August 1993 - cypherpunks-legacy

Re: Who is David Sternlight?
by collins＠newton.apple.com 27 Aug '93

27 Aug '93

>[...] WHO IS DAVID STERNLIGHT? [...] David Sternlight is a particulary active, if not universally admired, poster to sci.crypt et al (including a special fan club news group). The volume of his posts and their position (often antithetical to positions taken by cypherpunks) has led some to speculate that he is not an individual at all, but a group with an agenda. Some people delight in reading his posts, either because they approve, or for the same reason I like to read 'Ask Marilyn' in Parade: because they like to get riled up. Some people just add him to their 'kill' files. There has been debate over adding software moderation to sci.crypt that automatically redirects David Sternlight posts to a side group. In any case, DS (as he is sometimes referred to) is a prominent political feature of the privacy/cryptography related news groups. If you really want to know who he is: join sci.crypt; read some of his posts; and then ask him in e-mail. If you do send him e-mail -- make sure that if you use an anonymous remailer of the variety that allows him to respond to you, unlike the one you used to post this request. Hope this helps, Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024/669687 catalyst(a)netcom.com

1 0

ViaCrypt PGP and source code
by technopagan priest 27 Aug '93

27 Aug '93

I am sure that businesses will buy ViaCrypt PGP, even for $100. PGP has proven itself to be a useful and safe encryption package, and also can do digital signature, a feature not seen in similarly priced PC security packages. I think to not release the source code with ViaCrypt PGP is a serious mistake. First, I cannot see how releasing the RSA source can be harmful to ViaCrypt. People can freely examine PD PGP, I can't see how any trade secrets are going to be revealed by showing the RSA source. Perhaps it is slightly faster, but information theoretic limits show that RSA quickly becomes lengthy to encrypt, and I doubt PKP nor ViaCrypt have made any significant progress towards making it faster compared with PD PGP. I had to laugh when people suggested the "Clipper-Like" review. Why is it good for ViaCrypt, but not good for the government? Let's face it...if ViaCrypt is serious about security, they will release all source code for examination, and will digitally sign all programs and have those signatures tracable to a key on a ViaCrypt owned dial-up BBS. I understand that there is a contractual problem with releasing the RSA source. Perhaps the contract should be re-negotiated. I will bet ViaCrypt PGP will rapidly become a best-seller if implemented properly. There is plenty of money to be made if everything is kept on the cryptographic "up and up." -Thomas

2 1

Phil Zimmerman Press Briefing?
by edgar＠spectrx.Saigon.COM 27 Aug '93

27 Aug '93

To: Bay Area Extropians <exi-bay(a)gnu.ai.mit.edu> Cypherpunks <cypherpunks(a)toad.com> I just spoke to Phil Zimmerman on the phone (8/27 about 10am). He told me he plans to attend the Extropganza tomorrow, and to use the occasion to hold some kind of press briefing of his just- announce product "ViaCrypt", a commercial version of PGP. He asked me to send out this E-mail request for all of you who know any press people to invite them to attend. Unfortunately, Phil was unable to tell me exactly when he expects to arrive. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: Commercial PGP; trapdoor rumors
by nobody＠alumni.cco.caltech.edu 27 Aug '93

27 Aug '93

> In April, I talked to Jim Bidzos @ PKP, and he agreed to allow his > licensed RSA code to be built into a PGP compatible freeware program. have you considered the possibility that bidzos is a FUCKING LIAR? shaen bernhardt put it well many months ago: Don't sell out cypherpunks, RSA Inc. will stab you in the back as quickly as anyone else. here's another quote i like to review when i'm feeling too calm. it comes from a tcmay description of a cpunx mtg in sf: I think I mentioned somewhere that I put Bidzos on the spot with what I called "The 64-bit Question": Are you going to cut a deal and sell us out? [regarding clipper/capstone] Bidzos was very sober when he answered this, and said, roughly: "If you mean will I conspire with the government to deny strong crypto to users, no. But if Clipper and Capstone are destined for deployment and they come to us and offer royalties, what choice will we have? We have a duty to our shareholders." And as he was leaving for the day, he leaned in the door to our meeting and said, as if to reiterate the point, "Tim, I won't sell you out." let me translate bidzos' reply: I WILL SELL YOU OUT. so go ahead, rely on bidzos' word. but take my advice: count your fingers after shaking hands.

1 0

Adding an "AKA"
by fergp＠sytex.com 27 Aug '93

27 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- I just finished upgrading from PGP v2.2 to v2.3a (and without a hitch, I might add). This may sound like a silly question, but how do you add an AKA to your key? I skimmed through the manual, as usual, to ensure that I didn't absent-mindedly overlook something, but didn't see this mentioned. I have, however, seen it done and have a couple on my keyring in fact. Something along the <pgp -kva ferg> lines of: Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> -----> Paul Ferguson <ferguson(a)icp.net> 1 key(s) examined. Danke. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLH1mVJRLcZSdHMBNAQHchAP/URXN0T/7aW/kFC1flZgi4Rnjf4QEr2Nu Dx/FidcB2JgV9Kz0M145VCvNa1w4f9+jBFltRMLRRB/xHLFFB6kCj18a6EO31rp0 VAhjqd3GG+WAgZJ4VyQ4vY+iuByum++gHSzbh+eiD1Gpha/Fw96Pv4xskl5QbtS2 Y55QKIQB1Io= =tg73 -----END PGP SIGNATURE----- Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

2 1

Cypherpunks FAQ status
by snark!esr＠gvls1.VFL.Paramax.COM 27 Aug '93

27 Aug '93

I have received valuable and detailed feedback on the second-draft cypherpunk FAQ from a couple of posters. Accordingly, I expect to post a third cut either later today or around 8th September, on my return for California. (I'm flying out tomorrow for the World Science Fiction Convention. I'll meet some of you FTF at the 5th anniversary Extropians party.) -- >>eric>>

1 0

RE: Commercial PGP; trapdoor rumors
by Pat Farrell 27 Aug '93

27 Aug '93

In message Fri, 27 Aug 1993 01:46:57 -0400 (EDT), Mike Ingle <MIKEINGLE(a)delphi.com> writes: > > Will PKP agree to condone the use of the free version for personal > non-profit communication? They will if they know what's good for their > bottom line. PGP could become a standard, and they stand to make > a lot of money off its success. In April, I talked to Jim Bidzos @ PKP, and he agreed to allow his licensed RSA code to be built into a PGP compatible freeware program. I believe some folks at MIT were planning to start work on it... After all, cypherpunks write code... Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: Coming Soon: Commercial version of PGP!
by dmandl＠lehman.com 27 Aug '93

27 Aug '93

> gg(a)well.sf.ca.us writes: > > > How soon before a Mac compatible version is available? Or will the > > current version run under Soft PC on the Mac, which is essentially a > > PC-emulator...? If yes to either, sign me up...! > > Have you tried the freeware version of MacPGP yet? It is very easy to use. > The next release (now in beta) will even support AppleEvents. I think it will > be quite a while before you can buy something similar. > [And why would you want to pay if you can get for free?] > > --Marc I was a beta tester of the latest version of MacPGP, and it looks *very* nice. Some annoying minor bugs have been fixed and a few new features added, including a hook for BBEdit (a godsend). I assume it'll be released any week now, if not sooner. If it's true that the freeware version of PGP will be allowed to exist alongside the new (sourceless) commercial version, I don't think the cypherpunk in the know will have much trouble choosing... --Dave.

1 0

Re: Source Code NOT available for ViaCrypt PGP
by George A. Gleason 27 Aug '93

27 Aug '93

"(the problem is) convincing ViaCrypt to trust (some Cypherpunk)." There are cypherpunks who have sufficient assets that they would reasonably be considered to want to protect themselves from losing same in a lawsuit over violating the terms of the non-disclosure agreement. Hey, if you have equity in a house, you begin to qualify for this one. Better if you own a company or have other significant assets. If someone here stands up and says, "Hey ViaCrypt, I'll put my (house/company/stock portfolio/etc.) on the block to back up my NDA, now let's play ball," ViaCrypt will have a very very hard time saying no. And if they do say no, they come out looking very bad indeed. If ViaCrypt are reasonable people, let's give them the reassurance that any reasonable person needs against the possibility of getting burned. Then the ball's in their court, and they've got to respond. -gg

1 0

Re: ViaCrypt's PGP
by George A. Gleason 27 Aug '93

27 Aug '93

Source code for ViaCrypt: I believe I raised a point about having some trusted members of the crypto community (i.e. cypherpunks) examine the source under non-disclosure. Well...? This is an entirely reasonable demand. There are people in this list who are highly placed professionally, who own companies that are worth a reasonable sum, or who own houses at least, and therefore who can be trusted by ViaCrypt to not blow the gig because the resulting lawsuit would cost them mightily. So we trust those folks because they're part of this community, and ViaCrypt would trust them to not blow their NDA because they could be sued all to hell. Also from ViaCrypt's perspective, think of the marketing value of having the product independently certified or validated. That would certainly be worth something. NOw if Viacrypt refuses to go with this, that fact in and of itself would be harmful to their position: it would be a virtual admission that their system was dirty. The question is, who here wants to take this on...? To me the point is very straightforward: we have an interest in privacy, and the legal issues around privacy... the fight to preserve "underground" crypto fits into this picture, but I can't see any justification for boycotting or trying to tear down ViaCrypt simply because they're charging a fee for it and are making a profit on it and all that. Free markets, right? A successful ViaCrypt product would probably spread around to many users who would never have gotten onboard with PGP, for instance businesses who want to be totally squeaky clean about the copyright issues. We need everyone onboard who we can get, and we *don't* need some kind of PC litmus test of "are you willing to use underground software?" -gg

1 0