- cypherpunks-legacy - lists.cpunks.org

Re: a modest proposal
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Nikolaos Daniel Willmore <uunet!columbia.edu!ndw1> writes: > Greg Broiles <greg(a)goldenbear.com> offered, > "I suggest that remailer operators might find it useful to redirect > remailing requests originating from Detweiler directly to > postmaster(a)lance.colostate.edu." > > Here are results of a somewhat unfair but curiosity driven experiment. I > have got to admit I agree with the postmaster, but I figured it was worth > a try. They are reproduced without permission. > > [Postmaster sez he doesn't care what Detweiler writes] I was thinking that the postmaster would be annoyed by the volume, not shocked by the content, of Detweiler's posts. I understood Detweiler's recent posting about remailer weaknesses as a threat to exploit those weaknesses - potentially creating hassle and expense for the people whose accounts are used as remailers, and perhaps even the other people with accounts on the machines which run the remailers. He's no longer talking about (assuming he ever was) using the remailers to make an unwelcome or politically unpopular comments - he's now talking about using the remailer system to hurt the people who run it and the people they share machines with. I take issue not with the content of his messages, but their purpose and volume. I don't know how many messages it takes to swamp a remailer. I predict that it's more than 10 times the number of messages, redirected to Detweiler's postmaster, than it'd take to get his mail access yanked. His postmaster can take one of two positions: 1. Detweiler's conduct is unacceptable and beyond even the most basic requirements of decent net citizenship; and the postmaster will be in an excellent position to address this concern locally. 2. Detweiler's conduct is within the boundaries of acceptable behavior; in which case, objections to it showing up in his mailbox and on his machine (as well as everyone else's) seem hardly appropriate. If you've ever seen _Brazil_, picture the two maintenance guys with their pressure-suits filling up with sewage, after Robert DeNiro (?) replaced their air-supply tubing with sewage tubing. I figure that piping some of lance.colostate.edu's sewage back onsite seems only fair. - -- Greg Broiles "Sometimes you're the windshield, greg(a)goldenbear.com sometimes you're the bug." -- Mark Knopfler -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLTpRYX3YhjZY3fMNAQGkAwP/fIrU+ZTCs2zKS1G9jMkjGWqGa31nbu3E qsPyDkWzaTcJoR6OzYw8vXghI6zAOavSF8ei3qxRmL4j7IIiTd0nRX0f7t0fSYoU WfXyZqaByv3fdCqRu2Biylye/uQxf25F1DIszrD1uU7hN4+MNo/26OHgcgg7M0CI 0oHEBkjEl8Q= =E9uE -----END PGP SIGNATURE-----

1 0

SecureDrive Distribution Controversy
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- W. Kinney posted: Hal <hfinney(a)shell.portal.com> writes: >Mike wants to protect himself against a PGP-style investigation >into export of software. But if 1.2 is put up for FTP, it could >conceivably lead to such an investigation. And Mike would >presumably be a potential target. > >This is a confusing situation. What rights does Mike have to >control a derivative product like 1.2, given that he is releasing >it under the Gnu Public License? Legal questions aside, one might hope that within the Cypherpunks at least there might be more of an ethic of respecting the wishes of an author. Edgar seems awfully casual about exposing other people to legal difficulties without their consent, and justifying that by some bullshit technicality doesn't change the reality of it one bit. I for one am most unimpressed. And I would have hoped for more backbone from a group calling itself the Cypherpunks, perhaps we should rename it the Cypherwimps. ~~~~~ ~~~~~ I respected Mike's wishes (once they were clearly expressed) in respect to SecureDrive version 1.0, which was wholly his creation. I will continue to respect his wishes re version 1.1. But (to answer Hal's question) Mike has no control at all of derivitave products like version 1.2 and (to be announced shortly) version 1.3. I have done my best to make clear that Mike is not responsible for my distribution policies re versions 1.2/1.3. But I am not going to allow Mike or anyone else to intimidate me from the exercise of my constitutional right to publish my own code anywhere I damn well please, at least within the USA/Canada. I have not and will not export SecureDrive. I have warned anyone contemplating doing so that they may be violating US law. If someone does so anyway, it's not my fault; and if NSA or DOJ thinks it is, they can try to sell that idea to a judge & jury. If this ridiculous and unconstitutional law (especially an interpretion that publishing domestically constitutes export) needs to be tested, perhaps I'm the best one to do it. I'm retired, & my pension will continue even if I'm in jail. Should I be charged, I hope EFF will be there for me the way they were for Steve Jackson. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLTqvN94nNf3ah8DHAQE1/AP5AetHZReujCW6JZg+x5gG9FQzwuejln++ 6LyPUzHd0bt4mVecq88cHzr40V0lPu2zWEp26sP39+EqTJz05j3rA7a4B3Du7PZ/ u9e7xheXE02sRB9Y+VOjbCyA53T9GXaow6qkHZ+cb4DLx1pp+xHNhlFMOeoDmqg9 rqgPTdKUAE8= =ZcSW -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

2 1

Too Much Noise, Goodbye
by mentor＠indial1.io.com 17 Dec '03

17 Dec '03

I've been subscribing to this list since almost the beginning, and used to learn a lot from it. The incredible DetNoise has finally worn me down, though. It's been fun... Loyd -- * Loyd Blankenship /o\ mentor(a)io.com (Finger for PGP key) * * 2529 Glen Springs Way / \ "And keep on praying through that bass, * * Austin, TX 78741 /fnord\ for it is a link to Jah. One love, one * * /_______\ heart, one destiny." -- Flabba Holt *

1 0

PGP questions
by Jon 'Iain' Boone 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have set up PGP on an ultrix box. Sometimes, when I or other people sign messages, the messages show up with a bad signature. Is it possible that something in the delivery path is editing an important part of the message to cause the signature to be invalid? Or is my pgp software just flaky? Jon Boone | PSC Networking | boone(a)psc.edu | (412) 268-6959 finger boone(a)psc.edu for PGP public key block -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLTrONYSAMUrxt1aZAQEpLAP/WYByv8HfFnUa4fBit7w/0QCH+PKAr0Or G5whqmoCCq5Y9K6LCajzjTJuK5+8CfPTP5kNhdLBxqKdkhobyTjjPLSzaW8oMy2E hxp9Unp6b6CIBZ1XUtmYi2nIOBTcgH79hkrAoyJ5NpSPplXox61ft+nboM6xkN1d OmxgGLQxinM= =To1Y -----END PGP SIGNATURE----- #

1 0

thanks for applied crypto info
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

Thanks to everybody that sent information about Applied Cryptography. -john.

1 0

RSA Questions
by an56238＠anon.penet.fi 17 Dec '03

17 Dec '03

Hi Cypherpunks ! I've got a few questions about the RSA encoding (if they're answered somewhere in litterature, just give directions, thanks) If the public encryption key is e (the exponent) and n=p*q (the modulus), then the encryption scheme is: cypher= (plain^e) mod n. Number theory tells us that the reverse operation (taking the e-th root) can be performed, as long as we know p and q: we know how to compute d such that for any plain<n, (plain^e)^d=plain. Now my questions are: 1. Is there a way to determine ALL the possible values of d verifying: (plain^e)^d=plain for any plain<n (or at least have an evaluation for their number) ? In other words, is there a way to know the number of keys that unlock what your public key locks ? 2. Is there a way to determine ALL the possible values of d verifying: (plain^e)^d=plain for *a given plain* ? In other words, is there a way to know the number of keys that unlock *a given message* ? Here's an example that's quite worrying (maybe because I chose p and q to be random primes, and they have bad properties): e=17 # Exponent p=967 # Prime p q=1031 # Prime q n=p*q=996977 # Public modulus phi=(p-1)*(q-1)=994980 g=gcd(p-1,q-1)=2 f=phi/g=497490 d=(1/e) mod f=234113 # A possible value of d given by number theory Here's the result of the exhaustive search for the answer to question No. 2: plain=12345 cipher=(plain^e) mod n decipher=(cipher^d) mod n The possible values for d (138 of them) are: 3393 10603 17813 25023 32233 39443 46653 53863 61073 68283 75493 82703 89913 97123 104333 111543 118753 125963 133173 140383 147593 154803 162013 169223 176433 183643 190853 198063 205273 212483 219693 226903 234113 241323 248533 255743 262953 270163 277373 284583 291793 299003 306213 313423 320633 327843 335053 342263 349473 356683 363893 371103 378313 385523 392733 399943 407153 414363 421573 428783 435993 443203 450413 457623 464833 472043 479253 486463 493673 500883 508093 515303 522513 529723 536933 544143 551353 558563 565773 572983 580193 587403 594613 601823 609033 616243 623453 630663 637873 645083 652293 659503 666713 673923 681133 688343 695553 702763 709973 717183 724393 731603 738813 746023 753233 760443 767653 774863 782073 789283 796493 803703 810913 818123 825333 832543 839753 846963 854173 861383 868593 875803 883013 890223 897433 904643 911853 919063 926273 933483 940693 947903 955113 962323 969533 976743 983953 991163 That makes a probability of 0.013% Looks to me like it's a LOT. Maybe I'm wrong. -zap ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Inman turns down DOD sec job
by jim＠Tadpole.COM 17 Dec '03

17 Dec '03

supposedly there will be a press conference at 1:00pm to say 'why'.

1 0

Re: PGP posting validation
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

DrZaphod writes: > Ah ha! Another facet of a LIST run authentication system > [Cypherpunks Run Authentication System - CRASs?] > may be to allow users to mail THE LIST and ask their mail > to be filtered so they don't have to pay for msgs they don't > want. THIS IS DANGEROUS because a forger could mail in > such a request.. to patch this, THE LIST could mail out a > weekly msg -- a compiled list of which msgs got thru, and > which were filtered, and why. > > This opens up another possibility which may prove more > effective. If THE LIST can maintain a list of msgs/posters/ > PGP authentication, then those users who trust THE LIST > to authenticate their mail can select the msgs they want > to receive [from the same compiled list]. The list software that Ray Cromwell wrote for the Extropians list does all these things. Users can exclude [user|thread] and receive a regular ( I think daily) list of filtered msgs. Users can also set their own mode of receiving the list (reflected or digest), and can temporarily unsubscribe by excluding all. About the only intervention needed by list management is for subscribes and permanent unsubscribes, other than general maintenance. The list also has a security feature that when turned on only accepts posts from addresses previously authenticated as belonging to list members. This can still be spoofed, but at much greater difficulty than LD has had to expend heretofore. Jeff trestrab(a)gvsu.edu

1 0

Crypto and Taxes
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'll just briefly recap some of the points: Hal> I don't agree with the extreme position that cryptography will lead to Hal> the failure of the income tax and the destruction of the government. Perry> No one is arguing, by the way, that all the economy will go black. I'm Perry> merely noting that whereas right now its hard to lead a normal life Perry> entirely in the black economy (you suffer from a myriad of Perry> inconveniences), an anonymous offshore banking system that you have Perry> free access to changes all that. It's not clear to what extent Perry and I disagree here. I agree that some people will exploit the new opportunities. My doubt is whether the vast silent majority on which the government depends for its taxation revenues will do so. I read the other day that the government gets something like 70-80% of its tax revenues from people making less than $35,000 a year. These people are not financially sophisticated. Duncan> In traditional Black Markets, the transactions are illegal. In future Duncan> Black Markets on the nets, most of the transactions will be legal. Duncan> Legality certainly encourages transactions relative to illegality. I agree with the last point about legality helping, but I don't understand why most transactions will become legal in the future. I thought we were talking about ways to evade laws via cryptography. My assumption is that governments would actually crack down when faced with lost revenue, similar to what was described as happening in Italy: ??> Customers are fined for leaving businesses without a receipt. Your car may ??> be stopped and searched for undocumented merchandise at any time. Imputed ??> income taxes for self-employed people are at ridiculous levels (i.e. a ??> large degree of evasion is assumed). Taxes are levied on everything (car ??> radios, the width of your driveway, electric lighters for gas stoves). So I'd think even more transactions would be illegal in the future. The main issue, I thought, was whether people would widely risk violating these laws in order to save on their taxes, and whether cryptography would let them do so with impunity. Duncan> You left out a few information purchases: education, much of medicine, Duncan> all of financial services, design, marketing, supervision, and Duncan> management. Duncan is pointing out that more of the economy is in the form of information than I was counting. Even if we count these things as information, though, the question is still to what extent the providers of these services will be able to escape taxation. Take medicine as an example. I should be able to go to a doctor today and pay him cash, off the books, at a greatly reduced rate, for my medical services. Yet no doctor I've ever seen, and I've probably seen twenty or thirty in my lifetime, has ever suggested that. I don't see how cryptography will change this. Duncan> Once the interface is good enough, virtual offices with full workgroup Duncan> interaction built of pure information will spring up and the Duncan> "information" component of much of what we think of as physical work Duncan> will become apparent. Is this the key, people working for virtual businesses? No one knows the true name of anybody else, so no one is afraid of being caught? I am still skeptical. A whole nation of people tele-commutes to work for companies whose name they don't know, with co-workers protected by aliases, all so they can be paid in cash for their services. I find this notion implausible in the extreme. Joe and Jane Sixpack aren't going to want to work for a boss who wears a mask. Duncan> If you wander down the shopping street of a future MUD/MOO and you Duncan> buy or sell things, what nation has jurisdiction for tax purposes. Duncan> What if the MUD/MOO exists as a set of cooperative processes spread Duncan> around the globe. This may be uncertain now, but I don't see why it would always remain that way. There is nothing to stop governments from declaring, say, that residents in their boundaries are subject to their taxation, or that their citizens are subject to their taxes regardless of where they do business. More interesting from the crypto perspective would be the case where the business in the MUD refuses to disclose its true nationality or location. There again, though, I think running an anonymous corporation will pose many practical problems. Sandy> You don't need to Sandy> *own* a car, to have the *use* of a car. Imagine leasing a car Sandy> and using your cyberspace bank digital checks, digital money or Sandy> credit card to pay the monthly rent. No audit trail, and no Sandy> asset to be seized. Similar techniques can be used for virtually Sandy> all of your assets. How does this bear on the issue of government collapse due to failure of income tax? This example actually strikes me as an unobjectionable use of cryptography, one in which individual privacy is protected. The only tax consequence I see is possible avoidance of sales tax, which is col- lected only at the state level and not the national level. Sandy's example shows that car rental agencies might be able to operate on a cash basis, like the local fried chicken outlet. I don't see how this brings down the government. Sandy> I think Hal hasn't been reading Duncan or my posts very closely. Sandy> Here's a hint: A Cayman Islands corporation is a non-US citizen Sandy> even if it is owned by an American. Sandy is replying to my question about moving out of the country to avoid taxes. I gather that he is suggesting that people could set up corporations in the Cayman Islands and somehow divert some of their income to them, so that the income would be shielded from taxes. Can this be done today? Can I go to my boss and ask him to start sending my salary to this numbered bank account in the Cayman Islands, and to stop troubling the U.S. government with information about how much he is paying me? Sounds great. Why doesn't everybody do it, and why will everybody start doing it in the future? To sum up, I am willing to accept that people will be eager to avoid paying taxes, but I still doubt that cryptography will bring down the United States government. Particularly when we consider the lack of sophistication (both financial and technical) of the vast middle class who provide the bulk of tax receipts, I think that virtual corporations and offshore tax havens are not likely to become widespread enough to seriously endanger the government. (In response to John Kreznar's comments about my use of the term "cheating" to refer to violation of tax laws, I accept the thrust of his comments but I'll just observe that while preparing a false set of books may be justified and in some circumstances even honorable, it is not honest.) Hal -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLTnMY6gTA69YIUw3AQHqlgP/d6GTpNrK3c4B/jfxT5tQqAJ0uBkvc5Y7 fh1dtj16QrR/CmAHEJVV+JWXUjwaTnjqO1RdgPJfjjG1U7CaSiuy84OVlyQPSpAc JeIC7qa1HfqXRCK/bQmxcJMhbOULMKkk2plphcwDvL2Tlxe8DXvmgDLS21DUV6r+ bOT9RBf2U3c= =p55w -----END PGP SIGNATURE-----

2 1

Re: RETURNED MAIL, ANYBODY?
by drzaphod＠brewmeister.xstablu.com 17 Dec '03

17 Dec '03

> > Yep, happened to me too (subject was "Re: PGP posting validation", a > coincidence?). > > Felix I wondered about that myself.. |-] -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)brewmeister.xstablu.com] [MindPolice Censored This Bit] - - 50 19 1C F3 5F 34 53 B7 B9 BB 7A 40 37 67 09 5B - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0