- cypherpunks-legacy - lists.cpunks.org

Re: Export Restrictions of Crypto
by Dave Banisar 17 Dec '03

17 Dec '03

You can get a copy of the ITAR regulations from cpsr.org /cpsr/privacy/crypto/export_controls dave > Date: Sun, 10 Apr 1994 14:39:14 -0400 (EDT) > From: Senator Bedfellow <samman(a)CS.YALE.EDU> > Subject: Export Restrictions of Crypto > To: cypherpunks(a)toad.com > Message-Id: <Pine.3.07.9404101413.P29469-9100000(a)jaguar.zoo.cs.yale. > edu> Mime-Version: 1.0 > Content-Type: TEXT/PLAIN; charset=US-ASCII > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > Does anyone have the cite for the restrictions on the export of crypto, > where crypto is classified as munitions for export purposes? > > I know ITAR says absolutely nothing about crypto, so its a US goverment > thingee. > > Thanks > > Ben. > > > ____ > Renegade academician. They're a dangerous breed when they go feral. > -James P. Blaylock in "Lord Kelvin's Machine" > > > >

1 0

RE: MacPGP and AOL
by Pat Farrell 17 Dec '03

17 Dec '03

> AOL will not allow me to upload MacPGP on the basis that there is > a court case pending against the author, and therefore it should not be > allowed. My question is since the court case is pending why can't they > allow it on until a verdict has been reached? Is this common for > commercial online services or ftp sites to ban it? Jim Bodzos of RSA has a simple plan that goes roughly like this: if you make money off of RSA, he makes money. CompuServ pulled PGP a long time ago, way before PRZ's lawsuit, because they were the only ones making money off PGP in the country -- all those $$ for download fees. EFF had it in their forum, as did several others, all were pulled. Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

MacPGP and AOL
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

AOL will not allow me to upload MacPGP on the basis that there is a court case pending against the author, and therefore it should not be allowed. My question is since the court case is pending why can't they allow it on until a verdict has been reached? Is this common for commercial online services or ftp sites to ban it? ThAnks, Reuben Halper Montclair High -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi16KosAAAEEAMUwRni4a9+GbuAhHDLcBWK60hCJUYxhr2hYokpELAhx0ejp 2fq61Tu9Hjn051CN8Xy5nu6sv2ODfG/t59l4DJSb5pirQaII3zaX0rMX0ydwGDoW YakL4ow1lNY+d/k14KpIuUW404+fNuNhIGSkdVLQIfbOgh0preK7/P44AKvdABEB AAG0JlJldWJlbiBIYWxwZXIgPGZoYWxwZXJAcGlsb3Qubmppbi5uZXQ+iQCVAgUQ LXorceK7/P44AKvdAQEUxwQAoffTibRlwE5tNQVGvrulh1OQgXNhTRec9vUaUwPy U64FIZ+KnmdfYgiJYXtcItA90EB9MDexazKeqJzMOPShVNOfyiwy2yUlnQs425f8 DxBvM//zuvj6s4/mXDTPUZtG9PP0HVaEGTJY15JdfRqtj/w+HHnsHlgCnj0NnIhX TW8= =D9UX -----END PGP PUBLIC KEY BLOCK-----

2 1

fermats theorem. possible urban legend
by Grand Epopt Feotus 17 Dec '03

17 Dec '03

While ona BBS someone brought up something about Fermat's Last THerorem being proven and that renders all crypto broken. After trying to figure out what the hell this person was talking about I figured that he apparently believes that all encyptian schemes are based on large numbers, and since Fermats Theoremn is something like proving that youca find the solution for a^n + b^n = c^n that all of the codes are broken. Now please dont mistake me for someone who has fallen for this, but I am just wondering what the hell this guy is talking about? You're eqipped with a hundred billion nueron brain, that's wired and fired, and it's a reality generating device, but you've got too do it. Free youself ----Tim Leary----

1 0

Zero Knowledge, Hamiltonian Cycles, and Passwords
by norm＠netcom.com 17 Dec '03

17 Dec '03

Page 85 in Schneier's "Applied Cryptography" begins a good introduction to zero knowledge proofs and such.

1 0

No Subject
by Peter Murphy 17 Dec '03

17 Dec '03

I found Timothy May's post on Hamiltonian cycles in graphs very in- teresting. However, my main reason is due to the relevance between this subject and the P - NP problem. Although I am familiar with the practical aspect of this terminology (through my numerical mathematics subjects), I am a bit hazy on the "pure", theoretical side. Does anyone have any references on this matter. I am especially interested in the "P=NP?" problem. Thanks. Peter Murphy. <pkm(a)maths.uq.oz.au>

1 0

identity, privacy, & anonymity in cyberspace
by tmp＠netcom.com 17 Dec '03

17 Dec '03

hal finney recently wrote an interesting message taking the position that cypherpunk aims are not so much to pursue total anonymity but to promote systems with a variety of degrees in identity and pseudonymity so that the appropriate level can be achieved in various settings. (for example, borrowing money seems to require that one sacrifice some degree of anonymity and privacy). below is a message i have taken to represent the cypherpunk position from hal finney. this came from chaos.bsu.edu, a fun gopher server with a lot of cypherpunk position papers (i assume they are representative). in it, hal argues against identifying anonymous messages, saying that it would mark them with a `scarlet a' and relegate them to the `ghetto'. his recent comments seem more accommodating and less extremist. >The level of anarchy will >inevitably increase as larger numbers of people acquire net access. it seems to me that the cypherpunks already have a name for the kind of anarchy that can happen when somebody uses pseudonyms to harass and cause trouble. that word is `detweiler'. do you really know what `anarchy' is, cypherpunks? as the old parable goes, be careful what you wish for, you might get it. hal argues below that `you already know nothing about the people you interact with on the net' and that `anonymous remailers introduce no more problems than are already present on the net'. these seem to me to be flawed arguments. here's why. first of all, everyone has the experience of going to a party and knowing nobody there. but the fun of the party is learning about the people who are there! do we really want an online environment where identity is as transitory as a nym on IRC? it seems that what everyone is craving behind the banging on the keyboard is what has been called active, human `interconnection' to contrast it to `interaction' with a computer alone (still generally considered an inanimate object). if we want communities, the places we like to live in, it seems that identity is intrinsic to them. next, `anonymous remailers do not introduce any problems beyond those that already exist'-- aren't we trying to *solve* the problems associated with building an online community, our civilizations in cyberspace? it seems to me that if cypherpunks want the rest of the world to adhere to their ideas, they have to show how they are *superior* to those already present, and how they *solve* nagging problems. yes, remailers solve the problem of trying to post messages without identity, but are we sure this is a `problem' we want to `solve'? for example, hal notes that some system operators completely ignore complaints on the net. but do we really want a community of system operators that simply throw any feedback to /dev/null? what about when someone is mailbombing Usenet from a site? isn't what we *really* want a more basic definition of what is allowed and what is not? besides, under the cypherpunk vision, operators would never censor a user for postings-- but is it the case that all cypherpunks can say they have never tried to censor anyone by notes to sysadmins, i.e. of detweiler? regarding the pseudonymity issue, it seems to me a more basic, fundamental design goal might be this: we wish to make sure that people do not use sensitive private information against us. it is not a problem for our friends to know this information-- in fact it is critical that they do (friendship is based on identity!). the cypherpunk vision seems to split the world into two groups: those people i trust (my friends) and everyone else (whom i completely distrust with intense paranoia). this is a very xenophobic and chauvinistic philosophy at heart. hal argues below that there is `no line dividing the clean from the unclean' (real name vs. pseudonymous vs. anonymous etc.). to the contrary it seems to me to be the case that either `i know who you are' or i don't. what does it mean for me to `know who you are'? i admit there is no basic definition, but it does seem to me that should not prevent us from trying to find one. for example, it seems to me you cypherpunks have a very important agenda, but you seem to be extremists. the important goal is `defining what privacy really means' and cypherpunks seem to take the position, `it means that nobody knows anything about me'. our society simply cannot function under this constraint. if i wish to `interconnect', identity is necessary to minimize risk to the people i `interconnect' with. so what the cypherpunks might consider is a less extremist elucidation of what `privacy' means. for example, cypherpunks, what information should a bank be allowed to have on you when you go in to request a loan? what should companies be allowed to do with credit histories, and what rights does the individual have to influence them? if you continue to insist that `nobody should know who i am' i fear you will be bypassed by more sophisticated groups that have a less polarized view of issues of identity and privacy. and it will ultimately be the least controversial proposals that will shape the future we live in. the recent hal finney message as well as recent considerations of `morality' on the list (albeit quizzical) suggest to me you might be open to a more conciliatory, less dogmatic position on these immensely important issues. i am going to sign off for awhile in an attempt to advance some new meaningful projects (such as set up a gopher server), but i thank you for your stimulating conversations and email, and i apologize to anyone i have ever offended (send me mail if you feel i have personally left something unresolved). hal finney's message follows. pseudonymously yours, --tmp -----BEGIN PGP SIGNED MESSAGE----- I sent mail to Cypherpunks on this a couple of days ago, but it never appeared. There is a problem with the notion that all "anonymous" remailers and news-posting services should label their messages as anonymous so that users can decide whether to read them or not. This approach abandons one of the strongest arguments in favor of anonymous remailers, which is that the net is inherently an anonymous environment. Especially as more public access Unix systems, BBS systems, and so on become part of the net, we are going to see less and less of the strict controls on identity which were possible when the net was restricted to a few government labs and large universities. The level of anarchy will inevitably increase as larger numbers of people acquire net access. Unless massive and universal authentication efforts are undertaken, it is going to be more and more the case that you will know little about the true identity of a poster. Because of this, those who object to having to read the words of an "anonymous" poster are taking an untenable position. They are already reading words of people about whom they know no more than they would about an anonymous poster. And the argument that "non-anonymous" posters are subject to a form of discipline not available to anonymous posters - messages to the system operator - is clearly falsified by the existance of many sysops who care nothing about complaints. As more and more people run their own machines with net access, these cases will only increase. In short, we anonymous remailer operators have every right to be part of the net. We introduce no more problems than are already happening and will continue to occur as the net grows and becomes more universal. The resistance we've seen is from old-time sysops who are unable to adjust to a changing network environment. Rather than placating obsolete beliefs about network identity by agreeing to mark our messages with the scarlett letter A for anonymity, by accepting that we deserve to be in a ghetto set aside for inferior posts, I feel that we should challenge the net with messages that blur the distinction between anonymous and authenticated posts. The sooner people realize that there is no line that divides the clean from the unclean, the sooner anonymity will be widely accepted on the net. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK7S2oqgTA69YIUw3AQEfagP8DlzINcvUDn7jc351S+hHTBz5NtB3RbRC l+0rgltFcn6QxWaE0GsWFcOa6RcPOe1DOTlwiJejiT6MbnfuDopbUoS98bCiIzLE 0Q2ZVhtsfLs5zFdUj08bRzzU7zyuzSmNoSsCx01O6OiGZB/zs0PEnx/0XqRtXFD2 RM1YTCPIF7Y= =0zw5 -----END PGP SIGNATURE-----

1 0

Re: Zero Knowledge, Hamiltonian Cycles, and Passwords
by Derek Upham 17 Dec '03

17 Dec '03

> A potential use for such systems is for passwords--one can prove one > has the knowledge without actually producing it (by typing in a > password, for example). I don't know that anyone is actually > exploring this application, yet, but I expect it'll come. Look at "Strongbox: A System for Self-Securing Programs" by J. D. Tygar and B. S. Yee in the "CMU Computer Science 25th Anniversary Commemorative" proceedings (from 1991). As the paper describes: ``Strongbox uses an authentication protocol derived from Rabin's observation about the square root operation: if one can extract square roots modulo n where n=p*q , p and q primes, then one can factor n . [That should be `if and only if', i.e., finding the square roots is too hard unless you created n in the first place.] Both our protocol and FFS are *zero-knowledge authentication protocols_* [. . .] And in contrast to Needham and Schroeder's authentication protocol, zero-knowledge authentication protocols require no central authentication server and thus there is no single point of failure that would cripple the entire system.'' In addition to zero-knowledge authentication, the paper provides an algorithm for the secure exchange of sessional symmetric encryption keys, and ways of combining authentication and key-exchange steps. I managed to get the key-exchange working some months back (in C++, using GMP to handle the number-crunching), but it was hampered by my incredibly slow 386 on one side and odd bugs in the Sun4 environment on the other. Contact me if you want to hack around on it. I also know where to find unreleased GMP 1.9 sources for some additional, probably more reliable, functions for calculating the Legendre symbol (which the whole system depends upon). Derek

1 0

FW: Shot 'Round the World
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Blanc Weber writes: > On the subject of psychological warfare as a method in this privacy > effort, I was pondering: > . the effectiveness of the tactic employed > . the character of the intended recipient of the message > . how it will be interpreted by them > . predicting whether they will care, in the same way as the sender, > about the purpose & content of the message > Since the communication is mostly words framing thoughts and > philosophical arguments, the effects that one can aim for will be > either cognitive or psychological (hopefully achieving both). To aim > for a psychological effect only, is to propose that you know so much > about psychology, that you know precisely what to aim for - in the > minds of all of the recipients, and to expect predictable results. This goes too far; it's possible/reasonable to only suspect that an action will cause a certain effect in a useful segment of the target population. We don't insist on all-or-nothing accuracy in other forms of warfare, why expect it here? > In the attempt to persuade, convince, convert others from their > position which is offensive to one's own, the methods employed are > typically negative: pointing out the adverse consequences, pointing > out what is wrong with what is being done, pointing out how > bad/lousy/wrong/mistaken the offending party is, etc. This doesn't sound like psychological warfare to me - it sounds like some form of discussion. Psychological warfare is about manipulation and FUD (fear, uncertainty, doubt). (For all I know, it's about other stuff, too. Folks with actual training in the field are welcome to correct me.) > What is lacking in the mind of that type of psychological target is a > perspective on what is normal to a regular human being. So how could > positive indicators to the rest of life be given; how could a vision of > what else is true about real people be created, so that the perspective > of those targeted individuals or agencies is offered something better > to think about than the problems created by a few out-of-control types; > so that their outlook on the subjects of their attention (in this case, > the citizens of the US) is not composed only of visions of delinquency > and aberrant behavior? It sounds like your point is "if we're really good and eat our vegetables and clean our rooms, maybe Dad will let us stay up late to watch TV." Well, fuck that. The state is not our parent, and we don't need to demonstrate good behavior to convince it/them that we deserve or can be trusted with strong crypto or untapped phones. > It is a challenge to "maintain one's head while all about one, others > are losing theirs". Yet not only is that what is needed, but the > agencies supposedly charged with our welfare could also use some help > in maintaining *their* rationality. They apparently need some support > to the end of acquiring confidence in our judgement (the rest of us who > are not members of the elite, the chosen few). They are alarmed by the > potential threat of destruction of a system which they prize as the > means to social stability. What would reduce their felt need to cover > the world with wiretraps in order to make sure that they don't miss any > loose cannons out in the mists of the wild electronic atmosphere? What > could provide that sort of reassurance, that everyone is not going to > begin using their liberties in wanton, uninhibited, juvenile ways > against the system or against each other. What could provide evidence > contrary to the agencies' conclusion that non-government employees do > not have what it takes to make rational decisions about the toys & > tools and other devices which they create for their own amusement. No, they do not need our solicitude to bolster their flagging confidence, they need a good kick in the teeth. I suspect that good behavior will only convince them that we're up to something *really* evil that they need more tools/access to discover. [...] > There would be a great benefit to a psychological type of warfare, if > it could achieve points for the potential to normality which exists in > everyone; if it could present evidence to counter the argument that the > individual cannot be trusted, that we need to be saved from each other > (by the intelligence agencies). What could bolster their lack of > confidence in the judgement of the general population, such that the > conclusion made to use the services of these agencies would be proved > unnecessary? There is no rational argument that can force the non-trusting to trust. Attempts to formulate one frequently inspire further mistrust. > This would be demonstrated by the kinds of actions taken by individuals > in response to the threats against their privacy. So .. to demonstrate that we deserve privacy, we should ask politely for it? Bad little girls and boys are to get no dessert? Heck, my dog is smarter than that - she wants to see the treat before she does the trick. I don't even see the treat here (and am uninterested in letting the state teach me any new tricks). > To wage a psychological war is to assume a great responsibility for the > impressions made upon those who will be judging the behavior of their > "charges". Sometimes it's useful to drive opponents into such a frenzy that they're no loger capable of rational thought; it can be dangerous when the frenzied opponent will use the mechanisms of "public safety" to express its frustration. I agree that this sort of project must be undertaken with some care - but the point may be to create a state of irrationality, not a particular rational conclusion. The former is frequently easier and cheaper to create. > The psychological warriors would be taking part in the > creation of a picture of the population, the effects of which would be > a determining factor in the decisions made for future policies. It is > very easy to take exceptional cases and use them as examples upon which > to base techniques implemented for the cause of safety. It could > hardly be expected that a limited few would have the resources to > accomplish the goal for everyone, of saving the image of the individual > against the one-dimensional cyclops (within our own lifetime); it is > questionable whether any individual should associate themselves with > the burden of such a responsibility. Perhaps this discourse about "images" isn't useful, and it's time to talk about capabilities. Individuals have the capability to carry on private conversations whether the state likes it or not. Just as the forces of "public safety" can and will represent themselves as activists, terrorists, and saboteurs in order to infiltrate and influence dissident political groups, members of the public safety forces may be or may become disenchanted with the current regime or political climate and use inside information to embarass or injure the machinery of the state. I don't think Jeff Davis' action was an attempt at discourse but a shot fired across the bow of the ship of state. As such, it does indeed serve the purposes of rational discussion poorly; but it was meant to reach other goals. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLajOb33YhjZY3fMNAQGWMAQArmz5Ue8t8MCy09lM2q2w3QWARhzw1zHl vysopTCHhHh9CYtxJRaMPRsmCXWf4/b8ThEVE30dfVDYA1TeZktxYQCtDzRP7Xg+ wCPlxKGFCnpfaOdjkrq02sl/hMoZgBT89q8Y/rz5DLAcbKFBh/Ei5Pkyl2a5Kst3 mFnc0xpe/Bw= =JQNO -----END PGP SIGNATURE-----

1 0

ftp sites for 1984 NSA shirt
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

The NSA 1984 shirt is now available at the following ftp sites: ftp.atd.ucar.edu:/pub/Crypto ftp.wimsey.bc.ca:/pub/crypto/shirt It is still available for web surfers at: http://phoenix.aps.muohio.edu/users/jdblair/t-shirt.html Thanks to Mark Henderson and Jonathon Corbett for making the design available. Contact me at: jdblair(a)nextsrv.cas.muohio.edu if you would like the ordering information again. -john. -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 PGP public key available upon request. KILL YOUR Privacy in the information age is a right, not a privilage. TELEVISION Information = Power = Control. Fight the centralization of information.

1 0