- cypherpunks-legacy - lists.cpunks.org

Re: Hardware RNG
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 06:23 AM 6/30/96 -0700, Timothy C. May wrote: > While radioactive decay is unpredictable (so are a lot of things, by the > way), there are all kinds of biases that reduce the apparent entropy. > Detector "dead time" is a classic one (basically, the detector can't detect > counts during a post-pulse recovery time...probably not a problem at low > count rates, but an example of how subtle things can sneak in). If he has more than eight bits of timing resolution, such biases will have no affect. He is using his non uniformly distributed random number to select a uniformly distributed pseudo random number. Provided that the does not attempt to get more entropy out than he puts in, the result should be a uniformly distributed truly random number. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: [Fwd: Doubleclick]
by Tim Dierks 17 Dec '03

17 Dec '03

At 10:24 AM 7/1/96, Scott Wyant wrote: >At 12:43 PM 6/30/96 -0700, jon(a)aggroup.com wrote: >>> > >From: Scott Wyant <scott_wyant(a)loop.com> Subject: COMMENT: >>> > > >>> > >If you're like me, you never went to a site called "doubleclick." >>> > >So how did they give you a cookie? After all, the idea of the >>> > >cookie, according to the specs published by Netscape, is to make a >>> > >more efficient connection between the server the delivers the >>> > >cookie and the client machine which receives it. >>> > >But we have never connected to "doubleclick." >> >>Scott must have. Navigator is very picky about where a cookie comes >>from and what is put in the domain field of the cookie. > >Nope. I'm afraid your information is incorrect here. I've also watched >other sites hand me a double-click cookie. The way doubleclick works is that the sites who contract with them to sell advertising space insert a URL into their page which fetches the doubleclick ad banner. For example, the guys at TroutHeads, Inc. (www.troutheads.com) would insert an HTML IMAGE tag with an HREF referring to ad.doubleclick.net; that then results in _your_ browser doing an HTTP transaction with ad.doubleclick.net; doubleclick can then hand you all the cookies it wants. Anytime you fetch an image, you're visiting a site, and because it's automatic, you can easily visit a lot of sites you never knew you were going to. >From <URL:http://www.doubleclick.net/web_sites/htmlchange.htm>: For any HTML document you wish to display an ad banner for, simply add the following HTML tags: <CENTER><A HREF="http://ad.doubleclick.net/jump/MY_URL"> <IMG SRC="http://ad.doubleclick.net/ad/MY_URL" WIDTH=468 HEIGHT=60 ISMAP></A> Click on graphic to find out more!</CENTER> Where MY_URL is the URL for the HTML document displaying the ad banner. For example: <CENTER><A HREF="http://ad.doubleclick.net/jump/www.iaf.net/htmlchange.htm"> <IMG SRC="http://ad.doubleclick.net/ad/www.iaf.net/htmlchange.htm" WIDTH=468 HEIGHT=60 ISMAP></A> Click on graphic to find out more!</CENTER> - Tim Tim Dierks - Software Haruspex - tim(a)dierks.org "...when ketchup finally comes out of the bottle, it is going a good 25 miles a year.... It rolls along at three-thousandths of a mile an hour. Heinz knows the speed because it has a device called a Bostwickometer, a chutelike contraption that calculates the speed at which ketchup travels." - The New York Times, June 12, 1996

1 0

Re: mocking paranoia
by Deranged Mutant 17 Dec '03

17 Dec '03

On 29 Jun 96 at 5:58, nelson(a)crynwr.com wrote: > Earlier, someone mocked someone else for being paranoid. Sorry, but > this is a mistake. By definition, you have a non-empty threat model > when you set out to encrypt; therefore you must be paranoid to use > encryption. [..] Depends. If you're paranoia is irrational, then you may do irrational things that will hurt... For instance, there are people who believe that the NSA has control over every C compiler on the planet which inserts a back door into any version of PGP, and therefore the only 'safe' PGP is v1.0. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Iron Censorship
by Duncan Frissell 17 Dec '03

17 Dec '03

The New York Times reports that: "Tipped off by an anonymous source named "nobody," Simon & Schuster Inc. and its literary police are engaged in the Internet equivalent of a high-speed car chase: tracking down a runaway book pirated on right-wing and anarchist sites on the World Wide Web. In the last month, the publishing house's monitors have discovered more than seven Internet sites containing the text of "Report from Iron Mountain," first published in 1967 and intended as political satire, and re-released early this year by a Simon & Schuster imprint, the Free Press." http://www.nytimes.com/library/cyber/week/0701iron-mountain.html Taking up the challenge, I fired up AltaVista and quickly found: http://www.cwi.nl/htbin/jack/mailfetch.py?2383 (2646 lines) I haven't checked this version against my dog-eared first edition so I don't know if this one has been modified by the Great Enemy. DCF "Who wonders what ever happened to the Regional Government Conspiracy. Anyone out there remember "Blame Metro", "Terrible 1313" and other chronicles of what used to be called the Metropolitan Government movement?"

1 0

Re: rsync and md4 [NON-CRYPTO ALGORITHM]
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:50 AM 6/30/96 +1000, Andrew Tridgell wrote: >It effectively creates binary diffs of the two files, without direct >(local) access to both files. As far as I know this is a new type of >algorithm. I worked with an algorithm which sounds similar to this one back about 20 years ago when creating a diff for VM/370 at Tymshare. Here's a quick description of the algorithm so you can see how much the hashing discussion below applies to your problem. (1) Chose a way to break the files into "units". We chose line ends. (2) Hash each unit in both files making two vectors of hashes. (3) Identify which units exist once and only once in a file by: (3a) Initialize a (large) vector of 2-bit entries to all zeros. (3b) Use the hash of each unit to index the vector. If the entry is 00 change it to 01. If it is 01 change it to 10. If it is 10 leave it alone. (4) And the two 2-bit entry vectors together to get the units that exist once and only once in both files. These units are anchors of similarity between the files. (5) Find the hashes which represent these anchors of similarity in both files and link them together. (6) Link the neighbors of already linked units. (7) The unlinked hashes represent differences between the two files. Note that this algorithm finds units that have been moved. I had to do something intelligent with this information to allow for diff-like output. To handle binary files you may need to change the definition of "unit". We used a simple barber poll hash. We went for a number of years before we had a hash failure. (I know, there was a bug in the code that handled hash failures.) A hash based on a CRC calculation would probably be better. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

Re: The Net and Terrorism
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 0:54 7/2/96, snow wrote: >On Mon, 1 Jul 1996, Simon Spero wrote: > >> I want my, I want my, I want my Atropine > > No, you don't. Simon, you got to be more careful when synthesizing that Sarin. Always check that the vent is working first. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Disclaimer: My opinions are my own.

1 0

Re: hard drive encryption
by Joel McNamara 17 Dec '03

17 Dec '03

Currently, SecureDrive seems to be the most reliable under Win95. Check out: http://www.eskimo.com/~joelm/cryptbk.html I just published a cookbook on how to build a "CryptoBook" (a secure PC laptop with all sorts of crypto goodies). Details on SecureDrive are included. Joel At 07:53 AM 7/2/96 -0700, you wrote: > >What is the best utility freely available for encrypting an entire drive >that won't be used for a length of time? ie: I'm going away for a period >of time and wish to encrypt the drive while I'm gone, but have no interest >in actually using it while it's encrypted. I also have no real preference >in what algorithm is used, as long as it's relatively secure. Speed is >also not a big consideration, as it will be used once when I leave to encrypt, >and once when i return to decrypt. >Thanks in advance for the help... >//cerridwyn// > >btw, the OS is Win95 if that matters... > > >

1 0

Re: But what about the poor?
by jim bell 17 Dec '03

17 Dec '03

At 06:37 AM 7/2/96 -0400, Duncan Frissell wrote: >At 11:25 PM 7/1/96 -0700, Bill Frantz wrote: > >>Current government "Key Escrow" systems cost $200/key/year. [Craig Mundie] >>These systems can best be described as key-rental systems. > >This is shocking, shocking. Oh, but what a business opportunity! I assume a floppy can hold 1000 keys. Even if I undercut the going rate of $200 per year by a factor of 10, that's a potential income of $20,000 per floppy per year. A box of 20 floppies on the shelf, and I'm set for life! >This argument against key escrow never made it onto that long list of >questions we made up in the Spring of '93 when Key Escrow was first proposed >by the Admin (it was probably Vince Foster's fault). We showed a lack of >imagination. There's no doubt that the government will want to bribe the escrow agents, first to tolerate the system at all, and second to foster enthusiastic cooperation later on, and possibly even ILLEGAL cooperation. Over-paying them is just one way to do it. One thing that never ceases to amaze me is how the government can continue to ignore the likelihood (hell, certainty!) that since "key escrow" will only be attractive to the extent it actually benefits the user, such users will be served by escrow agents who store only encrypted or anonymously-held keys. These are inherently protected against any kind of disclosure, yet provide all the claimed benefits of key escrow. Jim Bell jimbell(a)pacifier.com

1 0

But what about the poor?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:25 PM 7/1/96 -0700, Bill Frantz wrote: >Current government "Key Escrow" systems cost $200/key/year. [Craig Mundie] >These systems can best be described as key-rental systems. This is shocking, shocking. It never occurred to me that our government would charge us for the benefit of being tapped. What about the poor. I'm going to write Senator Kennedy and see if maybe we can get the selfish Republican Congress to free up some cash so that less fortunate Americans can afford to be tapped too. This argument against key escrow never made it onto that long list of questions we made up in the Spring of '93 when Key Escrow was first proposed by the Admin (it was probably Vince Foster's fault). We showed a lack of imagination. DCF "Gee Ossifer I'd love to let you read my files but I just couldn't afford expensive socialistic key escrow so I bought cheap efficient private key escrow instead."

2 1

Lack of PGP signatures
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Jul 02 19:40:44 1996 I've noticed recently that two PGP programmers (Mr. Zimmerman and Mr. Atkins) do not seem to PGP clearsign their messages to this list. In fact, a surprisingly small percentage of messages on the C-punk list are signed. This despite the fact that the average subscriber is at least literate in PGP. Does anybody have any speculation on why this is? Is it because people consider mundane mail unimportant enough to sign? Is it because the members of this list are more concerned with encryption than authentication? Is it because most mail programs are not PGP aware? Is it because of the weaknesses in MD5? David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMdmzfeSLhCBkWOspAQEdaAf7BzkKqxVyzBY4TAKoSXqO2DhFpceMGfv1 WJhMXHCi9FnZuCHs2hl03vhf/DReX1Y6YWU9ntLhpO8kY6eDeRdq/M9eyD/le1df lZXewrfWrv/JSQgDEmUgao01EkVCVILAx/mUzeBTYPx0nx4CVKUw5pCOJvcO4oVs Y9K1w7ivSpVtwvonYSrqWjT3qDDXm2aCID+YlffH2c+nDBXPgv094fj5Fzzoi+4i sS8u/otxz8d2A+NlhqKJZWxkPtBi0AA2VO6L2Mx8ZmlwRWaD4EiTjaozusPq5GoE tEh9YIPt4+CJZTiLwRRh1x+OqWIDQOJMcDlLmNhiYxFYuevWhmbLPA== =/E0F -----END PGP SIGNATURE-----

6 5