while "Escrow" implies that it's definitely somebody else besides you. >From the "Eternal Vigilance is Better than Hindsight" department, we should have seen this coming and done a pre-emptive strike on the term. One of the papers on Dorothy Denning's web site is a May 20, 1996 SUBJECT: Draft Paper, "Enabling Privacy, Commerce, Security and Public Safety in the Global Information Infrastructure" from OMB, which is one of the Clipper 3 announcements, and it uses the term "key recovery". # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: speeding detected by civilians
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 02:01 PM 7/13/95 -0700, Vladimir Z. Nuri wrote: >Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing >citizens to check out radar guns from the local police department to >catch speeders in their community. The radar guns are combined with >cameras in order to instantaneously capture the car, license number, and the >rate of speed. The citizens can check out the units for a week at a time. The >police have stated that they, at this time, will use the data to issue >warning letters to the violaters. I wonder how they'll feel if citizens start tracking the speeds of police cars and reporting them..... :-) # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Pathfinder Personal Edition Launches
by help＠pathfinder.com 17 Dec '03

17 Dec '03

Dear Friend of Pathfinder: We invite you to discover Pathfinder Personal Edition, the new personalized news and information service available exclusively on Pathfinder. With Pathfinder Personal Edition, you can customize the news to make it YOUR news. You just specify your areas of interest, and with the click of a mouse, Pathfinder Personal Edition searches the most comprehensive collection of up-to-the-minute news sources available online (including over 20 specialized news wires and some of your favorite magazines -- Time, Fortune, Money, People, Sports Illustrated, Entertainment Weekly and Life) and brings back to you news, sports scores, stock quotes, and even your favorite cartoons. With Pathfinder Personal Edition you're not just getting raw information from news feeds, you're getting in-depth information that's valuable to you, complete with analysis. Pathfinder Personal Edition even has a staff of real editors working every day to bring you the top stories from their areas of expertise. And with eight graphical formats to choose from and control over how sections and articles appear, Pathfinder Personal Edition literally makes the news your news. Everything is up to you -- you can build your own newspaper from the ground up or choose one of our six Editor's Editions from the newsstand and make it your own by personalizing the content right down to your local weather. Pathfinder Personal Edition puts everything in one place, so you spend less time wading through unwanted information and more time soaking up what you want to know. With this special risk-free offer, you can try Pathfinder Personal Edition for free for two full months! Avoid information overload -- try Pathfinder Personal Edition today: http://pathfinder.com/promo Sincerely, Pathfinder Pathfinder Personal Edition - Retrieves your world.

1 0

Re: Restrictions on crypto exports
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Mike - you write that an FTP archive is a library open to the public. While it looks like one to me, the important thing is convincing a grand jury or jury that it's true, or heading off a prosecutor who'll try to paint ftp archives as 'subversive hacker BBSs' or nonsense like that. (Which won't stop them from treating them as libraries if it's useful for other things they're doing.) Until there are some court cases setting precedent one way or the other, they can try to construe it narrowly when they want narrow and broadly when they want broad. It would seem that some cheap insurance in cases like this is to make sure that most of the interesting material finds its way into paper libraries, and start documenting it. Do you know if anyone's doing this in an organized fashion? (I'm in the process of moving west, so I can't start doing this with my friendly town librarian, but I may try once I'm resettled.) Bill Stewart

1 0

Announce: New mailing list for PGP developers
by Gary Howland 17 Dec '03

17 Dec '03

Hi, I have set up a mailing list for PGP developers. The main topic of conversation will be issues directly related to developing PGP tools and libraries, such as non-standard cipher feedback modes :-/ The list can be joined by sending subscribe pgp-dev _your mail address_ to majordomo(a)systemics.com. Best regards, Gary Howland -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

Phrack, where can i find it?
by varange＠crl.com 17 Dec '03

17 Dec '03

Tim Scanlon <tfs(a)adsl-122.cais.com> writing [ 762] bytes in <$m2n21503-.9612012338.AA09683(a)adsl-122.cais.com> from nexp.crl.com!usenet73.supernews.com!news.good.net!news.good.net!www.nntp.primenet.com!nntp.primenet.com!feed1.news.erols.com!phase2.worldnet.att.net!uunet!in1.uu.net!204.171.44.51!scramble.lm.com!mail2news!toad.com!cypherpunks-errors said: > > where can i find latest (and old) phrack issues? > > > ftp.fc.net /pub/phrack has all the back issues, as well as the > current ones. Mid-1995 is about their latest issue. Their older issues truely sucked with mucho false info. -- Cheers!

2 1