- cypherpunks-legacy - lists.cpunks.org

Re: So, what crypto legislation (if any) is necessary?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:14 PM 3/31/96, Rev. Ben wrote: >I won't post my opinions upon whom I think is an Agent Provocateur, but >Uni isn't one. For what it's worth, I don't think there's a single agent provacateur on the list. At least not a vocal one (which sort of defeats the point). While I expect there may be a few government types who subscribe just to see what's going on (and I don't mean more active subscribers, such as Brian Davis, even though he's an Assistant District Attorney--he openly admits his role and makes contributions openly), I've seen no evidence that anyone is a provacateur. We're fairly open in our approaches, and are not plotting in secret, so the role of an agent provacateur is not clear. Disruptors, yes. But one man's disruption is another man's lively debate. So what else is new. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

EMO_ney
by John Young 17 Dec '03

17 Dec '03

3-30-96 Economist, three related E-money reports: "Trials of digital cash and smart cards seem to be going on everywhere. Who will win the race to control tomorrow's money?" "Digitising dollars." Citicorp's Electronic Monetary System could make all forms of physical money redundant, and, if it wins broad acceptance, could help to solve some of the financial industry's most intractable problems. "The foreign exchange market: illiquid lunch." Diminishing liquidity; settlement risk; impact of electronic brokering. EMO_ney

1 0

Re: Witch Hunts
by jim bell 17 Dec '03

17 Dec '03

At 04:15 PM 3/31/96 -0500, Bruce Zambini wrote: >On Sun, 31 Mar 1996 JonWienke(a)aol.com wrote: > >> >My preferred and soon to be permanent e-mail address:unicorn@schloss.li >> >"In fact, had Unicorn not existed, potestas scientiae in usu est >> >Detweiler might not have had to invent him." in nihilum nil posse reverti >> >00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information >> >> Unicorn = Detweiler = Agent Provocateur > >Well, I won't say it's impossible. > >However, for those of you who are relatively new to the list, Mr. Unicorn >has been a regular (and useful) contributor to the list. My belief in >this has been unwavering. Excepting, of course, the recent Unicorn/Bell >flamefest, which we all get sucked into occasionally. The fact that you are willing to include the name "Unicorn" in that "flamefest" should hold a clue as to the source of the problem. >My opinion of Mr. Bell on the same issue has varied widely; however, he >has participated (in recent times) in more flamewars on the list than >anyone, including the usual flamers (ie Perry, me, etc.). I do, however, promote one of the most controversial ideas you've probably ever seen discussed on the computer networks. You might well imagine that doing so would tend to attract people who are like moths attracted to a flame. Thus, a "flamewar." Notice that Unicorn tries to flame me on practically every subject he can, which should be another clue as to his motivations. If you've ever had a controversial work published in a mass-media outlet (and the Internet is turning into just such a thing) you'll notice that you'll get unsolicited letters from people, some of whom aren't quite "all there", and people who obviously have their own ax to grind. Often both. (I had a guest editorial published in the Portland Oregonian newspaper about six years ago, so I speak from experience.) Usually that ends quickly; people have short memories and are distracted by newer events. In the computer network area, however, the opportunity for follow-ups is ever-present. That's why I'm not surprised about people like Unicorn. It would probably be excessive to say "he's crazed," but he clearly spends an unusual amount of effort. Check out the CP archives a few days ago; I did an experiment, choosing to not to respond to nearly all of his notes. He kept writing! >It is also interesting to note that Mr. Unicorn talks knowledgably about >several fields; Mr. Bell talks about one field, and there are those who >would dispute his knowledge about it. Quite the contrary: While my degree is in Chemistry, most particularly Organic Chemistry (but also Physical chemistry, solid-state chemistry, and inorganic chemistry), I am rather knowledgeable about physics (including nuclear, high-energy, semiconductor, astrophysics, etc), electronics (analog and digital; I was frequently mistaken for a EE student during my college years), optics, computer hardware, a smattering of computer software, radio (I'm a ham) and a few other fields. This, however, is the "Cypherpunks" area, and with the exception of some bomb-trigger discussions a few weeks ago, much of that knowledge isn't commonly shown in the majority of the discussions here. It's odd, therefore, that you would suggest that I "talk about one field," as if that was somehow my limit. If anything, it shows that I (at least in your eyes) pay more attention to the subject of the list than Unicorn. If you really want to start talking about some of these other fields, I'd be happy to, but I don't think that would improve the specificity of the list. Other people might object, as well. We go on enough tangents as it is. >I have had an e-mail correspondence with Mr. Bell that lasted several >messages. In it, we were both civil and friendly; I post this now not to >take sides in the flamewar, but merely to note that, in my opinion, it is >improbable that Black Unicorn is Detweiller, and that, although I missed >the origin of this thread, it is likely a suggestion from Mr. Bell or one >of his associates, intended to discredit him. This sounds like a conspiracy theory. I don't have any "associates." And I have never posted on any list, echo, USENET group, or bbs under an alias, and I am posting with my real name. I'm listed in the phone directory for Vancouver, Washington, and I've never had an unlisted telephone number. Until Unicorn is willing to identify himself with the same amount of verifiable detail, it is in his direction you should look for conspiracies. >If Mr. Unicorn is indeed Detweiller, it is in the mold of Vlad Z. Nuri, >who (while almost certainly Detweiller) has produced useful contributions >on the list, while refraining from acting out. What, exactly, is your definition of a "useful contribution"? >It is also worth noting that the original Detweiller, in a sense, played >De Sade to Tim May's Rousseau, in that he used an unorthodox, but >effective, critical technique. (This is, in fact, one reading of De >Sade's "pornography" -- an interesting counterexample to what was >trumpeted on _Both_ sides of the recent Firing Line debate: that >pornography or obscenity is, whether or not protected, devoid of any >intellectual content.) Somebody ( I don't recall who) once opined to me that Unicorn behaves toward me somewhat like Detweiler behaved towards Tim May. I probably missed most of that, but I can see the similaries. This doesn't make him Detweiler, but it suggests that his motivations are similar. One last thing: On re-reading your note, I noticed that your writing style is rather... how shall I say... familiar. Care to discuss how you did it? Did you use a program? Jim Bell jimbell(a)pacifier.com

1 0

(fwd) Russians Break RSA?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Friends, I just grabbed this of the ClariNet news feed on Netcom...I'm not supposed to forward anything from this service (so don't tell Brad Templeton!), but this appeared to be too important not to pass on as quickly as possible. Apparently those rumors that the Russians, always topnotch mathematicians, had developed public key crypto in the 1950s or early 60s are true--my hero Kolmogorov developed this when he was technical director at Kryptogorodok, the secret city of Soviet cryptographers hidden in the Urals (and first visited by an outsider, Stephen Wolfram, only a couple of years ago). Here's the report on a news conference announcing the cracking of their Kolmogorov system, which is equivalent to our own RSA. I haven't had a chance to talk to John Markoff, who was at the press conference, to get his comments. --Tim > Xref: netcom.com clari.world.europe.eastern:2783 > clari.news.hot.ussr:3792 > clari. > news.trouble:3258 clari.science.crypto > Path: netcom.com!bass!clarinews > Approved: doug(a)clarinet.com > From: clarinews(a)clarinet.com (AP) > Newsgroups: > clari.world.europe.eastern,clari.news.hot.ussr,clari.news.trouble,clari.sc > ience.crypto > Distribution: clari.apo > Subject: Russian Mathematicians Announce Breakthrough > Keywords: Europe Cryptography RSA > Copyright: 1996 by The Associated Press, R > Message-ID: <russia-cryptoUR7f0_4ME(a)clarinet.com> > Date: Mon, 1 Apr 96 10:40:19 PST > Expires: Mon, 7 Apr 96 12:40:19 PDT > ACategory: international > Slugword: Russia-Crypto > Priority: regular > ANPA: Wc: 116/0; Id: V0255; Src: ap; Sel: -----; Adate: 03-14-N/A > Codes: APO-1103 > > > MOSCOW (AP) -- At a press conference held minutes ago in a > crowded hall, Russian mathematicians announced that a breakthrough had > been made nearly a decade ago in the arcane branch of mathematics > known as "cryptography," the science of making messages that are > unreadable to others. > Leonid Vladwylski, Director of the prestigious Moscow Academy > of Sciences, called the press conference yesterday, after rumors began > circulating that noted Russian-American reporter John Markoff was in > Russia to interview academicians at the previously secret city of > Soviet cryptographers, Kryptogorodok. The existence of Kryptogorodok, > sister city to Akademogorodok, Magnetogorsk, and to the rocket cities > of Kazhakstan, had been shrouded in secrecy since its establishment in > 1954 by Chief of Secret Police L. Beria. Its first scientific > director, A. Kolmogorov, developed in 1960 what is called in the West > "public key cryptography." The existence of Kryptogorodok was unknown > to the West until 1991, when Stephen Wolfram disclosed its existence. > American cryptographers initially scoffed at the rumors that > the Russians had developed public-key cryptography as early as 1960, > some 15 years prior to the first American discovery. After interviews > last year at Kryptogorodok, noted American cryptographers Professor > D. Denning and D. Bowdark admitted that it did seem to be > confirmed. Professor Denning was quoted at the time saying that she > did not think this meant the Russians could actually break the > Kolmogorov system, known in the West as RSA, because she had spent > more than a full weekend trying to do this and had not > succeeded. "Believe me, RSA is still unbreakable," she said in her > evaluation report. > Russia's top mathematicians set out to break Kolmogorov's new > coding system. This required them to determine that "P = NP" (see > accompanying article). Details are to be published next month in the > journal "Doklady.Krypto," but a few details are emerging. > The Kolmogorov system is broken by computing the prime numbers > which form what is called the modulus. This is done by randomly > guessing the constituent primes and then detonating all of the > stockpiled nuclear weapons in the former Soviet Union for each "wrong > guess." In the Many Worlds Interpretation of quantum mechanics, > invented in 1949 by Lev Landau (and later, independently by Everett > and Wheeler in the U.S.), all possible outcomes of a quantum > experiment are realized. > As Academician Leonid Vladwylski explained, "In all the > universes in which we guessed the wrong factors, we were destroyed > completely. But since we are obviously here, talking to you at this > press conference, in this universe we have an unbroken record of > successfully factoring even the largest of imaginable numbers. Since > we are so optimistic about this method, we say the computation runs in > "Nondeterministic Pollyanna Time." Allow me to demonstrate..." > > [Press Conference will be continued if the experiment is a success.] > > MOSCOW (AP), ITAR-Tass, 1 April 1996 > > > Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

Re: Chaumian ecash without RSA
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 08:10 AM 3/31/96 -0800, David Wagner wrote: > The bank picks a secret value k, and publishes g^k. > > To withdraw a coin, Alice picks an x, sets > y = x | hash(x), [ | is concatenation ] > chosen so that y is in G. Alice chooses a random secret blinding factor b, > sends to the bank > A->B: y g^b, > and the bank returns > B->A: (y g^b)^k, > debiting Alice's account. > > Note that this is a (blinded) Diffie-Hellman key exchange with public > exponentials g^k and y g^b; the bank returns the exchanged "secret". > > Alice unblinds this value, computing > z = (y g^b)^k (g^k)^{-b} > and now c = (x,z) is a coin in the digital cash system. Note z = y^k. > > We use the traditional online clearing protocol; to deposit the coin, a > shop S sends > S->B: x, z. > The bank checks to make sure the coin hasn't already been spent, and then > computes > y = x | MD5(x), > checking whether y^k = z. Two irritations with this protocol: 1: A coin is almost twice the size of a coin in the RSA protocol 2: Nobody except the bank can verify that a coin has face validity. The second point is more serious than you might think, as most of us want to see a world where everyone is his own bank and his own credit rating agency, as well as his own publisher. It will obstruct contracts of the form "Anne promises to provide numbers with certain cryptographic properties, provided Bob provides numbers with certain cryptographic properties." With RSA crypto cash, Anne can construct a blinded unsigned coin, and ask Bob to have it signed. For this to be reasonably convenient and practical, we need to have locally verifiable signatures. For computer mediated management of contracts, transactions, and credit ratings, we need contracts such that all intermediate transactions can be reduced to locally verifiable cryptographic protocols. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: What backs up digital money?
by FRank O. Trotter, III 17 Dec '03

17 Dec '03

Quite a time to go on vacation and have the power supply to my laptop first show wires then break! A great series of rants about the backing of ecash, and I missed most of it (at least in real time). I'll add a few of my thoughts and see if it all goes any further. Ecash is a means of transferring value, currently USD at Mark Twain, betweeen parties. Ecash, however denominated, is not a currency in itself. Any "currency" or other "value units", be it USD, DEM, gold, silver, coupons, etc can be transferred by the ecash system. The Mint licensee must agree and then issue the units. This is, after all, software. The value unit or currency has value because people agree it has value. CyberBucks were (and still are) somewhat convertable to tangible goods - they are for sure convertable to intrinsic goods as demonstrated by the CyberBucks trial. USD and DEM have value only because we all accept them as payment - as fiat currencies there is no formal backing. Gold has value because ... One of the keys in any system is that users feel comfortable about the future value of the units or currency, be the units a national currency, a commodity, or a coupon. There are two components to this: 1) The user must believe that they will receive the units back from someone at a later date - this is plain old fashion credit risk. For example if I am running an ecash system with gold then you have to believe that I will give you gold upon request - same for USD and this is why banks for the time being should be the primary issuer to avoid a general credit risk. If users are unsure or unable to determine if the Mint operator will return the nominal value of the units then there is not enough confidence to run a system. Consider pre-FDIC days in US banking. 2) The user must believe that the units will have a value in the future. We can agree that FOT Units are each worth US$1.0 million today, but how will their value be determined tomorrow? Non-national currency, however attractive from a theoretical standpoint is weak under this guideline. I am a strong believer that ecash will support many national currencies, commodity based implementations such as gold and silver, as well as coupons and commercial equivalents. Use of ecash for payments will depend only on the creative uses presented by someone willing to sell at a profit a product that attracts customers. There is likely some point where a non-national currency will become attractive first to the internet community, then to the public at large. If done with low credit risk it can survive. You should consider that two of the key elements to determine value are precisely known in ecash and not in circulating money - money supply and velocity. One now has only to consider other factors like purchasing power to obtain a base value. Ecash puts banks back into the business of being banks - acting as a storehouse of value, and as a means to transfer this value, all for a fee. The early bank models were exclusively along these lines, with the various lending and investing functions added later. All for now, a start anyway. FOT Disclaimer - Personal not corporate thoughts. Frank O. Trotter, III - fotiii(a)crl.com www.marktwain.com - Fax: +1 314 569-4906 --------------------------------------------

1 0

Sun vs. FUD: Elvis is waiting; Sun puts high-strength encryption software aside
by David Honig 17 Dec '03

17 Dec '03

http://dailynews.yahoo.com/headlines/technology/wired/story.html?s=n/reuters /980310/wired/stories/sun_4.html Tuesday March 10 9:58 AM EST Sun puts high-strength encryption software aside SAN FRANCISCO (Wired) - Sun Microsystems, which had hoped to market high-strength encryption software developed by a Russian firm, has put the plans on hold due to ongoing scrutiny by the US Commerce Department, the Wall Street Journal reported Monday. The software, partially based on a Sun security protocol, was developed by a Moscow company called Elvis+, a firm started by former Soviet space scientists in which Sun now owns a 10 percent stake. The deal attracted widespread attention because it appeared to give Sun a way around the Clinton administration's regulation of strong-crypto exports. Sun contended the Elvis+ products fall outside the purview of US government policy. The administration has been reviewing the deal for nine months now. Sun executives, who had hoped to put the encryption software on the market last August, have shelved the plans for the moment, but they remain hopeful, the Journal reported. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Hi, There seems to be a problem posting anonymous messages to cypherpunks(a)ssz.com. I have posted several messages over the past week and *none* of them have showed up. I am posting this as a test message. I am sending it to the following addresses: cypherpunks(a)toad.com cypherpunks(a)ssz.com cypherpunks(a)algebra.com cypherpunks(a)cyberpass.net I will add the server name to the subject line for each post to test which messages are being delivered and which are not. I AM TOTOCUS!!

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)spook.alias.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.alias.net> alpha pgp'; $remailer{'cubed'} = '<alias(a)alias.alias.net> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)gate.net> mix cpunk latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) (vishnu spook wmono nymrod) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 1 Apr 96 6:48:11 PST remailer email address history latency uptime ----------------------------------------------------------------------- ecafe cpunk(a)remail.ecafe.org -*#*######## :48 100.00% haystack haystack(a)holy.cow.net *-##+*****+* 2:09 100.00% cubed alias(a)alias.alias.net ***+#** 19:29 99.99% pamphlet pamphlet(a)idiom.com ++++++++++-+ 1:22:18 99.99% nymrod nymrod(a)nym.alias.net +++--*+*+--* 38:14 99.98% nemesis remailer(a)meaning.com **++******** 17:30 99.97% flame remailer(a)flame.alias.net .---.------ 5:25:05 99.97% shinobi remailer(a)shinobi.alias.net #*########*# 1:07 99.97% hacktic remailer(a)utopia.hacktic.nl ****+******* 8:11 99.97% alpha alias(a)alpha.c2.org ++++-++++**+ 46:53 99.92% vegas remailer(a)vegas.gateway.com .-*.-#*#+### 4:28:59 99.89% ncognito ncognito(a)gate.net #*# ##***-## 6:36 99.72% mix mixmaster(a)remail.obscura.com -+-___.--*-* 15:11:14 99.69% spook remailer(a)spook.alias.net +***+*+**+** 19:46 99.66% gondolin mix(a)remail.gondolin.org __.--*----- 13:53:43 99.64% gondonym alias(a)nym.gondolin.org __.--*--+-- 13:48:57 99.64% exon remailer(a)remailer.nl.com --***++**-* 13:59 99.59% replay remailer(a)replay.com ++**++*+**+ 8:46 99.57% vishnu mixmaster(a)vishnu.alias.net ++- - ***--+ 2:46:31 99.26% treehole remailer(a)mockingbird.alias.net --+++-- -+++ 3:47:33 98.96% amnesia amnesia(a)chardos.connix.com -- --+--+++ 1:57:42 98.49% portal hfinney(a)shell.portal.com *#-#####*## 1:30 96.59% alumni hal(a)alumni.caltech.edu _* #+# -### 1:08:06 96.24% penet anon(a)anon.penet.fi .___ -__.. 47:32:06 95.78% c2 remail(a)c2.org *****.+-+++ 37:24 94.43% extropia remail(a)miron.vip.best.com --------- 6:03:31 83.40% lead mix(a)zifi.genetics.utah.edu *+++++ 34:15 34.40% tjava remailer(a)tjava.com #* ** 1:02 25.24% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

"Dead beef" attack against PGP's key management
by Raph Levien 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This post is signed by a forged key for Phil Zimmermann. I forged the key this morning. The key has the same user id and visible key id as an old key for Phil Zimmermann, which he has since revoked. I should stress that this attack does not in any way weaken the security of PGP's message formats. However, it does expose a problem in the user interface of its key management. Namely, it is fairly easy to forge a key that looks very similar to an existing key. In fact, the only way to distinguish between real and forged keys in general is by the fingerprint and keysize together. My purpose in posting this is to demonstrate that such forgeries are possible. The lesson is: please do not use the key id alone to identify keys. Another reason for the public posting of this forgery is to goad the PGP development team into improving the user interface in PGP 3.0, so as to make the detection of such a forgery much easier, if not routine. Derek Atkins has assured me that PGP 3.0 will include a cryptographic hash of the key, for use as a key id. If implemented properly, such a facility would address this attack. I am not the first to propose this attack. According to Derek Atkins, Paul Leyland first proposed the attack two years ago. Also, Greg Rose successfully mounted a similar attack six months ago, creating a key with user id 0xDEADBEEF, thereby giving rise to the name. The pseudocode for the attack is as follows: choose random 512 bit prime p choose random 480 odd x q = x * ((0xdeadbeef * (p * x) ^ -1) mod 2^32) do {q += 2^32} while q composite The above bit of pseudocode replaces the original selection of p and q, which are normally just random 512 bit primes. Without having done detailed analysis, I believe that the resulting forged keys are just as good as ordinary PGP keys. Further, the modified key generation is almost as fast as ordinary PGP key generation, and I think I could speed it up a bit more. The attack took me a few hours to design and code. Any good programmer familiar with PGP could duplicate it easily. One practical application of this attack is to implement a certain degree of "stealth." Since PGP includes the key id in encrypted messages, it is in most cases possible to identify the recipients of encrypted messages. However, if a lot of people generated keys with the same key id, then it would not be possible to tell from the encrypted message which one was the intended recipient. Here's the public key I forged, which can be used to check the signature of this message: Key for user ID: Philip R. Zimmermann <prz(a)acm.org> 1024-bit key, Key ID FF67F70B, created 1992/07/22 Also known as: Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAyptNMAAAAEEALRhS3ZCFKLPNF/fZeluh/rNfpgZ5a0ddTBtxJ+1yLIkVurb HWFFBsrmnA4hU4MhlA8DS/f2gnS0v3zyQ78JOY1SBIJrLdaIPIrh0ZTAZXWoQWDe Qknm1ZgyLkIRJlt5aDLp+iLJ5sc+LSO5N/DtrL+Htc5MF0AVAWtzPhz/Z/cLAAUR tCJQaGlsaXAgUi4gWmltbWVybWFubiA8cHJ6QGFjbS5vcmc+iQCVAwUQMWAremtz Phz/Z/cLAQE//AP/bg9gMOuiBYkFCiyarJ/DIARWDf7e4bWFJloXAyPeBXCITDIw tuHRJ41yFqnlLmdcuVhXQf/xrH248JyWpHqqED6eOU/PnBHo9IR6H0Fts+O3I+vk tOYRjuTJy+6JV0s/8VN/Sgh8y6Jm2FGhhzhCp6KHNcTHpUud6iGScaEs/CG0LFBo aWxpcCBSLiBaaW1tZXJtYW5uIDxwcnpAc2FnZS5jZ2QudWNhci5lZHU+ =Z1mf - -----END PGP PUBLIC KEY BLOCK----- Raph Levien -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWA2pGtzPhz/Z/cLAQELEQP/fam4tHS8TlMy7SFoUZvC0C4q0ID9Ze5W rY2D++df4UtAFDITGs4lQqzeq6YCqk51oT8gZAACK6D6UlFgr5roIbgwa74Fxso1 B5mquC9axlOlxZJI1PuK+NflBJqCokuQGtG95ER6vbm4n4RACW43In9SAatIvduN JfBSLYrAr14= =V5U6 -----END PGP SIGNATURE-----

1 0