February 1993 - cypherpunks-legacy

remailer scripts
by Karl Barrus 22 Feb '93

22 Feb '93

Douglas Sinclair helped me uncover a subtle problem which may arise in the use of the remailer scripts: since errors are redirected to /dev/null or nul, if a key is untrusted (or isn't there), the script will hang, waiting for input from a prompt you don't see. New versions of hop.mail, hop.send, and anon.mail should be up at the ftp site soon... If anybody feels like porting these scripts to the Mac, Amiga, or VMS, please feel free! I know zippo about these platforms, as far as batch languages. Also, regarding compatibility with pc's - although the MSDOS script language could stand some big time improvement, it seems the best to use for max portability. But I'll definitely attempt a PERL translation and then the folks who can use PERL will be able to. /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

1 0

Proposal - The 'Peterson.mil' Virus List
by deltorto＠aol.com 22 Feb '93

22 Feb '93

Yo, Punks I propose that we establish another list dedicated to the study of viruses and name it after Keith Peterson. After all, why shouldn't he get some credit for awakening a sleeping giant? I want to know more about viruses so I can protect myself from government-created viruses and so I can learn about the various mechanisms involved. In addition, the study of self-promulagting code has very positive implications for the study of "smart email." For those of you who haven't been following the exploits of General Magic and their Telescript protocol, there will soon be mail which "delivers itself" to the right location. I'm sure our members at General Magic can illuminate this subject further. The implications of this technology reach into the world of encryption and viruses and certainly further into the realm of privacy discussions. Wot say, all? d2t

1 0

Government Encryption
by fnordbox!loydb＠cs.utexas.edu 22 Feb '93

22 Feb '93

Recently there was a thread on a public-key program that would involve a central, government-backed-or-authorized agency to issue key pairs and serve as a repository. Could someone please post some details on this -- I seem to have gotten it into my head that this is how PEM works, and I don't know whether I'm right or just medicated. :-) Loyd *************************************************************************** * loydb(a)fnordbox.UUCP Call the Fnordbox BBS * Loyd Blankenship * * GEnie: SJGAMES 2 v32bis lines, 24 hrs * PO Box 18957 * * Compu$erve: [73407,515] 512/444-2323 * Austin, TX 78760 * * cs.utexas.edu!dogface!fnordbox!loydb * 512/447-7866 * ***************************************************************************

2 1

No Subject
by nowhere＠bsu-cs.bsu.edu 22 Feb '93

22 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- I believe I have uncovered a serious bug in the Finnish anonymous remailer, one that allows me to piece together anonymous id's and actual email addresses. I'm reluctant to publish the details here, but I'll explain how it works if you send me your email address. > DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4kCn/FZTpBW/B35AQEOkgF/euVoBz+q3iOb8oAFWaF5n/lPIIv76L0y eT0bYJl7RebSiyV8tWzXWNibZrPn1aPc =6ZVT -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

2 1

Re: Computer Virus Origins
by pmetzger＠shearson.com 22 Feb '93

22 Feb '93

> From: Jay Prime Positive <jpp(a)markv.com> > It has been a bit of a sore point with me for some years. When Fred > Cohen wrote his thesis he credited Len Adelman ((the A in RSA) our > professor at the time) with coining the term "virus". In fact it was > I who did this. It was I who introduced the class to the concept of > computer viruses. I developed the idea with a guy named Eric ??? with > whom I worked at the time. It was in private with Eric that I came up > with the name (or perhaps he may have sugested it). I based the idea > on the "worm" from one of John Brunner's novels which I had just read. Brunner's novel explicitly mentions the notion of viruses as well as tapeworms. Remember the "phages"? A phage is a virus. Perry

1 0

Government encryption
by Hal 22 Feb '93

22 Feb '93

Loyd Blankenship asks whether PEM involves having a government agency create key pairs. I think this may be confusing two different issues. PEM does not involve having anyone else create key pairs for you. You create your own keys and keep the private key secret just as in any other public key system. However, PEM requires you to get a "certificate" from an agency in order to use the system. The certificate-issuing agency is typically expected to be your employer or your university, from my reading of the RFC's. Large institutions like these would issue certificates, which are basically similar to PGP's key signatures, which certify that you are who you say you are. The large institutions themselves would have their own public keys signed by an agency higher in some key-signing hierarchy. Last I checked, the top of the hierarchy was the company RSADSI; they would certify the companies and the companies would certify the employees. I think this part may have changed a little in the last few drafts of the new RFC. So, there's not really any government involvement. There is a centralized hierarchy for key signatures, but key generation is still an individual activity. Oh, yes, there may also be a charge for getting your key signed; this charge might be borne by the company/university in some cases. There is also a provision to get a certificate outside this system; these "persona" certificates wouldn't really vouch for anything but they would let you use PEM. I'm not sure what they will cost. The other idea which Loyd might have been mixing up with this was Dorothy Denning's proposal several months ago that all users of public key systems be required to register their secret keys with some quasi-governmental agency. (Originally she proposed the Justice Department, then later suggested an independent group.) This way if the government wanted to spy on your communications, it would have to get a court order (as it does now, in theory, for wiretaps), and take this court order to the key-holding agency to get them to reveal your secret keys. Then it could read your messages. This proposal was subjected to a very strong attack led largely by our own Tim May. It soon became known as the "lead balloon" for its lack of support and has not been heard of recently. I don't think anyone would be terribly surprised if some variant were to resurface, though. Hal Finney

1 0

Re: msdos perl
by Eli Brandt 22 Feb '93

22 Feb '93

> The executeable in the file you refer to can also be ftp'd from > tandem.com, it's source site, in the directory /pub/perl. To quote > the README file for that directory: > The port makes use of Borland's VROOM technology and pretty much *requires* > access to extended memory. There is approx. 300+ Kbytes of memory available > ^^^^^^^^ (emphasis not mine) Which means a 286, not a 386. If there are a lot of people out there on 8086 machines, sorry. People with that particular problem are going to have a hard time running most modern software, let alone Unix ports. > This version of Perl has been tested on both 286 and 386 machines with > and without extended memory. > CrysRides PGP 2 key by finger or e-mail Eli ebrandt(a)jarthur.claremont.edu

1 0

No Subject
by treason＠gnu.ai.mit.edu 22 Feb '93

22 Feb '93

Does anyone know the status of this product? Is it proprietary? What encryption algorityhms does it use? Are there any flaws in it? treason@gnu

1 0

Key Registration
by tcmay＠netcom.com 22 Feb '93

22 Feb '93

>Recently there was a thread on a public-key program that would involve a >central, government-backed-or-authorized agency to issue key pairs and >serve as a repository. Could someone please post some details on this -- >I seem to have gotten it into my head that this is how PEM works, and I >don't know whether I'm right or just medicated. :-) > >Loyd The proposal was slightly different and has not been officially proposed as any kind of law. Here are some more details: * Dorothy Denning, noted cypto and security expert, floated a trial balloon at the Computer Security Conference last fall. (I summarized it and posted it to sci.crypt, where more than 1000 messages related to this thread, "A Trial Balloon to Ban Encryption?," eventually appeared.) * Under her proposal, a user of P-K methods would take his _private_ key and encrypt it to the _public_ key of an agency like the Justice Department (which I'll use from now on to represent the government side). The encrypted key would then be placed in a repository with another agency, perhaps a private agency like the CPSR or even the EFF. The key storage agency obviously could not read the messages (as they would be encryped to the Justice Deparment's key). * A properly-obtained warrant could then be presented to the key repository, obtaining the specific key. The Justice Department could then decrypt with its private key and thus have the private key of the user. * Ostensibly, this prevents the Justice Department from simply snooping through whatever messages it wishes to read. * There are some obvious practical and constitutional issues: - What happened to constitutional rights to privacy? Analogously, must one escrow personal diaries? Install tape recorders in all private places and escrow copies of all tapes? (Lots of comparisons to free speech, to gun control, etc.) - What happens when people register the "wrong" key? Is this even detectable? - If "noise" is sent, will the Justice Department demand the "key" be presented? How? And what penalties for noncompliance? - Many applications demand dynamic generation of keys---many public keys, many session keys, etc. How will these be registered? What fees? - It seems likely that a key registration scheme will also place limits on many of the things we hold dear on this list--digital money, anonymous systems, remailers, and all the other wonders of crypto anarchy. There's a lot more. And there was a lot of debate in sci.crypt about this. Fortunately, I don't see any further moves to make this a law. But it may come in a few years. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0

Bug in the anon.penet.fi remailer
by an5877＠anon.penet.fi 22 Feb '93

22 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- I believe I have uncovered a serious bug in the Finnish anonymous remailer, one that allows me to piece together anonymous id's and actual email addresses. I'm reluctant to publish the details here, but I'll explain how it works if you send me your email address. > DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4kCn/FZTpBW/B35AQEOkgF/euVoBz+q3iOb8oAFWaF5n/lPIIv76L0y eT0bYJl7RebSiyV8tWzXWNibZrPn1aPc =6ZVT -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0