June 2002 - cypherpunks-legacy

INVESTMENT
by PHILIP JONHSON 17 Jun '02

17 Jun '02

ATTN: PRESIDENT. I WOULD LIKE TO BEGIN BY WAY OF INTRODUCTION..MY NAME IS MR .PHILIP JOHNSON,A NATIVE OF CAPETOWN IN SOUTHAFRICA AND A SENIOR EMPPLOYEE OF THE SOUTH AFRICA MINISTRY OF ENERGY AND MINERAL RESOURCES CURRENTLEY HERE IN AMSTERDAM-NETHERLANDS ON A ONE YEAR STUDY LEAVE. I AM WRITING THIS LETTER TO SOLICIT YOUR COORPERATION IN ORDER TO REDEEM AN INVESTMENT INTEREST CURRENTLY BEING HELD UNDER TRUST WITH THE SOUTH AFRICA MINISTRY OF ENERGY AND MINERAL RESOUSES. THE SAID INVESTMENT NOW VALUED AT US$35.500.00 (THIRTY FIVE MILLION FIVE HUNDRED THOUSAND UNITED STATES DOLLARS) WAS ORIGINALLY PURCHASED BY ONE MR ROBINSON MOORE LEASED TO THE FREE STATE CONSOLIDATED MINING CORPORATION IN 1975 FOR 25 YEARS. SINCE THE MATURITY OF THIS CONTRACT IN AUGUST 1999,SEVERAL ATTEMPTS HAVE BEEN MADE WITHOUT SUCCESS TO CONTACT MR MOORE OR ANY OF HIS CLOSE RELATIVES ,IN WHOSE FAVOURE THE INVESTMENT CASH VALUE COULD BE PAID TO. MY PARTNER WHO IS THE ACCOUNT DIRECTOR AT THE MINISTRY OF ENERGY AND MINERAL RESOURCES AND TWO OTHERS COLLEAGUE, HAVE INITIATED THE PROCESS OF FILLING ACLAIM FOR THIS MONEY,WITH THE HOPE OF HAVING THIS FUND TRANSFERRED INTO A SAFE OFFSHORE ACCOUNT . WE COULD FILE A CLAIM FOR THIS MONEY WITH THE MINISTRY CLAIMING THAT YOU WERE APPOINTED BY MR MOORE TO BE THE BENEFICIARY TO THIS FUNDS.AS SOON AS THE CLAIM IS APPROVED,THE STATED SUM OF US$35.5MILLION WILL BE TRANSFERED INTO AN ACCOUNT OF YOU CHOICE,AFTER WHICH MY COLLEAGUES AND I SHALL TO MEET WITH YOU FOR THE DISBURSEMENT OF THE FUNDS. SINCE THE MONEY WILL BE IN YOUR CUSTODY,YOU HAVE THE RESPONSIBILITY TO ENSURE THAT MY COLLEAGUES AND I RECEIVE 70% OF THE TOTAL SUM WHILE YOU KEEP THE REMAINING 20% FOR YOUR ASSISTANCE WHILE 10% IS SET ASIDE FOR EXPENCES.. PLEASE WE URGE YOU TO KEEP THIS AFFAIR VERY CONFIDENTIAL,BECAUSE WE ARE STILL IN ACTIVE GOVERNMENT SERVICE. I WANT TO ASSURE YOU THAT MY PARTNERS ARE IN A POSITION TO MAKE THE PAYMENT OF THIS CLAIM POSSIBLE, PROVIDED YOU AGREE TO MEET WITH US AND GIVE US THE GUARANTEE THAT OUR SHARE WILL BE WELL SECURED IN YOUR CARE . BE REST ASSURED THAT THERE IS ABSOLUTELY NOTHING TO WORRY ABOUT IN VIEW OF THIS CLAIM . IT IS PERFECTELY SAFE WITH NO RISK INVOLVED,AND IT IS NOT SUBJECT TO ANY ENQUIRY, AS MY PARTNERS WILL BE HANDLING THE CLAIMS DIRECTLY ON YOUR BEHALF IN SOUTH AFRICA. PLEASE ACKNOWLEDGE THE RECEIPT OF THIS LETTER BY PHONE ON MY CONFIDENTIAL TELEPHONE 0031613506987 LOOKING FORWARD TO YOUR PROMPT REPLY. YOURS TRULY, MR PHILIP JOHNSON reply to philijons2(a)email.com

1 0

[IRR] SA passes Electronic Communications and Transactions Bill
by R. A. Hettinga 17 Jun '02

17 Jun '02

Notice the crypto-provider registration bit, below... Cheers, RAH --- begin forwarded text

1 0

Do you run a business? [osdsm]
by Chad Karen 17 Jun '02

17 Jun '02

1 0

[ANNOUNCE] OpenSSL 0.9.7 beta 2 released
by Lutz Jaenicke 17 Jun '02

17 Jun '02

The second beta release of OpenSSL 0.9.7 is now available from the OpenSSL FTP site <URL: ftp://ftp.openssl.org/source/>. Quite a lot of code changed between the 0.9.6 release and the 0.9.7 release, so a series of 3 or 4 beta releases is planned before the final release. To make sure that it will work correctly, please test this version (especially on less common platforms), and report any problems to <openssl-bugs(a)openssl.org>. Application developers that use OpenSSL to provide cryptographic routines or SSL/TLS support are kindly requested to test their software against this new release to make sure that necessary adaptions can be made. Changes between 0.9.6x and 0.9.7 include: o New library section OCSP. o Complete rewrite of ASN1 code. o CRL checking in verify code and openssl utility. o Extension copying in 'ca' utility. o Flexible display options in 'ca' utility. o Provisional support for international characters with UTF8. o Support for external crypto devices ('engine') is no longer a separate distribution. o New elliptic curve library section. o New AES (Rijndael) library section. o Change DES API to clean up the namespace (some applications link also against libdes providing similar functions having the same name). Provide macros for backward compatibility (will be removed in the future). o Unifiy handling of cryptographic algorithms (software and engine) to be available via EVP routines for asymmetric and symmetric ciphers. o NCONF: new configuration handling routines. o Change API to use more 'const' modifiers to improve error checking and help optimizers. o Finally remove references to RSAref. o Reworked parts of the BIGNUM code. o Support for new engines: Broadcom ubsec, Accelerated Encryption Processing, IBM 4758. o Extended and corrected OID (object identifier) table. o PRNG: query at more locations for a random device, automatic query for EGD style random sources at several locations. o SSL/TLS: allow optional cipher choice according to server's preference. o SSL/TLS: allow server to explicitly set new session ids. o SSL/TLS: support Kerberos cipher suites (RFC2712). o SSL/TLS: allow more precise control of renegotiations and sessions. o SSL/TLS: add callback to retrieve SSL/TLS messages. o SSL/TLS: add draft AES ciphersuites (disabled unless explicitly requested). -- Lutz Jaenicke jaenicke(a)openssl.org OpenSSL Project http://www.openssl.org/~jaenicke/ --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

Re: PKI: Only Mostly Dead
by lynn.wheeler＠firstdata.com 17 Jun '02

17 Jun '02

I think there is even less "I" than most people suspect. I've recently taken to some manual sampling of SSL domain name server certificates ... and finding certificates that have expired ... but being accepted by several browsers that i've tested with (no complaints or fault indications). there was thread in another forum where I observed that back when originally working on this payment/ecommerce thing for this small client/server startup that had invented these things called SSL & HTTPS ... my wife and I had to go around to various certificate manufactures with regard to some due diligence activity. I think w/o exception that they all made some comment about the "PK" being technical ... and the "I" being service ... and providing "service" is an extremely hard thing to do (and they hadn't anticipated how really hard it is). some past ssl domain name certificate threads: http://www.garlic.com/~lynn/subtopic.html#sslcerts As i've observed previously there are a number of ways that the technical stuff for "PK" can be done w/o it having to equate to (capital) PKI ... some recent threads on this subject: http://www.garlic.com/~lynn/aepay10.htm#31 some certification & authentication landscape summary from recent threads http://www.garlic.com/~lynn/aepay10.htm#32 some certification & authentication landscape summary from recent threads http://www.garlic.com/~lynn/aepay10.htm#34 some certification & authentication landscape summary from recent threads http://www.garlic.com/~lynn/aepay10.htm#35 some certification & authentication landscape summary from recent threads http://www.garlic.com/~lynn/aadsm11.htm#18 IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#19 IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#20 IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#21 IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#22 IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#23 Proxy PKI. Was: IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#24 Proxy PKI. Was: IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#25 Proxy PKI. Was: IBM alternative to PKI? http://www.garlic.com/~lynn/aadsm11.htm#26 Proxy PKI http://www.garlic.com/~lynn/aadsm11.htm#27 Proxy PKI http://www.garlic.com/~lynn/aadsm11.htm#30 Proposal: A replacement for 3D Secure http://www.garlic.com/~lynn/aadsm11.htm#32 ALARMED ... Only Mostly Dead ... RIP PKI http://www.garlic.com/~lynn/aadsm11.htm#33 ALARMED ... Only Mostly Dead ... RIP PKI http://www.garlic.com/~lynn/aadsm11.htm#34 ALARMED ... Only Mostly Dead ... RIP PKI http://www.garlic.com/~lynn/aadsm11.htm#35 ALARMED ... Only Mostly Dead ... RIP PKI .. addenda http://www.garlic.com/~lynn/aadsm11.htm#36 ALARMED ... Only Mostly Dead ... RIP PKI .. addenda II http://www.garlic.com/~lynn/aadsm11.htm#37 ALARMED ... Only Mostly Dead ... RIP PKI http://www.garlic.com/~lynn/aadsm11.htm#38 ALARMED ... Only Mostly Dead ... RIP PKI ... part II http://www.garlic.com/~lynn/aadsm11.htm#39 ALARMED ... Only Mostly Dead ... RIP PKI .. addenda http://www.garlic.com/~lynn/aadsm11.htm#40 ALARMED ... Only Mostly Dead ... RIP PKI ... part II http://www.garlic.com/~lynn/aadsm11.htm#42 ALARMED ... Only Mostly Dead ... RIP PKI ... part III pgut001(a)cs.auckland.ac.nz at 6/1/2002 2:18am wrote: >Peter Gutmann should be declared an international resource. Thankyou Nobody. You should have found the e-gold in your acount by now : -). >Only one little thing mars this picture. PKI IS A TREMENDOUS SUCCESS WHICH IS >USED EVERY DAY BY MILLIONS OF PEOPLE. Of course this is in reference to the >use of public key certificates to secure ecommerce web sites. Every one of >those https connections is secured by an X.509 certificate infrastructure. >That's PKI. "Opinion is divided on the subject" -- Captain Rum, Blackadder, "Potato". The use with SSL is what Anne|Lynn Wheeler refer to as "certificate manufacturing" (marvellous term). You send the CA (and lets face it, that's going to be Verisign) your name and credit card number, and get back a cert. It's just an expensive way of doing authenticated DNS lookups with a ttl of one year. Plenty of PK, precious little I. >The truth is that we are surrounded by globally unique identifiers and we use >them every day. URLs, email addresses, DNS host names, Freenet selection >keys, ICQ numbers, MojoIDs, all of these are globally unique! >"pgut001(a)cs.auckland.ac.nz" is a globally unique name; you can use that >address from anywhere in the world and it will get to the same mailbox. You can play with semantics here and claim the exact opposite. All of the cases you've cited are actually examples of global distinguisher + locally unique name. For example the value 1234567890 taken in isolation could be anything from my ICQ number to my shoe size in kilo-angstroms, but if you view it as the pair { <ICQ domain>, <locally unique number> } then it makes sense (disclaimer: I have no idea whether that's either a valid ICQ number or my shoe size in kilo-angstroms). (This is very much a philosophical issue. Someone on ietf-pkix a year or two back tried to claim that X.500 DNs must be a Good Thing because RFC 822 email address and DNS names and whatnot are hierarchical like DNs and therefore can't be bad. I would suspect that most people view them as just dumb text strings rather than a hierarchically structured set of attributes like a DN. The debate sort of fizzled out when no-one could agree on a particular view). I think the unified view is that what you need for a cert is a global distinguisher and a locally meaningful name, rather than some complex hierarchical thing which tries to be universally meaningful. Frequently the distinguisher is implied (eg with DNS names, email addresses, "for use within XYZ Copy only", etc), and the definition of "local" really means "local to the domain specified in the global distinguisher". I'm not sure whether I can easily fit all that into the paper without getting too philosophical - it was really meant as a guide for users of PKI technology. Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

cypherpunk,FREE 4 Week Sample of HGH !
by Annie Momoh 17 Jun '02

17 Jun '02

1 0

SINCERE ASSISTANCE NEEDED
by MR.MUYIWA IGE 17 Jun '02

17 Jun '02

I regret any initial embarrassment my letter might cause you, as we have not had any correspondence before this time. My name is MUYIWA IGE, the son of the slain Attorney General and Chief Justice of Nigeria, Chief Bola Ige. I got your contact in my search for a reliable and trustworthy partner who l can do business with. I am contacting you in view of the fact that we will be of great assistance to each other. I currently have in my possession the sum of Forty-Five million US Dollars (US$45 million) cash which l intend to invest, specifically in your country although I do not know in which area yet. This money came as a payback contract deal between my Late father and a Russian Firm for a contract executed in the Country's multi-billion dollars Ministry of Justice Complex in Abuja. The Russian Partners returned my father's share of USD$45,000,000.00 after his death and it was lodged in my father's security company of where l am director at the moment. Now after my Dads burial on Friday 11th January 2002 and as the son of late attorney General, the president and commander in chief of the armed forces in Nigeria (Chief Olusegun Obasanjo) has asked me to submit all documents belonging to the Federal Government in my daddy's custody for easy assessment and replacement of the Attorney General. In view of this, l acted fast to withdraw the US$45,000,000.00 from the company's vault and deposited it in another Security Company and marked it as film and film materials. I have declared my father's Security Company bankrupt. There is no record of this money traceable by the Government because no document exists showing that we received the money from the Russians. Due to the current situation in the country, it has become quite impossible for me to make use of this money within. This informs my decision to transfer the money out of the country for investment. Please contact me as a matter of urgency to enable us discuss this transfer in details. You are at liberty to discuss with me what your percentage share of the funds will be. Please reply by above email. Please do treat this as highly confidential while you consider the proposal. I look forward to a mutually beneficial relationship. Best Regards MUYIWA IGE

1 0

[ANNOUNCE] OpenSSL 0.9.1 beta 1 released
by Lutz Jaenicke 17 Jun '02

17 Jun '02

The first beta release of OpenSSL 0.9.7 is now available from the OpenSSL FTP site <URL: ftp://ftp.openssl.org/source/>. Quite a lot of code changed between the 0.9.6 release and the 0.9.7 release, so a series of 3 or 4 beta releases is planned before the final release. To make sure that it will work correctly, please test this version (especially on less common platforms), and report any problems to <openssl-bugs(a)openssl.org>. Application developers that use OpenSSL to provide cryptographic routines or SSL/TLS support are kindly requested to test their software against this new release to make sure that necessary adaptions can be made. Changes between 0.9.6x and 0.9.7 include: o New library section OCSP. o Complete rewrite of ASN1 code. o CRL checking in verify code and openssl utility. o Extension copying in 'ca' utility. o Flexible display options in 'ca' utility. o Provisional support for international characters with UTF8. o Support for external crypto devices ('engine') is no longer a separate distribution. o New elliptic curve library section. o New AES (Rijndael) library section. o Change DES API to clean up the namespace (some applications link also against libdes providing similar functions having the same name). Provide macros for backward compatibility (will be removed in the future). o Unifiy handling of cryptographic algorithms (software and engine) to be available via EVP routines for asymmetric and symmetric ciphers. o NCONF: new configuration handling routines. o Change API to use more 'const' modifiers to improve error checking and help optimizers. o Finally remove references to RSAref. o Reworked parts of the BIGNUM code. o Support for new engines: Broadcom ubsec, Accelerated Encryption Processing, IBM 4758. o PRNG: query at more locations for a random device, automatic query for EGD style random sources at several locations. o SSL/TLS: allow optional cipher choice according to server's preference. o SSL/TLS: allow server to explicitly set new session ids. o SSL/TLS: support Kerberos cipher suites (RFC2712). o SSL/TLS: allow more precise control of renegotiations and sessions. o SSL/TLS: add callback to retrieve SSL/TLS messages. o SSL/TLS: add draft AES ciphersuites (disabled unless explicitly requested). -- Lutz Jaenicke jaenicke(a)openssl.org OpenSSL Project http://www.openssl.org/~jaenicke/ --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 1

Bill of Rights vandalism, supremes don't ride busses
by Major Variola (ret) 17 Jun '02

17 Jun '02

Given this degradation of the Bill of Rights, it would be pretty cool to put stickers on bus seats, or in bus-stops, reminding people --whether citizens or not, and regardless of their albedo-- of their rights. Of course, this would be considered vandalism. Writing the Bill of Rights was treason at the time, of course. http://story.news.yahoo.com/news?tmpl=story&cid=514&ncid=716&e=1&u=/ap/2002… Supreme Court Rules on Bus Searches Mon Jun 17,12:32 PM ET By GINA HOLLAND, Associated Press Writer WASHINGTON (AP) - The Supreme Court ruled Monday that police who want to look for drugs or evidence of other crimes do not have to first inform public transportation passengers of their legal rights. The ruling gives police guidance on how to approach and search passengers, a case with renewed interest as officers seek out possible terrorists on public transportation. The case focused on the difference between police questioning on a bus and in a less confining environment, such as a sidewalk. In both instances, police would need permission or probable cause to search someone, but the justices rejected arguments that passengers, confined to small spaces, might feel coerced to go along. The court ruled 6-3 that officers in Tallahassee, Fla., were within their rights as they questioned and searched two men aboard a Greyhound bus in 1999. Justice Anthony M. Kennedy, writing for the majority, said the passengers did not have to be told that they didn't have to cooperate. The Bush administration invoked the war on terrorism in asking the Supreme Court to get involved in the case, but the court majority did not specifically refer to that argument. Kennedy did note that public transportation riders understand the risks from potential criminals in their midst. "Bus passengers answer officers' questions and otherwise cooperate not because of coercion, but because the passengers know that their participation enhances their own safety and the safety of those around them," Kennedy wrote. Three officers boarded the bus, bound from Fort Lauderdale to Detroit. One officer introduced himself to Christopher Drayton and Clifton Brown, and told them he was looking for illegal drugs and weapons. He asked to pat down the men's baggy clothing. The men agreed, and officers felt hard objects on the men's legs that turned out to be packets of cocaine. "It is beyond question that had this encounter occurred on the street, it would be constitutional. The fact that an encounter takes place on a bus does not on its own transform standard police questioning of citizens into an illegal seizure," Kennedy wrote for the court. On the street, the person being stopped could simply refuse to cooperate and keep walking. Unless police had good reason to pursue the person further, they would be free to go. Drayton and Brown argued that they did not have the same option while seated on the bus. They were convicted and sentenced on drug charges. The 11th U.S. Circuit Court of Appeals ( news - web sites) ruled the cocaine should not have been admitted as evidence, because the officers failed to tell the men they were not required to cooperate. That court said the encounter violated the Constitution's ban on unreasonable searches and seizures. Monday's ruling overturns that decision. In a dissent, Justice David H. Souter said that three officers "pinned-in" passengers on the stopped bus. "The situation is like the one in the alley, with civilians in close quarters unable to move effectively, being told their cooperation is expected," wrote Souter, who was joined by Justices John Paul Stevens ( news - web sites) and Ruth Bader Ginsburg ( news - web sites). He said because of terrorist concerns, airplane passengers know they must submit to searches. "The commonplace precautions of air travel have not, thus far, been justified for ground transportation," Souter wrote. Donna Shea, legal director of the National Organization for the Reform of Marijuana Laws, said police will use the ruling as justification for aggressive questioning. "I think police will continue intimidating passengers," she said. The ruling "gives bus passengers a lesser expectation of privacy. I think that's unconstitutional." The case is United States v. Drayton, 01-631.

1 0

Save Up to 70% on Your Current Term Life Insurance.
by cypherpunks＠Algebra.COM 17 Jun '02

17 Jun '02

Save up to 75% on your Term Life Insurance! Compare rates from top insurance companies around the country In our life and times, it's important to plan for your family's future, while being comfortable financially. Choose the right Life Insurance policy today. Click the link below to compare the lowest rates and save up to 75% COMPARE YOUR COVERAGE http://216.240.140.55/lifequotes/627208/ You'll be able to compare rates and get a free application in less than a minute! *Get your FREE instant quotes... *Compare the lowest prices, then... *Select a company and Apply Online. GET A FREE QUOTE NOW! You can't predict the future, but you can always prepare for it. http://216.240.140.55/lifequotes/627208/

1 0