- cypherpunks-legacy - lists.cpunks.org

SECURE + PGP
by Remo Pini 17 Dec '03

17 Dec '03

I played around with secure (eudora plugin) a little bit, but it seems to be unable to decrypt anything it encrypted. (eudora 16-bit on winnt 4.0) Any hints? Also, I wan't to write a mail-program (like eudora), with built-in PGP. Is the algorithm published anywhere (including the protocols)? ie.: key generation, signing, en- and de-crypting, u.s.w. I presume the algorithms are of the shelf (DES and IDEA), but what about the hash-algorithms and key-ring management? ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 --------< words are what reality is made of >--------

2 1

No Subject
by Anonymous 17 Dec '03

17 Dec '03

>a security dude grabbed my laptop and said he wanted >to 'analyze' it. Yeah sure whatever, I decided not to protest >I was late for my flight. >This analysis, it turned out, was wiping a coffee filter over the strap >of its bag, and sticking the coffee filter into a slot on a machine. >No solvent even. The machine had columns labelled TNT RDX NITRO PETN HMX. ..... >The machine name was ION-something; I wonder whether it sucked vapors >from the fiber disk or whether it was a neutron-spectrometer (?) device. Try asking them where they've posted the California Prop 65 warning indicating which toxic chemicals are used in the system :-)

1 0

Questions from a Wannabe
by Charley Sparks 17 Dec '03

17 Dec '03

Hi all, I have been reading all of the posts for a few days now and I have a couple of questions, if someone has time. In the event of GAk, how can we be forced to register our keys ? We could always scrounge some old outdated but functional TEMPEST equipment .... and could someone please explain ITAR in a simple way for me ? One last thing.. If I have the US PGP and a friend uses the export version, I assume we are compatible, yes ? Thanks all, Charles E. Sparks<sparks(a)bah.com> In God we trust, all others we encrypt ! http:/www.clark.net/pub/charley/index.htm Public Key At http://www.clark.net/pub/charley/cp_1.htm

1 0

Re: MIT harassed over publication of PGP book
by Carl Ellison 17 Dec '03

17 Dec '03

Hal, would such review have any material effect on MIT behavior? I appreciate the point about the sneakiness of the State Dept. However, I can't imagine publication of the next PGP source (or whatever) to be funded by Sandia. I would also hope they would have no fingers into any crypto research. Prior review of crypto research publications is what Adm. Inman wanted back in 1978, in response to which both Cryptologia and ICAR were founded (from my POV). MIT was a strong force in backing NSA down on its attempt to get prior review of publications and I'd hate to see them knuckle under in any way on this point. - Carl

1 0

Re: Execution of signed scripts received by e-mail
by Hal 17 Dec '03

17 Dec '03

That sounds very impressive! The one problem I've run into with mail filtering software is that each message asynchronously spawns a separate filter process. This can cause some conflicts with accessing disk files. I haven't used procmail so I don't know if it has this problem. But if so you may need to be careful if there are any cases where two processes could be accessing the same disk files. For example, what if two copies of an identical email message arrive at almost the same time, would your dup detection work. The other issue is the possibility of mail arriving out of order. Looking for increasing timestamps may cause spurious rejection of some messages. On the other hand this is a difficult problem to handle in general so probably the current solution is OK. Hal

2 1

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Harry Hochheiser 17 Dec '03

17 Dec '03

On 12 Jul 96 at 21:31, Arun Mehta wrote: > At 23:38 10/07/96 -0700, Will Price wrote: > >ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download > > Sorry if this has been discussed before (please point me in the > right direction if that is the case), but VSNL, my government-owned > ISP (which also has a monopoly on all international traffic) made me > sign that I will not use my Internet connection for voice traffic. > Is there any way they could find out if I were using PGPfone, or > rather, could I prevent them from finding out? Arun: I can't give you a definitive answer here, but I'll take a shot. Most Internet telephony systems use UDP packets to transfer speech, since the lower overhead of UDP (as opposed to TCP) allows for better throughput. I assume (but I'm not certain) that PGPfone works the same way. Unfortunately, most of your other TCP/IP communication will be based on TCP packets. Therefore, it's theoretically possible for your ISP to monitor your traffic, watching for large numbers of UDP packets. --------------- Harry Hochheiser harry(a)tigger.jvnc.net 08 3A B5 F6 47 7F C7 C4 28 B4 8D D2 2E DF F6 1E

4 3

Re: MUD anyone?
by jim bell 17 Dec '03

17 Dec '03

At 09:47 AM 8/27/96 -0700, Jon Leonard wrote: >> Would anyone out there be interested in helping set up a >> crypto-anarcho-capitalist MUD to play around with some of the social >> aspects of crypto-anarchy and anarcho-capitalism? I can probably hack >> together a basic lpmud in a month or two if someone has a machine which >> it could run on and which could run a mailing list for those involved. > >I've been planning to run a MUD like that, at mud.umop-ap.com port 2121. >I just don't have enough coded to be worth announcing yet. >Which cryptographic primitives should be coded in initially? >Obvious choices are: >Pseudonyms >Anonymous digital cash (issued by any pseudonym, not just "banks") >Public and private keys >Secret sharing >Anonymous broadcast & message pools >Anonymous markets > >What am I missing? Should there be direct support for Jim Bell's >assasination markets? It'd provide a means of demonstrating its >ineffectiveness as a means of social control. Aren't you writing up the results of the experiment before you even take the data? That's called "dry-labbing." In any case, I'd welcome such a simulation, but there are a number of caveats. To me, the most obvious one is GIGO: Simulations, especially political/social ones, might depend heavily on assumptions that are programmed into them. A trivial, yet interesting example is the computer game "Sim City" which allowed you to adjust the "tax rate" but problems always cropped up the further away you were from 7%. The libertarians were frustrated that we were unable to drop the tax rate and still get a well-functioning, happy society. It is unlikely, obviously, that there is anything magical to a society about a tax rate of 7% The answer is likely that the people who wrote the program simply hard-coded it into the game, either directly or as a consequence of various political/social assumptions that they didn't realize they were making. Another problem was demonstrated a few weeks ago when a "game theory"-type problem was proposed on CP, the one where 20 thieves sequentially are given the task to propose the disbursement of $20 million in loot, with a vote on the proposal and death for the proposer of a rejected proposal. I pointed out that the difficulty with an _exact_ (game-theoretical) solution to such a problem is that the "cost" of death in this problem is undefined. A person might be willing to take a risk of death for $20 million that he's unwilling to take for $20 THOUSAND, and certainly not $20 DOLLARS. AP (Assassination Politics), at least the initial "government-eliminating" function of it, should work on a financially-sound principle: Actuarially, the value of a continuing $1/year obligation is $20 if the real interest rate is 5%. This means that if a randomly-selected government employee is paid $40K per year including benefits (money which is stolen from taxpayers), it would be worth a one-time cost (actuarially speaking) of 20x40K, or $800,000 to see him dead and not replaced. Assuming his death can be purchased for less than this, you are dollars ahead to buy it. If you can buy his death for, say, $20,000 (half his yearly salary) you have, in effect, profited by $800,000-$20,000 or $780,000 to do this. (Technically, the amount _society_ would benefit is actually the amount of salary cost eliminated, minus the ordinary benefit of that government employee doing his usual job. A person (statist?) might try to conclude from this that getting rid of them won't save much. That's the collectivist point of view. However, the people who (unwillingly) finance these salaries with their tax dollars, and the people who arguably benefit from these employees are, in my estimation, two separate and distinct groups of individuals, so my analysis is still valid for the former group.) It gets even better. If most of these employees decide that discretion is the better part of valor, and 90% of them resign rather than (almost literally!) get the ax then the average cost of getting rid of a given employee is reduced by another factor of 10, perhaps to $2,000. And obviously, the system feeds on itself: Once the average cost of getting rid of them drops to $2,000, their fate is so certain that the resignation rate would probably skyrocket to well over 99%, which would further reduce the average cost to perhaps $200, and so on. The overall effect is somewhat akin of "falling off a cliff," or perhaps the collapse of a star destined to become a black hole: Once a certain point it reached return is impossible or impractical. Now you should understand why I'd be quite pleased to see such a system modelled: It would be great to be able to vary the initial conditions, and see that the outcome turns out almost identically each time. Such an outcome would make you very nervous: It would show that I am correct! (BTW, a similar analysis will probably suggest that the amount of money traditionally spent on US national defense would drop from the current figure of about $250 billion to no more than 1/1000th of this, or maybe even far less, and for similar reasons.) Jim Bell jimbell(a)pacifier.com

1 0

Singapore
by William "Bud" Kennedy 17 Dec '03

17 Dec '03

SINGAPORE (ITN) * Singapore announced rules Thursday aimed at blocking anti-government views and pornography on the Internet, adding to the thicket of laws that regulate books, movies and public discussion here. But authorities insisted the latest rules -- one of the first attempts by any country to screen the Internet -- do not amount to censorship. The government will hand out annual licenses to Singapore's three Internet providers, as well as to political parties that maintain Web sites, groups and individuals who run discussion sites on politics and religion, and on-line newspapers. Beginning Monday, these groups will be responsible for blocking out material deemed objectionable by the government. Violations will result in licenses being revoked. "We are not censoring discussion groups. By registering these groups, we are asking that they behave responsibly," said the Singapore Broadcasting Authority, a governmental regulatory body. The free-wheeling global computer link up has provided the Singapore government a major dilemma. Singapore promotes the Internet as part of its objective to make the city of 3 million people the hub of high-tech industry. One in three homes has a computer, and the number of Internet accounts doubled last year to 100,000. A government plan calls for connecting each home to a computer network by 2000. But the Internet has also brought into Singapore what the government had successfully kept out for years -- criticism of the administration and the judiciary, pornography and discussions on race and religion. About 10 SBA officials will surf the net daily for objectionable material. A government-appointed panel of prominent citizens will decide what is objectionable, said Goh Liang Kwang, chief executive of the Broadcasting Authority. But he admitted that even with regulations, the SBA cannot completely police the Internet. "We don't claim we can regulate the Internet. We just don't want objectionable material to be easily available. We want to keep our immediate neighborhood clean," said Goh. Still, a lot of rules remain vague. Although political parties will need licenses, it is not clear if individual politicians would be allowed to post anti-government views on bulletin boards. The SBA guidelines say it will not allow contents that "tend to bring the government into hatred or contempt, or which excite disaffection against the government." The definition of hatred or contempt has not been spelled out. The government will also ban: -- contents that jeopardize public security or national defense. -- anything that ridicules racial or religious groups. -- the promotion of religious deviations or occult practices. -- the "gross exploitation" of violence, nudity, sex or horror. -- the depiction of "sexual perversions" such as homosexuality. All these are already banned from books, magazines, newspapers, movies and public forums.

1 0

Re: A case for 2560 bit keys
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Jul 13 12:51:36 1996 > On Thu, 11 Jul 1996, Chris Adams wrote: > > > check your setup. I used to run a 386-20 (5MB RAM) and it took about > 3 > > seconds for a 1024 bit key. Given it didn't even have a copro (not > sure > > when/if PGP uses one) and that it was off of a Stackered drive, I'd > > expect you to have much better times. > > That's consistent with the timings I've been getting. It should take > about > 9 seconds to decrypt an arbitrary message with a 2048-bit key with the > setup > you describe. Of course, I usually use X, so that probably does throw > off > the timings a bit. > This is an issue that is connected with the "Need PGP awareness" thread. If everyone is decrypting their messages by hand then nine seconds is a hinderance. On the other hand, if everyone is using an off-line reader that checks signatures/decrypts as it receives messages then nine seconds (or less for a newer machine) is less significant. I'll refrain from making any product plugs here, but I could barely notice the difference moving from a 1024 bit key to a 2047 bit key. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMefUGeSLhCBkWOspAQGuPgf+I2A0a3F6OeBMA9MGUp0ww13Xiq3+LdS4 pOEvhz7Ub1tBUcl5Ko8/y/7pIZE1pZom0fOoyDOD9HX9OrHrY7sDkKbDY2sirfEl dovFKKImIJaMzxDgKhxAdlrmrLq/xrz2rAXv9FvA/KSkCJys/A7ydu9AprKA7Esf E6qRDmQFuuTcNvEVC5WOoDLVQoNZQUe1gVs97YFYFabTMA0bXr8bI/RdHcFy8vIj 51jBSI3Ib2WgcGOa2dKrmU7TRMQk5UHGGxKuKGGgIaOZ4uvPVUmNwHVg9wADbnzX fjkZBvk8/sIqvD4Z4rHWulpHVJxCgKHzVgsh7exCVoZlffITu0SHqw== =kHRX -----END PGP SIGNATURE-----

1 0

Markoff on Clipper III
by Duncan Frissell 17 Dec '03

17 Dec '03

On the Friday "Clipper III" rehash by the Admin: Balancing Privacy and Official Eavesdropping By JOHN MARKOFF "The president and vice president took an oath to protect our national security," Simon said. "They feel they have to err on the side of protecting national security." The government also said that it did not see an immediate technical solution to the problems that would result from the global proliferation of "strong cryptography." ************** Last time I looked, the oath they took was to protect the Constitution -- not the nation or national security. I don't see an "immediate technical solution" to strong crypto either. Or, indeed, a long-term solution. DCF

1 0