- cypherpunks-legacy - lists.cpunks.org

Re: Constitution and a Right to Privacy
by Alec 17 Dec '03

17 Dec '03

At 09:33 AM 2/18/97 -0800, you wrote: :Let's not start this. : :Tim wasn't arguing for or against abortion; he made no comments :about abortion. His comment was that the _argument_ used to "legalize" :abortion was unconvincing to him. : :If we are going to discuss privacy, that's fine. :It we are going to discuss abortion, there are better fora. : : :-- Marshall : :Warning: Objects in calendar are closer than they appear. Good for you!!!!! I appreciate your post. However, it smells like a Daleism. I revel in fora. (Had to think about that.) Nice sig too. Alec

1 0

Re: [rant] Race
by Lynne L. Harrison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Fri Nov 08 21:16:34 1996 > ObCrypto: Is it true that "Kemo Sabe" is Abanake for "Horse's Ass"? The author had some fun with their names. Kemo Sabe is a play on words and actually stands for "que no sabe" which, translated from Spanish, means "he who knows nothing." Tonto in Spanish means stupid. ************************************************************ Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; lharrison(a)mhv.net | - Survive; http://www.dueprocess.com | - Go to bed." ************************************************************ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMoPpgj5A4+Z4Wnt9AQFHsgP5AVSS0pG5Sp2VqtTm+BefXkA9IcA//LvQ IXISs4RaLUrUmPjMkggFbyoMEEmIIz2TjdUr2Rjn+0+T/8cmSSXTrUqofroOu8rC G00MlCPGzLWuQ5g3iuxGfxZMszWuYWEkb7m37nP0ozdPgR3xG6sYkAeuTPiny27x ZXXPgmMbidU= =m/jZ -----END PGP SIGNATURE-----

1 0

Re: to The Atlantic
by lefty＠apple.com 17 Dec '03

17 Dec '03

>The NSA has not admitted that it can break DES, but there is plenty >of evidence that 0.01% of its budget would be enough to build a >machine to break it. That sounds to me like a big "Yes" for supposition, then. -- Lefty [gYon-Pa] (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Black Eye for NSA, NIST, and Denning
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Perry writes: > > However, it can be done in advance, and you can conceivably reuse > > forged LEAFs. > > I will point out something that I didn't quite understand myself but > have since discussed with Matt Blaze in some detail -- LEAF checksums > are tied to session keys. You CAN do this in advance but only if your > key exchange will permit you to generate your session keys in advance, too > Obviously, reusing forged LEAFs requires reusing session keys. More precisely, as Steve's summary pointed out, it's tied to the IV, which is tied to the session key. (It makes sense - assuming the descriptions of the LEAF contents are true, the only session key component in the LEAF itself is encrypted with the chip-unique backdoor key, and tying it to the IV accomplishes key-dependence, though they could also use the session key externally from the LEAF.) Unfortunately, most Clipperphones will probably use Diffie-Hellman key exchange, since it reduces or eliminates the need for prearranged public-key management (depending on whether they're using radio or a medium that can be actively wiretapped), so precomputation will generally not be usable. I suppose some crude Diffie-Hellman implementations might always use the same half-key for every conversation, rather than generating a random one each time, and you could precompute session keys for talking to them. For email applications, however, most standards will probably use sender-generated session keys, so it would be simple enough to make secure Tessera mailers if you don't worry about subliminal channels in the hash. Bill

1 0

Re: Mandatory sig workaround
by Andrew Lowenstern 17 Dec '03

17 Dec '03

Roy Silvernail writes: > Tim, just for fun, what tools would need to appear to make it > possible for you to sign your traffic? Maybe a description will > inspire some of the Macheads out there to get hacking. (the astute > reader will note that I'm not suggesting new tools to the erstwhile > Mr. May, as has been done so often in the past) Perhaps I'm wrong, but doesn't MacPGP allow you to sign things on the clipboard? Are there any MacPGP users out there? If this is true (and I think it is), then I don't see what's holding Tim back... Compose message, select all, cut, sign, paste, deliver... andrew

1 0

Mosaic / CEB / CypherEssay Archive and List
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

I think that Mosaic pages are the way to go these days. These are not hard to write and they are very nice to use. For some interesting examples of what can be done, check out some of the existing cypherpunk mosaic pages: ftp://soda.berkeley.edu/pub/cypherpunks/Home.html ftp://ftp.u.washington.edu/public/phantom/cpunk/README.html http://www.quadralay.com/www/Crypt/Crypt.html http://digicash.support.nl ftp://furmint.nectar.cs.cmu.edu/security/README.html http://pmip.maricopa.edu/crypt/cypherpunks I think it would be good to have a "cypherpunks-essay" mailing list that was not moderated but people only sent essays that they thought were good enough to be archived. For starters, people can just CC: mail to "vac+cypheressay" and it will get dropped into a separate file in: ftp://furmint.nectar.cs.cmu.edu/security/cypheressay My "vac+cypheressay" was done with one line in my .maildelivery and a short shell script I call "save-numbered". Both are below (note the A.I. methods used to moderate mail). Having a "cypherpunks-essay" mailing list on the same machine as "cypherpunks" could be nice for folks who want a lower volume group. Could have mail to it also go to cypherpunks, and Reply-To: also go to cypherpunks. -- Vince Addr vac+cypheressay pipe R /usr/vac/bin/save-numbered /usr/anon/security/cypheressay #!/bin/csh -f # # This is not totally safe as it is not atomic. If two messages # came at the same time there is a chance one would get lost. # For a low volume list this will not be a problem. cd $1 umask 022 set current = `cat num` @ next = $current + 1 echo $next > num cat >> $next # Moderator says no reply messages grep "Re:" $next if ($status == 0) then /bin/rm $next endif

2 1

The Illogic of Clipper
by Ed Carp [SysAdmin] 17 Dec '03

17 Dec '03

I'm sorry, but I just don't understand the government's position on Clipper. After all, the best way for people to ensure that the government's not going to listen in on their communications is to not use Clipper. Now, unless it was a crime to use anything other than Clipper, the government couldn't do a thing about it. No criminal is going to use a system that would allow the feds to eavesdrop - that's worse than sending messages "en clair". The only way I see Clipper working is if it was mandatory to use it, with stiff penalties against using anything else. That way, if the feds decided to listen in on someone's conversation, and they couldn't decrypt it, all they'd have to do would be to charge them with the crime of using a non-approved method of encryption. This raises another question - wouldn't the mandatory use of Clipper violate the fifth amendment's protection against self-incrimination? The courts have held that for the government to mandate someone filling out a form (for example) that would incriminate them is not legal. It seems to me that to require someone to use an "approved" method of encryption is, in essence, violating one's fifth amendment rights. Before someone points out that it's the case now with the government's ability to read stuff "en clair" anyway, I would point out that the courts may find that there is a higher expectation of privacy when someone uses encryption that if they did not. There is a fundamental expectation of privacy, even if one is engaged in criminal activity, that the courts have tended to maintain. Ed Carp, N7EKG/VE3 ecarp(a)netcom.com, Ed.Carp(a)linux.org "What's the sense of trying hard to find your dreams without someone to share it with, tell me, what does it mean?" -- Whitney Houston, "Run To You"

2 1

Card Playing Protocol
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

Oh, GREAT! Tim says (roughly): "Go for it, too bad you are doomed to lose interest shortly." Geeze, I hate people who make generalizations which are, well, likely to be borne out yet one more time. (I *hate* that!) <Mutter grumble hrumph errrrrrah, phooy!> So I am either supposed to put my tail between my legs now, or take this as a challenge to "Follow through this time.", or let it soon die quietly and hope Tim takes mercy and doesn't rub my nose in it. Grrr. I *hate* reality. So here is where I am: 1) I am wondering whether a "digital deck of cards" is a good choice. 2) If it is, I am wondering how the protocol would roughly be framed (Fundamental card operations, etc.), with an eye towards what the cryptographic protocols can offer. 3) Then, if things make sense, appear tractable, and (drum roll) I haven't gone onto fresher blue-sky ideas, I figure out how to start building the damn thing. 4) And if I ever get to building it I will start first with the little pieces (the cryptographic fragments) which might be useful individually when I lose interest in building the larger beast. I assume that I will have to do real work at each of these stages--though I welcome any help. Both now when the talk is still cheap and later when the bits hit the disk. So far I am at step #1, nudging towards portions of step #2. I refuse to be shamed about abandoning step #3 until I have at least embarked on it. (Then you can make fun of me.) Just producing a complete RFC-quality protocol would be something not to be sniffed at. In fact, I am prepared to stop there and *still* feel smug. (So there!) As for getting people to want to use this digital deck of cards, I rely on my passion for good user interface design combined with the continuing popularity of card games. (And people's continued interest in playing games with other people rather than just computers.) So I am currently at step #. Is the Card Playing Protocol a good choice for being: 1) cryptographically interesting 2) tractable 3) "harmless" 4) appealing to users? Comments? (You too Tim.) And Tim, don't worry about my eyes becoming glazed over with images of Donald Trump. I don't like The Donald. Gambling is boring. (Besides, generalized transactions are far more appealing to a megalomaniacal fool like me. How CPP applies remains for me to understand...) -kb, the Kent who is going to be Cometing tomorrow, handy annual open house at JPL this weekend, etc. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 32:00 hours of TV viewing so far in 1994!

3 2

Re: National ID cards are just the driver's licenses...
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 06:41 PM 7/15/94 +0100, Graham Toal wrote: >I'd love to take part in a list for discussing practical ways of >assuring privacy. I've been doing it myself for years. How about >asking Robert Hayden to start up a specific mailing list for it? >(Some name like 'obfusc', for obfuscating database entries etc...?) >- description: 'discussions of practical real-life ways of improving >personal privacy.' How about "Hardcore Privacy" > >Also, you tend to mention things in dribs and drabs... in fact, didn't >you do a sort of mini privacy-101 some years ago by posting little >snippets of advice in your .sig file every post? Do you have >any collected files with _lots_ of this stuff in it already that we >could read? That was me. I'm kind of lazy about pulling everything together in one place. DCF "Give me a rule, I'll give you a work-around."

1 0

Re: Card Playing Protocol?
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

jamiel(a)sybase.com wrote: >What about implementing a Multiplayer Game Protocol? Cool, but only to the extent it falls out nearly for free, being too general is an enemy of actually getting results. Besides, it seems a better application of any urges to be general would be to work with *any* transport medium from an alt.games.moves to IRC to email (AOL, Compuserve, etc., in addition to Unix mail) to TCP/IP to pagers. So let's tag things and leave room for expansion with new tags, but let's build one thing first. Don't get me wrong, I would love for it to be general--like become the basis for general purpose transactions--but the very fact that that occurs to me warns me that it is best to make version 1.0 first, and then 2.0, etc. Plus, being general about allowing new tags will certainly tweak the ITAR police. Ben.Goren(a)asu.edu wrote: >Just so people know: complete protocols for poker can be found in >Schneier. All you need is a snazzy GUI. Do you *really* think I would propose such a thing without a handy place to crib from? Some people! Hell, I might have to write some code here, and I'm lazy. Oh, it would be nice to be bit more general than just poker. Just a deck of cards, places to put them, the ability to reshuffle and rearrange stacks on the table, play cards from your hand, etc. The enforcement of plays is through the same technique as with a real deck: other players are watching. The cryptographic aspects are the interesting ones, not implementing any particular game. Besides, I'm lazy, remember. Ben.Goren(a)asu.edu also wrote: >And, with ecash, you can even do all your betting. Noooooo! This is a political move. It should be nothing more wicked than a deck of cards. (To some people that is bad enough. Maybe there would be a Rook option...) Just a deck of 52-cards (and how many for Rook?) and a table on which to play. And that worries me. What are the fundamental operations with cards? Can everything be modeled as different stacks on the table? Some have special privilages: I can see my hand, you can't; the top n-cards of some stacks are visible to everyone; some stacks are visible to all (playing a trick). Any player can manipulate any card--though if you grab one from my hand I might get upset, every player will see the manipulation. Some cards are face up (or once were), some are face down (shuffled with the whole deck or a subset). Interesting realization: there is a set of card tricks which can be performed in this environment and a set which cannot. I suppose there would then be a set of magicians who are willing to perform with this deck and a set who will not. (And how many will use magic tricks as proof of having factored RSA-XXX?) Where to put the information about face down cards: To make slow interactions possible, is there a way every player can have all information--but can be challanged that cards have not been peeked at? And how to keep you from checking my hand in poker after I--maybe--bluffed you into folding. Hmm, there is a tension here. Looks like I need to carefully read pages 78-81. -kb, the Kent who is practicing looking innocent and saying things like "Who me?? MUNITIONS??? All I wanted to do was to play gin rummy. With my mom in Minnesota." -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 32:00 hours of TV viewing so far in 1994!

1 0