- cypherpunks-legacy - lists.cpunks.org

Randomness testing
by Clifford Heath 17 Dec '03

17 Dec '03

We have been asked by a customer if we have any tests that demonstrate the randomness of the SSLeay random number generator (augmented by some sound-card random number seeding that we wrote). I'd like to find some standard implementation for testing randomness, but Schneier offers no help (other than a reference to Knuth Vol 2), and I don't know where else to turn. I realise that cryptographic randomness requires unpredictability, and this quality depends upon closed-world assumptions about unknown individuals' predictive powers, but we have to live with that. -- Clifford Heath http://www.osa.com.au/~cjh Open Software Associates Limited mailto:cjh@osa.com.au 29 Ringwood Street / PO Box 4414 Phone +613 9871 1694 Ringwood VIC 3134 AUSTRALIA Fax +613 9871 1711 ------------------------------------------------------------ Deploy Applications across the net, see http://www.osa.com

6 7

Fair Credit Reporting Act and Privacy Act
by Frank Willoughby 17 Dec '03

17 Dec '03

FWIW, while the goal of the cypherpunks in helping to promote secure private communications by making encryption publicly available on a worldwide scale, definitely helps socially backward countries which have dictators (communist or otherwise), it misses its mark somewhat in the USA. Personally, I think that in the USA, this is treating the symptom, but not the disease. Probably the easiest way of ensuring that personal information isn't wantonly distributed by credit agencies or (anyone else) is to update our Privacy Act - which is ridiculously out-of-date and badly in need of being re-written. It is also hampered by its apparent lack of teeth. My personal recommendation would be a law like Germany's BDSG. The BDSG (BundesDatenSchutzGesetz which translates to: Federal Information/Data Protection Law (aka Privacy Act). Even better would be a law like the one in Austria (which I understand has the world's strictest privacy act. (Hooray for the Austrians). 8^) If the Privacy Act were rewritten to be as strict as the BDSG, businesses would have a (mandatory) legal requirement to: o Ensure that personal data is stored properly (by encrypting it, etc) o Ensure that personal data is not distributed o Ensure that databases are *not* being maintained which describe the characteristics of individuals (buying habits, income, property ownership, etc) wantonly propagated by marketing (direct mail, telemarketing, etc) companies. (Note that credit bureaus still have a function, but they would be (forced to be) responsible for ensuring that compliance with the Privacy Act would be maintained. This could result in better safeguards being implemented by the credit bureaus.) resulting in the following by-products: o the promotion of the use & implementation of encryption - including the possibility of ITAR being reduced or eliminated for the export of encryption products o reduced propagation of personal information o reduced amount of junk mail that winds its way to our mailboxes each day 8^) o reduced amounts of tele-marketing 8^) If pressure were brought to bear on the law-makers to rewrite the Privacy Act to give it qualities like the BDSG, etc, then this would significantly help achieve the cypherpunks' goal of promoting secure private communications. (I realize this isn't the only goal of the c'punks, but its a start). As the changes would be made within "the system" as opposed to outside of it, there would be virtually no hassle from the government. IOW, changing the Privacy Act will probably solve a variety of problems while achieving the c'punks goal of secure personal communications. Food for thought. Best Regards, Frank <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified Home of the Free Internet Firewall Evaluation Checklist

1 0

Re: U.S. presidential debate: URLs, V-Chip, huge databases
by Bill Stewart 17 Dec '03

17 Dec '03

>Except for one sentence that will go down in Net.history -- Bob Dole >ended the 90-minute session with what he framed as an appeal to >younger voters: "If you really want to get involved, tap into my home >page at www.dolekemp96.org. Thank you." It's an amazing web site. The first thing that it wants you to do is fill out a Custom Design Form Information on the following form will allow us to customize your personal Dole for President web site. Imagine - a web site for a candidate so spineless he wants to tell you what _you_ believe in, not what he believes in! Dole is one of the few Republicans out there who make Clinton look like he's got principles. Bush would always sneer while he was lying to the public, but at least the man _was_ up to something. Something evil, but _something_. And when Nixon lied to you, it was ok to laugh. (Well, in most circles. And even his die-hard supporters generally understood....) >Ain't it hip to be a netizen? > .... Clinton ... V-Chip ... Dole ... nationalized ID card database >Dole called the use of illegal drugs a heinous crime, accusing Clinton >of being a "liberal." Bwah-hah-hah! <insert much cynical laughter here> Liberal. Yeah, right. I've known liberals, and he's not one. Even the hacked Dole/Kemp web page had the right-wing arrow pointing to the ClintonGore page, and the left-wing arrow pointing to the "You can't go back again" page :-) >Then, responding to a get-tough-on-guns >challenge from his opponent, Dole suggested a database system that >would check your identity and background before allowing you to buy a >gun: "You put your card in there and if it says 'tilt' you get >nothing. No guns. Zippo." Card? What card? Thank you very much! >These are hardly the words of someone who gives a rat's ass about privacy. Declan McCullagh, you have been fined two credits for violation of the verbal morality law. >What's worse, elephantine government databases or V-chip >style censorship? All I know is that neither of 'em has my vote. Isn't it nice to have options! If I weren't voting Libertarian, there's Perot and Ralph Nader (both of whom are _interesting_ statists), or Pat Paulsen (I don't care that he lost the primary), or Barry Goldwater (:-). Or there's Hugh Romney (aka Wavy Gravy, who runs the Nobody for President campaign), or Frank Zappa (who'd make a better president, dead, than most of the major candidates would alive.) Or you can take a decentralist approach - vote for someone you trust. Yourself. Your spouse. One of your neighbors. Your mom. Just spell their name right. (I've met Harry Browne, but he's always been in public-figure mode. I guess he'll do. Jo Jorgensen, the VP candidate, is actually a real person, as is Nancy Lord, previous VP candidate.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: Encryption and Backups
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 20:33 2/4/96, John Pettitt wrote: >On Sun, 4 Feb 1996, Alan Olsen wrote: > >> Something that I have not seen addressed is the need for strong encryption >> in backup software. >> >> Most backup software has an "encryption" option, but I have seen few that >> have anything resembling strong encryption. Furthermore, I have seen no >> real push for strong encryption for backups at all. >> ... >> Might be an idea for a product there... (And you can bet law enforcement >> would throw a hissy fit about its existence.) >> >CP Backup (part of PC Tools for Central Point aka Symantec) has DES. As to >how good the implementation is: I have no idea. Retrospect (a Mac Tape/Floppy Backup Utility) also has an Encryption Option I think.

1 0

RE: [NOISE] Futplex makes the news!
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

OK, I give up. Took off the head phones connected to the TO, went downstairs, set the V-15 Type II on the Dual 1019 to 7/8 gm. Patched to the Pioneer 1500TD amp feeding front AR-5's and rear AR-2ax's, cranked to "pain" and spun some vinyl. "Freedom's just anotha' word foa nothin' left to lose." - Janis Joplin & Full Tilt Boogie Band, Columbia PC 32168 (first one I found in the pile - believe the original was on a album with her standing spraddlelegged with the big grin - is here *somewhere*. Credit on th record was K. Kristofferson and F. Foster. (Had to go downstairs, contrary to popular belief, everything is not in my den 8*). warmly, Padgett

1 0

Indecent Trash
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 10 Jan 96 at 10:42, t byfield wrote: > At 10:26 PM 1/9/96, Alexander 'Sasha' Chislenko wrote: > > >- Landfills: They are probably the richest source of detailed > > historical information that is not obtainable from any > > other source and can be used to reconstruct the detailed > > history of society, economy, technology and any single > > person with incredible detail. > I ain't holding my breath until someone develops a search > engine for Fresh Kills. I can see it now... about the time that Grandson of Altavista finally yields a URL for Jimmy Hoffa's body in some dump somewhere the government will have figured out that it's so much simpler to catalog the stuff on the way IN, when all the artifacts are fresh and unmixed. While we're all watching what the government does to intercept packets, they will be routing *trash* packets through mysterious "garbage routers." As the stink grows stronger, someone will conceive of anonymous trash forwarders. They will accept unidentified trash, no questions asked, anonymize it with random DNA and fingerprint whorls, and sneak it into public trash receptacles. DNA generators will enable the mischievous to plant fabricated indications that Hillary did indeed have something going with Vince, the late Khomeini (hey, hard is hard, right?) as well as legions of four-footed friends, confirming the suspicions of multitudes. As the piles of trash-based data grow, some Senator from Nebraska will sound the alarm that kids are too easily exposed to the indecent signs of private behavior retrievable on the Net and will propose draconian measures to hold everyone responsible for their contributions to the city landfill. Public receptacles will be closed. Trash will only be collected from registered Identifed Surplus Providers (ISP's). $250,000 fine for disposing of a condom in a dump accessible from the Internet... 10 years in prison for carelessly tossing those nasty Polaroids in the kitchen compactor. The trash of the world will have to be made safe for kids to view. Everything will be a lot easier to trace and control if the garbage input is fully identified. Barcodes on trash bags might do for starters. Access to the garbage system might have to be restricted to those 18 and over. Trash collectors could be made responsible for content, drafting them without pay into the ranks of the trash police. People could be encouraged to report suspicious trash, and trash-related activities like neighbors sneaking out at night to place an innocent-looking compactor bag down the block with someone else's trash. For their own protection, youngsters might be required to retain all their garbage until age 18 and then, in a solemn ceremony worthy of the true significance of coming of age, pitch it all (duly anonymized to prevent abuse of minor indiscretions) from their new position as lawful participants in the world garbage system, friends and well-wishers trying to applaud and hold their noses at the same time (try it -- if you're not careful you can break your own nose, but hey, that'll work, too!). Who knows? Maybe Heinlein's advocacy of keeping kids in a barrel and feeding them through a hole until age 18 will enjoy resurgence among the compulsively protective while the Web meanwhile will provide real time underground data on Heinlein's rpm rate. Protecting the trash of youth will, however, give rise to the hiding of adult trash among that of the underaged. The government will have to root out offenders and "impute" suspicious trash to the parents. Those with no visible source of trash will of course be suspect, and will have to emit innocent trash to cover themselves. This will give rise to the practice of "trash laundering," in which agents convert nasty trash to innocuous trash that may then be tossed into any monitored, controlled channels with no repercussions. Trash laundering will become a grave offense to the accompaniment of government and Ad Council PSA's and free brochures from Pueblo, Colorado. Blatant offenders who have fled to foreign climes will be kidnapped, some will be tortured, because the War Against Filth will be a moral commitment of the national body. Foreign governments headed by suspected trash traffickers will be toppled in quickie invasions, their leaders brought back in chains to disappear into federal dungeons. Public debate will center on the legalities and rationalizations of using the military in policing domestic trash, while agencies such as the FBI cry for more budget to fight the scourge that threatens the decency of the nation's repositories. Control of trash will spread inevitably to control of liquid wastes, whereupon a terrible discovery will be made: Everyone, but everyone, emits unspeakable bodily products. At that point the government will have no choice but to reluctantly declare everyone an outlaw and execute the populace. It's all as logical as what happens when you introduce division by zero way down at the bottom of the complex equation where it isn't so noticeable. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMPS/PEjw99YhtpnhAQH1UQH5AdXBd7AvG6xT7x/cTXf5W1cAUXzoJ+GB N0/SPrdoJnbUSN5LkJDwoVwA/eiL6/LVN9CjtmQwmydyBysM7M/7Xw== =q+CF -----END PGP SIGNATURE-----

1 0

fcpunx subscribe
by Wendy Fu 17 Dec '03

17 Dec '03

Wendy Fu, Network Manager St. John's University School of Law 8000 Utopia Parkway, Jamaica, NY 11439 E-Mail Address: wfu(a)sjulaw.stjohns.edu Phone: (718)990-1666

1 0

Is /dev/random good enough to generate one-time pads?
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Subj sez it all. Thank you. - Igor.

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash latent ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ek ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.alias.net> alpha pgp'; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo hroller alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) (vishnu spook wmono) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 5 Feb 96 6:47:36 PST remailer email address history latency uptime ----------------------------------------------------------------------- ford remailer(a)bi-node.zerberus.de +--+++++..-+ 8:06:08 99.94% portal hfinney(a)shell.portal.com *#+*######## :42 99.94% alumni hal(a)alumni.caltech.edu +-+#+ ---*## 27:01 99.81% pamphlet pamphlet(a)idiom.com +++++++ ++++ 44:57 99.80% alpha alias(a)alpha.c2.org ***** ***-** 18:20 99.72% hroller hroller(a)c2.org ###### ##-## 12:23 99.63% mix mixmaster(a)remail.obscura.com ++-+- -----+ 1:25:43 99.56% gondolin mix(a)remail.gondolin.org ---- 7:30:27 99.47% flame remailer(a)flame.alias.net --+++ + -++- 1:17:58 99.41% ecafe cpunk(a)remail.ecafe.org ##*## + ##*# 1:46 99.41% c2 remail(a)c2.org ***** *** ** 23:58 99.29% nymrod nymrod(a)nym.alias.net ***+*** *** 7:40 99.18% gondonym alias(a)nym.gondolin.org *-- 4:42:54 98.55% shinobi remailer(a)shinobi.alias.net #### # *#-# 33:56 98.34% extropia remail(a)extropia.wimsey.com _.__.-.--- 21:13:22 97.85% vishnu mixmaster(a)vishnu.alias.net +*+****--+ 37:03 96.15% penet anon(a)anon.penet.fi __.-__ _ . 44:43:59 92.95% rahul homer(a)rahul.net ** ## ****## 4:49 99.66% hacktic remailer(a)utopia.hacktic.nl ** + **** 8:01 89.57% replay remailer(a)replay.com *- +**** 6:41 80.79% tjava remailer(a)tjava.com *##### 2:46 32.29% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

TechNet on Feinstein, SF Chron article, and encryption
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 19 Feb 1998 12:58:17 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: TechNet on Feinstein, SF Chron article, and encryption This in response to these comments in the SF Chron article, sent in a sep. message: >Wade Randlett, a Democratic Leadership Council activist who advises >TechNet, said Feinstein's ``detractors are narrow- minded and hung up on >her stance on encryption. If you look at any broad sweep, she is as big a >champion for Silicon Valley as anyone in the U.S. Senate.'' -Declan ---------- Forwarded message ---------- Date: Thu, 19 Feb 1998 12:43:14 -0800 From: "Garrett, Sean" <sgarrett(a)alexander-pr.com> To: "'declan(a)well.com'" <declan(a)well.com> Subject: Feinstein & Internet Policy Declan: Below is the awaited article about Senator Feinstein and Internet policy. I also want to make sure that TechNet's position on the encryption debate is clear. While encryption regulations are not the only major issue facing the industry, we recognize that they are extremely important to many (including most of TechNet's members). While TechNet as an organization is not playing a role in the debate, we believe the dialogue that we facilitate between tech CEOs and public officials will help further all of our collective goals-including the industry's domestic and export crypto goals. Regarding Senator Feinstein, we hope that future meetings between her and the industry are productive on encryption and other important issues. We do wholeheartedly appreciate the Senator's leadership with education and securities litigation reform-TechNet's two policy goals. Best, Sean Garrett Alexander Communications (representing the Technology Network) Sgarrett(a)alexandercom.com

1 0