- cypherpunks-legacy - lists.cpunks.org

Re: Secret network
by swc＠uc1.ucsu.edu 17 Dec '03

17 Dec '03

Alas, water pipes are much better for 1) noise and unintentional transmissions (which can be quite garbled and no one cares), and 2) low frequency transmissions (which can carry only low bandwidth communications). Trying to transmit meaningful communications at high data rates over water pipes would be a TREMENDOUS technical challenge, requiring a vast amount of signal processing to compensate for multipath reflections, impedance mismatches, thermal noise, pickup of an almost variety of interference soures ces, infinite variety of interference sources. , nonstationary channel characteristics, intermittent grounds, etc etc ad infinitum (or at least ad nauseam). Sorry about the cold water, I have seriously considered this scheme and believe that it can be used only for very short haul, very low bandwidth communications (say intra-building at 300 baud). , although that's a guess not a simulation result). ------------------------------------------------------------------------ Stuart W. Card, Consultant, Card & Associates -- Research & Development Box 153 RR 1 Newport Rd Utica NY 13502 315-735-1717 / FAX -8469 swc(a)uc1.ucsu.edu or cards(a)top.cis.syr.edu "Who is John Galt?"

2 1

Glithces in PGP Message
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Ummm... Thats not a PGP message ya got thare, but rather someone who likes to type gibberish and send it as a message. Look at your keyboard and then look at the message. Now keep your hands in the normal position and type random (pseudo) keys. Hmm...I tend to hit 'sadf' an awful lot too. --Matt ______________________________________________________________________________ "This new technology (the printing press) threatened the Crown, which shuddered at the thought of widespread dissemination of works advocating religious heresy and political upheaval. The Crown's solution to the problem was a system of regulation designed to control this "dangerous" art." -From my Copyright Law Text (refrencing the Statute of Anne - the first Copyright Statute) (c)1993 ______________________/___________________________________mjmiski(a)macc.wisc.edu

1 0

Re: PK patents
by whitfield.diffie＠Eng.Sun.COM 17 Dec '03

17 Dec '03

> I forget if your name is on any patents. My name is on the exponential key exchange patent (4,200,770). I wasn't much involved in the filing process and the for all that it pays me royalties and is of commercial significance, I didn't pay a lot of attention to it. I can believe someone might write an entertaining article called the ``The Public Key Patent Squabble,'' but I have no interest at all in doing so. What exactly do you think I should have included? > I understand that the NSA tried to deny the RSA patent . . . > Do you know anything about what I'm talking about? No. But after all, the RSA patent was filed from MIT by people (R, S, and A) that I didn't know well till much later. There may have been some hankey pankey I didn't know about, but I certainly don't recall the New York Times article you refer to. The statement that ``They just got the application back rejected.'' Doesn't sound right to me. I presume that the Patent Office has to state why an application is returned. It's decisions, after all, are a constant subject of litigation and it must have to be very careful about following its own procedures. There was an interference between the RSA patent and the Pohlig-Hellman patent, which is the reason RSA didn't issue till '83. > I'm very concerned about some anomalies on the cypherpunk list. > Are you on it? Yes. Is that irregular or are you referring to something I haven't noticed? > In particular some messages you may have traded with T.C. May have > shown up lately and I'm a bit suspicious of some irregularities. That's because, as discussed one of Tim's messages yesterday, I normally send comments only to the people who posted and leave it to them to repost to the whole list if they think what I said is worthwhile. Like Tim, I have noticed that the list is cluttered with multiple responses to the same question. Whit

1 0

Reason Magazine Nov 1993
by wak＠next0.math.pitt.edu 17 Dec '03

17 Dec '03

Cypherpunks and Extropians, I'd like to mention that the Nov 1993 issue of Reason ("Free Minds and Free Markets") magazine has an article addressing the issue of electronic privacy by Lee Dembart entitled "Hide and Peek". Walter A. Kehowski wak(a)next0.math.pitt.edu

1 0

pornography & the ``cypherpunk cause''
by L. Detweiler 17 Dec '03

17 Dec '03

First of all, a clarification. I raised this issue with EFF because I'm utmostly concerned about upholding their sterling image, not because I am trying to start a flame war or engage in a sniper attack. If I had sent email to a few key people there I would have gotten nowhere (as my email actually proves). Here we have a *small personal forum* to discuss this in *unemotional* terms. I raised it in that spirit and am very disillusioned to see it all dragged through the gutter by many respondents. People are reacting like I've said, There Is No Cypherpunk Cause or Eric Hughes and T.C. May Are Traitors. So, I'm quite relieved that D. Frissell has posted some cool comments on case law and others who have focused on the issue of *operator knowledge* related to the law, which was one of my chief concerns from the beginning. * * * S. Steele <ssteele(a)eff.org> >My warning to sysops simply said that these files were listed >on a federal indictment, so the "lack of knowledge of the age of the >depicted people" defense remains The bulletin strongly suggests that the files constitute illegal child pornography. therefore, that would imply to a sensible operator that the age of the people pictured is not above that allowed for legal pornography. The point of *requiring knowledge of age*, in my view, seems to be a subset of a more important idea of *knowing the pictures violate the law*. Knowing the age of the participants is *one* way that one might know that the pictures violate the law. But one may come to that conclusion otherwise. For example, learning that they are the target of a federal investigation into child pornography would imply to a high degree of probability they are `illegal'. Of course, I don't claim to be a lawyer, and this is just one interpretation. perhaps it is mistaken. feel free to correct and insult me at the same time (what fun is it without both?). * * * I would like to say the following. My analogy to the CERT warning that appeared here seems to have completely escaped many, or perhaps everyone is intentionally evading it. The metaphor is extremely compelling. Both are sent to operators in order to bring something to their attention they `might' need to fix by an outside party generally interested in the operators own best interests. While I'm not sure that what CERT did was apropos, that warning was so *delicately worded*. In contrast the EFF announcement SHOUTS IN YOUR EAR. the CERT announcement was extremely diplomatic. the EFF announcement was SCREECHING. Do `we' have *any* consistency, sophistication, or coherence as a group? Recent messages have DISMAYED me. is `our' philosophy nothing but Beavis&Butthead style ``Gubberment and the Fedz and Pigs are THINGS THAT SUCK and EFF is a THING THATS COOL.'' Or do `we' have no philosophy at all? Are `we' just blind, crosseyed, and elitist `codeheads' that char newbies for cruel sport? Is it better to just ignore the `politics of cryptography' which coincidentally involves things like what has been called the `Tim May .sig Agenda' because some people might have strong opinions? If `we' don't have our own house in order, `we' are nothing but LOUD HYPOCRITES. If you don't clean your dirty laundry, IT STINKS. Excuse me, but I think the press adores the Cypherpunk cause, and `we' got press exposure such as the NYT and Wired article, because there appears to be LEADERS and a DEFINITE POLITICAL AGENDA. It appears, reading from those, that perhaps we even view the whole matter of free cryptography use as a MORAL ISSUE, which of course would seem to imply we possess some MORALITY to so claim. Oh yes, what was that hand-wringing a few months ago on the list about the ``MOVEMENT STALLING''? I wonder why! who posted that, anyway? I forget. p.s. I dare someone to post that old CERT announcement sent to E.H. that was posted here and caused such a noxious stink here. Look at how gentle it really is. In fact, I would recommend that future announcements of this sort look to it as a model. It clearly has been finetuned past many revisions. As much as I hate to admit it, CERT has a lot of expertise in dealing with this kind of thing. If anyone wants to emulate them, don't reinvent the wheel. p.p.s. go ahead, flame me into oblivion. ah, anonymously is even better! from people we've never *heard* of before on the list! yes, let everone up to the top tell me what a jerk I am for caring. please be as *emotional* as possible. defend the silly announcement or the Cypherpunk Status Quo as if I had accused *you* of being a child pornographer or traitor. Even better, banish me from the list for my thoughtcrimes! Yes, cyberspatial hemlock is what I need right now.

4 3

about Cypherpunks (fwd) "instant faq"
by henry strickland 17 Dec '03

17 Dec '03

Someone on the FutureCulture list asked about Cypherpunks. I took the opportunity to be the first to reply, to try to get 1) hard information there and 2) some practical advice on how to participate. I hope my tone was not too discouraging. Others might want to take advantage of the "instant faq" I threw together, if you see queries in other places. strick cypherpunks write code Forwarded message: # Subject: about Cypherpunks # To: FUTUREC(a)UAFSYSB.UARK.EDU # Date: Thu, 14 Oct 93 13:54:27 PDT # From: henry strickland <strick(a)osc.versant.com> # # # Does anyone here know about Cypherpunks? # # The list is pretty high volume, and is currently experiencing # signal/noise problems, but that should be nothing new to FCers :-) # # <cypherpunks-request(a)toad.com> # # You might first check out the archives # # ftp://soda.berkeley.edu:/pub/cypherpunks # # to see if it holds your interest. It is a list on which you # should do some serious reading before beginning to post. # # # # cypherpunk strick # cypherpunks love to practice # # # # ----------------------------------------------------------------------------- # # Cypherpunks assume privacy is a good thing and wish there were more # of it. Cypherpunks acknowledge that those who want privacy must # create it for themselves and not expect governments, corporations, or # other large, faceless organizations to grant them privacy out of # beneficence. Cypherpunks know that people have been creating their # own privacy for centuries with whispers, envelopes, closed doors, and # couriers. Cypherpunks do not seek to prevent other people from # speaking about their experiences or their opinions. # # The most important means to the defense of privacy is encryption. To # encrypt is to indicate the desire for privacy. But to encrypt with # weak cryptography is to indicate not too much desire for privacy. # Cypherpunks hope that all people desiring privacy will learn how best # to defend it. # # Cypherpunks are therefore devoted to cryptography. Cypherpunks wish # to learn about it, to teach it, to implement it, and to make more of # it. Cypherpunks know that cryptographic protocols make social # structures. Cypherpunks know how to attack a system and how to # defend it. Cypherpunks know just how hard it is to make good # cryptosystems. # # Cypherpunks love to practice. They love to play with public key # cryptography. They love to play with anonymous and pseudonymous mail # forwarding and delivery. They love to play with DC-nets. They love # to play with secure communications of all kinds. # # Cypherpunks write code. They know that someone has to write code to # defend privacy, and since it's their privacy, they're going to write # it. Cypherpunks publish their code so that their fellow cypherpunks # may practice and play with it. Cypherpunks realize that security is # not built in a day and are patient with incremental progress. # # Cypherpunks don't care if you don't like the software they write. # Cypherpunks know that software can't be destroyed. Cypherpunks know # that a widely dispersed system can't be shut down. # # Cypherpunks will make the networks safe for privacy. # # ----------------------------------------------------------------------------- # # # A Cypherpunk's Manifesto # # by Eric Hughes # # Privacy is necessary for an open society in the electronic age. # Privacy is not secrecy. A private matter is something one doesn't # want the whole world to know, but a secret matter is something one # doesn't want anybody to know. Privacy is the power to selectively # reveal oneself to the world. # # If two parties have some sort of dealings, then each has a memory of # their interaction. Each party can speak about their own memory of # this; how could anyone prevent it? One could pass laws against it, # but the freedom of speech, even more than privacy, is fundamental to # an open society; we seek not to restrict any speech at all. If many # parties speak together in the same forum, each can speak to all the # others and aggregate together knowledge about individuals and other # parties. The power of electronic communications has enabled such # group speech, and it will not go away merely because we might want it # to. # # Since we desire privacy, we must ensure that each party to a # transaction have knowledge only of that which is directly necessary # for that transaction. Since any information can be spoken of, we # must ensure that we reveal as little as possible. In most cases # personal identity is not salient. When I purchase a magazine at a # store and hand cash to the clerk, there is no need to know who I am. # When I ask my electronic mail provider to send and receive messages, # my provider need not know to whom I am speaking or what I am saying # or what others are saying to me; my provider only need know how to # get the message there and how much I owe them in fees. When my # identity is revealed by the underlying mechanism of the transaction, # I have no privacy. I cannot here selectively reveal myself; I must # _always_ reveal myself. # # Therefore, privacy in an open society requires anonymous transaction # systems. Until now, cash has been the primary such system. An # anonymous transaction system is not a secret transaction system. An # anonymous system empowers individuals to reveal their identity when # desired and only when desired; this is the essence of privacy. # # Privacy in an open society also requires cryptography. If I say # something, I want it heard only by those for whom I intend it. If # the content of my speech is available to the world, I have no # privacy. To encrypt is to indicate the desire for privacy, and to # encrypt with weak cryptography is to indicate not too much desire for # privacy. Furthermore, to reveal one's identity with assurance when # the default is anonymity requires the cryptographic signature. # # We cannot expect governments, corporations, or other large, faceless # organizations to grant us privacy out of their beneficence. It is to # their advantage to speak of us, and we should expect that they will # speak. To try to prevent their speech is to fight against the # realities of information. Information does not just want to be free, # it longs to be free. Information expands to fill the available # storage space. Information is Rumor's younger, stronger cousin; # Information is fleeter of foot, has more eyes, knows more, and # understands less than Rumor. # # We must defend our own privacy if we expect to have any. We must # come together and create systems which allow anonymous transactions # to take place. People have been defending their own privacy for # centuries with whispers, darkness, envelopes, closed doors, secret # handshakes, and couriers. The technologies of the past did not allow # for strong privacy, but electronic technologies do. # # We the Cypherpunks are dedicated to building anonymous systems. We # are defending our privacy with cryptography, with anonymous mail # forwarding systems, with digital signatures, and with electronic # money. # # Cypherpunks write code. We know that someone has to write software # to defend privacy, and since we can't get privacy unless we all do, # we're going to write it. We publish our code so that our fellow # Cypherpunks may practice and play with it. Our code is free for all # to use, worldwide. We don't much care if you don't approve of the # software we write. We know that software can't be destroyed and that # a widely dispersed system can't be shut down. # # Cypherpunks deplore regulations on cryptography, for encryption is # fundamentally a private act. The act of encryption, in fact, removes # information from the public realm. Even laws against cryptography # reach only so far as a nation's border and the arm of its violence. # Cryptography will ineluctably spread over the whole globe, and with # it the anonymous transactions systems that it makes possible. # # For privacy to be widespread it must be part of a social contract. # People must come and together deploy these systems for the common # good. Privacy only extends so far as the cooperation of one's # fellows in society. We the Cypherpunks seek your questions and your # concerns and hope we may engage you so that we do not deceive # ourselves. We will not, however, be moved out of our course because # some may disagree with our goals. # # The Cypherpunks are actively engaged in making the networks safer for # privacy. Let us proceed together apace. # # Onward. # # Eric Hughes # <hughes(a)soda.berkeley.edu> # # 9 March 1993 # #

1 0

Re: DES
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

I don't think it takes the cube of it. There are 56 bits in one key, and 112 bits in two keys, so there could not be an entropy of more than 112 bits to triple DES. It is no more cryptographically secure than double DES because it uses 2 keys. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Re: Generating Random Numbers...
by catalyst＠netcom.com 17 Dec '03

17 Dec '03

Bob Baldwin writes: >The english language has an entropy of 1.0 to 1.5 bits per letter, so it >is safe to extract one bit per character. [Shannon's work et al >demonstrates] that this bit per character is truely random. - entropy - In information theory, a visceral meaning of the term 'entropy' is 'a measure of surprise', or unpredictability. Entropy is the amount of information in some chunk of data, that could not be deduced. Equating entropy with randomness is a tautology. Entropy (like velocity) is relative, however, to the observer. If the observer has a good model of the data, the entropy will be low (not much information present). If the observer has a bad model, the entropy will be high. One example that demonstrates a difference in relative entropies is a block of ciphertext. The entropy of the block with respect to its intended recipient (who has the key) is low; with respect to an interloper (no key), it is high. - the entropy of english text - The paper cited by nobody, and alluded to by Bob Baldwin, is a landmark paper in estimating the entropy of english text. Note that these estimates are not lower bounds, but empirical values with respect to the human 'predictors'; and that the (1, 1.5) bits per character are an _average_ across an entire message. For example, if the message begins "Four score ", then, with respect to a typical American history student, there is very little entropy in the remainder of the sentence, should it continue " and seven years ago". - turning entropy into random numbers - >From reading Bob Baldwin's post, I am not sure how he intended to extract this 'one bit per character'. You would certainly not just pick the n-th bit from every byte. A good way to turn entropy into actual bits is to build a compressor. A compressor is usually a combination of a predictor (or model) and an encoder. The predictor plays the role of the human 'predictors' in Shannon's experiment, and for each new symbol of the message, generates a probability that represents (inversely) its 'surprise' at seeing that symbol. A good encoder uses the probabilities from the predictor to encode the symbol in the smallest number of bits. The better the predictor, the less it is suprised, the larger the probabilities it returns to the encoder, the fewer number of bits output. Thus, good predictors (and competent encoders) lead to efficient compressors. See Bell, Cleary, & Witten, "Text Compression" Prentice Hall, 1990. ISBN 0-13-911991-4. Especially Ch. 5 'From Probabilities to Bits'. - entropy and transformations - Both Bob Baldwin and nobody discuss the use of hash functions on the text to get random numbers, and wonder if redundancy in the underlying message will 'show through'. Cryptographically secure deterministic hash function are designed with this criteria in mind. That is, one goal is that the entropy in the bits of the hash itself, relative to an observer who knows the input stream, is 0; to an observer who does not know the input stream, it is maximal (i.e., has a lower bound related to your predictability in selecting an input). nobody asks: >could someone here describe how this compares to other pseudo-random >sources? how well would this function as a seed to some other >pseudo-random number generation process? Using hashes as random number generators is as secure as the hash which (for a cyptographically poor hash) may be dependent on the entropy of the input, and your use of it (e.g., don't always hash the 'Gettysburg Address' to get your random numbers). Using compression to convert the entropy in a message (with respect to the compression model) into a random number is dependent on the quality of the model. If you use a poor model, someone else will be able to find, and perhaps capitalize on, redundancy in your output. Related to this, in a conversation on this topic with Ron Rivest he noted that good enough compression might be secure in itself (with the model and its initial state as the key), and that he had students who were researching this. Hope this helps, Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Re: Generating random numbers from english text
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Bob Baldwin, describing Shannon's info theory stuff, said: > 1. Ask a person to speak about any topic for a paragraph or two. > Instruct them to generate original sentences, not just repeats of > some passage of a written work. Write down what they say. > 2. The english language has an entropy of 1.0 to 1.5 bits per letter, so Actually, if you've got an audio input on your computer, one way to generate "true" randomness for use in keys or whatever would be to turn on the microphone and _speak_ about any topic for a few seconds, and take the MD-5 of the sound file; the differences in voice, timing background noise, microphone quality, etc., ought to add a lot to the randomness. (Or else, turn on the mike and type N random characters and record them :-)

1 0

cypherpunk mindWHAT?
by Philippe_D_Nave 17 Dec '03

17 Dec '03

Hello, all! I assume all of you saw the message about 'cypherpunk mindfucking' today. It appears to have come from an anonymous mail system (unless S. Boxx is the name of the sender- but then, that name sounds a lot like the S-box used in the DES encryption scheme. Call me paranoid, or give me a point for catching an inside joke.) That said, it seems that the point of the message is that there is a lot of smoke coming from people who use aliases or anonymous remailer services to post to the cypherpunks list. Does this posting contribute to that problem, or have I missed something? > i've been monitoring the list for some time. > something needs to be done about the fucking perversions. we are being > mindfucked by traitors. > thanks to everyone who has sent me mail. keep it coming. i intend to > get to the ugly bottom of this if i have to. there is a putrid rotten > stench here, i pray to GOD that others will finally smell it. i'm > getting closer. i'm breaking it _wide_ open. the pretenders and > traitors will be shot. the Cause has been stalled. the Cause will > conquer. the Cause will live on. What the hell ?!? I've either missed something significant (and would appreciate enlightenment) or this is a candidate for 'strangest post of the year'. If 'S. Boxx' really exists and is the author of this posting, I apologize- if not, then come out from behind your damn remailer and quit contributing to the problem. As for monitoring the list for traitors, go ahead- I post under my own name, and I don't give a shit what you do with the text. If I was concerned about lurkers building 'traitor files', I'd encrypt my messages and happily watch you choke on them. ........................................................................ Philippe D. Nave, Jr. | The person who does not use message encryption pdn(a)dwroll.dw.att.com | will soon be at the mercy of those who DO... Denver, Colorado USA | PGP public key: by arrangement.

1 0