November 1992 - cypherpunks-legacy

Re: Apple including PKS?
by karn＠qualcomm.com 15 Nov '92

15 Nov '92

After reading the details of that (formerly) secret back-room agreement between NSA and SPA, I don't think I'll *ever* trust a commercial encryption package, especially one for which source code is unavailable for scrutiny. I've learned an important lesson in this business. You can never depend on someone else to ensure your privacy. You have to do it yourself. Phil

1 0

Re: Apple including PKS?
by oren＠apple.com 15 Nov '92

15 Nov '92

>Re: Apple include a PKS with their Macs > >Well, Apple does have a site license for RSA. Tim Oren, who's on the >list, knows more about this than I. I ask him to respond. > >Maybe Apple could license the PGP code as a system utility? > >Eric Apple does have a license from RSA, which includes both site and redistribution rights. The intent is to make security-enhanced features available in something called OCE (Open Collaboration Environment) which is to be Apple's entry in the E-mail / user directory / etc. marketplace. OCE is likely to be an add-on, that is, something not shipped with every Mac, but available at extra cost. Since I'm under NDA for the details of OCE, I will simply quote what MacLeak says: According to MacWeek, Apple is using RSA software with 150-200 digit primes for Digital Signatures. They are using "RSA's RC4 algorithm [which will] provide encryption of the fly for data transmitted across an OCE (open Collaboratioon Environment) network. Each message will be scrambled using a unique 64-bit key. BTW, notice that's decimal digits, not bits, in the signature length. Apple is set up as a certifying authority, but I don't know any details of the plans on how to certify keys. It's a far from simple problem to work out something that will work in the current personal computer market structure and isn't subject to spoofing. Re Apple licensing PGP code: While Apple could presumably do so without violating any laws, so long as any copyright holders in PGP granted appropriate rights, I don't think it's very likely. OCE is a package to be differentiated by its user interface, and apparently MacPGP's (though I haven't tried it myself yet) is rather crufty from the Mac point of view. Also, Apple traditionally wants very tight control over its source code, and is unlikely to adopt something that arrives in such a (shall we say) 'informal' fashion from outside. Finally, as a dose of preventive medicine, I should mention that all of the above is my best interpretation of Apple policy and probable action, with which I don't necessarily agree personally. Flameage ignoring this statement will be routed appropriately. Tim Oren

1 0

test message
by nobody＠alumni.cco.caltech.edu 15 Nov '92

15 Nov '92

This is an un-encrypted test message. Please ignore.

1 0

Re: What's More Important?
by George A. Gleason 15 Nov '92

15 Nov '92

I suspect the reason why anon remailers haven't gotten their due, and OTPs are getting so much press here, is that anon remailers are being developed locally and the development problems for these are straightforward, whereas good RNGs for OTPs are a sort of sticky technical issue which seems to call for a lot of debate. You don't see anyone debating the **software** for OTPs now, do you...? And I do agree, anon remailers are absolutely vital in the overall scheme of things. If for no other reason, to stop or hinder traffic analysis, which is a way more powerful form of signals intelligence than most people realise. -gg

1 0

What's More Important?
by tcmay＠netcom.com 15 Nov '92

15 Nov '92

I try to never say on lists or newsgroups that some subject is inappropriate, or boring, has already been beaten to death, etc. Instead, I figure it's up to others to make this choice. I can always ignore threads that don't interest me. But let me confess I'm mystified as to why the subject of random number generators (and CD-ROMs filled with them) is getting so much attention while Hal Finney's remarkable post on his work toward a fully-encrypted remailer (allowing digital pseudonyms) has received no discussion whatsover! Random number generators, in software and in hardware, pop up in discussions on sci.crypt every couple of months or so. Every argument made here, every basic question, etc., has already come up several times in just past year! Furthermore, and I don't mean to sound chiding or condescending, one-time pads are fundamentally not the way to go. Yes, I know that I just applauded George Gleason's cryptodiversity idea...but I see the stark contrast between the dozens of postings on RNGs, Rander, one-time pads, and CD-ROMs and the utter lack of postings about Hal's remailer...and I am chagrined. Granted, Hal's system is hard to follow. This is another area where some diagrams would help immensely, especially drawn on a blackboard. But anonymous remailing is where cypherpunks need to be. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: awaiting Macintosh version.

1 0

Some organizational trivia to consider
by crunch＠netcom.com 15 Nov '92

15 Nov '92

I will be "off line" for a few days now, as I have to do some work to help out an old friend. I'll be back "on line" sometime late Tuesday, and hopefull will have formulated some organizational plan to propose to the group. In the meantime, start thinking about how we can organize "on line" meetings (Or even meetings in person) to hammer out some type of plan. Someone mentioned a meeting to be taken place later, is this meeting for the Cypherpunks project? My involvement at this point will be that of an adviser, and perhaps pump in some ideas to the group. As the host of the Programmers Netsork, I am experienced at setting up organizational groups, but often these groups tend to "fizzle out" as people have other time committments, so it's important that we try and work out a mechanism for "passing the torch" when one person has to bow out for some reason. My recommendation is to set up an FTP site where one can download the latest organizational plan, people involved, who is doing what, etc, and keep this info updated on a regular basis. I don't recommend that just ONE person do this, it has to be done by several people in the event one (or more) have to drop out for some reason. In the meantime, just be thinking about the following: a) Setting up a cypherpunks FTP site to contain organizational info, latest source code, who is doing what, and a list of things that need to be done. b) Maintaining a SOurce code control mechanism whereby people can "check out" code modules and work in parallel towards a common goal. c) Provide periodic updates by posting important info to the rest of Cyberspace via UseNet or other on-line systems. Till next Tuesday, take care Y'all.... See U in Cypherspace next Tues Cheers John Draper crunc(a)netcom.com crunch(a)well.sf.ca.us

2 1

Re: Rander box and other stuff
by George A. Gleason 15 Nov '92

15 Nov '92

I have a question regarding the ideas which have been circulating about using CD ROMs as key storage. How does one go about rapidly and effectively erasing everything on a CD ROM? The reason I ask is, in the case of OTPs you want to cancel your key as it's used, to prevent accidental double-use of key; and of course in any system you want to make sure that all your crypto material can be wiped squeaky clean in the event of a barbarian invasion. -gg

1 0

cypherpunks mail list.
by Keith Basil 15 Nov '92

15 Nov '92

i'd like to be added to the list. thanks. keith

1 0

Re: Rander box and other stuff
by tcmay＠netcom.com 14 Nov '92

14 Nov '92

Eric Hollander writes: > All of these designs leave us Mac users a bit out in the cold. My powerbook > 100 has one lonely little serial port and no parallel port. Desktop macs > usually have two serial ports, and it's not easy to add more. > > For us powerbook users (and also for users of other notebooks), we want > something which is internal. It's horible to have little things dangling > off of your nice little notebook. They inevitably get pulled out, etc. Maybe I'm being crypto-dense, but why would individual Powerbook 100 users care so much about generating the bits in the volumes that a hardware-based RNG is designed to supply? For filling a CD-ROM (600 MB) with good random bits, I can see the need for a back-biased diode source (such as Tony Patti's widget), but such filling of a CD-ROM presumes a fair amount of other stuff, like the CD-ROM burners, etc. I can't imagine a PB 100 user, and I'm one of them, developing OTPs on CD-ROMs on the PowerBook. For generating PGP keys, the keyboard timing methods work quite well, as several folks have pointed out. Maybe for some of the dynamic key generation applications that will be appearing in the next couple of years such a hardware RNG will be useful (so that the bits can be generated in the absence of a human operator, and at higher rates). But I don't see them needed immediately, and certainly not on a PowerBook. (No insult to the PowerBook, it's just that I can't see Eric Hughes' and Hal Finney's remailer running on such a platform, for obvious reasons.) Am I missing something? --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: awaiting Macintosh version. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: awaiting Macintosh version.

1 0

Re: Rander box
by George A. Gleason 14 Nov '92

14 Nov '92

Re Eric's quote of me agreeing with him that OTPs are "expensive to make relative to other forms of security." A point of clarification seems in order. I do agree that OTPs are more expensive and less convenient to use than PKSs. However, I also believe that the public interest would *best* be served by having *many* different kinds of cyphers available, including OTPs, PKSs, and various conventional cyphers, historic cyphers with relatively little current security value (for educational purposes) and so on. The main advantages of OTPs are provable absolute security and the fact that the basic technique is so straightforward that it probably could never be banned and put out of circulation. The time may come when we *need* OTPs, and we ought to have them ready beforehand, and have them in use in appropriate situations long before any crisis comes (to gain operational experience which could lead to improvements). With regard to PGP, I am not sure what the copyright status is on that one; and if there is any doubt about it, the govt could screw a lot of people to the wall on copyright-related charges if they so chose. I would like it very very much if PGP was free & clear public domain. The last thing we need is for the first warning of tyrrany to be a wave of hardware seizures on the grounds of having unauthorised copies of copyrighted material. Now I may be off base on this point, but the key here is the idea that many different kinds of cyphers, like many different varieties of plants and animals, make for a robust ecosystem which can't be wiped out by one plague. -gg

2 1