February 2001 - cypherpunks-legacy

PGP/MIME implementors: text mode vs. binary mode? (fwd)
by Jim Choate 13 Feb '01

13 Feb '01

____________________________________________________________________ Before a larger group can see the virtue of an idea, a smaller group must first understand it. "Stranger Suns" George Zebrowski The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- -------------------------------------------------------------------- ---------- Forwarded message ---------- Date: Tue, 13 Feb 2001 13:54:27 +0100 From: Thomas Roessler <roessler(a)does-not-exist.org> Reply-To: ietf-openpgp(a)imc.org To: mail-client-dev-list(a)lists.sourceforge.net, pgp-mime(a)lists.uchicago.edu, coderpunks(a)toad.com Cc: ietf-openpgp(a)imc.org Subject: PGP/MIME implementors: text mode vs. binary mode? Please forward this message to any implementors of PGP/MIME you are aware of. To whom it may concern. In the ietf-openpgp working group, we are about to finish a revised version of RFC 2015. While this looked like an easy task at first sight, it is not, since OpenPGP breaks traditional pgp's text-mode signatures. This message is to solicit further input and comments from other implementors of PGP/MIME. (We thought we were done, but then there were more arguments against the solution we believed to have found...) The current draft is draft-ietf-openpgp-mime-04.txt, and available from: <http://www.ietf.org/internet-drafts/draft-ietf-openpgp-mime-04.txt>. Please direct any answers to this message to the ietf-openpgp mailing list. In order to subscribe to that list, send a message to <ietf-openpgp-request(a)imc.org> with the single word "subscribe" in the subject. The Problem. To pgp 2 and 5, a text-mode signature meant that line endings were transformed to a CR-LF sequence, and the result was then hashed. However, with OpenPGP, preparing a text-mode signature has another effect: Trailing blanks (and tabs?) are stripped - this is what used to be done as a clear-sign signature with traditional PGP. Of course, this is a bug in the spec, but one which won't be easily fixed now that all the implementations are out there. Now, for PGP/MIME, this turns into a really ugly problem: RFC 2015 does not specify which kind of signature to use. However, it does specify how the signed material should be canonicalized before hashing. This method of canonicalization exactly matched what was done by traditional PGP versions for text mode signatures, which means that the very same hash value could be used to verify either a text-mode or a binary-mode signature. That way, PGP/MIME according to RFC 2015 and with traditional PGP had the desired one-pass properties. With OpenPGP, this construction breaks badly as soon as trailing white space is involved. Since it doesn't look right or elegant to ask implementors of one-pass parsers (if they exist) to calculate two hashes in parallel, some decision has to be made on the kind of signature which should be mandated for the future. I'm listing the choices and the pros and cons I'm seeing: * text-mode signatures + easy to implement if you invoke a command-line tool to which you can leave the details of canonicalization. - Ian Bell of turnpike.com tells me that it's hard to persuade the PGP SDK to produce detached text-mode signatures. + the new-style text-mode signatures will nicely ignore any whitespace changes which are irrelevant to the message's content (When used the right way, MIME is invariant under modifications of trailing whitespace.) - there are incompatibilities between implementations which use text-mode AND leave trailing white space in messages. - thus, clients will need additional code in order to avoid trailing whitespace (e.g., apply quoted-printable). - this will make any clients non-compliant which are using binary mode today. * binary-mode signatures + easy to implement if you use the PGP SDK (I'm told). + clients are interoperable regardless of the back-end version used and regardless of the treatment of trailing whitespace. - those people who rely on "pgp -t" will have to add some code to pass canonicalized data to the back-end. In some cases, this may badly break things. - signatures will break upon changes to trailing white space which don't affect the message's content or MIME semantics - thus, clients may need additional code in order to avoid trailing whitespace (e.g., apply quoted-printable). - this will make any clients non-compliant which are using text mode today. Bottom line: The decision what to mandate boils down to the question what implementors prefer. And, yes, both alternatives are bad solutions. Thus, if you are an implementor of PGP/MIME, please subscribe to the ietf-openpgp mailing list, and let us know what should be done in your opinion, and why. Also, please tell us what mode you are using nowadays, so we get a more precise impression of what software we are going to break. Thanks, and kind regards, -- Thomas Roessler <roessler(a)does-not-exist.org>

1 0

Re: [Re: The meek will inherit what, exactly?]
by LUIS VILDOSOLA 13 Feb '01

13 Feb '01

You have made a point, I share your view. That's the focal point to power struggles. You want it all but nature does not allow it all. To me the question is, what are the protocols under which a dynamic stability can be achieved that goes beyond the design of an encryption protocol? mmotyka(a)lsil.com wrote: > > > I regard that one verse, and its implications, as one of the most > > dire, tragic, and hopeless of all the prophecies in the bible. > > > > Bear > > > The tragedy of that one verse is the result of that go forth and > multiply horseshit that some mindless fuckwits actually think still > makes sense. > > The meek will inherent only a big hobnailed boot imprint in the middle > of their backs and a depleted and polluted planet. Of course the > non-meek have to live in the same place as the meek so they're only > fucking themselves over in the long run. > > So, to end on an optimistic note, viva las cucarachas. > > Mike ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

1 0

Re: The meek will inherit what, exactly?
by mmotyka＠lsil.com 13 Feb '01

13 Feb '01

> I regard that one verse, and its implications, as one of the most > dire, tragic, and hopeless of all the prophecies in the bible. > > Bear > The tragedy of that one verse is the result of that go forth and multiply horseshit that some mindless fuckwits actually think still makes sense. The meek will inherent only a big hobnailed boot imprint in the middle of their backs and a depleted and polluted planet. Of course the non-meek have to live in the same place as the meek so they're only fucking themselves over in the long run. So, to end on an optimistic note, viva las cucarachas. Mike

1 0

ernest & young & zks
by Blank Frank 13 Feb '01

13 Feb '01

AF wrote: >ERNST & YOUNG VETERAN TAMAS HEVIZI NAMED PRESIDENT AND CEO OF >ZERO-KNOWLEDGE SYSTEMS Pretty ironic. E & Y was the firm that did a private forensic investigation of air stewards' home computers because they were annoying an airline.

1 0

RE: The meek will inherit what, exactly?
by Trei, Peter 13 Feb '01

13 Feb '01

> ---------- > From: Ray Dillinger[SMTP:bear@sonic.net] > > >But let's not worry so much of differences in power, for the poor and > peace > >makers will inherit the world. -somewhere in the Bible- > > "Blessed are the meek, for they shall inherit the earth." > -Matthew 5, verse 5. [...] > I don't think prime real estate, exactly, Perhaps a near-barren > rock with a poisonous radioactive atmosphere and a few surviving > species of insects and fungus. Perhaps less than that. [...] > Bear > Y'know, it's dissapointing that Luis doesn't make use of the Internet, all of which is presumably sitting in front of him as he types, to get his citations right. >From Matthew, KJV [3] Blessed are the poor in spirit: for theirs is the kingdom of heaven. [4] Blessed are they that mourn: for they shall be comforted. [5] Blessed are the meek: for they shall inherit the earth. [6] Blessed are they which do hunger and thirst after righteousness: for they shall be filled. [7] Blessed are the merciful: for they shall obtain mercy. [8] Blessed are the pure in heart: for they shall see God. [9] Blessed are the peacemakers: for they shall be called the children of God. [10] Blessed are they which are persecuted for righteousness' sake: for theirs is the kingdom of heaven. (BTW: These are generally known as the Beatitudes) Nothing about the just plain not-having-money poor getting anything special (at least here - there's plenty about the spiritual problems of the rich elsewhere in the New Testament). I've got a button somewhere I picked up at an SF convention: "The Meek shall inherit the Earth. The rest of us will go to the stars!" Peter Trei > >

2 1

hidden update 2
by Tom 13 Feb '01

13 Feb '01

once again I'm asking for some details/help on what looks ever more like a pure anonymity problem. maybe I should start with revealing what it's all for, since I'm pretty much stuck there at the moment. point your browser to http://www.lemuria.org/Black if you want and take a look. there's not much there at the moment, but should be enough to give you a basic idea. in short, it's kind of an archive for thought crime. a little like cryptome but with a different topic and philosophy. most importantly, it's only a front. the actual data store is somewhere else, e.g. freenet. so when the thugs kick in my door and take the machine, nothing whatsoever is lost. now since some of the information archived there will surely be illegal in one or more countries, what is needed is guaranteed anonymity for pretty much everyone involved (except the publisher, who's taking a risk but can drop out at any time without destroying the data). some of the related problems are solved, many not. one of the worst unsolved so far is what I call "hidden update". in short, I need a way for Alice to give Bob a piece of information with neither Alice nor Bob knowing each other. however, Bob should have a way to verify that subsequent messages are coming from the same Alice. bonus points if there's a way for Bob to send messages to Alice, too. main problem: the need to implement the above with existing and readily available infrastructure. one solution I've come up with so far is for Alice to encrypt to Bob's (anonymously published) key and post via remailers to, say, alt.anonymous.messages, which Bob is known to read. alternatively, agree on one or more porn/binary newsgroups and use stego.

3 3

Ernst & Young guy is new Pres ZKS
by Aimee Farr 13 Feb '01

13 Feb '01

<clipped> ERNST & YOUNG VETERAN TAMAS HEVIZI NAMED PRESIDENT AND CEO OF ZERO-KNOWLEDGE SYSTEMS "...a strategic business leader with an impressive track record of growing sales and operations," said Hammie Hill, Zero-Knowledge Systems chairman and chief financial officer..... "...Austin Hill, formerly president of Zero-Knowledge Systems, will assume the role of executive vice president and chief strategist...." SVIC FOUNDER AND CEO ROBERT W. SHAW JOINS ZERO-KNOWLEDGE SYSTEMS' BOARD OF DIRECTORS "...Shaw's deep expertise building successful enterprise business platforms and his strategic technology industry relationships to strengthen the company's market position." aimee.farr(a)pobox.com Aimee E. Farr, Esq. Law Office Of Aimee E. Farr 5400 Bosque, Suite 675 Waco, Texas 76710-4418 office: 254.751.0030 fax: 254.751.0963 PGP Key ID 0xD8986924

1 0

Re: Here you have, ;o)
by Steve Orrin 13 Feb '01

13 Feb '01

Actually the part that looks like executable code is just encoded and the second part of the virus is a script to decode it. Once decoded it is executed and it is this decoded script that actually executes the virus methods (adding things to registry, replication and a timed DoS against some web site in .nl) The real interesting thing is that the virus was created by a Worm Generator (known as VBSWG 1.50b). It creates the worm for any script kiddie, thus doing the hard work like obfuscating the code and using randomly generated object names as well as the replication code and Registry entries. -Steve -----Original Message----- From: Declan McCullagh <declan(a)well.com> To: Adam Back <adam(a)cypherspace.org> Cc: Vin McLellan <vin(a)shore.net>; Com Cypherpunks@Toad. <cypherpunks(a)toad.com> Date: Tuesday, February 13, 2001 10:07 AM Subject: Re: Here you have, ;o) >Yep. Vorm writers are getting smarter. It seems as though VB >lets you embed executable (compiled, I assume) code in a .vbs >file, so a casual observer can't easily tell what this one does. > >-Declan > > >On Mon, Feb 12, 2001 at 09:37:33PM -0400, Adam Back wrote: >> Heh, heh. Guess who uses outlook :-) >> >> Endless source of amusement as a linux user watching the VB >> script worms play out. I think you actually have to click >> on this one, though the double extension helps as many >> users won't see the 2nd .vbs, just the .jpg. >> >> Adam >> >> On Mon, Feb 12, 2001 at 08:09:32PM -0500, Vin McLellan wrote: >> > Hi: >> > Check This! >> >> >

2 1

NYT: Railroad drops employee gene testing
by Alex Shirado 13 Feb '01

13 Feb '01

http://www.nyt.com/aponline/business/AP-Genetic-Tests.html DALLAS (AP) -- Hit with a federal lawsuit, Burlington Northern Santa Fe Railway agreed Monday to stop requiring genetic testing of employees who file claims for a wrist condition called carpal tunnel syndrome. On Friday, the U.S. Equal Employment Opportunity Comission filed a federal lawsuit charging that the policy violated the Americans With Disabilities Act. The EEOC said a railroad worker who refused to provide a blood sample after filing an injury claim was threatened with termination. ...

1 0

freedomforum.org: Federal judge quashes subpoena for Kansas bookstore's sales records
by Jim Choate 13 Feb '01

13 Feb '01

At least one blow for reader anonymity... http://www.freedomforum.org/news/2000/12/2000-12-04-04.htm -- ____________________________________________________________________ Before a larger group can see the virtue of an idea, a smaller group must first understand it. "Stranger Suns" George Zebrowski The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1