- cypherpunks-legacy - lists.cpunks.org

Selling our spin. was: Cypherpunks Press release
by Pat Farrell 17 Dec '03

17 Dec '03

Kevin L Prigge <klp(a)gold.tc.umn.edu> writes: > Does anyone know exactly how the press contact thing works? My impression > is that a reporter/journalist stumbles on to someone who knows something > about a particular area, and is willing to be interviewed. Then the next > time a story comes along that deals even slightly with that subject, the > reporter will tend to contact that person. I think the "exact" process varies with the journalist. But you have it generally correct. The press runs on reputations. When a writer gets a story, they look for "reliable sources" to contact. Reputations are based on a lot of things, including knowledge, speaking ability, looks and the ability to emit a sound-bite that is interesting. it is a strange process. I mean, I even got on CNN during the Morris worm. Tim is right, there is no "we" here. We can't have an official spokesperson, we don't agree on much. But we can work from the ground up. There are a number of serious cryptographers on the list, or at least friendly to the list when the S/N ratio makes sense. With a little work, we should be able to find a fairly long list of media contacts. We can even make it media friendly. >From people I've personally seen recently, we could have Doug Humphrey of Digex (nice to have a security-related company President) Bob Stratton of UU.Net (corporate security wiz) Carl Ellison of TIS (usually on c'punks light and at all DCcp meetings) probably others at TIS such as Ken Mendelsen or Steve Walker For the political side, the folks at EFF, CDT, EIPC, etc. And there are others that could be good contacts, such as William H Murray of Delloite and Touche, Matt Blaze of [Bellcore|BellLabs] It might take a while to get permission for referal, but I expect that most security consultants would consider being quoted in mainstream press to be good advertizing. If we make it easy, anyone would be willing to take advantage of the resource. We should also inclue a representative sample of folks who disagree with us. Any real list should include Dorothy Denning and other supporters. We can simply stack the deck. We can make sure that the mainline journalists know where to look, and make sure that CDT, EFF, ACLU, and EPIC have references that are ready when they are asked for referals. Assuming my web server recovers from the mention in comp.risks, I'm more than willing to accept suggestions and have a "security spokes-folks" page. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

SALT LAKE CITY
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, Anyone on this channel live in or near Salt Lake City? I'm planning my trip across the continent, and I'm looking for a place to spend the night in the Salt Lake area. Any takers? S a n d y

1 0

Re: GAK
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>>>How 'bout GIC (Gov't Interference with Crypto)? >>>or Federal Usage of Keys? >> >>Clearly -- >> >> Federal Usage of Citizens' Keys > >OK, one more: CRyptographic Access Police > >Doug > Perhaps: Cryptographic Resource Available to Police ? Finger merriman(a)metronet.com for PGP2.6ui/RIPEM public keys/fingerprints.

1 0

Spam of c'punks list: cleaning it up now.
by John Gilmore 17 Dec '03

17 Dec '03

Somebody, apparently at ci.diamond-bar.ca.us, has been feeding the last month's worth of Cypherpunks postings back to the Cypherpunks list. You probably saw a few of them. They are still coming in to toad.com. When I got home this afternoon, the load average had hit 150 and most of them were copies of sendmail. This prevented most of the messages from getting out to you, happily. I've cleaned up the ones I found in the queues, and I'll start working next on getting the *valid* cypherpunks messages flowing again... John Gilmore

1 0

Re: Project: a standard cell random number generator
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:50 PM 9/20/95, John Gilmore wrote: >Software-generated random numbers are likely to be of poor quality. >There just isn't that much true randomness visible to computers. >Several ways to build good hardware random number generators are >known. But before hardware random number generators can be >incorporated into common desktop computers, someone will have to put >them into a small fraction of a chip. Essentially, to have good market penetration, this means building a small hardware random number generator into the Pentium, and a few other popular processors. Building it into a separate chip is ineffective, as chip counts are going down on motherboards. (Some may quibble, but clearly about 60-80% of the market is now x86-based, with motherboards supplied by a limited number of companies, and with "chipsets" like the Triton.) What would it take to convince Intel, then, to devote resources to put a HRNG module on, say, future versions of the Pentium, Pentium Pro (P6), etc.? A lot, I'd say. First, Intel will ask what products would gain from _some_ hardware platforms having HRNG when the majority will not. (This is important, because it means that as long as there are vast numbers of 486-, Pentium-, SPARC-, MIPS-, 68K-, and PPC-based systems out there that DON'T have hardware random number generators, then Netscape and other suppliers of software CANNOT COUNT ON THE HRNG. This is an important point: a hardware RNG standard will take many years to percolate into the installed base and reach a level of penetration where even 30% of all machines are equipped with HRNG modules. In the meantime, Netscape and everyone else has to come up with solutions which fit the existing and nearterm-available machines. Second, how much extra will customers pay? Even if the area of the HRNG is less than 1% of the total, design resources are consumed and potential reliability and liablility issues arise. (Liability is problematic precisely because the HRNG is nondeterministic, and some chips are likely to be "more random" (which is "good") than others which are "less random" (which is "bad"). Imagine a customer having a chip which he finds out produces very little entropy, for technical/manufacturing reasons. >You probably can't build a hardware random number generator out of >existing "gate array" gates or "standard cell" cells, because all the >existing gates and cells are designed to behave completely >predictably! It will take designing a new circuit structure. You probably can, actually. CMOS and BiCMOS have all sorts of structures in which threshold voltages can be measured. DRAM arrays have various seemingly-random (*) discharge characteristics. Zener diodes can be built in any of these technologies. At small enough structural levels, such as we are now seeing at the .35 micron level and below, noise is omnipresent, and is dealt with in various ways. Thus, using the noise is not so difficult. (* The various charge/discharge characteristics are actually not random, of course, and are reproducible. But with care they can be used to increase the entropy of other soources. Care must be taken.) >Do we know any solid state physics / circuit design experts who think >this might be a fun thing to do? I bet you could get a paper out of >it. And probably improve the world a few years later, when companies >used your paper to close another hole in their computer security. I'm skeptical for the reasons given above. Even starting today, far too long to get enough out there. (Far-future thinkers will say, "Then let's start now," but it still is not true that companies like Netscape or Verisign will use such an invention to close another hole...they could only close the hole for the customers who had the HRNG-equipped machines, and this is not likely to be enough for quite some time. As John knows, but others may not, I worked on random noise effects in devices at Intel. A co-worker (now President of IC Works, Ilbok Lee) and I developed a hardware random number generator based on very low level radiation sources, using an effect I discovered. We tried to get a patent on it, in 1978, but there was no interest by Intel. Personally, I think that "software + user actions + environment stuff" can generate vast amounts of usable entropy, especially if a user lets it accumulate immediately prior to generating crypto material. * Software -- the standard cryptographic hash functions to "mix" bits even further. * User Actions -- mouse movements, keyboard timing, microphone noise, etc. * Environmental Stuff -- measurement of disk access timings, in milliseconds, amount of free blocks, Ethernet packet stuff, etc. (This may or may not be good for more than a few bits per second, but can be accumulated for several minutes or hours.) Any of these has various weaknesses and points of attack. But let's face it, would Golberg and Wagner have been able to crack Netscape if the PRNG had used some mouse swirling, some random keyboard pounding, some disk access measurements, and had then hashed this with a noninvertible hash function? I think not. This approach has the benefit of working almost immediately, without special dongles on the back of machines or of convincing Intel and Motorola to add special functions (which would take years to effectively penetrate the market). --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: netscape's response
by Jeff Weinstein 17 Dec '03

17 Dec '03

NOTE: my first attempt to send this bounced at toad.com On Sep 20, 5:16pm, David_A Wagner wrote: > Subject: Re: netscape's response > In article <9509200139.ZM206@tofuhut> you write: > > On Sep 20, 12:29am, Christian Wettergren wrote: > > > One wild idea that I just got was to have servers and clients exchange > > > random numbers (not seeds of course), in a kind of chaining way. Since > > > most viewers connect to a number of servers, and all servers are > > > connected to by many clients, they would mix "randomness sources" with > > > each other, making it impossible to observe the local environment > > > only. And the random values would of course be encrypted under the > > > session key, making it impossible to "watch the wire". > > > > Wow, this is a great idea!! > > Are you quite sure this is a good idea? > > I'd be very scared of it. In particular, it opens up the chance for > adversaries to feed you specially chosen numbers to pollute your seeds. What I should have said is that its a very interesting idea. Given current perceptions of netscape, I should have made clear that I wouldn't do something like this without getting a lot more discussion and review of possible dangers and how to avoid them. I certainly can't fault anyone for wondering if we would just implement this without thinking it through, given recent events. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Euro-Clipper
by Ian Goldberg 17 Dec '03

17 Dec '03

I don't think I've seen this here (but it was on a bunch of security newsgoups...) - Ian Forwarded message: > > According to an article in `Communications Week International', the > 34-nation Council of Europe has agreed to outlaw strong encryption > products which do not make keys available to governments. > > The article, `Euro-Clipper chip scheme proposed', is on the front page > of the magazine's issue 151, dated 18th September, which arrived in my > mail this morning. > > It relates that the policy was approved on the 8th September at > Strasbourg by the Council, and coincides with an attempt by the > European Commission to propose a pan-European encryption standard. The > Council - unlike the Commission - has no statutory powers to enforce > its recommendations. However, Peter Csonka, the chairman of the > committee that drafted the document (and an administrative officer at > the Council's division of crime problems) says that `it is rare for > countries to reject Council of Europe recommendations'. > > The proposal would make telecomms operators responsible for decrypting > traffic and supplying it to governments when asked. It would also > `change national laws to enable judicial authorities to chase hackers > across borders'. > > Opposition to this measure was expressed by Mike Strezbek, VP > responsible for European telecomms at JP Morgan, who said that his > organisation `will challenge any attempt to limit the power of our > network encryption technologies very strongly'. > > Czonka said that the Council had given consideration to business > interests but had tries to strike a balance between privacy and > justice. However, `it remains possible that cryptography is available > to the public which cannot be deciphered,' his document says. `This > might lead to the conclusion to put restrictions on the possession, > distribution, or use of cryptography.' > > Apparently another international organisation, the OECD, has called a > conference of its members in December to devise a strategy on > encryption. > > I for one will be making clear to my MP that his stand on this issue > will determine how I cast my ballot at the next election. I note that > John Major stated in a 1994 parliamentary written reply to David Shaw > MP that the government did not intend to legislate on data encryption. > I am disppointed that government policy has changed to the point of > supporting the Council of Europe, and that this change has sneaked > through during the parliamentary recess. > > Ross Anderson > > > >

3 2

Re: Encryption algorithms used in PrivaSoft (fwd)
by David Van Wie 17 Dec '03

17 Dec '03

David Clavadetscher of PrivaSoft writes: > At this time our crypto engine is patented and proprietary. Ian Goldberg writes: > Waitasec... I was under the impression that if you patented it, you had to > reveal it. That's why RC4 isn't patented (it used to be a trade secret). Many technologies have both patented parts and trade secret parts. Often, companies will maintain information that is in patent applications as trade secret until they are granted. I guess I should say _if_ they are granted! After a patent is granted, it is usually a good idea to also maintain some trade secrets in your products -- since trade secrets never "expire," unlike patents. If the patent isn't granted, you still have the option of treating the contents as an intellectual property under trade secret protection. dvw

2 1

Re: The Terrorists are coming! (fwd)
by CatAshleigh 17 Dec '03

17 Dec '03

Duct tape is like the force. It has a light side, and a dark side, and it holds the universe together ... -- Carl Zwanzig ---------- Forwarded message ---------- Date: Tue, 2 Aug 1994 18:12:39 -0700 (PDT) From: CatAshleigh <yusuf921(a)raven.csrv.uidaho.edu> To: Subject: Re: The Terrorists are coming! I was originally going to e-mail this to the people who made the comments, and would recognise what they had said, so I didn't preserve the distinction of who said what, but after re-reading I think it's directly related to Big Brother's attempts at limiting our privacy the >> are my comments, the > are responces and the ones without any >> at all are my counter porposals. sorry if there's any confusion > > first of all the only "muslim" (NOT ARAB, NO ARABS HAVE NUKES, the only > > country with nukes in the middle east is Israel) country > > with a nuclear program is pakistan, and they're years away from anything > > that could be stolen. > > True, but only because they haven't gotten their hands on any yet. It is > well known in certain international arms circles that Kadaffi or Hussein > would absolutely *love* to have their own means of producing nuclear > weapons. And they aren't alone. We built Hussein, and I believe that Kadaffi was still struggeling to build chemial when we bombed him in '86, or so, but I believe I could be mistaken. > > some call it pork barrel, I call it consperasy theory to protray muslims > > as terroists. > > I don't think so. Most of the world's terrorists (with the exception of the > IRA and a handful of others) are recruited and trained by folks in the > Middle East. It may be true that they have gotten more than their share of > publicity in the past, but the fact remains - the Middle East is *the* > training ground for that sort of thing, and there isn't a fundamentalist > over there who wouldn't like to shove a suitcase nuke up Bill's ass. Every orginization which exists in the middle east has a purpose, Hezbullah's purpose is the liberation of Palestine, using nukes would be counter produtive, like in the movie "red dawn" USSR invaded, but USA wouldn't use nukes on it's own territory, because that would make it worthless land. think critically, 1) What would be gained by nuking the US? there are more Muslims here then there are Jews 2) the objective of "terror tactics" is to destroy a lot of property with as few injuries as possible, something akin to "counting coup" to demonstrate that "IF their intention had been to kill people, alot more bodies would be found, which (ie more fatalities) is easly accomplised by simply packing the bomb with shrapnal. could you be more specific about which "fundamentalists" you're talking about? > Haven't you heard? America *is* THE ENEMY to a majority of the folks over > in that part of the world. If you don't believe me, travel to that part of > the world carrying an American passport and see what happens. OY! please don't make generalizations. Iran had a popular revolution and overthrew the Shah (it's well documeted that he tortured prisoners in his jails) and replaced it with a democratic parlement, and implemented Islamic law, the USA urged Saddam Hussein to attack them and refused to extridite the Shah to be tried for his crimes. Would you expect any less after that? Who else called the USA a satan? the "ENEMY" is dictators who suppress the people from democratic elections and the countries who back them. therefore keep your eye on Egypt, but they're not very conserned about the USA because there's not much the USA can do to interfere there. > In message <Pine.3.87.9408011942.A12890-0100000(a)raven.csrv.uidaho.edu> > CatAshleigh writes: > > > first of all the only "muslim" (NOT ARAB, NO ARABS HAVE NUKES, the only > > How do you know? > that's common knowlage, when Iraq got close to developing them, Israel bombed them. the only country the usa is throwing a hissyfit about is Pakistan. (and N. Korea) > Ahem. Uzbekistan is Muslim, and is also the third or fourth largest > nuclear power, and also is in a part of the world where there is a > long tradition of ... how do I say it gently ... greasing the palm. > I spent quite a while next door in Afghanistan and am familiar with > the culture. > the 5 largest nuclear powers are 1) USA 2) Russia 3) china 4) India 5) Israel (believed to have about 100 warheads) Uzbek was part of the USSR, and that's where they deposited some of their permanent sites, Uzbek refused to return them when the federation broke apart because they (they're smart) don't trust the russians farther then they can throw a nuke at them, after all they wanted nothing to do with USSR and were forced into the USSR by the soviets invading. Nukes are their insurance, they're not going to be parting with those any time soon. China is who they should be keeping an eye on. Smaller weapons certainly, such as stinger missiles, but that's capitalism :) A large part of the former USSR was Muslim and there were strategic and tactical nuclear weapons scattered all over the place (tactical weapons are used as mines, fired from artillery pieces, carried by short range missiles, and dropped from fighter bombers). If none of these is unaccounted for, it is a genuine miracle. It was my understanding that only the USA was incompetent enough to develop "tactical" nuclear weapons where any grunt can drop them and KABLEWY > Also, there has been quite a lot of press coverage here in the UK of > the defector from Saudi Arabia who claims that (a) the Saudis backed both > the Iraqi and the Pakistani nuclear programs and (b) the Saudis at > least have some nuclear materials. > The "defector" is an idiot, saudies were too busy building infrastructure to waist money backing other people's weapons development. The Saudies backed Iraq because they were fighting Iran and saudies aren't too fond of Shi'a. It might also be noted that the USA is similarly guilty. > > second of all there are more deaths caused by lighting on golf courses, > > ask any insurance agency. > > Also not true. The total number killed directly and indirectly in > Japan alone by atomic bombs is certainly over 100,000. I can't believe > that that many people have been killed by lightning on golf courses! > <BUZ> that's deaths from lightning on golf courses verses "terrorist attacks" I should have made that more clear, sorry. I'm glad that you mentioned that though, lets remember that it was the USA who was the "terroist" who bombed the civilians at Nagasaki and Heroshima (terrorist as defined in the dictionary) > > some call it pork barrel, I call it consperasy theory to protray muslims > > as terroists. > > Pork barrel? by inflating the NSA, and CIA, more people in your department, more job security. > -- > Jim Dixon > ---------- > > > The only other people who are called terroist are the IRA, and I don't see > > the FBI scrambling to protect Great Britian's consulet in DC when a > > car bomb goes off in London > > Here in the UK we read about lots of terrorist groups, not just the IRA: > ETA in Spain ... At least not called terrorist in USA papers, in fact only the British news agencies call the IRA terrorists, american papers seem to take a neutral attitude to the situation. my paragraph was in responce so automaticaly equating "nessisary step-ups in security against terrorists" as a codeword for "spying on arabs and muslims" by the FBI and CIA. > Maybe you should subscribe to a London newspaper. > The internet is better. > --- > Jim Dixon > > Duct tape is like the force. It has a light side, and a dark side, and it holds the universe together ... -- Carl Zwanzig

1 0

Re: Silly NetScape RND tricks...
by James A. Donald 17 Dec '03

17 Dec '03

At 12:05 PM 9/20/95 -0400, Deranged Mutant wrote: > >I've only been skimming the NetScape-related posts lately, but I've yet >to see anyone mention using a keyboard-timing sampler as a source for >some random bits Under windows, you get a lot more entropy from mouse timing and position than keyboard hits. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0