December 2003 - cypherpunks-legacy

Re: cool cpunk project proposal: "cpunk approved" logo
by Corey Bridges 17 Dec '03

17 Dec '03

>now, I don't know if people here realize how much great potential this >idea has. the media just LOVES to quote these kinds of judgements when >it's a slow news day (witness Blackwell's "worst dressed" list or >"best haircuts" or whatever else). Well...nothing personal, but I'd rather cut my n*ts off than be the blackwell of the information industry... >:-) And not to poo-poo a nifty idea, but ultimately, I think that any c'punk cooperative effort like that is doomed to failure. Sure, people can manage to get together every month or so for a cypherpunk meeting (well, *I* can't, but I'm even more disorganized than most), but beyond that, things like official c'punk press releases, and official c'punk FAQs, and official c'punk seals of approval are just NOT going to happen and still be called Officially Cypherpunk. It's tough to have an "official" anything for a group that's not REALLY a group--just the name of a mailing list. Now, this doesn't stop Tim from creating his Cyphernomicon, and it doesn't stop other people on this list from issuing their own press releases. Nor should it stop you (and other interested parties) from issuing your seal of approval to worthy products. I just don't think it'll work to call it the Official Cypherpunk S-O-A. Besides, the idea of having an official seal-of-approval sticker sounds like we're only one step away from having Cypherpunk action figures. ("New Eric Hughes figure with crushing logic grip! Detweiler with whirling Tentacles of Doom (tm)!") Uh, I guess I should have put "NOISE" in the subject line... Corey Bridges Security Documentation Netscape Communications Corporation home.netscape.com/people/corey 415-528-2978

3 2

Re: [reply to anonymous] Re: rsaref
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:06 AM 12/29/95 +0100, Alex de Joode <usura(a)utopia.hacktic.nl> wrote: >to whom it may concern: > >rsaref20 is available on ftp.hacktic.nl since may 1995 in > > /pub/replay/pub/crypto/LIBS/rsaref20.zip If the RSA folks want to get picky, this may be violating their copyright, which is enforceable in Europe (unlike their patents.) There's also an RSAEURO clone of RSAREF which is available on ftp.ox.ac.uk/pub/crypto, and presumably at many other fine sites. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, Pager/Voicemail 1-408-787-1281 # # "The price of liberty is eternal vigilance" used to mean us watching # the government, not the other way around....

1 0

Re: Employer Probing Precedents?
by ecarp＠tssun5.dsccc.com 17 Dec '03

17 Dec '03

> From owner-cypherpunks(a)toad.com Wed Dec 27 17:48 CST 1995 > Date: Wed, 27 Dec 1995 16:51:41 -0500 > Subject: Employer Probing Precedents? > To: cypherpunks(a)toad.com > From: "Jason D. Livingood/WSC"@hks.net > X-Server-Version: Cactus-Serv 1.5 > > -----BEGIN PGP SIGNED MESSAGE----- > > To Whom It May Concern: > > I was curious as to where I might find some electronic freedom legal > precedents. If, for example, an employer was planning to probe file systems on > PCs in the off-hours and employees began encrypting their hard drives, what > legal precedents would support the employees or would support the employer in > blocking the encryption? Try www.eff.org. I have a partition on my HD that is routinely encrypted. When asked about it, my response was that I was acting to protect company confidential material and company assets.

1 0

Re: Employer Probing Precedents?
by tcmay＠got.net 17 Dec '03

17 Dec '03

(I've purged the four accumulated names off the cc: list. I urge other to do the same, as the headers are getting clogged up, and people are often getting two copies.) At 10:59 PM 12/28/95, Mike McNally wrote: >Another vaguely-related concept is that of tenants' rights to a degree >of security in rental property. Actually, tenants have nearly absolute rights of privacy. Landlords cannot enter the premises whenever they wish, conduct bed checks, sniff for marijuana, etc. However, landlords are also not held liable (in most cases) for the illegal acts of tenants. (Obvious exceptions include recent developments with "crack house" laws, or where the tenants are using a house as a base of operations, such as shooting from windows...and even then the landlord's responsibility is to cooperate with law enforcement: he is not liable for the shootings, nor for anything else that he could not have reasonably known about or controlled.) Ditto for hotel owners. I wrote a long essay for the Cyberia list using these examples as jumping off points for a view of law in cyberspace. Basically, that ISPs be treated as hotel owners. Not liable for the misdeeds of customers in the "rooms" (in realspace hotels, or in cyberspace). However, corporations aren't given the luxury of disassociating themselves from the actions of their employees. (Contract workers are a further issue, and the issue of whether they supply their own tools/computers, workspace, etc., enters in.) I maintain that my employees are beholden to me as to what they run on their computers. They can always choose not to work for me. (And the same applies to hotels, actually. Were a hotel to have stringent rules on in-room behavior, such as the YMCAs and religious retreat hotels have, then customers have little right to complain about bed checks, mixed sex bans, etc. That most hotels have no such rules says more about where the Schelling points are than it does about the efficacy of rules and laws. >Though the ownership==control equation works sometimes, and is >appealing to reason, I don't think things are always so simple. Nor do I think things are always simple. But it pays to think about proposed laws from a perspective of maximizing personal choice. (The choice of the owner of a hotel, or computer, or car, to establish the basis for trading use of his property for other considerations.) --Tim May We got computers, we're tapping phone lines. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: blind validation
by Hal 17 Dec '03

17 Dec '03

Those are very interesting thoughts Alex Strasheim posted about blind validations. The issue of people handing out copies of their validations ("credentials" is the term Chaum uses) can be significant. Chaum's way around it was basically to have some mechanism to give each person a unique number of some special form. There doesn't have to be any agency who knows what number each person has (in fact, there isn't, in his scheme), but there is a mechanism to assure that one person does not get two numbers. This is sometimes loosely referred to as an "is-a-person" credential (although in this specific context it is not actually a credential, just an identifier). One way to achieve the goal would be to make each person give a thumbprint, or some other biometric identification, in exchange for giving them the is-a-person credential. Another way would be to use conventional ID, making sure their credential is blinded. Then, the blind validations are mathematically structured to be linked to the identity number. Only someone who has a specific identity number can show a specific blind validation. The idea here is that this addresses the copying-validation problem because a person would not only have to give away the specific validation, but also his identity number. This would in effect let the other person masquerade as the first, and any bad things he did would come back to hurt the person who gave away the data. You can't just walk away as in a totally uncontrolled blind signature system because of the linked nature of the credentials, and because you only get one identity number. So the result in effect is to make it difficult to give away just a validation, without also giving away the ability to act as you. Here is an idea about another way to achieve the same thing, closer to Alex's example: Alice gets a blind validation as Alex describes based on a simple blind signature. (Alice hands a blinded number to Bob, he signs it, Alice unblinds it, and uses the resulting signed number as the validation to, say, access Bob's files.) We add that Alice puts, say, $100 into "escrow", encrypting it with the secret number and putting it on some public server. She proves to Bob that she has done this using cut and choose. Now if Alice gives away her secret number, anyone using it will be able to access Bob's files, but they can also get the $100. So now it costs something for Alice to give away her secret. (There are some major problems with this idea, the worst being that Alice can extract and spend the $100 right after proving to Bob that she is doing what she said, and before publishing her number. Maybe someone could think of some fixes.) Hal

2 1

Re: Employer Probing Precedents?
by ecarp＠tssun5.dsccc.com 17 Dec '03

17 Dec '03

> From owner-cypherpunks(a)toad.com Wed Dec 27 17:48 CST 1995 > Date: Wed, 27 Dec 1995 16:51:41 -0500 > Subject: Employer Probing Precedents? > To: cypherpunks(a)toad.com > From: "Jason D. Livingood/WSC"@hks.net > X-Server-Version: Cactus-Serv 1.5 > > -----BEGIN PGP SIGNED MESSAGE----- > > To Whom It May Concern: > > I was curious as to where I might find some electronic freedom legal > precedents. If, for example, an employer was planning to probe file systems on > PCs in the off-hours and employees began encrypting their hard drives, what > legal precedents would support the employees or would support the employer in > blocking the encryption? Try www.eff.org. I have a partition on my HD that is routinely encrypted. When asked about it, my response was that I was acting to protect company confidential material and company assets.

1 0

A weakness in PGP signatures, and a suggested solution (long)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've been engaged in a lively debate with a few members of the cypherpunks mailing list about forgeries that are hard to repudiate even if PGP signatures are used. One of the participants suggested that I post a summary to alt.privacy.pgp and sci.crypt, which is just what I'm doing. (My apologies to the mail.cypherpunks readers who already saw much of this once.) I'll illustrate the problem with several scenarios of forgeries. (It's funny that earlier today I was showing a friend how easy it is to post forgeries. She seemed suitably impressed. :) Scenario 1: Bob once sent Carol an e-mail that looked like this: ----------------------------------------------------------------------- From: Bob@boxb To: Carol@boxc Date: 25 Dec 1965 Subject: Carol, we're history Message-ID: <111@boxb> ----BEGIN PGP SIGNED MESSAGE---- I no longer wish to go out with you. Merry Christmas! ----BEGIN PGP SIGNATURE---- Version 2.6.2 12341234... ----END PGP SIGNATURE---- ----------------------------------------------------------------------- Carol can forge an e-mail to Alice that looks like this: ----------------------------------------------------------------------- From: Bob@boxb To: Alice@boxa Date: 25 Dec 1995 Subject: Alice, we're history Message-ID: <222@bobb> ----BEGIN PGP SIGNED MESSAGE---- I no longer wish to go out with you. Merry Christmas! ----BEGIN PGP SIGNATURE---- Version 2.6.2 12341234... ----END PGP SIGNATURE---- ----------------------------------------------------------------------- We assume that it's easy for Carol to forge the RFC 822 headers to make it look like the e-mail came from Bob. That's why many of us use digital signatures. The signed portion of Bob's original e-mail did not state that the message is addressed to Carol (e.g., "Dear Carol"). Alice will probably verify that the signature matches Bob's private key and assume that the e-mail is authentic and has been sent to her by Bob. To repudiate the e-mail, Bob might have to point out that the "Received:" headers differ from his usual e-mails, without relying on PGP. In fact, the presense of his verifiable signature would create more of a presumption of authenticity of Alice's part. Scenario 2: Bob sends the same e-mail as above to Carol. David, a rogue sysadmin, gets a copy of the e-mail, forges the same e-mail as above to Alice. Scenario 3: Bob sends a signed e-mail to Alice. Alice sees it in her newsfeed, forges a Usenet article, makes it look like it came from Bob, and includes the body of Bob's e-mail as the body of the Usenet forgery. Usenet forgeries are easy. Again, if the signed text happens to be suitable, then Bob will have difficulty repudiating the forgery. He won't not be able to use the PGP signature, which will in fact verify. Hopefully, he'll be able to point out that the RFC 1036 Path: header is different from his usual header (which may not be the case). Many Usenet readers would be unconvinced and Bob's reputation would be damaged. Scenario 4: Bob posts a signed Usenet article to alt.sex. Alice forges a usenet article in Bob's name to misc.kids, recycilng the signed body, which would probably be considered inappropriate for misc.kids. Same result as #3. Scenario 5: Bob posts a signed Usenet article to some innocuous newsgroup. Alice reposts the same body in a forgery in Bob's name. The forgery can be cross-posted to numerous "inappropriate" newsgroups ("velveeta"), or multi-posted ("spam"). Certain rogue self-apponited net.cops forge cancels for all copies of Bob's article, including the original. (They are a bigger menace than the forgers :) (As several people know, I have been a victim of some of the above-described kinds of forgeries.) I think the underlying problem is that the way PGP signatures are used by most people, they validate a text, but allow it to be quoted out of context in an e-mail or Usenet forgery. I suggest to the kind folks working on PGP 3 that there should be a standard protocol to include within the signed portion the information on when and for whom this text is written: i.e. the list of e-mail recipients and/or Usenet newsgroups, which could be easily compared with the RFC 822/1036 headers of an e-mail/Usenet article. Perhaps there could be a new option for PGP to look _outside_ the signed block and match the headers with what's inside the block. For example, suppose the signature block says: this text was written by alice(a)zog.org, posted to alt.sex and alt.sex.banal and e-mailed to bob(a)masons.com. Suppose PGP is asked to check the signature in a file that purports to be a e-mail or a Usenet article and has some headers before the signed portion. If there is a list of To: recipients, and it includes someone other than the recipients listed within the signed block; or if there is a Newsgroups: header, and it includes newsgroups not listed within the signed portion; then the input is bogus. For compatibility with the existing software, if the signed block doesn't include this info, then this checking should't be done, of course. After I posted the above suggestion to cypherpunks, one very respected member of that list informed me that "the security multiparts standard (RFC 1848) includes a provision for signing the headers as well as the body of a message. The security multiparts can be used with PGP, and there is even an Internet Draft for it (draft-elkins-pem-pgp-02.txt), but there is not yet consensus for adopting this as a standard on the pgp-mime mailing list." I hope my examples will convince some that present practice of signing pieces of text which can be quoted out of context in a forgery is just not enough. We need to have an easy way to sign the headers without resorting to mine. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

5 5

Ecash graphic images?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Could anyone provide some pointers to a gif or jpeg file containing good-looking ecash coins? I would like something larger and more detailed than the "we accept ecash" you see everywhere. Thanks very much.

1 0

Re: Compuserve is Not "Censoring": Look to Governments for the Cause
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:17 AM 12/29/95, Bill Humphries wrote: [much good stuff, with which I agree, elided] >Support your local ISP. This simple line is very, very important! Consider two extremes: * Extreme 1--Internet access via Compuserve, AOL, or other organizations striving for a "global presence." Every country these organizations does business in puts pressure on them to control content, supply names of contacts, etc. Singapore bans 200 newsgroups, Iraq executes the local sysops, the U.S. jails the corporate executives for allowing "alt.barney.die.die.die" to corrupt the morals of young people. * Extreme 2--"Individuals on the Net directly." Joe User has a box on the Net. Albania is powerless to hassle him. France cannot seize his computer. (If he's in Country A, that country may harass him, but if he connects to accomodation addresses in other countries, even this is lessened or avoided completely.) Small ISPs are closer to Extreme 2, as they have no presence in Albania, Iran, France, Chad, or other states desiring to control content. For small U.S. ISPs, their main worry is what the U.S. government will say they must do. Small, local ISPs may of course be more prone to other kinds of pressure. But it is my experience that small services are less likely to adopt speech codes and other draconian behavioral laws than are larger and "more responsible" (:-}) services. Jay Campbell, one of the sysops at my ISP, "got.net," may want to give his perspective, if he sees this. I see a positive longterm trend toward people connecting through smaller, more local services. Hard to enforce Albania's laws on 20,000 small Internet connection services. Even longer term, the anarchy of the Net will reach its true flowering when millions of users are directly connected. How ya gonna keep em down when they're directly on the Net? --Tim May We got computers, we're tapping phone lines. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Proxy/Representation?
by David E. Smith 17 Dec '03

17 Dec '03

At 05:07 PM 12/28/95 GMT, lull(a)acm.org wrote: >> The question is: how do the current software packages handle representatives >> and proxies for a given is-a-person? Using PGP as an example, I can't sign >> a message with Helen's key. And a message signed with my key won't hold >> as much weight because "Dave" is not "Helen." And if every message I send >> on behalf of Helen has to be followed up by a message from Helen stating >> "yes, Dave may act on my behalf for this instance" then much of the point >> of the proxy process is lost. (i.e. the reduction of Helen's workload etc.) >I would think a power-of-attorney, signed by Helen, would do the >trick. This would normally be valid for some pre-defined period, for >a pre-defined set of transactions, and would not have to be generated >anew each time. That's basically the situation in the wonderful world of paper. What I'm interested in is how to handle the power-of-attorney case in the world of bits. (I've been using PGP as my example, but I'm certainly open to software that handles it better; suggestions?) Even if Helen signs my PGP key, that doesn't do anything other than connect us in the almighty Web of Trust (for whatever that's really worth). dave ----- David E. Smith, c/o Southeast Missouri State University 1210 Towers South, Cape Girardeau MO USA 63701-4745, +1(573)339-3814 PGP ID 0x92732139, homepage http://www.midwest.net/scribers/dsmith/ Dec15-Jan15: (618)244-3340/2209 Perkins, Mt Vernon IL 62864

1 0

Strategic Investments ....
by mjsus＠atlanta.com 17 Dec '03

17 Dec '03

This can be some interesting ..... **************************************************************************** ********** GLOBAL STRATEGIC SYSTEMS NEWSLETTER December, 1995 Strategic Management Investments, Asset Allocation, Evaluation and Review Strategic Management System (SMS) investments are long-term investments and total ROIs of these investments can only be evaluated after several years from the initial decisions and activities. However, this does not mean that the organization can not evaluate many specific elements and short-term projects of the whole SMS project separately and obtain some good feedback and information about the short-term performance within one year or sooner. The implementation of an overall SMS can be divided into small development projects such as back-up system, customer complaint processing, environmental communication and employee recruiting system development. Specific Return on Investment and other financial and cost objectives can be established for these projects, and they can be evaluated and monitored on a quarterly and/or annual basis. However, the main strategic objective, the aim of the SMS, can only be achieved, when all elements of the SMS have been implemented, integrated and operated effectively. To justify, specific investment decisions, both short-term and long-term financial indicators can be used, which can satisfy many passive investor's requirements to commit to the long-term investments. Depending on the field of technology and business complexity, the organization can spend up to 30 % of its annual revenue in the strategic investments including system development and any new technology R&D activities. In some cases, costs can be higher. What is the portion of this amount that is invested in the development of the SMS? With some rough information, it was possible to calculate that about 25 % of the total annual strategic investment was spent in one ISO 9000 quality system development. This 25 % was invested in organizational capability, improved quality assurance and additional equipment, manpower and machine acquisitions. Using the above estimation, the management estimated that it had invested up to 7.5 % of its annual revenue in the strategic management system development activities. The major portion of this investment can be used in tactical, short-term development projects such as returned goods processing and test and equipment control, where the investment performance data can be obtained faster; and the rest of the SMS investment can be used for project/program management and coordination, organizational restructuring, responsibility and authority definition, document and data control and any other supporting system development activities, the financial monitoring can be more difficult. The major cost categories in the SMS development projects are: 1. development, implementation and training time (manpower excluding external training, consulting and assessment activities), 2. equipment and machine acquisitions, 3. materials such as office supplies and 4. external project activities. Investments in the development of any SMS can be either tactical or strategic. The financial performance of the tactical investments is very often much easier to evaluate than the evaluation of the long-term investments that may not have specific and measurable investment objectives and/or the accounting information to evaluate the performance against any specific objectives which can be difficult to obtain. It is possible to develop specific budgets for each element of the SMS development project and identify the sources of development benefits and cost reductions that can be used for evaluating the financial performance of each project. The financial performance (including the maintenance of development budgets and the achievement of investment performance ratios such as Return on Investment and Investment Payback Period) can be reviewed and evaluated on a quarterly and annual basis. Any consolidated investments in the whole Strategic Management System development and the SMS development progress can be reviewed in the annual Strategic Planning activities by the top management in the same way as any specific tactical investments can be reviewed and analyzed in the departmental level to identify any problem areas, any potential problems and to determine and initiate necessary corrective and/or preventive actions to achieve or maintain all financial performance objectives and targets. The organization should manage its investments in the SMSs such as ISO 9000, ISO 14000 or Information Security Systems as it manages all its capital expenditures or any investments in financial instruments such as stocks and bonds. These investments have to be controlled, managed, reviewed and improved upon on an on-going basis by the managerial level. Each element of the SMS development can have its own budget and budget responsibility. The organization may establish its own unique accounting system for each SMS development project including specific cost and expenses categories, and identifying specific sources of financial benefit information that can be used to calculate financial ratios. Any over spending or other negative financial performance issues can be brought to the attention in the management reviews, which may lead to the initiation of necessary corrective and preventive actions. It is easy to overspend and waste financial resources such as the waste of manpower without adequate accounting, record keeping and monitoring systems and methods. The utilization of actual financial performance measures helps the organization also to see actual financial benefits from the strategic investments and to justify additional SMS development activities. However, we still have the question: "How much should the organization invest in any specific SMS to satisfy its future business requirements?"

2 1

FW: your financial transactions posting (fwd)
by Light Ray 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 29 Dec 1995 00:02:50 -0800 From: Bud Aaron <bud(a)checkmaster.com> To: "'privacy(a)ftc.gov'" <privacy(a)ftc.gov> Cc: "'hwg-business(a)daft.com'" <hwg-business(a)daft.com> Subject: FW: your financial transactions posting ---------- From: Greg Metcalfe[SMTP:biosphere@proaxis.com] Sent: Thursday, December 28, 1995 9:35 PM To: bud(a)checkmaster.com Subject: your financial transactions posting Bud, I've seen some well thought out messages in the commercial transactions listserver, but you are the first that I've seen with real numbers. Would you do us all a favor and make sure that you get some of this information to the privacy(a)ftc.gov discussion? I hope I'm not impertinent for asking. But numbers are probably our only hope. The gov has never really been into quantitative thinking... TIA --- Greg Metcalfe | The secret is getting E-mail biosphere(a)proaxis.com | enough sleep. URL http://www.proaxis.com/~biosphere | Usually. The following is a copy of the information mentioned above: The following article is quoted directly from Bank Technology News "Are Internet Security Fears Unfounded? Just how safe is the Internet? Pretty darn safe, according to Forrester Research, Inc., Cambridge, MA. Forrester predicts Internet fraud will occur far less frequently than current rates of fraud with cellular telephones, toll calls and credit cards (see chart). Cellular telephone fraud costs the phone industry almost $20 per $1000 in revenue, Forrester says, and toll-call fraud eats up $16 per $1000 in revenue. Meanwhile, credit-card fraud cost MasterCard almost $1.50 per $1000 in revenue in 1993. In contrast, Forrester says companies can expect to lose only $1 per $1000 of transactions on the Internet. Forrester's contentions on the safety of the Internet are backed up by some of the judges in this year's Best of the Newest bank technology survey. While many of the judges expressed concern over security issues, quite a few were also confident that the Internet will become a stalwart transaction system. See page one for further analysis of all the newest banking technologies." The chart accompanying this article shows the fraud levels in graphic form. You folks keep making drafts as a collection system seem more and more attractive. The fact that drafts MUST be deposited (not just cashed) and that the bank is going to want to know the depositor quite well means that tracking is excellent. The requirement added by the FTC that those whose accounts are being drafted must be notified by mail makes the system even safer. Let me add this - some level of security is obviously needed but regardless of the level of security, fraud will occur. All of these arguments for high levels of security remind me of the need for virus protection. Yes, virus attacks are real but virus protection vendors certainly make money by raising greater fear than may be realistic. Bud Aaron bud(a)checkmaster.com http://www.checkmaster.com/internetchecks/ The privacy list is run automatically by the Majordomo list manager. Please mail questions/problems to owner-privacy(a)ftc.gov

1 0

Revocation of Zimmermann's fossil key
by Philip Zimmermann 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To whom it may concern: I have revoked my oldest PGP key, keyID FF67F70B, user ID "Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu>" which should no longer be used. Instead, use my newer key, keyID C7A966DD, with user ID "Philip R. Zimmermann <prz(a)acm.org>" The new key has been distributed with all PGP versions since version 2.3a in 1994. My old email address at the sage site will soon disappear, so I'm revoking my old key. I keep getting mail at my old address at sage because people get that old address from my old key. I can't just revoke my old userID, so I have to revoke the whole key to get people to stop using it. Below is my revocation certificate, which I created shortly after I generated my new key in 1994. Please discontinue the use of my old key and my old email address. Note that this revocation does not imply that my old key has been compromised. -Philip Zimmermann prz(a)acm.org Here's my old public key with the revocation certificate... - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAipt8iwAAAEEALGKgLblEQCfcZEiQ+jBFnw5g0B+o16GMPssYBKI7bWgjGbB DqnkQoMGagNJpcG5tX2bKpJdegi01Sp22QOMpZbdrv/KXRWHp/JjrNLAZHp9B+nl osbRrPLhGZZA/OgyU6D2GsGnMDcTacPD43wo1g+RUpDv+UjMr+J13g7/Z/cLAAUR iQCVAgUgLIUrAOJ13g7/Z/cLAQHThQP+NtEJ2yPCXPA+Em45HDWQLwb3X0AM61K0 Mt0Woq54eaC1U5A03oVqV5wEPM6mfrhH18FB6NwO5eROKOdXY1xz7nCggJ9eYfoX ZH6wfXCqGFSB4oLJU97nFHrqvh69IYSrrlKM/dJ29F5CKVxJApstpnRmfHddrZLP yfR2y6dxGeW0LFBoaWxpcCBSLiBaaW1tZXJtYW5uIDxwcnpAc2FnZS5jZ2QudWNh ci5lZHU+ =9UCt - -----END PGP PUBLIC KEY BLOCK----- Here's my new public key, generated in May 1994... - -----BEGIN PGP PUBLIC KEY BLOCK----- mQCNAiv8ZoAAAAEEAKc4d45hN5qFM79nWGLkrGWputWmtdxJk0BZEbi0kNRbJBC2 p10ASImd//cCDwLR2alBUSt8O2WGik9PBZgthjMOenoDmzKiG8BkE9AFKonyxvD2 lDnqbydXi+YQmOTsWSw4jTTSb3cflhVkf8hVUVpMFQThafV0CmV5hLjHqWbdAAUR tCJQaGlsaXAgUi4gWmltbWVybWFubiA8cHJ6QGFjbS5vcmc+iQCVAgUQLB48XPTK AIGN5yLZAQHWtwP/RBiLPN4dnt8sm9qZtK0HPYV0hfdZ4IiSfR0V52uKKMQsIrBJ x2c5Z2vurBLeKkh8Oecf/X+Zh2mEenrymR/urBCf8xGQnyTPew4t/3IQ5KXsqi2b uOTysk9Pkk+cqxZTEXJQWixB3fVKrCkR02xbWcRXQ/pPs0ObOE4VLtQT1G2JAGAC BRAsHUvayj2h/YZap/MBAcRRAliFU3EgFQdOGkC2nCupBAitm/R6CkKtayTZHQrd e5I/pCY0bGUc6alEnSuqZUyA9HC1fMg0iqsqM4vrQ6PZr2qV0IXDY4miyYNRJyKJ AJUCBRAr/GdG4nXeDv9n9wsBAYr/BACh4r3DZsq9IOy2mcd+0D0qKV0Ymb887Lw0 KjIBKLmUIqXUw2Rbn8bAnr+GF0qGE61oAHdSSN7pLROmfjl7nMVaODXHOxYuLHAn HZ0Z/AQsLc5U055Pm6rQ5lKrSaL4z9mEKJTWM9hQDYMZpH4oAC8hIz+apYH+/hBj ZR9w7AKluw== =1jM9 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOOo+WV5hLjHqWbdAQHhaQP/SW02cLbkAtHq6cdNHtcJ4YqSlKqxumyR BYpjKrNatLiVAFQP8njiLRFqPi8rgf6809nnQETIVcyt3BzURakyJLd4UuL3vvqD lluyGdj9MoaQiQkWIbBMADFdNGFDvRCQkcxhS78hHwXSY7viCSWNnfCdJcpaFNCk QPfqPsMErMo= =uH7K -----END PGP SIGNATURE-----

1 0

Re: Employer Probing Precedents?
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:12 PM 12/28/95 -0800, Tim May wrote: >However, corporations aren't given the luxury of disassociating themselves >from the actions of their employees. (Contract workers are a further issue, >and the issue of whether they supply their own tools/computers, workspace, >etc., enters in.) I think this point about "contract workers" is going to become a lot more interesting as people move away from the traditional "employee for life" model and towards working at home/telecommunity, or working as subcontractors/consultants, etc. Further, it's becoming more common for employees to own their own communcations tools, and bring them to work. Arguments about a right to eavesdrop as being derived from workplace property ownership don't seem to work where an employee is talking on their personal cell phone, getting/sending messages on the SkyTel two-way pager that they pay for, using their laptop/Newton/PDA to get/send E-mail (using their private ISP/POPmail provider mailbox), and so forth. The concerns (about disclosure of secrets or wasting of time) raised to justify the invasions of employee privacy are still present, of course, but not the convenient "it's not your phone so you have no privacy" excuse. Employee/contractor ownership of work tools (or non-work related communication tools in the workplace) is probably going to get even more interesting; recent Ninth Circuit decisions re copyright law and licensing agreements have been sharply restricting the right of software licensees to allow third parties to use the licensed software. (e.g., _MAI v. Peak_ and _Triad Systems_, see http://darkwing.uoregon.edu/~gbroiles/triad for more on this and pointers to other analysis and the opinions themselves) I think this may lead to software licenses (or hardware ownership) which follows employees from home to work, and from job to job. Employees may get a credential from Microsoft, or Borland, or Mathematica or Word Perfect saying that they're allowed to be using a set of software tools; professionals will probably pay for those credentials themselves, or have them paid for as a fringe benefit of employment. An easy connection is to training related to the "software-right" - the licensor would also certify that the employee has been subjected to X hours of training and knows at least Y buzzwords and Z fancy tricks relating to the software. Retired or unemployed workers may work in a "black market", using software they're trained on but not licensed/certified for, logging on with the credentials of licensed users who have died recently or are sleeping. (Similar to the network of unlicensed uninsured under-the-table contractors, framers, electricians, drywall installers, etc., who exist at the fringes of construction activity.) And so on. >I maintain that my employees are beholden to me as to what they run on >their computers. They can always choose not to work for me. (And the same >applies to hotels, actually. Were a hotel to have stringent rules on >in-room behavior, such as the YMCAs and religious retreat hotels have, then >customers have little right to complain about bed checks, mixed sex bans, >etc. That most hotels have no such rules says more about where the >Schelling points are than it does about the efficacy of rules and laws. Subscribers to the Coase theorem would suggest that (modulo transaction costs) it doesn't matter who is initially assigned the right to determine whether or not surveillance will occur - the party who most values that right will bargain for it in the end. Then again, that party may lose something in exchange - and that's what makes this interesting. (And, I think, much too complex to simply be dismissed as a matter of "property rights". Then again, property looks to me like something that law creates, not something which exists pre-law which law is created to protect. YMMV.) I'd rather see the right to control surveillance assigned to employees, and let employers pay extra for it if they think it's necessary to their business situation. (Some might argue that this is the current situation, or at least that surveillance is something that market participants bargain over. My impression is that the current situation is legally murky absent a clear statement re "we're going to monitor you on the phone and search your briefcase when you enter and leave" and that a clear resolution re the legal baseline of surveillance would be useful to bargainers. And if we were to set a baseline for further bargaining, I'd rather see it set to favor employees.) -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

ideath remailer permanently down / PGP key changes for Greg Broiles
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't think that the local freenet folks are ever going to get my domain name again, so I'm officially announcing the closing of the remailer formerly located "remailer(a)ideath.goldenbear.com". Mail to the goldenbear.com domain has been bou for almost three weeks now, and I expect that to continue. Sorry for any inconve I predict about a year of erratic net access and moving around while I finish la school, take the bar exam(s), and find a job or get a business started. When eve settles down I plan to find a reliable net connection and run a remailer again. Due to the loss of my domain name and UUCP connectivity, other changes are happe I'm now using a Windows box, not a Unix box, for my net access; have switched to for DOS and Private Idaho (nice job, Joel!). Am also using a new PGP key, since my old one (0x58ddf30d) was almost 3 years ol updated the MIT PGP keyserver with an "obsolete" marker for the old key, as well new key (signed by my old key). The new key is appended to this message. Am using a new long-term E-mail address, "gbroiles(a)netbox.com". Re my discussion weeks ago of alternatives for mail storage/forwarding, I have settled on netbox. can receive mail as "gbroiles(a)darkwing.uoregon.edu" but I expect that address to working sometime this coming May. The netbox.com address will ideally keep worki years to come. - -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud | -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMOPafv37pMWUJFlhAQGnhAf/XrHe38eww+sMf0/mmqKFzT9xX9USCCBO 5yMteRAmAsEiiTo8TPcRPlB6eKqCrCiJJqDMfxm3UaWhhqBilRhQoB8BqdCvjTLY 87/HsHKV3Iv4IPvud+ojk9GEXwUf204U9m/CgVF17HKO+XTCK5GVN7gmsqWWxsLr a5gNccpentcFiy0KJVUWfLguOXA20I+nGnkZjMBK/RAPotBg4gezE2jqjbYyQ1rC y0SLX843ufEfRaePC1X8IyWH32gqiyrW5rZuTo8B2usbR96Y2VXXX6Oprrd5CD38 AuUhjkOXVEsCFVP5bt6uQbM81Uhvxc1mFYHYKKJyuWPWo5E6tBwXZA== =Heo3 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAy8+sdEAAAEH/2YvMvdRxoxAIpNp1W88EGq4EMOVhpucjGjZByoJATpDoU+x sqZl6lwzWh7yhHbLfuUZhWZVhLlLGxOAcHkZ3o6Tao+T/qCLKUnyFtw3Q/Wpzfiw YIGbXkbKvSaI7U3PTMHraimiZNAW/QAhIuLanVEkl/rko/aIdvyIfOJSFHW9Bjml ArZmyrsT8PiA+Eiqa+JyRv/JnWiJJ00FYHhG1GkcAvBovQJxxLzqq9PcB8nVlVfS t4aV2z1OfmjXHq4pgUye6CwdjzXnMz3e70FT1erkoP+/iC56iSkb/4J67y8NnKgq RNQ8lt+X2+vnq3Fa8r8EhhqZFZcV/fukxZQkWWEABRG0IkdyZWcgQnJvaWxlcyA8 Z2Jyb2lsZXNAbmV0Ym94LmNvbT60KUdyZWcgQnJvaWxlcyA8Z3JlZ0BpZGVhdGgu Z29sZGVuYmVhci5jb20+iQCVAwUQLz8tYn3YhjZY3fMNAQGOkwP/cYeYdbTj9H0C BVI9nw70avUIGYUWT1HdQaK6YqdOvV4Eg56rpKdFEFlwUdOBg8MbuFaLMbbAnKxH EvGsQBtu0N1kyIebMAuEniT/22yVlVGHHS+uGxyBKq1i7Nv5uRXl2WSdQDUCHN0W 9YAzReRI1F6ExnVXJHuHo4EY7lQ3P94= =yJO8 -----END PGP PUBLIC KEY BLOCK-----

1 0

practical annoyances from multi-level security?
by Simon Spero 17 Dec '03

17 Dec '03

Does anybody have any pet peeves and gripes about using systems with a compartmentalised security model- things that took ages to do even though they didn't really impact security, features that just got in the way or were too complicated to really use, etc? I'm currently working on a problem that seems to have some analogies to the compartmentalised problem, running code with various levels of trust were deliberate read-up and accidental write-down could be a breach. I've personally never used a system of this sort, but I've heard from friends in the RAF doing COM/SEC (more COM than SEC) that MLS can be a real pain at times. [for the truly paranoid, the RAF operates a network of communication satellites called Skynet :-)] Simon p.s. still no luck on the Hackers soundtrack - I did recognise a few prodigy tracks though (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

CAV_ein
by John Young 17 Dec '03

17 Dec '03

12-29-95. NYPaper: John Markoff page-ones Compuserve's cave-in to Reich sex law and the alt free-screeching for sex home censorship cave-in to rutting parents ashamed. CAV_ein

1 0

Re: ideath remailer permanently down / PGP key changes for Greg Broiles
by Greg Broiles 17 Dec '03

17 Dec '03

Doh, the wordwrap on that message was ugly. Sorry. Gotta spend some more time making friends with Private Idaho. Short version: remailer(a)ideath.goldenbear.com is gone forever, sorry. All mail to anything @goldenbear.com is bouncing. Mail for me should be sent to "gbroiles(a)netbox.com", effective immediately. I have distributed a new PGP key to the keyservers and marked my old key obsolete. I will be signing list messages again once I get that wordwrap thing fixed. -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Chinese Cypherpunk quote [NOISE]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I see that some rants here are rubbing off on the folks who write chinese fortune cookies, In tonites dinner, The cookie said: The will of the people is the best law. I wonder if we can get a couple thousand cookies sent to Congress with that message? A.E.N. or to T.C.M..... Xmas_Troll

1 0

Netscape 40-bit cracking. The new computing benchmark?
by Weld Pond 17 Dec '03

17 Dec '03

>From Infoworld Dec 25, 1995 page 3. Netscape Commerce Server Security Broken Integrated Computing Engines Inc. (ICE), in Cambridge, Mass. announced it has cracked the 40-bit DES [huh? not RC4] encryption in the Netscape Commerce Server. Unlike a similar security break-in [talk about bad terminology] by a French university student last August, which required eight days, 120 workstations, and two supercomputers, ICE said it used a computer that cost $83,000 and compromised the Wold Wide Web server's security in 7.7 days. [Hey, what about the Cypherpunks crack that only took 31.8 hours?] Netscape Communications Corp. officials were not surprised by the security crack. "We've known that 40-bit encryption is breakable since we shipped the server. That's the reason it's allowed to be exported," said company spokeswoman Rosanne Siino. "We need to keep lobbying to get rid of the U.S. governments 40-bit restriction on what can be exported." Within the United States, Netscape sells products with 128-bit encryption. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

3 2

Re: Compuserve is Not "Censoring": Look to Governments for the Cause
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 28, 1995 23:30:19, 'tcmay(a)got.net (Timothy C. May)' wrote: > >I see a positive longterm trend toward people connecting through smaller, >more local services. > Quite correct. Not only does the internet radically change (at least perceptions) of space and time, it also is producing serious disequilibriums of scale in economics. Economy of scale states that until a farily high limit is reached, bigger enterprises tend to produce goods that are less expensive than those produced by smaller enterprises. Specialized handicraft production aside, the goods produced in larger enterprises also tend to be of higher quality. The disequilibrium here began with the development of the microprocessor as we see from the shift to the old centralized IBM iron to the microcomputers we're using today. Ditto certain aspects of network switching. Ditto DES moved from centralized hardware to decentralized software. We're seeing a growing dystopian world where national entities and non-governmental organizations all seek to enforce their particular cultural/political/economic/etc. biases on the global internet. I believe this process will continue for some period of time. At the same time we may (and I think likely will) see aspects of the net broken down into widely geographically separated locations that simultaneously have no more effect on end users than the floor at the central library on which the book we want resides. E.G. we'll use Denmark to get "alt.sex.granny.gum-jobs," ftp to Singapore for "/warez/microsoft/win99/hack/" and to the Turcos Islands for "data.finance.internal.morgan." We'll have all three open and on our monitor at the same time, passed through an second-level ISP in some small country that decides there's money in switching and will no more regulate data throughput than they would try to hold hotel keepers responsible for the content of the phone calls made by their tenants. --tallpaul

1 0

Re: Compuserve is Not "Censoring"
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

This is a resend of a reply to Tim May's message on the CI$/Bundsweiser Republic/alt.nekkid.hitler.youth controversy. The Cypherpunks mailer didn't enjoy my attempts at humor in the headers... ------------ Tim May wrote: >At 4:52 PM 12/28/95, Cees de Groot wrote, speaking of Compuserve's recent >dropping of many newsgroups in response to demands by German prosecutors: > >>I won't start to comment on the style of this message. The term "Suitspeak" >>comes to mind. > >Perhaps it is "Suitspeak," but it is not "censorship." > >Or, more precisely, it is fear that government laws will be used to >sanction the service. Thus, it is the government of Germany in this case >which is "censoring." ("Censor" and "censorship" are notoriously overloaded >terms, of course.) It's a political problem. This demonstates the basic problem with tollerating monopolies in this industry. When governments interfere, everyone subscribing loses, which means most of the people in the audience for the service loses. Unfortunately, there are no technological fixes (in the short term) for monopolies. The shumpeterian cycle is too long for the time horizons engendered by the German government's actions or the Exon/Gorton/Hyde language. You have to fight monopolies on the political arena as well as the technical (remember how the WWW was going to liberate all of us on it's own? Until the elites recognized people wouldn't be watching Microsoft ads *conspiratorial wink*.) If I were a compuserve user, complain to your nearest German consulate and call your congresscritter. Those GOP types will have a field day condeming "euro-data-imperialism" during special order speeches on C-SPAN. Support your local ISP. Bill Humphries PS: If only the Germans worried about Nazis during the Nurmemberg trials the way they worry now, maybe they wouldn't be facing their current plauge of nativist/skinhead problems.

1 0

(fwd) DigiCash licencing?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Organization: Digiturg Date: Fri, 29 Dec 1995 17:32:10 +0200 (EET) From: Jyri Kaljundi <jk(a)digit.ee> To: ecash(a)digicash.com Subject: DigiCash licencing Mime-Version: 1.0 Sender: owner-ecash(a)digicash.com Precedence: bulk Reply-To: ecash(a)digicash.com Does anyone know about the terms and costs of licencing ecash software? I have tried contacting DigiCash directly with these questions, but have got no answers :( And who and where are already implemeting ecash? Mark Twain Bank and Swedish post are two I know of, what about the others? Our company is very interested in using ecash here in Estonia, but somehow DigiCash does not seem to allow that. With all the best, Juri Kaljundi, managing director, DigiMarket jk(a)digit.ee --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Ecash graphic images?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:58 12/28/95, anonymous-remailer(a)shell.portal.com wrote: >Could anyone provide some pointers to a gif or jpeg file containing >good-looking ecash coins? I would like something larger and more >detailed than the "we accept ecash" you see everywhere. Thanks very >much. Try http://www.delorie.com/gif/signs/ -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: HRB Systems Data Storage Encryptor
by Peter Trei 17 Dec '03

17 Dec '03

James A. Donald wrote: > At 09:45 AM 12/26/95 +0100, Anonymous wrote: > >Check out http://www.hrb.com/encryption/ssp.html, your > >exclusive source of the Ultron Crypto-Engine (tm) > > The web page proudly announces: > "is the only NSA-approved Type I data encryptor available today." > > There are probably some people ignorant enough to regard that as > a recommendation. >James A. Donald What's the problem? If you're a contractor or agency looking to store classified data, the NSA approval is essential. There's no pretence in the ad that the NSA can't read it. It says: "NSA provides necessary keying material for SSP3110 operation." and "It is available to U.S. Government agencies, military organizations, and defense contractors." This is not a snake oil product ala "Power One Time Pad" (sic). It's a real system, approved for use with classified data. I strongly doubt that there are any known holes (with the NSA supplying the key material, why should there be?) Speaking for myself, Peter Trei trei(a)process.com

1 0