- cypherpunks-legacy - lists.cpunks.org

Re: Juno Newbies are Great!
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 14-SEP-1996 07:37:07.81 >- it's free. Anybody can get on it. Easily. Anonymously, more or less, > since they don't need to have your whole credit history > to be able to charge you money. At most you need a maildrop. As has been previously pointed out, this also makes it nice for disposable remailer front ends. Is anyone currently working on this project? -Allen

1 0

Re: What is best policy paper on crypto?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 7:18 PM 9/12/96, Gregg Cooke wrote: .... > > I'm gonna stick my neck out here and ask a naive question: where > can I find "the NAS report" mentioned in this thread? Note that > I'm new to this list (2 days) so please be kind if this paper is > extremely well known (it's not known to me but it sounds like > something I need to read). > > -Gregg I think that they meant the NRC (National Research Council) report. It is at: <http://pwp.usa.pipeline.com/~jya/nrcindex.htm>.

1 0

Mobile IP URL typo
by John Gilmore 17 Dec '03

17 Dec '03

> >locations. See http://www.ietf.org/html-charters/mobileip-charter.html, > >or search for "Mobile IP" in a web search engine. > That URL got 404-NotFound... s/-/. http://www.ietf.org/html.charters/mobileip-charter.html John

1 0

Pipeline Up
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Cancel that poop about Pipeline being down. Seems only NYC is down. Access is OK through PSInet. jyy(a)gnn.com is for top secret black SIGINT only, okay?

1 0

Cryptography of a sort - redux
by Dale Thorn 17 Dec '03

17 Dec '03

If anyone remembers my original postings from a couple weeks ago (my first-ever on The Net), I described a method to "shuffle" bits in a text-stream, using simple random-number generators, to insure that the text cannot be descrambled by brute-force methods. It has occurred to me only after this time that there was significant misinterpretation of what I proposed. I do not change any bits of text, I merely reposition them, therefore there is no applicability of standard analysis techniques (XOR masking, whatever) to the decoding process. The result file contains the same number of zero and one bits as it started with, through any number of encryption layers. The only way to recover the original text is to reposition the shuffled bits correctly, which requires brute-force guessing of the pseudo-random-number output. This guess is very simple for the first encoding layer, but compounds exponentially in subsequent encodings, so that after half a dozen or a dozen passes, where the executable program(s) is called from scratch for each pass, the shuffling rapidly approaches true randomness, and cannot be decrypted in practice except through the exact mirror-image reversal of the encryption passes. An example: How long would it take for you to guess the number (between 0 and 32000) I'm thinking of, if you could guess 16 billion numbers per second? Would it be .000001 second, on average? If you had to guess the ten different numbers I'm thinking of, and get all ten correct sequentially, it should take an essentially infinite amount of time, yes? And remember, since computer bits have such low differentiation (ones and zeros), looking for "patterns" and so forth just doesn't apply in this type of encryption. As to the Public Key part of the argument, once there is general understanding on the above points at large, it might then be worthwhile to discuss the advantages and disadvantages of how to make/distribute Private keys, etc. One gentleman on this forum made an argument recently, something to the effect that it wouldn't be worthwhile for Hacker X to try to break into datastream Y, assuming datastream Y is encoded with such-and-such a key, that datastream Y is sufficiently unimportant, and motive for such a breakin would not be great enough to justify the expected effort. To such arguments, all I can say is, this is the computer age, and enough mundane transactions can add up to something significant, or, one could lower the expected-effort ratio, you get the picture.

2 1

Re: Workers Paradise. /Political rant.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:43 PM 9/15/96, attila wrote: > NO, it does not need to be or do either, BUT, it means > that everybody independently attempts to succeed and the > 'community' takes care of itself --and in the standard > sense, the ne'er do wells fall off the path of *their own > free choice.* There will always be sickness and calamity, > but that is what the community is for. > > BTW, it still works today; I live in one of 'em. And lest there be any doubt, I _do_ support certain kinds of charities, and will not of course stop anyone from practicing charity. While I have no religious beliefs to speak of, I strongly support the mechanisms some churches have for taking care of their own members, recruits from the street, etc. (Including Salvation Army and "mission" sorts of inner city things--note of course that most such entities also insist on prayer and/or Bible readings as part of the deal...I wonder how long it will be before a class action lawsuit is filed to stop the prayer part? This would effectively shut the missions down, of course.) The thing about _traditional_ charity, of the religious or community sort, was that it was not treated as an "entitlement," as something the resentful masses could "demand" as part of their "human rights." A parish priest, for example, might extend charity to a poor person, or a widow, or whatever, but not to an able-bodied person who simply decided to not work. Nor to an unmarried woman who kept getting pregnant and having more mouths to feed. (I surmise that most such women either died of diseases related to sexual promiscuity, died in childbirth, died of disease brought on by malnutrition, or ended up in convents (Catholic birth control).) The point is that even in an "age of charity," strings have to be attached by the givers of charity. People will simply not give 40-60% of what they earn to support a growing population of people who say it's their "right" to welfare, AFDC (Aid to Families with Dependent Children), WIC (Women, Infants, and Children), food stamps (*), and suchlike. (At certain supermarkets I sometimes shop in on the way back to my town, people in front of me in line put their nice cuts of meat down, their fine loaves of bread, their frozen dinner entrees, their "Ben and Jerry's Ice Cream," and then pay for it with books of blue "Department of Agriculture" food stamps. They use their own cash (perhaps gotten by cashing their welfare and "disability" checks) to buy their smokes and booze, as food stamps are not allowed to be spent on this stuff. My impression is that they eat more expensive food than I do, perhaps because they're buying the food with "play money," whereas I'm buying my food with money that's what's left after I had to pay 40-50 taxes, so I seek to economize when I can!) > Now, I don't intend to be Scrooge, but I'll fight for my > rights to cut off at the knees the knee-jerk liberals and > government slavemeisters who want to tell me that I, and > 2 others are required to support 100 freeloaders. And speaking of Scrooge, I like "A Christmas Carol" about as much as anyone I know, and try to take the lesson of what Scrooge learned as a general lesson about life and living it. (As with "Robin Hood," the message is often confused. Robin Hood was not "stealing from the rich," he was taking back what was stolen from the peasants and farmers by the King and his tax collectors, notably the Sheriff of Notingham. At least this is how I read the myth.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 10

Re: Snake Oil FAQ 0.4 [comments appreciated]
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Mon Sep 16 12:05:17 1996 > (First off, I'd like to thank Matt for doing this.) > > The key length stuff is good, but a common component of snake oil is > that it claims to have very long key sizes. > > | Some ciphers, while currently secure against most attacks, are not > | considered viable in the next few years because of relatively small > keysizes > | and increasing processor speeds (making a brute-force attacks > feasible). The > | tables below should give some general guidelines for making intelligent > | decisions about the key length you need. If the key is too short, the > system > | will be easily broken, even if the cipher is a good one. > | > | In [1] and [2], we're presented with some guidelines for deciding > | appropriate key length. (It is important to note that this is based on > the > | ability to predict computing power 40, 65, and 100 years from now. > Major > | breakthroughs in computing power 30 years from now might render > everything > | on this chart kiddieplay.) > > | * One-Time-Pads > | > | A vendor might claim the system uses a one-time-pad (OTP), which > is > | theoretically unbreakable. That is, snake-oil sellers will try > to > | capitalize on the known strength of a OTP. It is important to > | understand that any variation in the implementation means that it > is > | not an OTP, and has nowhere near the security of an OTP. > | > | A OTP system is not an algorithm. It works by having a "pad" of > random > | bits in the possession of both the sender and recipient. The > message is > | encrypted using the next n bits in the pad as they key, where n > is the > | number of bits in the message. After the bits are used from the > pad, > | they're destroyed, and can never again be used. The bits in the > pad > | must be truly random, generated using a real random source, such > as > | specialized hardware, radioactive decay timings, etc., and not > from an > | algorithm or cipher. Anything else is not a one-time-pad. > > The phrase easy-to-use should not appear in proximity to one > time pad, except in the context 'Easier key management than a one time > pad!" > I would also suggest that the generation of OTP 'pads' for users is *highly* questionable. Who else is getting a copy of them, assuming they're even valid? Dave Merriman - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PGP Email welcome, encouraged, and PREFERRED. Visit my web site at http://www.shellback.com/p/merriman for my PGP key and fingerprint "What is the sound of one hand clapping in a forest with no one there to hear it?" I use Pronto Secure (tm) PGP-fluent Email software for Windows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMjzSBMVrTvyYOzAZAQGVwQP+N6vjyniDH0ad3G8dWu1cPHi5yfvksbS7 EJmgpSVTlaLf1Kp7rX2zBULxKvd2bqN3z3tAhj6reeG8la+P3Skw9gPJS8ggYvOn cXwdRsCyRICgHYMcbaEB/91YsJMweYyzWLe2JZazs3NfsafxdNKerGR7kvoQF0bG oBNR169sGlo= =WqlN -----END PGP SIGNATURE-----

2 1

Re: Position escrow
by Brian B. Riley 17 Dec '03

17 Dec '03

On 4/21/98 7:33 PM, Mark Armbrust (marka(a)ff.com) passed this wisdom: >At 03:08 PM 4/21/98 -0700, you wrote: >>This is a really difficult issue. Even the most diehard cypherpunk >>cannot doubt the usefulness of a cellular position reporting >>capability in an emergency situation, when the user *wants* the cops >>or whoever to know where he is. The big problem is how to keep it >>from being used (or abused) for "law enforcement" purposes without the >>consent of the user. > >Don't archive the information -- supply it as part of the CNID. If the >user has disabled caller-ID don't supply the location info either. > >This depends on the integrity of the service provider and whether they have >the balls to stand up against CALEA. It seems to me that security dependent upon someone else's ethics/guts or lack of them is no security at all. Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "I tried sniffing Coke once, but the ice cubes got stuck in my nose."

1 0

GAO's Latest on Domestic Terrorism
by John Young 17 Dec '03

17 Dec '03

The General Accounting Office published today its April 9 report to Congress, "Combating Terrorism: Threat and Risk Assessments Can Help Prioritize and Target Program Investments." It reviews the status of the domestic preparedness program, and recommends that for continued funding cities be required to perform threat and risk assessments. There's interesting discussion about the Feds sharing sensitive intelligence with locals. And, FEMA questions if it will be legal to require cities to perform the assessments. The report is available from GAO in PDF format: http://www.gao.gov/new.items/ns98074.pdf (363K) We offer an HTML conversion: http://jya.com/nsiad-98-74.htm (78K + 4 images)

1 0

Re: The Living and the Dead
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On Sep 16, 1996 01:54:40, 'jya(a)pipeline.com (John Young)' wrote: >18 Nam photos on our Web page for a glimpse back to the >future of power-mad policy begetting slaughter. Corrected URL's: http://pwp.usa.pipeline.com/~jya/yp01.jpg through http://pwp.usa.pipeline.com/~jya/yp18.jpg

1 0