- cypherpunks-legacy - lists.cpunks.org

Solution to the Dimitri Problem
by nobody＠replay.com 17 Dec '03

17 Dec '03

Boy, it seems that our resident KOTM is now just posting for the hell of it - just get a kick out of seeing his own messages on this list. Therefore, I have a solution to this. Since he likes to see his own words so much, why don't we start sending him multiple copies of all of his words of wisdom? The following recipe for Procmail does the trick just fine. :0 * ^(From|Sender).*dlv(a)bwalk.dm.com ! dlv(a)bwalk.dm.com This recipe could also be modified to mail him multiple copies of his messages or anything you feel that he should see. Have fun with it! If enough people do this, we just might be able to get him to leave us alone for a while.

1 0

Re: DES cracker.
by Adam Back 17 Dec '03

17 Dec '03

[added cc cypherpunks also] Sameer Parekh <sameer(a)c2.org> writes: > Peter Trei <trei(a)process.com> writes: > > Ideally, this should be a DEMO case of a real world encrypted > > application, in which we have a cryptotext, and a known plaintext, > > each at least one 8-byte block long. > > I'd like to get in touch with a bank who can provide us some > sample ciphertext for an ATM transaction or something like that. I > initially thought we should hit SWIFT, but that would be very > illegal. =) If someone can dig up a selection of banking protocols (some of these things must be standardised), perhaps we can simulate the same thing without the legal implications. Of course you'd need the person constructing the challenge to be trustworthy to the tune of $10k, or whatever the prize fund pans out to be. For that matter the NSA, or anyone else with a hardware breaker would be able to cheat, but then they help our cause, which is to demonstrate how weak DES is :-) So start digging for banking protocols! Personal contacts, web searches, obtaining standard documents, dumpster diving, whatever it takes. Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Comment on binding cryptography (2)
by James A. Donald 17 Dec '03

17 Dec '03

At 05:41 PM 10/16/96 MET, Bert-Jaap Koops wrote: > I haven't yet made up my mind how the crypto problems for law > enforcement are to be addressed. It's my Ph.D. subject, and all I can > say at present is that the issue is complex. Before addressing the problems of crypto, how about addressing the problems of opaque envelopes in snail mail. Opaque envelopes not only facilitate criminal conspiracies in the same way that crypto does, it also makes possible such things as letter bombs, which have no crypto equivalent. The solution: Mandatory tranparent envelopes. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Goodbye
by John Young 17 Dec '03

17 Dec '03

At 07:04 PM 10/16/96 -0700, you wrote: >Thus the glory days of cypherpunks, an insider club of the best >and brightest, far superior to the common herd, where we planned and >organized for a world where the ignorant masses can no longer >rob and harass their superiors, a world where the elite can >live the good life in freedom and comfort and abandon the >useless worthless masses to wander blindly into ruin, despair, >and slavery, lost in a world they cannot understand, and will >no longer have the power to smash. Why, James, this reads very much like Robert McNamara's best and brightest in the Nam glory days, cheerleading the B&B gang's gory battles slaughtering the worthless masses for vain comfort of the elite Pentagon planners. I presume you are not a savagely scarred vet, wrecked by over-heated ambition of the B&B elite, just another rightly ignored McNamara crybaby aged-Whiz Kid. Take R&R for a long while, you need it. Go to your nearest VA Hospital and wipe-up bed pans. Then come back to c'punks and earn your rank, not just flaunt the vanity plates.

1 0

RE: [NOISE] I never knew that Dimitri Vulis was a net.legend
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> wrote: >And here I thought it was the real history of the Net, especially the part >about how "the dandruff-covered Peter Vorobieff (spit) conspired with the >purebred Sovok Valery Fabrikant (spit) to spread the lies of the Jew >cripples dying of AIDS in Sovok-controlled clinics." >(hint: this a satire, based on the writings of Vulis, who speaks of people >as "lying purebred Sovok Tchurkas" (whatever _they_ are), and attaches >the charming word "(spit)" after nearly every person he references.) Just last week Concordia University in Montreal unveiled four new art installations; one dedicated to the memory of each of the four professors shot and killed by Valery Fabrikant. The works are in the form of tables so that they can be integrated with the student body. Raving on the net does occasionally have physical manifestations. Prend soin, James

1 0

EUP_hem
by John Young 17 Dec '03

17 Dec '03

10-17-96. WaPo: "U.S. Considers Slugging It Out With International Terrorism" Officials contend that the main threat now comes from a murky network of home-grown, privately financed and largely independent groups forming a kind of international "terrorists' Internet." That network is proving extremely difficult for U.S. intelligence agencies to locate and penetrate. "Today's terrorists don't have to depend that much any more on states for access to financing or the technological means." "Postal Service Plans to Leave Its Mark on Electronic Mail" Cylink is developing a system for electronically postmarking and encrypting computer messages and Sun and Enterprise Productivity are developing software that will allow bulk mailers to calculate the price of mail shipments on the Internet. The Postal Service predicted that the new system ultimately will account for $5 billion in postage a year, about 9 percent of all postage. ----- http://jya.com/euphem.txt (18 kb for 2) ftp://jya.com/pub/incoming/euphem.txt EUP_hem

1 0

rival Clipper products
by scrappo.reverb＠juno.com 17 Dec '03

17 Dec '03

What somebody needs to do is make a rival for Clipper products. I propose that somebody with enough money should have a Clipper-type chip implementing Triple-DES or whatever developed and marketed. They should do the same things, except not be restricted by the government (obviously this wouldn't be for export) by the means of using weak crypto. These devices could probably be marketed to the same audience that Clipper products are aimed at, i.e. the general unsuspecting populace. The only problem I could see would be educating whoever buys into how the government is pulling the wool over their eyes. I'm sure with some funding from a major source, or some donation of time/supplies from a manufacturing company, it could be pulled off in grand fashion. Who said we can't play the government's little game? This along with some "Big Brother Inside" stickers massively propagated, and it might fly. Any insights?

2 1

Re: Anonymous Auth Certificates [was: Re: Blinded Identities]
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> >> >Steve Schear <azur(a)netcom.com> writes: >> > >> >[much cut] >> >> >> >> I've been charged with developing an Internet service which needs to >>assure >> >> its clients of anonymity. However, we fear some clients may abuse the >> >> service and we wish to prevent the abusers from re-enrollment if >> >> terminated for misbehavior. (In your example, it would be the person(s) >> >> trying to discover the service host via flood). >> >> >> >> My thought was to base enrollment on some sort of 'blinding' of their >> >> certified signature (e.g., from Verisign) which produces a unique result >> >> for each signature but prevents the service from reconstructing the >> >> signature itself (and thereby reveal the client's identity). I'm calling >> >> this negative authentication. >> > >(Sorry about quoting so much, but I liked Steve Schear's succinct problem >statement.) > >I don't see how authorization certificates solve this problem. How >would you determine if someone was qualified to receive an authorization >certificate? And what would you do to make them stop using the service >if they abuse it, and to stop them from getting new authorization >certificates? > >Thanks, >Hal It seems that one crux of the problem revolves around the CA and its method of certificate issuance. A CA which uses biometric data to reduce/eliminate the chance that an applicant could get several, unrelated, certificates issued would provide a basis for negative authentication (similar to a negative credit file). A one-way function performed, by the client, on their certificate from this CA would yield a token which unambiguously binds it to a valid certificate of the CA (and therefore uniquely identifies them) w/o revealing the certificate itself. -- Steve

1 0

Goodbye
by James A. Donald 17 Dec '03

17 Dec '03

Goodbye I am leaving cypherpunks for a while, perhaps forever. Why should anyone handle a high volume list as a list and not as a newsgroup? Our tools for handling newgroups are superior to our tools for handling mailing lists. The reason to prefer mailing lists is that the very inconvenience keeps out the ignorant masses. Word initially spreads person to person, and intelligent and highly motivated people make most of the contributions, Thus the glory days of cypherpunks, an insider club of the best and brightest, far superior to the common herd, where we planned and organized for a world where the ignorant masses can no longer rob and harass their superiors, a world where the elite can live the good life in freedom and comfort and abandon the useless worthless masses to wander blindly into ruin, despair, and slavery, lost in a world they cannot understand, and will no longer have the power to smash. In those days we forged the weapons and planned the strategies, defending the net against the enemies of freedom. But with the passage of time, we got the same half human trash as you encounter in the newsgroups, and less satisfactory tools to filter them. The glory days are long past, and cannot be revived by forming a new mailing list. Perhaps I will see you guys on Usenet, by and by. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Binding cryptography - a fraud-detectible alternative to key-esc
by Bill Stewart 17 Dec '03

17 Dec '03

I haven't seen the technical papers behind the postings you've made to the net, but the overall approach sounds very similar to "Clipper II", the Software Key Encryption work that the TIS people (Steve Walker?) and Dorothy Denning were touting a year or so ago. It wasn't in your references, and it's clearly close enough to be worth your attention. The design was interesting - it chose a set of public and symmetric key encryption that allows the recipient to validate the sessionkey-encrypted-to-key-copy-holder*. A not-highly-technical description of the TIS CKE Commercial Key Escrow system is at http://www.tis.com/docs/products/cke/present.html, particularly present9b.html. It's worth reading for the appalling graphics alone :-) I don't seem to have a copy of the technical description anywhere. <IMG href="http://www.tis.com/docs/products/cke/pres7a.gif"> A major capability that was missing from Walker's SKE work is the ability to split the copied* key into two or more parts, all of which are need to recover the session key, while making it possible to validate that the pieces do add up to the session key. (This was also missing from the Clipper chip in hardware, which pretended to do it in the master key setting process.) Can you extend the approaches you're using to allow an outside party, or at least the recipient, to validate that the two parts of the copied key contain the complete session key? [* I'm using the terms "copied key" and "Key copy holder" to refer to the copy of the key that you're giving to some third party and the third party. The term "escrow" is generally not applicable to the applications that transmit a copy of the key to some third party, and the technologies involved don't specify, communicate, or enforce conditions for access. TIS's CKE does at least cart around a 32-bit user-defined string for specifying recovery conditions, but there's not technical enforcement. ] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0