November 1992 - cypherpunks-legacy

PGP portability
by crunch＠netcom.com 13 Nov '92

13 Nov '92

John Gilmore writes: >The last thing PGP needs is an installed base of Mac users who are >always stuck three revs back because they forked off their own wierd >version and couldn't upgrade when the rest of us do. This was why I proposed the internal "engine" concept where I keep the machine independent code intact and the GUI seperate. At the moment, I can't think of a better idea. So perhaps you can give us some suggestions towards a solution to the problem, John!

1 0

Rander
by crunch＠netcom.com 13 Nov '92

13 Nov '92

Eric says: >In my previous post, I mentioned powering the device from DTR. DTR, >for those of you not familiar with RS-232, is a device control line >which is separately assertable. To turn the device off, toggle DTR. >Presto! No more power, no more bits. Simple, when you know what DTR >does. So far, I think this is the best idea, and after checking out my methodology and initial circuit design, I see no reason why I cannot go as high as 9600 baud. Even the more inexpensive AD converters can achieve that speed when we only want to use 8 bits. I am toying around the idea for using an 8 bit AD converter, then its just a matter of clocking them out a UART.

1 0

Rander box
by crunch＠netcom.com 13 Nov '92

13 Nov '92

>>I'd just make the thing spew continuously. It's not like you're >>losing real, er, information if you ignore a few random bits. This >>way you don't need the added circuitry for switching on and off. >Bad idea. If I hooked it up to my workstation, I'd end up spending >lots of CPU on the thing and possibly get nasty problems with buffers >filling. Not everything on earth is a PC that will ignore the >interrupts if the port isn't in use, you know. I agree, dealing with continious data streams might be problematic, but it was mentioned that we could use CTS/RTS or other lines on the connector to turn on and off the stream. Any comments on doing it this way?

1 0

Re: Hackers, Crackers
by jordan＠imsi.com 13 Nov '92

13 Nov '92

From anthrax(a)cow.com Fri Nov 13 14:03:27 1992 Doesn't PGP violate patent laws (or surely come pretty close)? Why would you want to be associated with PGP and its use, then? Are you saying that contributing to this mailing list (let alone *subscribing* to it) necessarily implies that one is using the PGP code? If so, take me off. /jordan

1 0

Re: DC 2600 mtg
by dmandl＠shearson.com 13 Nov '92

13 Nov '92

> Perry Metzger writes: > Pardon, but isn't 2600 magazine a magazine by crackers for crackers? No. It's called "The Hacker's Quarterly" and never claims to be anything else. Eric Corley (editor/publisher) is completely above-ground. He even does a computer show on WBAI here in New York, though I haven't heard it. In fact, he was on MY radio show (WFMU) a few years ago talking about hackers. I was initially surprised that he was willing to use his real name on the show; I ended up being almost disappointed by how "apolitical" he seemed. 2600 prints plenty of articles by flamboyant young pranksters on how to break into this or that system, but rather than an editorial line or policy, this is more a result of 2600's view that all this information should be available and uncensored. These are the kinds of guys who uncover holes in multinationals' computer security and TELL THEM about it. (BTW, I'm not involved with the magazine in any way; in fact, I find most of its articles kinda uninspiring or mundane.) --Dave.

1 0

Anonymous return addresses
by nobody＠alumni.cco.caltech.edu 13 Nov '92

13 Nov '92

Here is an example of how to use the cryptographic remailer at <hal(a)alumni.caltech.edu> to implement an anonymous return address. Note: this material is a little complicated, but if you will take it a step at a time you will see that there's not really that much to it. Suppose I want to receive mail at my address of 74076.1041(a)compuserve.com, but I don't want that address to be known. First, I create a file with the following contents. Call it t1: ---------------------- cut here ----------------------- :: Request-Remailing-To: 74076.1041(a)compuserve.com ---------------------- cut here ----------------------- This is the same as what you would normally put at the front of a message to use the remailer. Note that the last line of the file is blank. Now, I encrypt that file, using PGP, with the public key of the remailer (the key is at the end of this message). I use the command, "pgp -ea t1 alumni". I say "alumni" as a shorthand for the address of the remailer on the keyring. This creates a file, t1.asc, which looks like: ---------------------- cut here ----------------------- -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- ---------------------- cut here ----------------------- Now, I edit the file by adding lines saying "::", and "Encrypted: PGP", and a blank line, to the beginning (and I delete the blank line at the end of the file), giving: ---------------------- cut here ----------------------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- ---------------------- cut here ----------------------- The content of this file is my anonymous return address. To use it, I make my posting, anonymously, and I say something like: "Anonymous return address: mail to hal(a)alumni.caltech.edu, with your (possibly encrypted) message preceded by:" and I put in the contents of my anonymous return address file, above. So, to use this anonymous return address, suppose someone wants to send me this message: ---------------------- cut here ----------------------- Hello, I am responding to your anonymous post on cypherpunks. I would like to know more about your anonymous habits. Please post some more. ---------------------- cut here ----------------------- All they need to do is to put the anonymous return address at the beginning, giving: ---------------------- cut here ----------------------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- Hello, I am responding to your anonymous post on cypherpunks. I would like to know more about your anonymous habits. Please post some more. ---------------------- cut here ----------------------- They would then send this to hal(a)alumni.caltech.edu. The remailer would decrypt the PGP block, finding the "Request-Remailing-To" line, and then send it on to me. If I had posted a PGP public key along with my anonymous return address, they could have encrypted their message text as well, and put the A.R.A. in front of it. The resulting message would have looked something like: ---------------------- cut here ----------------------- :: Encrypted: PGP -----BEGIN PGP MESSAGE----- Version: 2.01 hEwCG6rHcT8LtDcBAf0YbKADFELfaRay6LFviabwpICAAGMV1Pff8meY3ND5o7hu jNy9hQv2bIMM9IyUCF2LFpgamxmMlSwpGQIVbJLEpgAAAEzDG0ddg2oBmjQFzB4c E0d/k7uE8KgxtCg6Sc+l639LN18sv4UWpq0nnyGRTUGEjL9JqtYZOSlTsiSAFU2c 4RoHslyk51suvGokhod0 =XSHb -----END PGP MESSAGE----- -----BEGIN PGP MESSAGE----- Version: 2.01 hIwCqBMDr1ghTDcBA/sGAyloGGHX/CBNRFOkov8RGNxNw/HqehwZ3yT5r0n45qAt AKmETej9GyJVFLZ5Oom7cqFN6+ARaZpp4LFqaxGF7phxC6l9HEPh2zI7w2G1/Df6 pMIwJJ7G+0vk7qBKoctmanNkYVTIb/bKAxJAbK6mUfcXPdRjyUaT/vf2X9RocKYA AAB/sjDjuW2cSN7o3HOKvQ4s+CyqshOGWe7xLRIfSBVyL2PXFOJKx7QMVdRyzDwC HO62PhXswqTlgxqIod0EXDzfEA8kI4Oz2gp45AMy8ElT1nV1jEKjCGC6HWGDU/P5 ZCTPgzOgmLetDNi5Yf8cPDMTHQ3Dcl7vDyNhpMD4+fdFog== =8FPE -----END PGP MESSAGE----- ---------------------- cut here ----------------------- The first PGP message is my anonymous return address, and the 2nd PGP message (which the remailer won't try to decrypt) is the encrypted message for me. If more people will implement cryptographic remailers, you will be able to create more secure ARA's which are "nested" so that they go through two or more remailers, and no one remailer will see the correspondence between your ARA and your real address. How might you use an ARA? You could create a pseudonym, and a public key corresponding to it. You could post anonymously, using our current remailers, to this list or another list. You could sign your messages using the public key of your pseudonym, so no one else could pretend to be you. And you could put an ARA into your messages so people could reply to you. They could reply anonymously if they wanted to, and could supply you with an ARA of their own. People could communicate freely under their online net identities, with cryptographic protection of their True Names, a la Vernor Vinge. Hal P.S. Here again is the public key of the remailer at <hal(a)alumni.caltech.edu>. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.01 mQBNAisCtU0AAAEB/jNOYzN1B2YzOxlK/Zb6axoOaGlPq5I7DV9GH3hcGRN5N6Fi T4sRLhi53Sc5rUdYDa8mFQd4tqvFG6rHcT8LtDcABRG0KlJlbWFpbGluZyBTZXJ2 aWNlIDxoYWxAYWx1bW5pLmNhbHRlY2guZWR1Pg== =K00H -----END PGP PUBLIC KEY BLOCK-----

1 0

Rander box and other stuff
by crunch＠netcom.com 13 Nov '92

13 Nov '92

To Cypherpunks: I think I have a rough description of the hardware serial random generator I want to build. I want to call it the "Rander box" for lack of a better name. It will have two serial connectors, one an input, and other the output, and connect to a modem or serial port. Physically, it should have dip switch to select baud rate, and an on-off switch. When switched on, and a "cr" (or some other character) is sent to it, random bytes will stream out continiously. Another "cr" will stop the byte stream. At least this is ONE approach. If anyone can think of a better way, Pse speak up. Next week, I plan on consulting with another hardware guru and formulate an initial design. I already know what components need to go into it, and now I want to try and eliminate an extra UART if I can figure out how to turn on and off the random stream via software. The internal code of PGP (I am told) uses an internal buffer to hold the random bytes, generated my environmental changes such as key strokes, mouse movements, or other external actions. Some of the Mac implementors are discussing the feasability of not maintaining 100% portability. I suggested that we break up the PGP program into four parts. a) Incryption engine b) Key management engine. c) GUI interface (DOS, MacOS, UNIX, Windows, etc) d) Random number generator (machine dependent, possibly hardware) Parts (a) and (b) are the "portable" parts, and (c) and (d) are the machine dependent parts. Because the Mac is not multi-tasking, we can get around that problem by implementing a random number generator as a driver. Mac drivers provide for "periodic" code to be called as often as possible, and there are plenty of places where this driver can "look for" environmental changes to generate random numbers using the hashing stuff that Phil implemented. Naturally, the IBM-PC and UNIX versions of software random number generation would be different. But as far as the Incryption and Key generators are concerned, all they need to do, is to look into the random "seed" buffer. Implementing the random number generation as a driver also affords the possibility of having total independence of a hardware device, and if one is desired, no changes to the code will be necessary to have one. We just drop an appropriate INIT into the system folder which will contain the appropriate driver. This is the Mac way of doing things. One other problem I am having in participating in this group is the extra phone expenses I will have. I cannot get on Netcom's local lines from here anymore because they are always busy, and there is a lot of other unconsiderate people that hog up all the local lines for many hours at a time, so mail responses to and from me, may take days. For instance, I cannot participate in any IRC chats unless I get local access, as I am unemployed and cannot afford to call out of my area. So please excuse any slow responses you might get from me. John D.

4 5

Hackers, Crackers
by anthrax＠cow.com 13 Nov '92

13 Nov '92

Let's cut out this elitist "crackers" crap altogether. It's just a little bit too PlaySkool, a little bit too "_I'm_ not a third grader! I'm a _fourth grader_!" The people who put so much energy into advertising how they're different tend not to know what the fuck they're talking about, in my experience. >> Pardon, but isn't 2600 magazine a magazine by crackers for crackers? << Beep. Sorry. Thank you for playing. >> 2600 is named after frequency of the disconnect tone used in blue boxes, isn't it? << 2600 is named after the frequency of the disconnect signal used in the telephone system for several decades. But so what? Doesn't PGP violate patent laws (or surely come pretty close)? Why would you want to be associated with PGP and its use, then?

1 0

Re: Rander box and other stuff
by wcs＠anchor.ho.att.com 13 Nov '92

13 Nov '92

John Draper asked for comments on a proposed interface to the Rander box. I would recommend using different characters to start and stop the transmission; if you use one character for both it's easy to get out of sync. ^S and ^Q are traditional, of course, and hardware flow control is another option (Perry's suggestion). Of course, not everybody's machine handles hardware flow control adequately. If you've got a dip switch annyway, you may want to use one switch to choose hardware or ^S/^Q. Bill

1 0

Re: DC 2600 mtg
by Bob Stratton 13 Nov '92

13 Nov '92

> Date: Fri, 13 Nov 92 10:39:23 EST > From: pmetzger(a)shearson.com (Perry E. Metzger) > In-Reply-To: Bob Stratton's message of Thu, 12 Nov 1992 14:25:32 -0500 < > 9211121425.AA32211(a)horton.intercon.com> Subject: DC 2600 mtg > > Pardon, but isn't 2600 magazine a magazine by crackers for crackers? > 2600 is named after frequency of the disconnect tone used in blue > boxes, isn't it? What I'm afraid of is that I will get confused with one > of them -- I'm not sure they are necessarily being misrepresented. In the case of the recent Washington Post article, I know for a fact that they're being misrepresented. I am one of the original attendees of that gathering, and I've been a professional in the computer industry for the past 9 years, not some rodent cracker downloading /etc/passwd files. Most of the people regularly attending that gathering are not involved in illicit acticity, but rather are computer and radio hobbyists, and in many cases are employed in those fields. I can personally attest to the fact that most of the discussions involve new hardware (announcements and purchases), and people's social lives. I'll grant you that 2600 frequently publishes items from miscreants, but the publisher's consistent goal has been to raise public awareness of the risks of various technologies, and their social side-effects. Unfortunately, the media environment in the country seems more oriented to hysteria and glossing over facts. > The tragedies come when idiots raid Steve Jackson Games and sieze > copies of "Cyberpunk" instead of shutting down the infants breaking into > TRW. Blurring the distinction between hackers and crackers is the last > thing we need. That's my point exactly - the media has all but abolished the distinction. They'd rather incite fear of the technically knowledgeable than educate the populace and the legislatures. The upshot of this are things like the "all hackers break into computers" definitions we frequently read, as well as the blatant misrepresentations on the part of cellular service providers that "your calls are private because it's illegal to listen to them". The papers and TV stations don't want to hear the fact that I can take an old TV set and listen to cellular phone calls without modifying it. I spend a lot of time with younger aspiring hackers in the hopes that I can help them establish productive goals, especially as regards careers. I do this for three reasons: 1) It's more personally satisfying to be paid for a job, than to have to look over your shoulder for law enforcement types. 2) The world's a little bit safer for every cracker who gets steered into a productive career. 3) My personal experience is that many of the college graduates with CS degrees these days are code grinders with no understanding or enthusiasm for an aesthetic engineering solution. I'd much rather see people who love what they do designing the things I use every day. I don't want to get too far afield of the topic of this list, so I'll stop here, but I really do believe, based on the precedents with firearms, radio receivers (scanning and paging), and recent law enforcement proposals, that cryptographic technology will be the next example vilified in the press of "things only evil people use". Bob Stratton Engineer, InterCon Systems Corp. strat(a)intercon.com +1 703 709 5525 (W)

1 0