January 1993 - cypherpunks-legacy

unsubscribe
by eab＠msc.edu 15 Jan '93

15 Jan '93

unsubscribe please

1 0

use of ripem instead of pgp
by BRIAN MCBEE 15 Jan '93

15 Jan '93

> RIPEM is Mark Riordan's public-key program. It is similar to PEM, but does > not use the PEM certificates and therefore does not require people to have > their keys signed by an agency. It is not really PEM compatible. It does > use the RSAREF public-domain encryption package, so it is legal for non- > commercial use in the U.S. and Canada. > > What I suggested was the use of RIPEM since it is available now, is legal, > and is free. > > Note, though, that whether RIPEM or PGP is used, they are only for non- > commercial use. A remailer that wanted to charge, such as the ones that > Eric Messick is discussing, would probably have to license the technology > from PKP directly to be legal. (I'm not sure whether PEM also is limited > to non-commercial use.) > > Hal Finney > 74076.1041(a)compuserve.com Since the only reason we are talking about RIPEM is because of legality concerns about PGP, I thought I'd mention that it is (at least theoretically) illegal to export RIPEM from the US, annd therefore could not be legally used to correspond with persons overseas. I don't know if there is a legal way to do public key cryptography between persons inside the US and persons outside the US. ----- Brian McBee ----- (503)378-4276 ----- brian(a)opac.osl.or.gov ----- ----- Oregon State Library, State Library Building, Salem, OR 97310 ----- Plan globally, attack locally

2 1

resource for writing corp e-mail policy?
by matt＠oc.com 15 Jan '93

15 Jan '93

Can anybody out there point me towards some resources that could be used to write a good corporate e-mail privacy policy? -- Matthew Lyle (214) 888-0474 OpenConnect Systems matt(a)oc.com Dallas, TX "...and once you have tasted flight, you will walk the earth with your eyes turned skyward, for there you have been, and there you long to return..."

1 0

Re: pax shutdown
by jordan＠imsi.com 15 Jan '93

15 Jan '93

From: BRIAN MCBEE <opac!brian%OPAC.osl.or.gov(a)CS.ORST.EDU> If it turns out that pressure to shut down really did come from the official net hierarchy ... There is no question: those who were paying for the (quite expensive, relatively low bandwidth) connection between the US & Australia found themselves with a saturated link and looked for a "good candidate" to shut off. It turns out that lots of the packets are mail, and a good number of the mail messages were going to/from the anonymous service. This was not a move against anonymous e-mail or the research into it. This was just an abuse of "someone elses money" that was easy to target. Next topic please ... this is getting tired. /jordan

1 0

Re: possible solution to the anonymous h
by dclunie＠pax.tpa.com.au 15 Jan '93

15 Jan '93

> RSA has a patent on their algorithm. It's quite likely that I can't > even create a key pair without their permission, let alone use it. I am not familiar with the legal status of patents and software packages, but it seems to me that they can sell you a program and license you to use it, but forcing you to use one of their key servers instead of your own seems pretty far fetched. I would be very surprised if the law is clear cut on this issue, or has ever been tested. I gather software licenses are pretty hazy territory at the best of times without getting involved in patent law as well !@#$ david

2 1

Whitfield Diffie gets award
by gnu＠cygnus.com 15 Jan '93

15 Jan '93

SUN ENGINEER RECEIVES INTERNATIONAL AWARD; FOUNDED NEW FIELD OF SCIENTIFIC RESEARCH MOUNTAIN VIEW, Calif. -- January 13, 1993 -- Whitfield Diffie, 48, Distinguished Engineer at Sun Microsystems Computer Corporation (SMCC), was recently awarded the degree of Doctor of Technical Sciences, Honoris Causa, by the Swiss Federal Institute of Technology. The award was given for founding a new field of scientific research, public key cryptography, which grew out of discoveries Diffie made at Stanford University in 1975. The Swiss Federal Institute of Technology, or ETH after the initials of its German name, is one of the most prestigious technical universities in the world. It counts among its alumni some of the foremost scientists of the 20th century, including Albert Einstein and John VonNeuman. Doctorates "by reason of honor" make up less than one tenth of the total number of doctoral degrees awarded by the ETH. They are granted for major scientific or engineering achievements and are given only after a nomination and review process taking two to three years. In conventional cryptography, encrypting and decrypting messages were inseparable; anyone who could create an encrypted message could also read it and vice versa. By separating these functions, public key cryptography allows people to guarantee the privacy of conversations with people they have never met before and to apply unforgeable "digital signatures" to their messages. In Diffie's words: it does what signatures and envelopes do for ordinary mail. At the time Diffie began his work in cryptography, he was one of only a handful of people not employed by government intelligence agencies who took a serious interest in the field. Today, the International Association for Cryptologic Research, of which he is one of the founding directors, has hundreds of members from industry and academia worldwide. Diffie joined Sun in the summer of 1991 with the title of Distinguished Engineer, although one of his inventions had already been used in the company's security products since 1987. In hiring Diffie, Sun recognized both the rising importance of security in computer communications and the critical role of cryptography in achieving that security. In the latest Sun(TM) Solaris(R) operating system, the original "secure RPC" has been improved, while more comprehensive applications of cryptography are planned for future versions of Solaris. Sun Microsystems Computer Corporation (SMCC) is the world's leading supplier of open client-server computing solutions. With headquarters in Mountain View, Calif., SMCC is an operating company of Sun Microsystems, Inc. ### Sun Microsystems, Sun Microsystems Computer Corp., Sun, the Sun logo, are trademarks or registered trademarks of Sun Microsystems, Inc. Solaris is a registered trademark of Sun Microsystems, Inc.

1 0

shrinking availability of PGP
by pfarrell＠cs.gmu.edu 15 Jan '93

15 Jan '93

On 14 Jan, Hal wrote: > >PGP is gradually disappearing from U.S. sites where it used to be >available. Recently it got taken off the EFF area on Compuserve. >We can't afford to see encryption and remailers be slowly strangled. > I agree that this would be terrible. Do you have any grounding for this generalized statement? I can understand CI$ backing off, as they were the only organization in the US making a profit from PGP. And they have the resources and assetts that could be a target if PKP wanted a test case. I just had archie look arround, and to me the number of places was about the same. For some reason, archie doesn't find it in two places I know it is: soda.berkeley.edu and phil.utmb.edu Archie did report that it is on wuarchive. I'm affraid that the legal cloud will remain over PGP for quite some time, and that the flawed PEM implementations will become the standard. Until there is someone with real assetts using PGP, PKP's lawyers will not bother to expose their patent to the possibility of being invalidated. I also don't expect to see those of us who are assett free changing from PGP to RIPEM/PEM just because it is free of the cloud. This cloud will make folks who are nervous about the changes that netwroks, communications, and encryption will bring more cautious. I expect that PGP will continue to move from site to site. Which is why archie and gopher are so important to all of us. Pat Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

If People Were Honest
by DrZaphod 15 Jan '93

15 Jan '93

In Message Thu, 14 Jan 1993 18:56:47 -0500, Marc Horowitz <Aktis.COM!marc(a)netcomsv.netcom.com> writes: > Remember, if people were honest, we wouldn't need encryption, > either. Sigh. Being honest has nothing to do with wanting privacy. Every mail system should have, and NEEDS a way to be anonymous. That is all. TTFN! DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

2 1

need for more anon remailer sites
by Daniel Ray 15 Jan '93

15 Jan '93

With the shutdown of PAX, if we are not going to roll over and let this type of site go away, what we need is a large new group of such sites. 20-50 or more anonymous remailer sites that each gets used randomly and occaisionally, with usernames that are not obvious such as "anon432", both in the U.S. and elsewhere in the world, are whats needed. the list of sites must remain fluid and unpredictable, and formats and conventions must also variate so that no one can get "a fix" on it. A person that wants to anonymously mail something can choose different sites each time, or perhaps there may be a subsystem that chooses this for them, WITHOUT the mail actually going there first, if a site is in charge of "ran- domizing" the traffic. I suggest using a truly covert approach of using non-account first names and other interesting words that are indistinguishable from regular usernames as anonymous temporary mailing names. This obviously is very tricky and would have to be worked out carefully, since it may, even in the future, conflict with an actual choice of a valid username for an anonymous site. But it can be done. and we need to spare the .sig at the bottom that advertises the anon service. that should be left to separate ads, not mixed in covert email itself. One of the things that has gotten to me is to do secret acts in overt ways, almost asking the Government to defy them! Secret things should be done secretly. Once, if in the future, cryptographic email is so common as to make this unnecessary, then we can relax it. But not completely. Secret should still always be DONE IN A SECRET WAY. I.e. using steganography and other covert procedures, fluid, nonfixed proce- dures, to ensure no disturbance with rerouted and/or encrypted email traffic. Yes this is security-by-obscurity, but it can work if it is just an adjunct to other strong methods such as good ciphers and procedures that use proper contingency planning. PAX, most likely, did no contingency planning for what happened to it. All things of this type need "what ifs" for every possible interference that can happen, not that all possibilities would be addressed. But they should all be looked at, if they can be thought of. Suppose the ante goes up and all this stuff becomes actively illegal. What then? If a large network is *already* in place, the risk is much lower than trying to do something after the fact. And it would be a more mature network of rerouting and encrypting sites, that have already learned from their mis- takes. we need --all--this-- to survive. otherwise it is all just a toy application of covert technology. norstar The Northern Lights, Troy NY | tnl dialins: +1 518 237-2163 @ 1200-2400 bps 8N1 $free ` | / ------------------------------------------------------- --- * --- Internet: norstar(a)tnl.com / | . Sysop of TNL Public Access UNIX |

2 1

pax shutdown
by BRIAN MCBEE 15 Jan '93

15 Jan '93

> I agree that the PAX shutdown is an ominous development. Nobody's > internet access is perfectly free from the kinds of pressures that were > brought against PAX. What steps can we take to keep the same thing from > happening to us? > > I agree with Karl that a big step would be to spread remailers more widely. > Eric Hollander is running three remailers in addition to the ones Karl > mentioned - hh(a)soda.berkeley.edu, and two other machines which I don't > have handy. They don't encrypt but they forward, and that's good enough > for many purposes. > > Some time back, there was mention that the owner of the commercial Portal > system would run one. Could someone follow up on that who knows him? > > PGP is gradually disappearing from U.S. sites where it used to be > available. Recently it got taken off the EFF area on Compuserve. > We can't afford to see encryption and remailers be slowly strangled. > > Hal > 74076.1041(a)compuserve.com If it turns out that pressure to shut down really did come from the official net hierarchy, there are other places on the net which should be nearly immune from that kind of pressure. There are thousands of UUCP sites which predate the Internet. And anyone getting their connectivity from one of the commercial providers (PSI, UUNET, ANS, etc.) can theoretically use those networks for whatever purposes they choose. ----- Brian McBee ----- (503)378-4276 ----- brian(a)opac.osl.or.gov ----- ----- Oregon State Library, State Library Building, Salem, OR 97310 ----- Plan globally, attack locally

1 0