- cypherpunks-legacy - lists.cpunks.org

GILMORE ON TV
by Sandy Sandfort 17 Dec '03

17 Dec '03

Hey C'punks, Was everyone too busy arguing about "freedom of the press" to note a real act of Cypherpunk stealth? While some of you were rehashing WWII, Cypherpunk co-founder, John Gilmore, was slipping cryptography between the lines in a news item about the "information superhighway." The item was about a "new" way to protect against (dare I say it?) pseudospoofing. Perhaps John will honor us with an official description of Cygnus Support's new software. S a n d y

1 0

FLASH: Vice President Gore Questions Current Key Escrow Policy!
by Stanton McCandlish 17 Dec '03

17 Dec '03

National Information Infrastructure Advisory Committee met today in Washington at the Old Executive Office Building. In comments made after a question and answer period, Vice President Al Gore said that key escrow policy announced last Friday (2/4/94) had serious flaws and that he hope the issue of who holds the keys and under what terms would be given more serious, careful consideration. Gore made it clear that some amount of control of cryptography technology was necessary for national security. However, the key escrow policies announced by the Departments of Justice, Commerce & State, and the NSA, were "low level decisions" that got out before thorough analysis. In a conversation with Mitchell Kapor, Esther Dyson, and Mike Nelson (of the White House Staff), Gore said that he would prefer that the keys be held by some part of the Judiciary branch, or perhaps even by trusted, private escrow agents. He made it clear that he believed that the escrow agents named in last Friday's announcement (National Institute of Standards & Technology and the Treasure Department) were no appropriate key holders. Mike Nelson also indicated that there was real interest in a software-based escrow system instead of the hardware-based SKIPJACK standard Those of us who heard Gore were quite surprised. His remarks suggest that the key escrow policies to date do not have full support of the White House. Still, Gore was quite firm in asserting that some control of encryption technology is essential to national security. "Encryption and codebreaking have determined the outcome of world wars. He stated (incorrectly) that most our industrialized allies place must stricter controls in encryption that the US does. In fact, almost all COCOM countries allow the export of DES-based products, though some do not allow DES to be imported. The whole question of encryption was raised when Mitchell Kapor told the Vice President that over half of the Advisory Council members had serious reservations about the current Clipper/Skipjack policies. Gore and Kapor agreed that the Advisory Council should be used to have a serious dialogue about encryption policy. Given Gore's departure from the current Clipper proposals, there might actually be something to talk about. ========== NOTE: This DOES NOT mean that Clipper is going away. Part of stopping Clipper is to lift export controls on encryption and enable US companies to start producing products that enable all of us to protect our privacy with strong encryption. I urge you to write to Rep. Cantwell today at cantwell(a)eff.org. In the Subject header of your message, type "I support HR 3627." In the body of your message, express your reasons for supporting the bill. EFF will deliver printouts of all letters to Rep. Cantwell. With a strong showing of support from the Net community, Rep. Cantwell can tell her colleagues on Capitol Hill that encryption is not only an industry concern, but also a grassroots issue. *Again: remember to put "I support HR 3627" in your Subject header.* P.S. If you want additional information about the Cantwell bill, send e-mail to cantwell-info(a)eff.org. To join EFF, write membership(a)eff.org. For introductory info about EFF, send any message to info(a)eff.org. The text of the Cantwell bill can be found on the Internet with the any of the following URLs (Universal Resource Locaters): ftp://ftp.eff.org/pub/Policy/Legislation/cantwell.bill http://www.eff.org/ftp/EFF/Policy/Legislation/cantwell.bill gopher://gopher.eff.org/00/EFF/legislation/cantwell.bill ************************************************************************** Relying on the government to protect your privacy is like asking a peeping tom to install your window blinds. - John Perry Barlow, EFF co-founder The Electronic Frontier Foundation is working to protect your privacy. To help stop Clipper and eliminate export controls on cryptography, support a bill introduced in the House of Representatives, HR 3627. To support the bill, send email to <cantwell(a)eff.org>. ...................................................................... Daniel J. Weitzner, Senior Staff Counsel <djw(a)eff.org> Electronic Frontier Foundation 202-347-5400 (v) 1001 G St, NW Suite 950 East 202-393-5509 (f) Washington, DC 20001 *** Join EFF!!! Send mail to membership(a)eff.org for information *** -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

3 2

Strategies for getting encryption in widespread use QUICKLY
by Bryan Ford 17 Dec '03

17 Dec '03

I recently sent a version of this message to Stanton McCandlish in response to EFF's call for support on the Cantwell bill; he said you people would probably be most interested in the idea. I was planning to sit quietly for a few weeks, watch the list, and make sure it's not just old news here before opening my big mouth. But seeing the volume of the list I may not last that long, so I'll post now. :-) --- It seems like the most effective way to fight Clipper would be to ensure that by the time the government has a chance to impose any effective controls, strong public encryption is in wide enough use to make such controls completely unenforceable. While encouraging people to always encrypt their E-mail might seem the most straightforward way to do this, most people just aren't interested enough and don't see a threat in leaving their mail open, and encryption is still inconvenient. An approach introducing encryption into some other aspect of information transfer, where it is more immediately and obviously useful, might be more successful in the short term. One of the most popular uses of the Internet is for distribution of free software, both in binary and source form. It would make the lives of many people much easier if the downloading and installation process could be made more automatic. Right now if I want to always have the latest version of GCC on my Linux box at home, I have to watch the right newsgroup for announcements, FTP to the right site, download the new version, unzip, untar, and install it (not to mention compiling it if I get a source code distribution). This is not too bad by itself, but it gets inconvenient on a "real" system containing hundreds of packages to be kept up-to-date, a new version of one coming out every day or two. It shouldn't be too difficult to automate this monitoring, downloading, and installation process, especially for binary distributions that require no complicated configuration or build sequence. But suggest this to most anyone, and they'll immediately get jittery with fear about trojan horses, viruses, and every other attach known. This is where encryption technology (specifically, public-key-based signatures) could come in. Unlike with E-mail privacy, where most people don't get a really tangible benefit, in this case encryption could be a real enabling technology: it would allow people to do what they couldn't (or wouldn't dare) do before. If it was done right, in a way that people can trust, people _would_ use it because it would make their lives easier, not more complicated. Before I get into any more detail, I want to hear what you all think about the general idea, so I'll leave it at that for now. Thanks! Bryan Ford --- Bryan Ford baford(a)cs.utah.edu University of Utah, CSS `finger baford(a)schirf.cs.utah.edu' for PGP key and other info.

6 7

JESUS SAVES!
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Part of the inspiration for OPERATION BLACKEN BLACKNET... ===cut=here=== RISKS-LIST: RISKS-FORUM Digest Thursday 10 February 1994 Volume 15 : Issue 49 Date: Sun, 6 Feb 1994 01:17:49 -0500 (EST) From: Paul Robinson <PAUL(a)TDR.COM> Subject: What goes around, comes around The following was posted on a local BBS about the recent incident on the network. ANDREWS NEWS Staff member suspended for network abuse, by Wendy Wein Clarence Thomas, systems administrator for "Redwood," the administrative computer, will be temporarily suspended from his job because he sent a 5,500 character religious message to between 1,200 to 1,500 news groups across the world through the Internet. This act violated the system's purpose, giving Andrews University a bad reputation among the Internet users. Over 1,200 complaints came over the Internet to the Andrews computer science department demanding justice. According to Mailen Kootsey, chair of the academic computing committee and dean of the College of Arts and Sciences, Thomas will be suspended from his position for a week. His status will be reviewed at the end of the time period. During this week Thomas will not have available access to the network computers. Sometime between five and eight o'clock Monday evening, January 17, Thomas sent his three-page message titled "Global Alert for All: Jesus is Coming Soon," from the Andrews computing center to the news groups which are accessible through the Internet, a computer system which connects computers throughout the world. These news groups deal with different individual topics. For example, if a news group is about cars, then only information about cars should be sent to that news group. Some people subscribe to more than one group and some universities and organizations are subscribed to almost all of them. Thomas sent his religious message to all of these groups. People who were not interested received this message, some more than once. Some organizations received 1,200 to 1,500 copies. For many of the subscribers religious input was not accepted very well. This message took up their time and money. The message accumulated 5.5 kilobytes of disk space. Within an hour after the message was sent, Daniel Bidwell, administrative contact for the network at Andrews, received Internet messages from the East coast. In two hours they came from the West coast and within four hours, complaint letters came in from other countries. The letters made statements such as "This is not what I am paying for" and "Will this guy be stopped?" In addition to the news groups, Thomas also sent his message through a mailing list, filling others' electronic mail. This could have been changed by sending it to only a few news groups so fewer copies could have been distributed. "If he sent his message through a news group which dealt with religious issues then everything would be fine," said Bidwell, "No one would have known." There are no laws against Thomas' actions, yet he violated and broke some of the unwritten rules of society. That is why many people are unhappy. This act created poor reactions towards the university. Thomas' intent was to spread the good news of Jesus' return to all those he could reach. Thomas was trying to witness to others, yet instead of creating joy in peoples' heart, he only created anger and resentment. "He was doing the right thing in the wrong way," said Bidwell. Some of those who wrote to complain said that they agreed with the message, but that Thomas delivered it wrongly. This message has created bad public relations for the church at another's expense. The letters that were received included threats. They wanted Thomas fired, or else the Internet connections from the Andrews campus could be "taken." People are now writing and finding ways to contact President Lesher. Not only have strangers called, but also a large amount of Adventists claiming that something must be done to save the church's sacred reputation. On Monday morning, January 24, Rob Barnhurst, Thomas's supervisor and director of the computing center, Ed Wines, vice president for finance, and Kootsey, met to discuss the incident. They decided to send out an apology through the Internet, explaining that they did not condone Thomas's act and will try to keep this from happening again. Thomas graduated from Andrews with a computer science degree. Those at the computer science department feel that he knew better then to send out that many copies. "It was clearly, very definitely abuse," said Ray Paden, chair of the computer science department. "He broke the guidelines for the Internet and violated the net etiquette. The trust was violated."

1 0

JESUS SAVES!
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Part of the inspiration for OPERATION BLACKEN BLACKNET... ===cut=here=== RISKS-LIST: RISKS-FORUM Digest Thursday 10 February 1994 Volume 15 : Issue 49 Date: Sun, 6 Feb 1994 01:17:49 -0500 (EST) From: Paul Robinson <PAUL(a)TDR.COM> Subject: What goes around, comes around The following was posted on a local BBS about the recent incident on the network. ANDREWS NEWS Staff member suspended for network abuse, by Wendy Wein Clarence Thomas, systems administrator for "Redwood," the administrative computer, will be temporarily suspended from his job because he sent a 5,500 character religious message to between 1,200 to 1,500 news groups across the world through the Internet. This act violated the system's purpose, giving Andrews University a bad reputation among the Internet users. Over 1,200 complaints came over the Internet to the Andrews computer science department demanding justice. According to Mailen Kootsey, chair of the academic computing committee and dean of the College of Arts and Sciences, Thomas will be suspended from his position for a week. His status will be reviewed at the end of the time period. During this week Thomas will not have available access to the network computers. Sometime between five and eight o'clock Monday evening, January 17, Thomas sent his three-page message titled "Global Alert for All: Jesus is Coming Soon," from the Andrews computing center to the news groups which are accessible through the Internet, a computer system which connects computers throughout the world. These news groups deal with different individual topics. For example, if a news group is about cars, then only information about cars should be sent to that news group. Some people subscribe to more than one group and some universities and organizations are subscribed to almost all of them. Thomas sent his religious message to all of these groups. People who were not interested received this message, some more than once. Some organizations received 1,200 to 1,500 copies. For many of the subscribers religious input was not accepted very well. This message took up their time and money. The message accumulated 5.5 kilobytes of disk space. Within an hour after the message was sent, Daniel Bidwell, administrative contact for the network at Andrews, received Internet messages from the East coast. In two hours they came from the West coast and within four hours, complaint letters came in from other countries. The letters made statements such as "This is not what I am paying for" and "Will this guy be stopped?" In addition to the news groups, Thomas also sent his message through a mailing list, filling others' electronic mail. This could have been changed by sending it to only a few news groups so fewer copies could have been distributed. "If he sent his message through a news group which dealt with religious issues then everything would be fine," said Bidwell, "No one would have known." There are no laws against Thomas' actions, yet he violated and broke some of the unwritten rules of society. That is why many people are unhappy. This act created poor reactions towards the university. Thomas' intent was to spread the good news of Jesus' return to all those he could reach. Thomas was trying to witness to others, yet instead of creating joy in peoples' heart, he only created anger and resentment. "He was doing the right thing in the wrong way," said Bidwell. Some of those who wrote to complain said that they agreed with the message, but that Thomas delivered it wrongly. This message has created bad public relations for the church at another's expense. The letters that were received included threats. They wanted Thomas fired, or else the Internet connections from the Andrews campus could be "taken." People are now writing and finding ways to contact President Lesher. Not only have strangers called, but also a large amount of Adventists claiming that something must be done to save the church's sacred reputation. On Monday morning, January 24, Rob Barnhurst, Thomas's supervisor and director of the computing center, Ed Wines, vice president for finance, and Kootsey, met to discuss the incident. They decided to send out an apology through the Internet, explaining that they did not condone Thomas's act and will try to keep this from happening again. Thomas graduated from Andrews with a computer science degree. Those at the computer science department feel that he knew better then to send out that many copies. "It was clearly, very definitely abuse," said Ray Paden, chair of the computer science department. "He broke the guidelines for the Internet and violated the net etiquette. The trust was violated."

1 0

Re: message pools.
by Nikolaos Daniel Willmore 17 Dec '03

17 Dec '03

:: Request-Remailing-To: cypherpunks(a)toad.com -----BEGIN PGP SIGNED MESSAGE----- Jim asked about message pools. Why not just start using alt.test? It's really not such a noisy group compared to say comp.org.eff.talk ;-)! You must include "ignore" in your subject line, or the remailer you use will be swamped by autoresponder messages. And as long as a PGP message already tattles what the nickname on the key it is encrypted with is, you can up front put that nickname in the Subject header. At worse, if you want to "hide" it, just remove the header and footer that announces it's a PGP message. No one will really notice. You could even add a jpeg header and laugh at the poor soul who tries to view that "ignore Stacy" jpeg that he never saw in alt.binaries.picures.erotics. No remailer operators like me to have to trust. No central pool software. Fuck the waste of bandwidth complaints, your just running a TEST. You still have to run through a remailer though, to alt.test(a)news.cs.indiana.edu, so use encrypted remailing. You can't use those that strip Subject lines, though even if qwerty did strip Subjects, the return address is in there as "qwerty-remailer" so I wouldn't see the autoresponds. I know this isn't a new idea, but he did ask for ideas. You still have to get the other person to "join the pool" (read alt.test), but that's easier than getting them to join a real pool which will fill his mailbox daily with garbage. And you can tell him to "join the pool" in public, say anonymously on this list, or on Usenet or for God sakes send him an anonymous snail mail letter! Whatever you do, since "Stealth-PGP" isn't here yet, I don't see a reason not to include the person's anonymous nickname in the Subject line or at least in the message, and make everybody's lives much easier! I think certain post-by-mail services like news.cs.indiana.edu function like anonymous remailers if you forge mail to them, in that they strip much of you original headers away, including the real path but you then have to connect directly to that post-by-mail site and end up on their logs. As far as problems go, I don't think the bandwidth problem would be a big problem since what, maybe a dozen people would be really doing this in a given week? Perhaps "strength in numbers" isn't going to be possible yet in the next few years. So be a little naughty and use the world-wide pool that already exists. The hell with internet bandwidth; this is one's privacy at stake! I don't have an exciting enough life, so let me know how it goes if you try it. -=Xenon=- P.S. Maybe Stealth-PGP is a secret and is the reason the jpegs on alt.binaries.pictures.erotics have become so "noisy" lately ;-). P.S.S. I'm going to start reading alt.test and misc.test, but I will not look at anything unless you put "ignore Xenon" in the Subject line! Look Ma, I'm in a pool. Somebody send me a message, and send me an anonymous public key within it, and I'll respond back the same way. Don't sign the Encrypted message; clearsign the message within it! Then nobody will know "Mr. Nickname" signed it. Why not contact Pr0duct Cypher this way? Then you aren't taking up space in alt.security.pgp. Afterall what's a 40K-100K message compared to how much is in the binaries groups a day?! And you can easily scan a day's alt.test postings for you name, then trash the rest. You can even automatically scan the postings for you nickname with most news readers. Sorry this is so long. I do have a nasty habit of thinking in public. P.S.S.S Extropia already has a pool set up, but I've been lazy and don't know the details yet. With Usenet though, you never end up on any pool's member list, except the list of all Usenet readers, and possibly all remailer users if such a list exists. And a guy like Pr0duct can NEVER be tagged for having picked up the message! No? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVrsWgSzG6zrQn1RAQEqXgP9GKqpDEvYfnq6z9Xfnj+BkFf8MiNTy5zS nHCrPwHkgrxEOTC352rgykcaOeChfwVZK9t43iPtegBK3uzZjYPdKxgcULx8Y4Rn nmKf8X64JrwXuqlGCGK5VEXIF/NFo7qbn0tHAHoWhY+kZuPbbP/xjBel1C/f3Brg EFpSRZA+AEA= =Md9H -----END PGP SIGNATURE-----

1 0

More on magic money problem
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

It appears that the problem with bigendian magic money is specific to the "mint" function. Minting one coin works OK, but minting more than one causes every coin after the first to be rejected by the client. Creating a coins.dat file with the -p function of the client works OK, even with more than one coin. Sending the output.asc to the server works OK too, as does handling the ascii file that comes back from the server. Only minting fails. Here are hex dumps of two coins.dat files. The first one is OK. It was created by "c -p" and has two coins. Key size is 512. 0000000 c0c4 f7c6 cbe5 af34 0893 a6dc ab39 4292 0000020 8200 1101 000d 01fd 1098 23f4 a67e 1f58 0000040 8fbe 3199 67cb dc70 6cd1 6921 df53 aa8a 0000060 8b5b 2a63 5e67 94da 9b18 7f03 ece9 34b2 0000100 0535 75f3 4e6a 3a45 b25e 565e 3fbb 14db 0000120 f3fb c6a7 6def cf77 c05a 9043 0ba7 e490 0000140 0ff5 fa15 83ae cbb3 1a00 1101 000d 01fe 0000160 2c61 ff65 299d 987f 4d88 0a3c 4b13 9f8f 0000200 612a dba6 ad6f 250d f665 ce0c 868f 3b62 0000220 5d1f 725f 449e 15bc da50 c270 5fba 2386 0000240 49ad 2c45 e26e b3af b94e deed b1e6 5f15 Here is a similar coins.dat file created by "s m" and also holding two coins of the same value (but different bit patterns, of course): 0000000 c086 9b22 8601 2974 3e71 d344 f7f1 ab13 0000020 6400 1101 000d 01fd 10ea 1ecb 711a 5114 0000040 5361 a558 9e67 a0ce 9eda 49af 58e1 9203 0000060 8f6b 9056 673c 88fb 79da 4a21 0e98 0e95 0000100 08a6 40f9 81f6 9e76 21e7 ea8d accf 0ef1 0000120 6e41 3657 aacf 34fb c0cc 8cc5 f400 0130 0000140 1400 0000 0000 0000 5900 1101 000d 01ff 0000160 5568 2e3d 9c7e ded9 6489 ba47 687e dc1a 0000200 f4e6 743e 2f12 f095 1363 7b03 6394 83ef 0000220 dbab 598b 60db ecf0 d09a d5ce 5ea8 d2e6 0000240 8277 1061 076b fd00 8aa8 edd9 17d0 3eeb It is immediately obvious that the 2nd, bad, file has a block of 7 zeros where the other one has random data (on the line labeled 000140). If I am interpreting this file right, this block of 0's is towards the end of what should be a 16 byte block of random numbers. So it looks like something overwrote 7 bytes of this 16 byte block before it could be stored. Hope this helps. BTW, for the curious, the format of the coins.dat file is as follows. For each coin, there is first a c0. Then there are 16 random bytes, the "coin ID". Then there is a PGP-style multi-precision integer which is the exponent corresponding to the coin. In this case it is 0011 01000d. The first two bytes are the number of bits in the MPI, (11 hex equals 17 decimal) and then there are as many bytes as are implied by that many bits; these hold the value. This exponent MPI is followed by another MPI which holds the bank's signature. This can be expressed as (C.ID)^(1/e), where e is the exponent, and C.ID is a byte of 0, a byte of 1, padding bytes of ff, the magic 18-byte "ASN" string, then 16 bytes of the coin ID. In the examples above, the first coin ends exactly in the middle of the row labelled 000120. Try to see if you can pick out the sub-fields of each coin in the files.

1 0

Re: message pools.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jim asked about message pools. Why not just start using alt.test? It's really not such a noisy group compared to say comp.org.eff.talk ;-)! You must include "ignore" in your subject line, or the remailer you use will be swamped by autoresponder messages. And as long as a PGP message already tattles what the nickname on the key it is encrypted with is, you can up front put that nickname in the Subject header. At worse, if you want to "hide" it, just remove the header and footer that announces it's a PGP message. No one will really notice. You could even add a jpeg header and laugh at the poor soul who tries to view that "ignore Stacy" jpeg that he never saw in alt.binaries.picures.erotics. No remailer operators like me to have to trust. No central pool software. Fuck the waste of bandwidth complaints, your just running a TEST. You still have to run through a remailer though, to alt.test(a)news.cs.indiana.edu, so use encrypted remailing. You can't use those that strip Subject lines, though even if qwerty did strip Subjects, the return address is in there as "qwerty-remailer" so I wouldn't see the autoresponds. I know this isn't a new idea, but he did ask for ideas. You still have to get the other person to "join the pool" (read alt.test), but that's easier than getting them to join a real pool which will fill his mailbox daily with garbage. And you can tell him to "join the pool" in public, say anonymously on this list, or on Usenet or for God sakes send him an anonymous snail mail letter! Whatever you do, since "Stealth-PGP" isn't here yet, I don't see a reason not to include the person's anonymous nickname in the Subject line or at least in the message, and make everybody's lives much easier! I think certain post-by-mail services like news.cs.indiana.edu function like anonymous remailers if you forge mail to them, in that they strip much of you original headers away, including the real path but you then have to connect directly to that post-by-mail site and end up on their logs. As far as problems go, I don't think the bandwidth problem would be a big problem since what, maybe a dozen people would be really doing this in a given week? Perhaps "strength in numbers" isn't going to be possible yet in the next few years. So be a little naughty and use the world-wide pool that already exists. The hell with internet bandwidth; this is one's privacy at stake! I don't have an exciting enough life, so let me know how it goes if you try it. -=Xenon=- P.S. Maybe Stealth-PGP is a secret and is the reason the jpegs on alt.binaries.pictures.erotics have become so "noisy" lately ;-). P.S.S. I'm going to start reading alt.test and misc.test, but I will not look at anything unless you put "ignore Xenon" in the Subject line! Look Ma, I'm in a pool. Somebody send me a message, and send me an anonymous public key within it, and I'll respond back the same way. Don't sign the Encrypted message; clearsign the message within it! Then nobody will know "Mr. Nickname" signed it. Why not contact Pr0duct Cypher this way? Then you aren't taking up space in alt.security.pgp. Afterall what's a 40K-100K message compared to how much is in the binaries groups a day?! And you can easily scan a day's alt.test postings for you name, then trash the rest. You can even automatically scan the postings for you nickname with most news readers. Sorry this is so long. I do have a nasty habit of thinking in public. P.S.S.S Extropia already has a pool set up, but I've been lazy and don't know the details yet. With Usenet though, you never end up on any pool's member list, except the list of all Usenet readers, and possibly all remailer users if such a list exists. And a guy like Pr0duct can NEVER be tagged for having picked up the message! No? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVrsWgSzG6zrQn1RAQEqXgP9GKqpDEvYfnq6z9Xfnj+BkFf8MiNTy5zS nHCrPwHkgrxEOTC352rgykcaOeChfwVZK9t43iPtegBK3uzZjYPdKxgcULx8Y4Rn nmKf8X64JrwXuqlGCGK5VEXIF/NFo7qbn0tHAHoWhY+kZuPbbP/xjBel1C/f3Brg EFpSRZA+AEA= =Md9H -----END PGP SIGNATURE-----

1 0

Glimpse of the Bowel Movement
by L. Detweiler 17 Dec '03

17 Dec '03

`Somebody' sent this to me... <g> ===cut=here=== From: tcmay(a)netcom.com Subject: Update for Jan 1994 Cyphertentacles, Some of you have asked about our plans for the next month. There have also been many questions about the Detweiler situation. Here's a summary of our current situation and status: The Netcom project is almost complete. We have 12 active accounts on this system, of which only 3 have been compromised. The internal keyserver net is in place. Each of our accounts will have its own PGP key. This will help to defuse any suspicion which may arise. People tend to accept digital signatures as valid, regardless of who did the signing. Just look at the number of unsigned keys on the servers. Their carelessness will be their demise. The phase change is getting closer. Eric has finished the mods to the toad.com sendmail. Any mail sent to this address, except from one of us, will bounce as though the account did not exist. Fingerd has likewise been modified, and security has been greatly enhanced on all the lists. BlackNet Enterprises has successfully infiltrated one of the major credit bureaus. For obvious security reasons, I can't tell you which bureau is involved or give any details. For the present, we will be archiving large numbers of credit records. Within a few years, they will be salable for the expired information they contain. The seven-year limit is ridiculous. Creditors will be willing to pay for more complete information. *.fi should have their digicash system operational within a year. We need many more Cypherpunks-style remailers outside North America to operate the digicash system and protect the servers. Now, about the Detweiler problem: we finally got rid of an12070/S.Boxx (thanks Julf!) but we're not out of trouble yet. We need more posters in the newsgroups, to help with the damage control. Also, please sign each others' pool keys. As I said earlier, the technology of encryption tends to impress people and cause them to believe things, where they would otherwise be skeptical. A recent posting which I made to public Cypherpunks, "Who is L. Detweiler?", has somehow found its way back to Detweiler. This is not serious, since public is only a propaganda organ, but it points out the security problems we face. Detweiler may have an agent on the public list. We must protect the privates, particularly this one and Colorado, from similar infiltration. Imagine what could happen if L. Detweiler gained access to this list! Even one post, if it fell into the wrong hands, could be extremely damaging. Be very careful not to expose any list traffic. More information will follow as it becomes available. For now, please continue the newsgroup activity. Use all the pools, not just a few of them. It was just this kind of carelessness which burned szabo. Keep up the good fight! --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.

1 0

What is the CANNET/NEWBRIDGE RNG-810
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been asked by several cypherpunks what the CALNET/NEWBRIDGE RNG-810 is. It is a board you can place in a 8 or 16 bit slot of an 80x86 computer. Each time you do an inb instruction for the board's port address you get a random byte. I have one in my computer, and it works. I got mine from CALNET electronics INC. I paid $300 for it several years back. However I have been informed that CALNET no longer sells them and they must be obtained from NEWBRIDGE MICROSYSTEMS. See quoted message: >From: bretth(a)Newbridge.COM (Brett Howard) >To: Paul.Elliott(a)hrnowl.lonestar.org >Subject: Calnet RNG-810 > > >Paul, > >The RNG-810 is now licensed to Newbridge Microsystems. I have done some work > with a 1-bit hybrid version of the technology (RBG-1210) and I do > know a *little* bit about it. If you have questions, you should > probably write to Newbridge (address at bottom) or you can email > me and I'll do my best! > >Take care, >Brett > >Newbridge Microsystems >603 March Rd. >Kanata, Ontario >Canada K2K 2M5 >Tel: 1-800-267-7231 > 613-592-0714 >FAX: 613-592-1320 I have a catalog from Newbridge Microsystems, Document:90000.MD300.02, Copyright 1992. Page 4-77 Says: "The NM 810 RNG Random Number Generator is an implementation of the latter approach, with eight RBG 1210s in parallel and a PC XT/AT bus interface. Random bytes are input to the computer through an I/O (Input/Output) port. Any data type (integer, floating point etc.) can then be easily constructed in software by using successive random bytes and arranging them according to the desired internal data format." I do not know if Newbridge still has RNG-810s to sell. Perhaps someone will call the 800 number above and find out. One restriction that I received in the docs with my CALNET RNG-810 is that if you attempt to read the device too fast (less the 40u sec between reads), the succesive bytes are not randomly independent. This is a problem for my IO driver as you do not want to do a spin wait on a real operating system like OS/2 and timer interrupts only occur 18.2 times per second. This causes my driver to run _MUCH_ slower than the hardware would require. I believe that the simple interface used by the RNG-810 is natural enough that it is likely to be used by others who create random number generators. And so my driver may be useful with other devices. But I have received mail recently from someone that makes a RNG that you attach to you serial port and runs at 9600 baud. You could probably use your standard serial port driver with such a device. - -- - ------------------------------------------------------------------------------ Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVtrJ/BUQYbUhJh5AQH6UQP/TXJ5X14vUKPf1J8To5AtwQchPrgabUBT 03lN0+XbsDE6JEgJm7SDN1e3B5EqNEZGi3RMh63HMN7oYf1f7UUMGVoZJdqFNmBM e09s37VcGsZZaZZnlXb5ogQwnjeNGkRSoldWqMcwYQWSBZJskpohHvqrhoge7MQ4 Ka9jDhGCNhg= =ULN8 -----END PGP SIGNATURE-----

1 0