July 1993 - cypherpunks-legacy

Re: Secure comm program, Sockets + LINK
by jpp＠markv.com 11 Jul '93

11 Jul '93

Oops, ignore that previous message. It got away from me (*blush*). j'

1 0

Re: Secure comm program, Sockets + LINK
by jpp＠markv.com 11 Jul '93

11 Jul '93

Andrew Betty KCA=Initial key K0 in s/w KCB=Initial key K0 in s/w KCB=Initial key K0 in s/w KCA=Initial key K0 in s/w KCi= KCA + KCB KCi= KCA + KCB KCo= KCA + KCB KCo= KCA + KCB Use KCi for reading, and Use KCi for reading, and KCo for writeing to the KCo for writeing to the chanell for a while chanell for a while Requset a new sesion key Requset a new sesion key DES(KCo,RSA(BP,K1A)) KRB=DES(KCo,RSA(AP,K1B)) \_____________ ______________/ KCi=KCA+KCB \ / KCi=KCB+KCA KCo=K1A+KCB X KCo=K1B+KCA _____________/ \______________ / \ Sevice new key request TA=DES(KCi,KRB) K1B=RSA(AS,TA) KCi=K1A+K1B

1 0

My Poll....
by J. Michael Diehl 10 Jul '93

10 Jul '93

Well, I finally got to look at the responses to my poll. FYI, I got 33 replies. This is a small number considering there are (I think) 400+ people on this list. I didn't take the time to actually tally the results for each question. I'm inherently lazy... ;^) I can make some comments about what we use, tho. Note that the lists are in no particular order. Since this was certainly not a scientific poll, I opted to not include any statistics, sorry. I was kinda hoping to have a more homogeneous environment than what we have. Kinda naive, huh? Well, this is what I have to say after reading each of your replies. I would like to thank everyone who participated in my informal poll. I hope the results are usefull to any software-developer-cypherpunks out there. The systems that we use tended to be (IMHO) hi-end PC's, 386's and better. Macs were a close second, with various *nix's forming a large block. This isn't any suprise. The actuall list: PC, NCube, Sun, Mac, IBM RT, IBM RS/6000, DEC/MIPS, VAX, NeXT, HP 7xx, Cray, SGI Indigo, Amiga. As for OS's, MSDOS was, again, the clear winner. It would seem that many people are going from dos, to one of the various (free) unix's for the PC. I didn't know it was so widespread. The list: MSDOS, BSDI BSD/386, SunOS, A/UX, 4.3BSD, UNICOS, Ultrix, Linux, MacOS, HP/UX, NeXTStep, Solaris, AIX, System, IRIX, AmigaDos, vm, DESQview. There are more Cypherpunks who refuse to use online services than use them. Of those who do use online systems, and I counted bbs's and internet as an online system, these are the systems we use: The WELL, MCI, Prodigy, Compuserve, GEnie, AOL, BBSs, netcom, Internet, Fido. I didn't know there were so many mail readers..... SLMR, MH, pine, elm, emacs, Cyberdesk, Mush, NeXTMail, NUpop, GRn, QWK, Eudora, dxmail, LOCALLY DEVELOPED I was shocked to find that people still use pgp v2.1. Why? Also, unix pgp made a strong showing, considering it probably isn't very secure in that environment. The only versions mentioned are: 2.2, 2.1, MacPGP 2.1, unix. I know of other versions, tho. This poll was motivated by all of the talk about writing a secure comm program. Judging from how many different programs in use now, it will be hard to write a program which will please everybody. I also wonder if any of the telix users find telix to be very much like procomm; I did. Of the telix users, would you be interested in helping me test my mail scripts, and perhapse writing extensions for other mail readers, if needed? Hope to hear from you. Anyway, here is the list of the comm programs which we use: MacSamson, JComm, Term, QuickLink II, PPP/SLIP, Seyon, UUPC, Telix, Z-Term, procomm, Kermit, vlt, White Knight, Eudora, QModemPro, Procomm Plus, Telemate, tapcis. +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

4 3

unsubscribe
by tango＠world.std.com 10 Jul '93

10 Jul '93

tango(a)world.std.com

1 0

Racal Datacryptor
by fergp＠sytex.com 10 Jul '93

10 Jul '93

While looking through my weekly snail after getting home last night, I opened up a advertising card deck put together by Info Security News. One particular advertisement got my attention, which I am going to send for more technical information and perhaps a catalogue. (I have used Racal-Datacom routing, bridging and mux equipment extensively, and all-in-all, they're pretty solid boxes. Caveat: This point, however, has no reflection on the quality of their s-boxes.) Here is the complete text on the postcard: "Encryption You Can Depend On! Racal-Datacom, a world leader in data encryption, offers a full range of high-quality Datacryptor (Registered Trademark) encryptors for use in Government, Banking and Finance, R&D, and any application that needs secure data transmissions! Datacryptor highlights include: - Automatic/manual key changes - Generates and stores up to 400 keys - Easy to manage and program - Centarlized of front-panel operation - Protects Dial-up, Leased Line, or Shared Packet Transmissions - Up to E-1 rates - DES and proprietary algorithms - ANSI X9.17 - FED-STD 1027 - RSA Public Key - And More! For more information on Racal-Datacom Datacryptors, return this card or call 1-800-RACAL-55." The address (should anyone be interested) is: Racal-Datacom ATTN: Pre-Sales Support 155 Swanson Road Boxborough, MA 01719-9980 (The small, black and white picture on the postcard reveals a small box, not unlike an external modem, with two key-locks on the front panel.) Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp(a)sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes?

1 0

738 ANS CO+RE Security to Use RSA Public Key Cryptography
by geoffw＠nexsys.net 10 Jul '93

10 Jul '93

--X- ANS CO+RE Security to Use RSA Public Key Cryptography ----------------------------------------------------------------------------- Contacts: ANS CO+RE Systems Inc. RSA Data Security Inc. Carol Harvey, Public Affairs Kurt Stammberger, Technology Marketing 703/758-7700 415/595-8782 harvey(a)ans.net kurt(a)rsa.com ANS CO+RE's Security Services to Incorporate RSA Public Key Cryptography REDWOOD CITY, CA and ELMSFORD, NY -- ANS CO+RE Systems Inc. announced major new extensions to its advanced InterLock family of security services. The new features focus around the incorporation of RSA Data Security Inc.'s Public Key Cryptosystem. RSA's techniques are widely acknowledged as being the most secure means of data encryption and authentication available today. InterLock is a suite of security services that control access among segments of an enterprise's private IP network and/or among multiple enterprises that communicate over a IP private network. InterLock also controls access between private networks and the public Internet. In addition to RSA key exchange- enabled end-to-end encryption, InterLock services include TELNET, FTP, SMTP, X windows, and NNTP. Network access is controlled by a rule base that can be configured for each user according to userid, network service, inbound/outbound connection, time of day, day of week, public/private network and/or host address, authentication method and enforced encryption. ANS CO+RE developed the new product with RSA's BSAFE 2.0 toolkit, the world's best-selling cryptography software developer's kit. BSAFE is the same toolkit that served as the encryption "engine" for the developers of Novell NetWare 4.0, Lotus Notes, WordPerfect InForms and Fischer International Workflow.2000. BSAFE provides an easy path towards integration of state-of- the-art encryption and digital signature technology -- without requiring the developer to have a background in cryptography or number theory. RSA security technology is a standard on the Internet, the world's largest network, and on the secure networks of businesses and financial institutions worldwide. RSA president Jim Bidzos, commenting on the deal, said, "As the Internet grows, more and more confidential and mission-critical data is flowing over it -- unfortunately, the open nature of the Internet makes that information relatively easy to steal, alter or forge. The RSA-based Internet PEM (privacy-enhanced mail) standards have provided a good start by offering secure messaging capabilities to Internet users -- but now any IP user can get a complete network security implementation, with RSA built right in, with ANS CO+RE InterLock." Al Hoover, VP of Information and Applications for ANS CO+RE stated, "We've been looking to incorporate a public-key based key management system that is both as advanced as the other InterLock services and easy to integrate. RSA's Public Key Cryptography fills that need perfectly, and we will be pleased to offer it to our customers beginning in the fourth quarter of this year. It represents our continuing efforts to build on our foundation of quality security services." RSA Data Security Inc. is a recognized world leader in cryptography. The Company develops and markets software developer's kits, end-user products, and provides comprehensive consulting services in the cryptographic sciences. RSA technology has been embedded in the products of companies such as IBM, Apple Computer, DEC, Microsoft, Sun Microsystems, Novell, Lotus, Motorola, Northern Telecom, AT&T, WordPerfect, Fischer International, General Electric, Hughes and many others. Founded in 1982 by the inventors of the patented RSA Public Key Cryptosystem, the company is headquartered in Redwood City, California. ANS CO+RE Systems, Inc. is a wholly owned subsidiary of Advanced Network & Services, Inc. of Elmsford, NY. In addition to offering network security services, the company markets attachments to its nationwide T3 backbone network, and provides other related support, such as network management outsourcing, network design and engineering, and systems integration. ----------------------------------------------------------------------------- InterLock and the InterLock logo are servicemarks of ANS CO+RE Systems Inc. X Windows is a trademark of the Massachusetts Institute of Technology. The RSA logo and BSAFE are trademarks of RSA Data Security, Inc. Copyright 1993 HPCwire. ----- End Included Message -----

1 0

Re: Can FBI/NSA break DES?
by wcs＠anchor.ho.att.com 10 Jul '93

10 Jul '93

Nick's story of the FBI agent telling him about having the NSA crack DES files found on a PC in a drug case could of course be the agent pulling his leg, but it could perfectly well be true. After all, brute-force may not work well for searching 2**56 randomly- generated session keys, but it's just fine for searching a million or so easy-to-remember short stupid keys from dictionaries and such. It's even faster if you augment your dictionary with the filenames on the machine, first names of stupid people and the victim's friends, family, customers, etc. If Crack can do a good job finding root passwords for computer-literate sysadmins, it ought to be pretty good at finding passwords for semi-literate folks as well. Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

REMAILER: really anon?
by remail＠tamsun.tamu.edu 10 Jul '93

10 Jul '93

If you can trace the origin (sender) of this message please send me mail personally rather than to the list. I'm using my favorite remailer here and I want to make sure it's working right. I have sent mail to the below sites as a test for anonymous remailing returns and to see what headers I get back. It has been maybe 4 days now since I began this experiment, some of the sites below have still not remailed my test message. My main curiosity in this quest is to determine what each header will look like when the mail is recieved. I think this is important in determining which remailer to use. The below is the list of remailers with the "unique header to remailer" info below each site number. If you wish to discuss this matter further, please send a follow up message to the cypher list with your address included and "Re: Unique header". I'm really not too concerned about remaining anonymous (that is, I will come out of hiding), I just want to see if this scheme is really airtight! Thanks! -z **Please take note of remailer 12 of this list.** The typical header received looks similar to the below: (I have removed the date, time, etc. to protect my privacy) >From rebma!remailer(a)kksys.mn.org Thu Jul x 00:38:01 1993 Received: by ahost.some.school.edu (5.57/Ultrix3.0/cc-ix.mc-1.5) id AA02491; Thu, x Jul 93 19:00:54 -0500 Received: from kksys.mn.org by uum1.mn.org with bsmtp (Smail3.1.28.1 #3) id m0oE6Du-00007JC; Thu,x Jul 93 00:21 CDT Received: from rebma by kksys.mn.org with uucp (Smail3.1.28.1 #13) id m0oE5jG-0007TsC; Thu,x Jul 93 00:50 CDT Received: by rebma.rebma.mn.org (Smail3.1.28.1 #1) id m0oE6nS-0002CzC; Thu, 8 Jul 93 17:58 PDT Message-Id: <m0oE6nS-0002CzC(a)rebma.rebma.mn.org> Date: Thu, x Jul 93 17:58 PDT To: me(a)myhost.some.school.edu From: nobody(a)rebma.rebma.mn.org Subject: 9 Remailed-By: Mr. Nobody <remailer(a)rebma.mn.org> Status: O =========This is where the list of remailers begins=========== *** Please keep in mind that in the below I included only the "unique to *** remailer" parts of the header.*** 1: nowhere(a)bsu-cs.bsu.edu From: Anonymous <nowhere(a)bsu-cs.bsu.edu> To: omitted X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> X-Ttl: 0 X-Notice: This message was forwarded by a software- automated anonymous remailing service. 2: hh(a)cicada.berkeley.edu From: nobody(a)cicada.berkeley.edu 3: hh(a)pmantis.berkeley.edu No response after 4 days 4: hh(a)soda.berkeley.edu From: nobody(a)soda.berkeley.edu Remailed-By: Eric Hollander <hh(a)soda.berkeley.edu> 5: 00x(a)uclink.berkeley.edu From: nobody(a)uclink.berkeley.edu Remailed-By: Tommy the Tourist <tommy@out> 6: hal(a)alumni.caltech.edu From: nobody(a)alumni.cco.caltech.edu Comments: This message is NOT from the person listed in the From line. It is from an automated software remailing service operating at that address. Please report problem mail to <hal(a)alumni.caltech.edu>. 7: ebrandt(a)jarthur.claremont.edu From: nobody@eli-remailer Remailed-By: Eli Brandt <ebrandt(a)jarthur.Claremont.EDU> Source-Info: From (or Sender) name not authenticated. 8: phantom(a)mead.u.washington.edu No response after 4 days 9: remailer(a)rebma.mn.org (this reply took almost 3+ days!) From: nobody(a)rebma.rebma.mn.org Remailed-By: Mr. Nobody <remailer(a)rebma.mn.org> 10: elee7h5(a)rosebud.ee.uh.edu From: nobody(a)rosebud.ee.uh.edu 11: hfinney(a)shell.portal.com From: nobody(a)shell.portal.com Comments: This message is NOT from the person listed in the From line. It is from an automated software remailing service operating at that address. Please report problem mail to <hfinney(a)shell.portal.com>. 12: remail(a)tamsun.tamu.edu From: remail(a)tamsun.tamu.edu Remailed-By: Anonymous <remail(a)tamsun.tamu.edu> Received: by tamsun.tamu.edu id AA04104 (5.65b/IDA-1.4.3 for you@yourhost); Tue, 6 Jul 93 04:15:57 -0500 you@yourhost = your address! ...really! 13: remail(a)tamaix.tamu.edu From: remail(a)tamsun.tamu.edu Remailed-By: Anonymous <remail(a)tamsun.tamu.edu> 14: remailer(a)utter.dis.org Received: by soda.berkeley.edu (5.65/KAOS-1) id AA13859; Tue, 6 Jul 93 03:09:09 -0700 Received: by merde.dis.org (4.1/SMI-4.2) id AA04354; Tue, 6 Jul 93 03:11:48 PDT From: nobody(a)dis.org Remailed-By: remailer bogus account <remailer(a)utter.dis.org> 15: remail(a)extropia.wimsey.com No response after 4 days NOTES: #1-#5 no encryption of remailing requests #6-#14 support encrypted remailing requests #15 special - header and message must be encrypted together #9,#14,#15 introduce larger than average delay (not direct connect) #9,#14,#15 running on privately owned machines

2 1

Re: anonymous mail
by peb＠PROCASE.COM 09 Jul '93

09 Jul '93

>Apparently, Mr. Steshenko thought it was appropriate to use company >resources for non-company activities. Use of phone, desk, email, bathroom, grounds, chairs, kitchen, are all company facilities that are necessary for working for a company, but it is widely accepted that they can also be used personally as perks. At the extreme of a perk-that-is-necessary is "calling your doctor". This is not company business, but if you can't make such calls at the office, you end up working less in order to get around such restrictions. The other extreme is something that takes up company resources due to purely individual convenience: posting to usenet for personal business. This can be done via a private account and does not have to be done from the office, but many companies allow this because they also expect people to work overtime for free and this keeps them at work. Depending upon many factors at a company, the amount of perk usage allowed varies. Some companies have policies about this while others do not. I think the reason no policy exists in many places is that defining it is a form of encouragement (like saying you have exactly 5 sick days a year, and they don't carry over to the next; this causes people to call in sick even when they are not. One company I worked for took sick days out of your vacation days (but you got more vacation days than was ordinary); this encouraged honesty, but also led to sick people coming to work). > On top of that, those activities misrepresented the company. This gets into the disclaimer bit. I *never* assume a person is speaking for the company unless they are making a product announcement; for anything else, it is fairly easy to see that postings are personal (even if they regard business related subjects like commendts about the quality of particular software). It would be far easier for everyone to assume that no messages represent the company, board of directors, etc., unless explicitly stated as such, simply because official messages are rare and personal/unofficial ones are frequent. >Steshenko's firing is something all the libertarians on this list >should applaud. The cost of accounting/surveillance/policing/ill-will must be balanced with the benefits of having a trusting/open/honest/self-policed-perks policy; this is a tradeoff all organizations must make and has nothing to do with free markets. Libertarian thought doesn't say anything about this tradeoff, except that governments shouldn't coerce a company into a particular position. Paul E. Baclace peb(a)procase.com

1 0

anonymous mail
by nobody＠entropy.linet.org 09 Jul '93

09 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Some people have e-mailed me saying that what happened to Mr. Steshenko isn't uncommon at all. This fact bothered me all weekend long, that somebody can get fired for views expressed in a private e-list, which probably extrapolates to USENET posting as well. Apparently, Mr. Steshenko forgot to include the "disclaimer: my opinions" with his email. Is this all that is required? If he merely would have added the disclaimer, would his former employer be facing possible legal action? Would he still be employed? Is there some "minimal" text that must be included? I mean, I've seen disclaimers that are nearly a paragraph long to ones that try to be cute (#include <std.disclaimer> and so forth). (If you missed the post to alt.comp.acad-freedom.talk and various other groups and don't get usenet let me know and I'll post it to the list if there is enough interest. I'm not sure if email copies I sent out made it since some bounces occured. Plus the good old "cannot deliver for 3 days; message queued" sort of error.) It bugged me because I really beleive that it is impossible to carry on a rational discussion if one side is afraid to voice an opinion. I'm not advocating libel or misuse (personal attacks, threats of violence, etc.) but every once in a while a really hot topic comes up which stirs the emotions. So, we can all forge mail with smtp, use the cypherpunk remailers, use "anonymous" servers like penet and charcoal, email-to-usenet gateways, etc. I've never seen instructions on how to forge a usenet post, so here goes: 1) Telnet to an NNTP server (see Yanoff's internet services list) 2) Type 'post'. After a bit, you'll get an OK message. 3) Type in what you want to appear. Have in mind before you start what fields you want in the header, or check other posts to see what they have. 4) End with a period on a line all by itself. After a bit, you'll get a "Post OK" message. 5) Type 'quit' For example, I was experimenting and posted this to alt.binaries.pictures.d: ====================================================================== Newsgroups: alt.binaries.pictures.d From: anyone(a)here.and.there Subject: A test Content-Type: text Nntp-Posting-Host: nowhere Organization: none Date: Wed, 7 Jul 1993 11:14:00 GMT This is merely a test. ====================================================================== I just typed all that stuff in (including a lone period, but that doesn't show in your message) and it showed up after a while. If you examine the post closer, particularly the Path and Sender fields, the fact the message originated at the nntp server in Germany is revealed. I guess I'll work on more sophisticated methods in my spare time :-) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLDseRoOA7OpLWtYzAQF+HQP+NUd41Sw3QVzBcisaG7o5W2tld02A+e6u 6TDNnwioCsTq/n9arLJ7+dDOEI15c4TTQ2d4f/YoFi5JpMGdc8svC4DFGVY9kZRR bZjnW3/EPaeqbh2dB5AJj3o5X4+UQc4KnB3RuEY62QOvVQ4mzWVMC/D55EH53o9y AYs0scqMwJI= =Dh7z -----END PGP SIGNATURE-----

2 1