March 1993 - cypherpunks-legacy

what is all o f this talk
by trump＠pluto.ee.cua.edu 04 Mar '93

04 Mar '93

well i dislike this argument of anon remailers etc being bad or what not because people can threten or what not wiht it... this argument is pretty bogus since i could do the same thing from an inactive hacked account... but thats my haypenny also what is the true to life name of Unix's passwd encryption program of scheem ??? Louis

1 0

ANON: anon policy of UB
by babani＠cs.Buffalo.EDU 04 Mar '93

04 Mar '93

Here is a copy of the policy that my system administrator was refering to: From: gerland(a)ubvmsb.cc.buffalo.edu (James R. Gerland) Subject: UCS Computing Usage Policy. Date: 16 May 90 19:56:27 GMT CONDITIONS OF USE OF THE COMPUTING CENTER FACILITIES Academic Computing Services University Computing Services State University of New York at Buffalo March 4, 1988 The use of University at Buffalo academic computer systems by members of the university community is authorized by Academic Computing, University Computing Services. All classes of users (students, faculty, and staff members) have equal privileges and equal access to the Computing Center's facilities, and all have the responsibility to use the Computing Center's services in an effective, efficient, ethical, and legal manner. Every computer account issued by University at Buffalo is the responsibility of the person in whose name it is issued. As a result, acquiring an account in another person's name, or using an account without the explicit permission of the owner and the full knowledge of Academic Computing will be considered to be theft of services, and will be dealt with according to the "Student Rules and Regulations" and/or Chapter 514 of the New York State Penal Law. It is mandatory that the owner of an account be careful to keep the account secure by keeping the password secret, changing the password often, and reporting to Academic Computing when anyone else is using the account without permission. Authorized Use As a condition for use of the Academic Computing systems, all users are expected: (1) To respect the privacy of others. For example, users shall not intentionally seek information on, obtain copies of, or modify files or passwords belonging to others. (2) To respect the integrity of the University at Buffalo computing systems. For example, users shall not intentionally develop or use programs that harass other users, infiltrate a computing system, or damage or alter the software components of a computing system. (3) To not develop programs or use any mechanisms to alter or avoid accounting for the use of computing services or to employ means by which the facilities and systems are used anonymously or by means of an alias. For example, users shall not send messages or mail, or print files which do not show the username of the user using the system or which exhibit a username other than that of the sender. (4) To respect the legal protection provided by copyright and licenses held by the Computing Center. For example, users shall not make copies of a licensed computer program to avoid paying additional license fees. (5) To use the accounts only for University related purposes. For example, users shall not authorize individuals who are not associated with the University to use an account nor use the academic computers for non-university related work, without prior arrangements with Academic Computing. Violation of these conditions, i.e., unauthorized use of another person's account, tampering with other users' files or passwords, or harassment of other users is certainly unethical and possibly a criminal offense. Whenever Academic Computing becomes aware of a possible violation of these conditions, Academic Computing will initiate an investigation. In order to prevent further unauthorized activity, Academic Computing may suspend the authorization of computing services to the individual. Confirmation of unauthorized use of the facilities may result in the closing of accounts permanently, billing for computer time used for non-university endeavors, disciplinary action, and/or legal action. Responsible use Users are expected to use computing resources in a responsible and efficient manner consistent with the instructional, research, and administrative goals of the University. Users are expected to refrain from engaging in deliberately wasteful practices such as printing large amounts of unnecessary listings, performing endless unnecessary computations, or unnecessarily holding public terminals, tape drives, dial- up phone lines for long periods of time when others are waiting for these resources. In addition, the playing of games or using networks for purely recreational purposes when others are waiting for terminals represents irresponsible use of the equipment. Academic Computing prefers not to act as a disciplinary agency or to engage in policing activities. However, in cases of unauthorized or irresponsible behavior, Academic Computing does reserve the right to take remedial action, commencing with an investigation of the possible abuse. Users, when requested, are expected to cooperate in such investigations. -- +==== Internet: babani(a)cs.buffalo.edu ===+======== Amateur-Radio: N2LYC ======+ ! Bitnet: V078LNGT(a)ubvms.BITNET | UUCP: rutgers!ub!babani ! ! Alternate: an173(a)cleveland.freenet.edu | Plsure dpnds on the othrs prmison. ! +== PGP key available. (If you don't know what a PGP key is... find out!) ==+

1 0

PGP: informal faq for eknipp
by wcs＠anchor.ho.att.com 04 Mar '93

04 Mar '93

Eknipp asked for an overview of PGP; my reply to him bounced, but it's of enough possible general use that I'm inflicting it on the list. It's rough and rambling, but believe it if you need it...., and please send me any corrections if there are offensive errors. The details of corporate relationships regarding PKP and RSA are especially haphazard. Thanks; Bill -- "He wouldn't have wanted that _thing_ walking around with his name on it" ------ well, here's a rough overview and definitions, ignore the parts you know already. You can get a proper faq by ftp from rsa.com, in the directory pub/faq. Cryptography = writing stuff only authorized people can read. Real crypto depends on algorithms that are secure as long as the Bad Guys don't know the keys, even if they know everything else. Most of the interesting stuff depends on mathematical processes that take exponential amounts of time, so a 56-bit key would take 2**56 attempts to guess - you can't guess it a bit at a time in 56 steps. Factoring large numbers is believed to take roughly expontential time. M = plaintext message Cyphertext C = E(k, M), E = encryption function, k = key. Plaintext M = D(k, C) ITAR - International Traffic In Armaments Regulations - the US has a bunch of laws about exporting munitions, and crypto hardware and software count as munitions - algorithms are OK, but our Benevolent Govt KNOWS that foreigners aren't bright enough to turn algorithms into code. Lots of flamewars discuss exactly the boundaries, and the laws are contradictory about which bureaucrats are really in control, but nobody's wanted to get thrown in jail for arms dealing badly enough to force a court case .... Appears to apply to importing crypto also, though that hasn't been something anybody's made a big deal about. Other countries besides the US may have major restrictions as well. Alice and Bob - the people sending messages to each other. Eve may be eavesdropping, and Charlie may be around also, Secret-Key Cryptosystem, also called Symmetric-key or private-key - the same key k is used for E and D, or at least a closely related key that's easy to derive if you know the other one. DES = Data Encryption Standard = IBM/NSA-designed secret-key system, very widely used, keys 56 bits long which may be a bit short, some people worry there may be an trapdoor put there by NSA, but if I told you I'd have to kill you :-) Banks use it, for instance. IDEA - a Swiss-written secret-key system, maybe more secure than DES, newer anyway. Patented in Switz but not US, easy licensing. Public-Key CryptoSystem - Encryption key ke and Decryption key kd are related, but in a way that you can't determine kd knowing only ke. ke is called the public key and kd the private key - you can publish ke where everyone can see it and encrypt stuff to mail to you, you can decrypt with private key kd. (If you want to reply, you've got to get their public key.) Public-key algorithms are pretty slow, so generally people use create a random secret key, encrypt their message with a secret-key algorithm like DES, and encrypt the secret key with the recipient's public key; recipient decrypts the secret key with his private key, then uses it to decrypt the message. Digital Signatures - if you can do public-key crypto, then you can do the reverse as well to sign a message - you *decrypt* the message with your private key, and the recipient encrypts it with your public key - if it restores the original message, she knows it's good and knows that *you* sent it, because only you have your private key. For speed, you normally make a "hash" checksum of the message, and sign the hash instead of the whole thing. Some public-key algorithms can only be used for encryption, some only for signatures, some for both but you need different keys. MD-4 and MD-5 - Message Digest hashing algorithms from (?) Rivest, which are thought to be unforgeable, unlike the CRC checksums used by many programs which are easily forged. RSA - A public-key algorithm developed by Rivest, Shamir, and Adelman. It's the only well-known public-key algorithm that does everything everybody wants, including signatures and public-key, that's secure enough that you can't crack it as long as you use reasonably long keys. Unfortunately, it's patented in the US, by Public Key Partners, a company R, S, A, and friends started that owns most of the interesting patents related to public-key. On the other hand, to avoid having the NSA classify their patent right when they applied (the NSA can do that), they published the algorithm before applying, which means that it's public-knowledge in most of the world and you can't patent it there, even in places that do allow algorithm patents. Their claims about what techniques their patents cover are *very* broad; if you want to do anything public-key related in the US, you've got to deal with them or carry a BIG lawyer, and so far everybody's chosen to deal with them rather than risk a long expensive difficult court case, or else chosen to ignore or infringe their patent but not sell their products for cash, and hoped to get away with it. RSAREF - an RSA implementation from PKP, which you may use free for personal non-commercial use as long as you agree to follow a set of rules that are much less restrictive than they used to be; you can't export it outside the US and Canada, and can't change the interface without their permission, and a few other terms. Better implementations of RSA's algorithms have been done, but you can use this one free, with their permission. Or you can pay them money and get support for incorporating their techniques into your products. Key certification - Public Keys are usually long - RSA keys are often 1024 bytes. Public keys crypto is only secure if you can be SURE you have the public key for the person you're trying to send a message to, like Bob, and that Eve hasn't handed you HER public key instead - she could be intercepting all your mail to Bob, decrypting it, and re-encrypting with Bob's key. So you need to find a secure way to transmit public keys, where "secure" means it can't be forged without you knowing about it (though anybody can read them.) Publishing in the New York Times classified ads is one approach, as is any other broadcast method you can be SURE everyone gets correctly. Another method is to use digital signatures - somebody you trust, whose public key you can be sure you know accurately, gets Bob's public key from Bob, and signs it with their public-key. Since not everybody knows somebody who knows Bob, the problem can be handled by a chain or hierarchy of key certifications - Charlie signs Bob's, Dave signs Charlie's ... and You know Xerxes yourself. Or George Bush signs all the general's keys, the generals all sign the keys for the colonels under them, the colonels sign for the majors under them, .... and you can check some sergeant's key because it's got a certificate from his lieutenant on up to Bush, and Bush's key is in the Phone Book. PGP - Phil's Pretty Good Privacy program - a nice packaging of this technology that can be used easily to prepare secure email. The original version used RSA and a choice of DES or a home-brew secret-crypto system; the current version uses RSA and IDEA. For certification, the method is non-hierarchical - you have a "keyring" containing public keys you know, maybe with certificates, and you can sign the ones *you* trust and give your signed keyring to your friends. Hierarchies imply the potential for control; this is cooperative anarchy, and there's no chain of people you HAVE to obey to exchange keys. When PGP version 1 first came out, RSA yelled at Phil Zimmerman, the author, and told him he was risking patent infringement lawsuits and such if he didn't cease and desist, so he's no longer distributing it. But some of those SNEAKY FOREIGNERS *somehow* got a copy, and so ongoing development of PGP is taking place outside the US, unhindered by patent problems. Version 2.1 is out, 2.2 real soon. Parts of PGP are probably not covered by PKP's patents, and parts are clearly not covered by ITAR, but some parts are a problem. RIPEM - Mark Riordan's public-key email system, which uses RSAREF to do RSA, so it's legally kosher but not exportable, and is related to the internet Privacy Enhanced Mail stuff that was being developed for a while. Still real new, but probably Pretty Good also; I seem to remember its key certification was more hierarchical. ---- More PGP info - PGP was originally written for a DOS environment (there are problems trusting any system you don't totally control, and it's tough to say you totally control a multi-user system), but it's been ported to lots of things by now, including UNIX and some early Mac ports (work is in progress to make the Mac port feel like Mac-stuff rather than Unix-stuff.) You can get the source, compile it, play with it, and do anything you want that doesn't infringe PKP's patent, so remember not to use it to exchange keys with anyone or send them mail unless you've got a licensing agreement..... Once it's compiled, type pgp -h to get help, and/or read the documentation. Where to get things: The fun place to shop is nic.funet.fi, by anonymous ftp, but if you telnet to an archie server like archie.rutgers.edu (login as archie) you can ask it wher to find anything. Using a US site would be potentially better legally, and also cuts down on the bandwidth used between here and Finland.... Bill Stewart

1 0

META/PERSONAL: Thanks for mailing.
by Alexander Chislenko 04 Mar '93

04 Mar '93

I am grateful to both people who sent me the mail I lost; I don't think I have a right to disclose their identity ;-) but I am grateful to them anyway, as well as to all those who might want to send it to me later - please don't - too bad I'll never know your names... Thanks anyway! BTW, I missed the point when people started using prefixes in message titles; was there an 'official' suggestion for it? Alex.

1 0

REMAIL: updated list
by Karl Barrus 03 Mar '93

03 Mar '93

(I intend to send this message to the list about once a month, or when "emergencies" arise) -----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: The list of cypherpunk remailers known to me: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: ebrandt(a)jarthur.claremont.edu 6: hal(a)alumni.caltech.edu 7: remailer(a)rebma.mn.org 8: elee7h5(a)rosebud.ee.uh.edu 9: phantom(a)mead.u.washington.edu 10: hfinney(a)shell.portal.com 11: remail(a)extropia.wimsey.com NOTES: #1-5 no encryption of remailing headers #6-11 support encryption of remailing headers #2 requires remailing request to appear in header #11 requires text to be encrypted along with remailing request #7,#11 introduce larger than average delay ============================================================ Q2: How do I use the cypherpunk remailers? A2: Instructions and helper scripts are available via anonymous ftp at soda.berkeley.edu (128.32.149.19) in the pub/cypherpunks directory. hal's.instructions instructions on how to use the remailers scripts.tar.Z various Unix scripts to assist remailer use anonmail.arj various MSDOS batch files to assist remailer use /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/ -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK5U6XoOA7OpLWtYzAQEuJgQAx3qgMv9ZTG0LXWuaUgfT+27NB9gQAFga 8f3L4Ew41JlaIqXAUqo8JUra9NjE9Xrgg5DFN31j1pTiGZOdCUc0qzq+R8Tvw8iC ujWvWKkoVExrPQqyArh+DSDeJdfykopL2I0W7NF0Z66Y13h89aNF1NN6H2W3Pf+I naWmJL6Oxd8= =S3XH -----END PGP SIGNATURE-----

1 0

ANON: un-filterable pseudonyms
by root＠rmsdell.ftl.fl.us 03 Mar '93

03 Mar '93

> In my off-line newsreader, Eudora, (which ironically is also the subject of > the message attached below--must be a plot), it's easy enough to mark all > the stuff from some anonymous site for deletion. This is only possible if there are few, well known, anonymous sites, and/or if all anonymous aliases look similar, such as an1234. How do you know if KSDF32@KMUVAX is an anonymous address, or a real user login? I also expect to see pseudonyms that look like real names. I don't think it would be too hard to pick a random first and last name from a list of real names, and create a From: line like jsmith(a)someplace.edu (John Smith) which will look just like a regular address. Even the remailers that don't create reply-able aliases could generate random real-looking From: lines, just to make the posts look non-anonymous. The only possible solution would be to ignore all messages not from addresses you trust. This is basically the "don't talk to strangers" policy. -- Yanek Martinson yanek(a)novavax.nova.edu

1 0

PGP: Help!
by eknipp＠lobo.rmhs.colorado.edu 03 Mar '93

03 Mar '93

Not to be stupid, but could somebody email me a plainspeak (Ok, I know some UNIX- I'm not *that* outta it) msg on what exactly pgp is, how to use it, and a copy of it. Thanx -- T'han The Unbeliever | "Fear is the mind killer."- Dune eknipp(a)lobo.rmhs.colorado.edu | Nobody believes what I say. | Laugh when life sucks. It helps. Future Autopian |

1 0

ANON: My remailer
by babani＠cs.Buffalo.EDU 03 Mar '93

03 Mar '93

Due to circumstances beyond my control, I have had to take down the remailer that is running in my account. (read: If I put it back up again... my account will be taken away.) I only got a brief message from the system administrator stating "Running anonymous remailers is against University policy." Thus, since my account is more important (considering I need it for projects and the like...) than a remailer, I have taken it down. I'd appreciate it if you spread the word. -- +==== Internet: babani(a)cs.buffalo.edu ===+======== Amateur-Radio: N2LYC ======+ ! Bitnet: V078LNGT(a)ubvms.BITNET | UUCP: rutgers!ub!babani ! ! Alternate: an173(a)cleveland.freenet.edu | Plsure dpnds on the othrs prmison. ! +== PGP key available. (If you don't know what a PGP key is... find out!) ==+

1 0

Re: Handling Abuses of Remailers
by tcmay＠netcom.com 03 Mar '93

03 Mar '93

(Sorry, Cypherpunks, for the ">" in this message--I made the classic mistake of sending this message only to Fen, hence this forwarded form. I'll try to watch this in the future!) >Fen Labalme believes Eric's "penny a hop" is still too expensive, especially >for "the poor": > >>Geeez, Eric! I'd think a penny a hop would be a pretty high price... And >>given that most messages go through two hops, then you'd really be giving >>your 2 cents worth! >> >>Note that there can be about 50 cypherpunks messages a day -- if each went >>through 2 hops at $0.10 / hop, as you proposed, that would be $10 / day in >>revenues for the remailers. Seems like a lot to me. >> >>I would support the idea if I felt that the system would quiet the flame >>wars, but I think rather it would simply quiet the poor... >> >>Fen > >You don't have to support the idea, Fen, you just have to open your own >remailing node! If you think you can do it more cheaply--perhaps subsidizing >the costs from your other income, or perhaps just doing it as charity--you are >completely free to do so. > >The "liquidity" of remailer hops (with the "Mark V" software that handles the >grunge automatically) will be quite interesting to see. Some will go for >minimum cost (one cheap hop), others will route messages through dozens of >hops. > >Services will arise which "rate" the quality of remailers, in terms of >pricing, security, latency, message sizes accepted, past experiences, etc. > >Bandwidths are increasing so rapidly and computer hardware is getting so >cheap, that I doubt even the poorest of the poor, in the U.S. at least, will >be unable to send these kinds of messages. The costs of transmission are just >so trivial compared to other costs that even poor people routinely pay. > >(Whether the poor and downtrodden will _want_ to participate in this Brave New >World is another matter. My guess is they will.) > >-Tim

1 0

REPS: Filters Against Unwanted Messages
by tcmay＠netcom.com 03 Mar '93

03 Mar '93

Attached below is a message wherein the author advertises in his .sig this item: "(anon. postings not read)" Simple, but it gets the point across. Expect to see more such declarations. In my off-line newsreader, Eudora, (which ironically is also the subject of the message attached below--must be a plot), it's easy enough to mark all the stuff from some anonymous site for deletion. Such "filters" are a basic kind of positive reputation system and are in use in many places. Some on this list have asked for this kind of filtering to be incorporated (somehow) into NetNews readers. Maybe this will come someday, but for now the best approach is to simply not read anonymous postings, if that's important to you. I want to also describe an important use of filters: Publishers almost never accept unsolicited material. Manuscripts "thrown over the transom," as the saying goes, are returned _unopened_ or sometimes just thrown away. And the publishers are careful to publicize this fact. Why? Mainly to head off charges that they or one of their writers "stole" an idea. Merely by opening the manuscript's envelope, they are exposing themselves, potentially, to lawsuits from would-be authors who claim to see elements of their ideas in someone else's "Movie of the Week" or Great American Novel. So publishers and editors scrupulously refuse to look at unsolicited manuscripts. (I have heard, anecdotally, that the onset of electronic submissions is causing them great distress. Without the option of "returned unopened," what are they to do? Various cryptographic solutions suggest themselves...this could be a small niche market for some cypherentrepreneur to fill, and could also be a way to get some P-K and reputation-filtering software out in the world.) Some forms of crypto-extortion can be handled the same way. (I described this approach to Dean Tribble a while back.) Simply advertise widely--like in your .sig--that you do not read messages unless they come from known sources. Would-be extortionists ("Deposit 10 kilocrypts in this account or I will do X") come to realize that they cannot easily contact their victim. To be sure, other channels exist (anonymous postal mail, phone calls, routing through other sources, etc.), but the lack of a direct channel makes the initial threat harder to issue. It's a kind of crypto speed bump. This approach, "I don't listen to extortion threats," is akin to "We don't negotiate with hostage takers." Far from perfect, but still a "damping" force. -Tim Here's the posting I cited earlier: >Newsgroups: netcom.general >Path: netcom.com!pfeiffer >From: pfeiffer(a)netcom.com (Kevin Pfeiffer) >Subject: Re: EUDORA for DOS? >Message-ID: <1993Mar3.171249.26738(a)netcom.com> >Organization: Pfeiffer Design Assoc. >X-Newsreader: TIN [version 1.1 PL8] >References: <1993Mar3.062411.9712(a)netcom.com> >Date: Wed, 3 Mar 1993 17:12:49 GMT > > You might look into pceudora... Can't speak for it, but Eudora (Mac) >seems well-designed. No matter what seems to break my connections (me, the >phone company, etc.) Eudora (and unix) leaves my mail intact at Netcom. >Knock on wood. >-- > * Kevin Pfeiffer <pfeiffer(a)netcom.com> (anon. postings not read) * >--

1 0