August 1993 - cypherpunks-legacy

Other shoe drop confirmation
by bart＠netcom.com 03 Aug '93

03 Aug '93

Well, somebody else heard the story as I did. Bart

1 0

Remailer configuration
by greg＠ideath.goldenbear.com 03 Aug '93

03 Aug '93

Hal Finney writes and asks what folks think about his remailers - if two are better than one, etc. My two cents' worth is that two is better; already we're starting to see applications (like the UT mail-to-news gateway) where people are filtering known remailers out. The bigger the list of remailers which might be sending mail, the harder it'll be to do that sort of thing. I wonder how big the list would need to get before sysadmins would consider it more economical to abandon filtering entirely? Let a thousand flowers bloom. -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0

REMAIL: Anonymous posts
by nobody＠soda.berkeley.edu 03 Aug '93

03 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- Several people have asked about anonymous posting given that the utexas gateway is blocking (some?) cypherpunks remailers. Another possibility is to use Julf's anonymous remailer in Finland. I'm not sure what groups it posts to but I'm pretty sure it includes sci.crypt and most of the alt groups. For more security, you can mail to it from my remailer at hfinney(a)shell.portal.com, and probably other cypherpunks remailers as well. I'm pretty sure my other remailer, hal(a)alumni.caltech.edu, will work too. Send mail of the form: ========================= cut ==================== :: Request-Remailing-To: alt.privacy(a)anon.penet.fi This is a post to alt.privacy. ========================= cut ==================== This should work. You can also use PGP encryption; encrypt that message above with the PGP public key of my remailer, add the header: :: Encrypted: PGP and a blank line before the -----BEGIN PGP MESSAGE----- line, and send it to the remailer. You can chain through a bunch of cpunks remailers using Karl's scripts for higher security. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- iQCVAgUBLF28O6gTA69YIUw3AQFj8QQAvaATrxKVYbKR4Jvj/Oj54DYJT7NdSs+z lozanaG70YJRnJNI5EAzRK8mT9egjxHzd41aa/XqEeuC9qjLCA5qDYQEhsFFr6tw LclgvXJ9I8xFvzHmIa7sVEytlWhDZJHXImHcyoFxAsmNFbLBJ5/h1szNgCx6NpzV UnmXw3ftshQ= -----END PGP SIGNATURE-----

1 0

Re: ...
by cme＠ellisun.sw.stratus.com 03 Aug '93

03 Aug '93

>Subject: ... >From: greg(a)ideath.goldenbear.com (Greg Broiles) >Message-Id: <eyio8B1w164w(a)ideath.goldenbear.com> >Date: Mon, 02 Aug 93 16:55:01 PDT > >The "celebrating 400 years .." thing sounds wonderful. Would make a neat >poster/flyer, too. Thanks. It's 4000 years, BTW. I assume your 400 was a typo. - Carl

1 0

Re: Skipjack Panel
by wcs＠anchor.ho.att.com 03 Aug '93

03 Aug '93

I'll disagree with Mr. Thug. It probably *is* in the interests of the National Spook Agency to have the SkipJack algorithm secure; they've taken too much heat in the past for DES, and if they can't convince enough of us that we can trust them, we'll all use real encryption products from independent vendors, or at least triple-DES. The Key Escrow business strikes me as major sleight of hand, but even if they don't steal the keys somewhere in that process, they can change to rules so they can get them from the experts. Obviously they could hide weaknesses anywhere in the system, but the SkipJack part is pretty clean, and trapdoors in the chip itself are a lot of trouble to use compared to the escrow process. Right now they're trying to draw everybody's attention to the foot-thick concrete walls and roof, and the final release of the report will emphasize the heavy steel door with the big bulletproof neon sign saying "COPS ONLY" and the elaborate ceremony for opening the two case-hardened real-estate-agent locks on the doors, so you forget to notice that they've already made a spare copy of the key, and maybe you can pop the unbreakable titanium pins out of the hinges as well. Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

FBI wants to ban Crypto
by gast＠cs.ucla.edu 03 Aug '93

03 Aug '93

I just heard a little of the report on NPR on Saturday, but it seems that the FBI went public last week at a security conference with its desires to ban cryptography, at least crypto that it cannot break. The FBI said that in four different wiretap cases, it got encrypted messages instead of talk. I know that the FBI has previously announced similar plans including at CFP-2, but this seems to be a new salvo. David

1 0

Re: Encrypted BBS?
by wcs＠anchor.ho.att.com 03 Aug '93

03 Aug '93

> > Would it be at all possible, given today's present state of > >cryptography, to run a bbs in a totally encrypted form? If so, are there > >any software packages out there that accomplish this at some level? You've got to think about what threats you're trying to protect against. - Confiscated Machine - this can be done today with commercial products, a no-brainer. You keep the disk in encrypted form, either using software or a hardware-assist DES board, and it's automatically handled by your disk drivers using a boot-time secret-key password. Neither your users nor your BBS sofware knows any difference. (Obviously you also want to decrypt your backup floppies.) - Wiretapping - there are tons of possible solutions, at varying amounts of work. you can either do this with public or secret-key approaches, and you can use a shared secret key, separate secret keys, session keys set up using secret or public keys, etc. Most of these methods affect the BBS sofware itself, though you could use an encrypted telnet or other comm program instead, presumably in conjunction with the encrypted disk. A solution that requires a little more integration is to have the users upload the files encrypted (using random keys), and upload the keys (encrypted) and have the host recrypt them with the readers public or private keys, either at upload or download time, or perhaps on a batch basis during idle time. You could probably adapt PGP to retain the initial key for each file, and only re-encrypt the key when a user wants to download it, instead of re-encrypting the whole file. - Untrusted users - if there may be narcs on your box, you've got to give the users control over who can access what messages they create. If the users trust *you*, you can use some sort of password-based system; some existing BBSs presumably provide this, and you can even hack Usenet to do it (for non-NNTP use, anyway) using Unix groups; this allows groups of users who trust each other but not other users. - Untrusted Sysadm - if *you* may be a narc :-), your users can include PGP-encrypted messages in their postings, and there's not much you can do about it :-) This somewhat solves the untrusted-user problem as well, though it makes the closed user group bit more annoying. Bill Stewart

1 0

"Big Brother Inside" tshirts
by nate＠VIS.ColoState.EDU 03 Aug '93

03 Aug '93

I regret to inform the group that I cannot make the T-shirts. I have no money to fund them, and even less time. I do, however, encourage anyone else who want to make the shirts to do so. I uploaded the logos to soda this morning, so they should be available soon (if not already). I printed on of the images out (the large one) and it looked great...... I am sorry for this, but I am absolutely financially strapped now. BTW, the images names started with "BigBro" -= and if you want, you can strip off the "Image Edited by Nate Sammons" line I dropped in the lower right corner of the large images (it was in, I think, 12-pixel high letters). Well, for anyone whe makes the T-shirts, put something cool on the back, and sign me up for one, size XL. -nate sammons nate(a)vis.colostate.edu

1 0

...
by greg＠ideath.goldenbear.com 03 Aug '93

03 Aug '93

I think the T-shirt thing is a nice idea, and I think that the "Big Brother Inside" thing is also a nice idea, but I liked them better when they were separate. Wearing a shirt that suggests "big brother inside" seems like it might send the wrong message. Dunno if there are enough of us in the world for it to be worth worrying about, but some of us Cypherpunks just laugh at L and XL T-shirt sizes; best fit for me is a XXXL-Tall. I might order an XL shirt to hang on my wall, but it's unlikely it'll ever hang on me. :) The "celebrating 400 years .." thing sounds wonderful. Would make a neat poster/flyer, too. -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0

cross-post
by cme＠ellisun.sw.stratus.com 02 Aug '93

02 Aug '93

Path: transfer.stratus.com!ellisun.sw.stratus.com!cme From: cme(a)ellisun.sw.stratus.com (Carl Ellison) Newsgroups: sci.crypt Subject: Skipjack review as a side-track Date: 2 Aug 1993 21:25:11 GMT Organization: Stratus Computer, Marlboro MA Lines: 28 Message-ID: <23k0nn$8gk(a)transfer.stratus.com> NNTP-Posting-Host: ellisun.sw.stratus.com It amuses the gallows-humor bone in me to see people busily debating the quality of Skipjack as an algorithm and the quality of the review of its strength. Someone proposes to dangle you over the Grand Canyon using sewing thread tied to steel chain tied to knitting yarn and you're debating whether the steel chain has been X-rayed properly to see if there are flaws in the metal. Key generation, chip fabrication, court orders, distribution of keys once acquired from escrow agencies and safety of keys within escrow agencies are some of the real weaknesses. Once those are as strong as my use of 1024-bit RSA and truly random session keys in keeping keys on the two sides of a conversation with no one in the middle able to get the key, then we need to look at the steel chain in the middle: Skipjack itself. -- - <<Disclaimer: All opinions expressed are my own, of course.>> - Carl Ellison cme(a)sw.stratus.com - Stratus Computer Inc. M3-2-BKW TEL: (508)460-2783 - 55 Fairbanks Boulevard ; Marlborough MA 01752-1298 FAX: (508)624-7488

1 0