- cypherpunks-legacy - lists.cpunks.org

Re: kocher's timing attack
by dreschs＠austnsc.tandem.com 17 Dec '03

17 Dec '03

On Firewalls, "Jonathan M. Bresler" <jmb(a)FreeBSD.ORG> said: JMB> regarding kocher's timing attack paper: JMB> RSA attack. only known ciphertext is needed. dont know how many JMB> known ciphertexts are required (related to key size surely). the JMB> paper's example is digital signature, rephrase that to Alice signs JMB> Bob's public key certifying that (you know the story). After JMB> several large key signing parties hundreds of known ciphertexts JMB> could have been generated using Alice's key--each one a public key JMB> of someone else. over several years it piles up. the known JMB> ciphertexts can be tested/analyzed to yield Alice's secret key. JMB> ouch. ;/ Are you sure about this? It would seem that the same principle would then apply to signed messages as well, and I find it a bit hard to believe that signing messages would make ones key pair vulnerable. -- #include <disclaimer.h> /* Sten Drescher */ To get my PGP public key, send me email with your public key and Subject: PGP key exchange Key fingerprint = 90 5F 1D FD A6 7C 84 5E A9 D3 90 16 B2 44 C4 F3

4 3

Re: the best justice money can buy --Lessig (fwd)
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Jim Choate (ravage(a)ssz.com) wrote: >If there were no copyright nobody would have any reason to market software >or much else for that matter. So I presume that Linux doesn't exist[1]? And, for that matter, I make my living writing software which is given away for free... Mark [1] Yes, I'm aware the GPL uses copyright to enforce its conditions, but it's copright-free in the important sense: anyone can copy Linux and use it with no fear of black ninjas at their door.

1 0

Re: e-mail forwarding, for-pay remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 14-DEC-1995 03:22:12.75 >There are two different sets of relevant rules in the US - Post Office and state. The PO's primary interest is making sure you don't mind if they don't forward your mail once you stop using the Commercial Mail Receiving Agent (CMRA) and secondarily that you aren't committing fraud by using the mailbox, sending people change-of-address notices, ripping off your creditors, and skipping town. California has a hopelessly dishonest law that just went into effect in 1995, which pretends to be designed to protect consumers from fraud by the 7 million small businesses in CA that uses mailboxes, and actually requires that _anybody_, business or not, who wants to rent a mailbox must fill out the Post Office form and also appoint the PO or CMRA as their agent for service of process and give them up-to-date True Addresses. The PO, meanwhile, "usually wants" a California Driver's License plus another ID to rent a box from them. (I didn't have such a thing when I last rented a box, and the PO hassled my mailbox company into asking for one when the new law came out.) After many attempts at calling the PO to get anybody who knows the _official_ rules for what ID is required, I found a PO lawyer who told me the rules are in the "Domestic Mail Manual", which any Postmaster has, so my next step is to look up one of those before I next get a mailbox. So maybe a random photo ID will work, such as your FooBar Consulting Employee ID, and maybe it won't, depending on what state you live in and how clueless your local Post Office bureaucrats are. ----------------- The more critical question is likely to be what the people at the local MBE/whatever _think_ the rules are. When I last got a box (under my real name, in case anyone's wondering), I seem to recall that they'd accept credit cards. Once one has one box under a given name, this opens up the possibility of getting a secured credit card to make future access easier. However, I believe that they do want at least one form of photo ID; I can't remember just off what their specifications were. -Allen

1 0

BXA Crypto Meet
by John Young 17 Dec '03

17 Dec '03

A report on this would be welcomed. Does anyone know who are the subcommittee members? ---------- Federal Register: February 6, 1998 (Volume 63, Number 25) Page 6153 --------------------------------------------------------- Bureau of Export Administration President's Export Council Subcommittee on Encryption; Partially Closed Meeting A partially closed meeting of the President's Export Council Subcommittee on Encryption will be held February 23, 1998, 2 p.m., at the U.S. Department of Commerce, Herbert C. Hoover Building, Room 4832, 14th Street between Pennsylvania and Constitution Avenues, NW., Washington, DC. The Subcommittee provides advice on matters pertinent to policies regarding commercial encryption products. Public Session 1. Opening remarks by the Chairman. 2. Presentation of papers or comments by the public. 3. Update on Administration commercial encryption policy. 4. Discussion of task force development and work plan. Closed Session 5. Discussion of matters properly classified under Executive Order 12958, dealing with the U.S export control program and strategic criteria related thereto. Dated: February 3, 1998. William V. Skidmore, Acting Deputy Assistant Secretary for Export Administration. FR Doc. 98-3001 Filed 2-5-98; 8:45 am

1 0

Re: Jim Quinn interview of James Norman
by Ed Carp (ecarp＠netcom.com) 17 Dec '03

17 Dec '03

> Date: Wed, 13 Dec 1995 09:49:56 -0800 > From: Martin Janzen <janzen(a)idacom.hp.com> > To: ecarp(a)netcom.com > Subject: Re: Jim Quinn interview of James Norman > > This is the third time you've cross-posted this long and completely > irrelevant message to Cypherpunks. Please stop it! No, sorry, I only ACCIDENTALLY cross-posted it *ONCE*. Any other posts you are seeing are NOT MY DOING.

1 0

Re: the best justice money can buy --Lessig (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 6 Feb 1998 03:13:00 -0800 (PST) > From: mark(a)unicorn.com > Subject: Re: the best justice money can buy --Lessig (fwd) > Jim Choate (ravage(a)ssz.com) wrote: > >If there were no copyright nobody would have any reason to market software > >or much else for that matter. > > So I presume that Linux doesn't exist[1]? And, for that matter, I make my > living writing software which is given away for free... So do I, and I bet both our incomes combined doesn't add up to 15 minutes of Bill G's and it won't. From a market perspective we're flies on the back of great elephant. Please be so kind as to describe how and why this marketing mechanism (copyleft) will succed? I've been using and supporting Linux since 1993 (SSZ is listed as a source site in the back of 'Running Linux' since day one) in this manner neither I or anyone else has gotten rich. Linus made so much money off it that he went to work for a company in So. Cali. writing fully commercial software... > [1] Yes, I'm aware the GPL uses copyright to enforce its conditions, but > it's copright-free in the important sense: anyone can copy Linux and use > it with no fear of black ninjas at their door. It's copyrighted in the important sense in that it uses the copyright to enforce its conditions. That is just as important as the marketing decisions made by it. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: ADDRESS DATABASE?
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

>On Thu, 14 Dec 1995, Sandy Sandfort wrote: >> Yeah, maybe, but my original question was, "does anyone KNOW how >> the trick was done? ^^^^ Sandy, The phone companies sold the information as soon as you moved. ^^^ ^^^^^ ^^^^^^^^^^ ^^^^ ^^^^ ^^^^^^^^^^^ ^^ ^^^^ ^^ ^^^ ^^^^^^ It's called the Blue Book, any library has one for your area. Welcome Wagons and the like buy them. You can buy lists by address, sequential phone #'s, types of services people order, etc. A recent real-life example is this: I ordered caller-id on my phone in Nov. I already have had three direct mailings for security devices. It is assumed by being a girl, and ordering caller ID I am in fear. -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: ADDRESS DATABASE?
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

> The best way to circumvent something like the below occurring is to have >your home phone number listed under a pseudonym with no street address listed - >and block out *69 and caller-id. If some entity wants your phone number, >give them your business number. Another "best way" is to make all calls that you want to be personal with a cellular phone. Most cellular systems don't send ANI and do not provide any type of billing information to the phone company. The number is also by nature unlisted and the only way to get it is by you or the cellular carrier. If the cellular carrier gives your number out without your permision or a court order they are in BIG trouble..

2 1

Re: Secured RM ? (source)
by jps＠monad.semcor.com 17 Dec '03

17 Dec '03

I don't think this will work. When you > if ( (Pfp = fopen(Pfilename, "wb") ) == NULL) the file will be truncated. Subsequent writes could be anywhere on the platter; you're building a new file. I think you can work this way if you open the file for read/write access, although I'd be more inclined to take the file name into the directory and then walk the inodes. jps -- Jack P. Starrantino (215) 674-0200 (voice) SEMCOR, Inc. (215) 443-0474 (fax) 65 West Street Road jps(a)semcor.com Suite C-100 Warminster, PA 18974

3 2

Re: "Strongly Voluntary" Key Escrow
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: <snip> >All of these are "voluntary" key escrow (though I hate that misuse of the >word "escrow") [...] I do too, and I hate it enough that I must (again) object to any use of it where there is not a _NEUTRAL_, _THIRD_ party involved, as explained before on the list (at length) by me, James A. Donald, and many others. [So, why are you *again* consuming bandwidth on this subject, Jim?] Because I love the English language, and because I am quite aware that those who define the terms end up winning the debate, every time. I do not want the word "escrow" in a key context to go the way of the word "voluntary" in an income-tax context (or the word "take" in an enviro- law context). The government has snaked in a Newspeak meaning for the latter two terms, but I hope that cypherpunks will only use the term "GAK" when talking to or about the government. Failure to do so will not only put "our side" in a worse public-relations position, it may (in the future) do violence to the English language. While I enjoyed Tim & Uni's "voluntary" sarcasm, I think we have enough material for *ample* humor without adding even more words to the Newspeak roll. <snip> >there are few circumstances where I think "government certification" "Government Key Certification" might be an OK compromise-term compared to "key escrow," but we should [IMNSHO] continue to stick to "GAK." As you know, I prefered the term "FUCKED," but now we must be "decent" in our communications. <sigh> >is even useful, let alone necessary. I can think of only two, but perhaps there are others: 1. Government employees (but only while working on government time). 2. Convicted felons (I wouldn't include the failed drugwar's felons). >Any scheme in which the government interjects itself in what would not >normally involve them can hardly be said to be strictly voluntary. Indeed, but we have already "lost" the word "voluntary" to Newspeak, which is why it's necessary to qualify it with words like "strictly" and "strongly." JMR - ---------------------------------------------------------------------- Regards, Jim Ray http://www.shopmiami.com/prs/jimray "Thank God we don't get all the government we pay for." -- Will Rogers [Said back when we paid for (and got) a _lot_ less government.] - ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 <liberty(a)gate.net> IANAL - ----------------------------------------------------------------------- Help Phil! e-mail zldf(a)clark.net or http://www.netresponse.com/zldf _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMNF6U21lp8bpvW01AQGhXwP/ZDmtjY77AnAnnmddpd/rX93E4nGm7JBg 8KXyM7TGiiifpPfLRLJR3LncS0OE7V6CIcaq6zSox+qK97SfNZJhwP+GUIMegChJ WiqIaU5el2x6n0KeD/Km4loXMah6o4q4RJyVyo/M3uLlvYsBUyi9i4MQHy6fHpdU BSBnPIz0j0w= =9K29 -----END PGP SIGNATURE-----

1 0