December 2003 - cypherpunks-legacy

Re: ESP Unix encrypted session protocol software
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:02 AM 1/30/95, Matt Blaze wrote: ....>As for the alternatives, I think the picture is pretty bleak, to tell >the truth. The cryptographically sound way to prevent spoofing is >with authentication of the agreed key. But for the remote host to >authenticate itself, it has to have a secret signature key. Where to >store it? A typical machine, especially a multi-user, unattended server >simply has no safe place to store keys. .... There would be on a secure "multi-user, unattended server". They are not easy to come by and they arn't really Unix. I don't get on my soap box very often but I couldn't resist your execelent opportunity. I think that security requires good crypto and good OS security. There are Orange book rated systems that are rated to run hostile software in the same machine with Top Secret information.

6 6

How the cypherpunks nearly got me fired (long)
by dmandl＠panix.com 17 Dec '03

17 Dec '03

This is a true story. Yesterday, I found out that the mail at the company I work for is being read by SAs on a regular basis. The company is so ignorant about the net, so stingy, and so paranoid, that they're terrified by the possibilities of our internet access (which is crippled: email only, with a misconfigured sendmail, no less; no ftp or telnet; no Usenet). People receiving email from outside could be receiving JPEGs or sound files--all non-business-related, and therefore wasteful of company resources and valuable employee time. This in a biggish and very profitable Wall Street firm. These people are serious dinosaurs. So they installed a pathetic scanning program. Since the evil filetypes are "usually uuencoded," their scanner greps all incoming mail for "^begin"--no kidding--and stops the message right there if it's found. I found this out yesterday when my boss got a call from an SA: turns out he'd been mailed a PostScript file from a vendor (some documentation we were waiting for), and a "begin" statement in the file triggered the alarm. After my boss assured him that it was just a user's manual, the SA let it through. Today, I was sitting in my boss's office in a routine meeting when _his_ boss (let's call him Larry) came by. He said that _his_ boss (this is now my boss's boss's boss--let's call her Mary) wanted to talk to me. I had no clue what she wanted, and neither did my direct boss, which seemed particularly strange. One thought that crossed my mind was that they were going to give me a promotion, which I deserve and which it had been obliquely suggested I might be getting soon. Ha. I walked with Larry over to our other building, four blocks away. We went up to Mary's office, and there she was, sitting with another woman I'd never met. The latter was introduced to me as--oh, let's call her "Paula." There was a printout on the table. Glancing at it out of the corner of my eye, I noticed that it was a piece of email and got a chill. Had they intercepted email from me to a friend telling him how much the company I work for sucks (which, ironically, I'd done just yesterday when I found out about the mail-scanning)? Would these three execs actually call me on this and ask me to explain it? I was very nervous, even though they had a piece of MY PRIVATE CORRESPONDENCE in their hands. Paula started off by explaining to me that they'd just installed this nifty scanning program to catch illicit or potentially dangerous software coming in from the outside. Here was a piece of email, sent to me, containing a uuencoded binary file inside of it (actually, it was just C source code, as the header plainly stated). From the comments at the front of the message, it was clear that this was a piece of software intended to circumvent firewalls, breach network security, and intentionally mask the identity of the culprit. (I'm more or less quoting from memory here; I only got to glance at the comments, so I don't know exactly what the code does; it was posted by Matt Ghio a day or two ago). Why was I having a program like this mailed to me? I explained that it was sent to a mailing list that I subscribe to. The mailing list is concerned with encryption and data security. This is just something that someone on the list happened to post. I have no control over what people post to the list. I read and save what's of interest to me on the list and trash the rest, like everyone else does. Why did I have this message forwarded from my private account to my work account? she wanted to know. Because I have all my mail from that particular ("techie") list forwarded to my work account, the same way that I keep all my other technical documentation at work--my Perl manual, my Unix manuals, etc. She actually pointed out that she saw the word "cyberpunk" on the message (that's right, she can't even read), and this also caused her concern. (I would have been interested in hearing her explanation for that.) She started huffing and puffing about how this all made her very very worried. If there's no way to control this kind of thing, she'll just have to turn everyone's internet access off (or just mine). I said, "Look, I'll turn off the forwarding when I get home tonight and not have any of this stuff forwarded to me here any more." She said, "Yes, naturally." The discussion ended with her asking ME what they can do to assuage their fears and prevent evil programs like this from being sent to employees of the company. I said that there wasn't much they could do; this stuff is freely available, and if it isn't emailed in, people can still bring it in on floppy discs. It also could be mailed un-uuencoded (why was it uuencoded anyway?)--and then what would they do, scan everyone's mail for '{'? What I didn't feel like saying at that particular place and time was that people could just as easily bring sledgehammers in, or trash databases using their legitimate access. Unfortunately, the company has just got to trust its employees. I didn't actually say any of that because I just wanted to get out of there. I was getting bad flashbacks of being sent to the principal's office in third grade. My internet access at work is probably history; maybe everyone else's, too. (Our access is so crippled that there are probably only four people who even get mail from the outside; and as I said, there's no news or ftp/telnet access. I use it for nothing more than reading cypherpunks, actually. The system is so badly maintained that I'd never trust it for personal email.) I now have to start receiving and reading cypherpunk mail at home, which presents a problem because my personal time is very limited, whereas at work mail trickles in during the course of the day and is easily managed. This may mean I have to unsubscribe soon, after two and a half years (almost since day one of the list). I love Big Brother. P.S.: I've tried to avoid injecting my personal politics into this story. Yes, I know that as the owner of the connection, they've got the right to do whatever they want (and this seems to be borne out by the ECPA documents, which at a friend's suggestion I read as soon as I got home--too bad, because I'd have seriously considered legal action). I just thought you might enjoy this little story, and would want to keep it in mind if you're ever considering employment at Bear-Stearns. --Dave. -- Dave Mandl dmandl(a)panix.com

1 0

PGP/crypto XCMDs for hypercard...
by Adam Feuer 17 Dec '03

17 Dec '03

anyone know if there are any PGP or general crypto XCMDs for hypercard? i'm prototyping a front-end to control some premail stuff and some secure WWW server apps, and it would be convenient to have something like this. on related notes, anybody know about XCMDs that talk to MacTCP...? and can someone send me status or a pointer to the PGP library for windows? please reply to me personally; i'll summarize to the list. -adam Adam Feuer adamfast(a)seanet.com 206-628-8813

1 0

Is the remailer crisis over?
by skaplin＠mirage.skypoint.com 17 Dec '03

17 Dec '03

Well folks as of 11:30 on 1-30-94 there are 14 remailers with uptimes greater than 99%. What's the consensus...Is the remailer crisis over? Sam -- ============================================================================== skaplin(a)skypoint.com | Finger skaplin(a)infinity.c2.org for | a listing of crypto related files PGP encrypted mail is accepted and | available on my auto-responder. preferred. | (Yes...the faqs are there!) | E-mail key(a)four11.com for PGP Key or | "...vidi vici veni" - Overheard Finger skaplin(a)mirage.skypoint.com | outside a Roman brothel. ============================================================================== And God said: E = *mv* - Ze*/r ...and there *WAS* light!

4 3

RE: "bad" government
by Richard F. Dutcher 17 Dec '03

17 Dec '03

>> Subject: RE: "bad" government >> From: "Richard F. Dutcher" > >> Do you assume privacy and protection from arbitrary power are solely >> libertarian concerns? If so, educate yourself and check out the ACLU >> and Amnesty International ... > .................................................. > > You can check out each group, each organization, each institution, etc. > one by one, and eventually arrive at the realization that it's a matter > of principle. Anyone can make your life hell, even the "good guys" > who are supposed to know better and whose talents are engaged > supposedly for the support of great ideals. > > "Oh Liberty, what crimes have been committed in your name." > > .. > Blanc > All too true. What's your point? Got a principle that *hasn't* been used/abused? Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ...

1 0

The RSA FAQ on http://www.catalog.com/jamesd/rsafaq.html
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

Chris converted the RSA FAQ to html for easy reading. I have placed this faq on http://www.catalog.com/jamesd/rsafaq.html --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.catalog.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the omnipotent state. | jamesd(a)netcom.com

2 1

commercial authecation
by hkhenson＠cup.portal.com 17 Dec '03

17 Dec '03

Some time ago (perhaps even two years back) I seem to remember discussion here--or in a related area--about a service some former Bell Labs people were offering. It was a time stamp/authentication service which depended in part on publishing of a hash in a paper of record. I now find I have need for this service. Pointers to this service (by email) would be much appreciated. Keith Henson

1 0

Re: AT&T and VLSI Encryption device
by Michael Sattler 17 Dec '03

17 Dec '03

At 07:21 1/31/95, Perry E. Metzger wrote: >"Pat Farrell" says: >> Today's (1/31) Washington Post has a tiny blurb that AT&T and VLSI will >> announce a hardware encryption device for use in lots of >> communications devices, including cell phones, PDAs, etc. > >This is the device I posted a newswire article about a couple of weeks >ago. No details, but it looks cute. How does this device conform with the legislated requirement that it must deliver plaintext to the government upon court-approved demand? -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

2 1

RE: "bad" government
by Blanc Weber 17 Dec '03

17 Dec '03

From: "Richard F. Dutcher" What's your point? Got a principle that *hasn't* been used/abused? .................................................. The original statement I made was in response to Richard Moore, who was wondering out loud why someone else on this list was "on the wrong side"; I remarked in essence that he likewise is seemingly on that side, as cryptography, in its development, is designed to serve the purposes of individuals in disproportion to governmental control over it. I'm not assuming that "privacy and protection from arbitrary power are solely libertarian concerns" either. Yet I don't need to "check out the ACLU and Amnesty International ..." to understand the many possibilities and dangers. My remarks were intended to indicate that it isn't necessary to inspect the varying degrees of comparative corruption or betterment in any of the institutions which these political arguments encourage; if you understand full well the principle involved, or what it is that is "wrong", then it shouldn't be too difficult to see the similar impropriety wherever it becomes manifest. .. Blanc

1 0

Re: "bad" government
by alt＠iquest.net 17 Dec '03

17 Dec '03

> >>From: erc(a)s116.slcslip.indirect.com (Ed Carp [khijol Sysadmin]) > >>Governments as a whole are seen to be "bad" because they invariably undermine >the right of the individual to make choices for themselves. > >Quite untrue. It's society which provides you with an environment in which >you have choices. And its government which orders that society. It's >because government has served you so well, that you have luxury to >fantasize you don't need it. You're being duped. Government does indeed "order society." However, "order" does not equat to liberty, luxury, or to individual freedom. If strong government resulted in liberty and freedom, then the most intrusive, all-encompassing governments would result in its citizens having the most liberty. Is this the case? I would look at the (former) Soviet Union, Iran, Cuba, East Germany, etc., for your answer. Individual liberties do not necessarily result in an "orderly society." In fact, an imposed "order" on society, by definition, must result in limited liberties. Apply this to anonymous remailers, and encrypted personal mail, and you can easily see how the government imposing "order" would result in the end of those activities. ************************************************************ * Just your basic signature block * * * * Al Thompson * * Fidonet 1:231/110 * * alt(a)iquest.net * ************************************************************

2 1

URGENT - MS hack of FFS
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

Could somebody here please give me the reference for the full version of Micali and Shamir's hack of the Fiat-Shamir family of authentication schemes. I need it to make sure that what I've put in the class notes for an IAP course I am teaching is correct. I have the short paper (An improvement of the Fiat-Shamir Identification and Signature Scheme) from Crypto '88 (I think), but I need the full version. If anybody here can get me the reference before the libraries here close tonight, I'd really appreciate it. Thanks, Jason W. Solinsky

1 0

Z-Mail
by jltocher＠CCGATE.HAC.COM 17 Dec '03

17 Dec '03

Can someone please email me with details about obtaining and configuring Z-Mail for use with PGP? Thanks, John John L. Tocher THE CITY-a bounded infinity. A labyrinth where JLTocher(a)ccgate.HAC.com you are never lost. Your private map where every PGP: CE 72 1A 11 07 47 35 block bears exactly the same number. Even if you 35 9A C1 DE EA 64 21 BC 94 lose your way, you cannot go wrong. --Kobo Abe

1 0

Re: AT&T and VLSI Encryption device
by Michael Sattler 17 Dec '03

17 Dec '03

At 09:55 1/31/95, Perry E. Metzger wrote: >Michael Sattler says: >> >> How does this device conform with the legislated requirement that it must >> deliver plaintext to the government upon court-approved demand? > >There is no such requirement. I was under the impression that "the Communications Assistance for Law Enforcement Act requires equipment manufacturers and telecommunications carriers to develop network technologies that are readily wiretapped" (from Garfinkel's book). Doesn't a "hardware encryption device for use in lots of communications devices, including cell phones, PDAs, etc." seem to fall into that category? If it doesn't then I have no idea what CALEA is supposed to do. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | And so these men of Indostan/ disputed long and loud/ each in his own | opinion/ exceeding stiff and strong/ though each was partly right/ and | all were in the wrong! - John Godfrey Saxe |

3 3

Re: Better living through better `procmail'
by Adam Shostack 17 Dec '03

17 Dec '03

In reponse to quite a few people asking, Procmail can be found at ftp.informatik.rwth-aachen.de as pub/packages/procmail/procmail.tar.gz safe-tcl, which some people prefer, is at ftp.ics.uci.edu:mrose/safe-tcl/safe-tcl.tar.Z Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: PFF's Magna Carta and the new netserfs
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Ed Carp wrote: > > Unrestrained economic powers (companies, corporations, whatever) have > > the same property. This seemed to me to be a fundamental point that > > Rishab was making -- and one that is often ignored in discussions of > > economic libertarianism. > > Agreed, but I don't see that that was the point Rishab was making. Oh, well.. It was, actually. "Corporations can be at least as bad as governments" - the examples of extreme circumstances were extraneous. BTW the original analysis of the PFF thing by Richard Moore was posted here on the 25th by him, though he seems to think that I got it from elsewhere and volunteered to post it... ----------------------------------------------------------------------------- For Electric Dreams subscriptions and back issues, send a mail to rishab(a)arbornet.org with 'get help' as the message Subject. Rishab Aiyer Ghosh rishab(a)dxm.ernet.in rishab(a)arbornet.org Vox +91 11 6853410 Voxmail 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

the moderation principle
by rkmoore＠iol.ie 17 Dec '03

17 Dec '03

From: alt(a)iquest.net (Al Thompson) If strong government resulted in liberty and freedom, then the most intrusive, all-encompassing governments would result in its citizens having the most liberty. Is this the case? I would look at the (former) Soviet Union, Iran, Cuba, East Germany, etc., for your answer. In all things, moderation. If I like salt on my steak, that does not mean the most salt is the best. Thinking in fundmentalist extremes severely limits your room for creative problem solving. You don't do that when you discuss cypers -- you don't take rigid sides of "subway" vs "mixmaster", and paint the other side as fools becauase their system would be silly if taken to its extremes. You learn from one another. Be as creative about political possibilities. -rkm _____________________ Richard K Moore > cyber scribe < citizenships: USA ; cyberspace homes: Ireland ; <rkmoore(a)iol.ie> _____________________

1 0

Economist Article on Ecash
by frissell＠panix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The article from the Nov. 26, 1995 of The Economist "So much for the cashless society. (Electronic Money)" is available at: http://www.ios.com/~lroth/clips/emoney.html The WWW disabled can apply to Al Gore for a subsidy or send me an emailed request. DCF -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLy6XVYVO4r4sgSPhAQEJTQP/W9VI76LRPHopmk9eT5FPqpjry9L+PSwM cdbMMCyy4lFWjt+KuS2ca9QCtoxNYT3F7k0RvmI5YwlvbhXYbpiSG999inbZZIv5 vcR3iu5CEGum4yQCW3luWojvlKL8fxsZ6ucnTeAJacxmTlO9uqpg43+2uvzapBBe q5/YsIGB9Dw= =jTuA -----END PGP SIGNATURE-----

1 0

Cypherpunks CD-ROM
by sameer 17 Dec '03

17 Dec '03

I am putting together a CD-ROM covering cryptography, privacy, remailers, etc.. essentially the whole cypherpunk bit. Please send contributions/suggestions/comments/flames to sameer(a)c2.org. Thanks. -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Economist Article on Ecash
by frissell＠panix.com 17 Dec '03

17 Dec '03

NO CARRIER RING CONNECT 14400 NO CARRIER RING CONNECT 9600 NO CARRIER RING CONNECT 9600 ATH NO CARRIER RING CONNECT 9600 NO CARRIER RING CONNECT 14400 NO CARRIER RING CONNECT 14400 t} t}t}t}t}t} NO CARRIER

2 1

Frothing remailers - an immodest proposal
by kevin＠elvis.wicat.com 17 Dec '03

17 Dec '03

It seems to me that the current remailer web suffers a fundamental flaw. It is simply too static. When a remailer disappears, service is disrupted and messages are lost. Humans have to statically route their messages through the web either by hand or using relatively primitive tools such as the chain script (not to belittle the useful work that has been done, but it is by no means idiot proof yet). Basically, the current web of mailers shows nothing of the dynamic nature that has kept the internet alive and has offered us a decent chance at truly anonymous communications, nor is it easy to use to its full potential. Consider a more dynamic web of remailers. I envision remailers that actively advertise their presence on the web so that all active remailers are aware of all other active remailers. This advertising is to have very low latency so that a new mailer can be known to the web within minutes (I will address the implementation of this later). Thus, remailers can constantly be appearing and disappearing without impact on the web as a whole (I refer to this dynamic web of remailers as a "froth"). Imagine also that remailers are allowed to dynamically perform the routing functions that are currently done statically offline (for reasons I will discuss shortly). Now, given all this, what do we gain? First, consider my situation (which is what started me on this line of thinking); my company has a leased 56K internet link. I cannot consume this valuable bandwidth with a remailer during business hours. However, if remailers could pop up and announce their presence to the web, I could run a transient remailer for several hours in the wee hours of the morning when the line use is minimal. Another benefit would be the possibility of remailers with no fixed physical location. A remailer can shift from host machine to host machine daily, as long as there is a decent mechanism to locate it. The use of such transient routers implies allowing dynamic routing. If any given remailer may go down or move at any point, it is impractical to expect users to keep track of which are up at the moment and create static routes in the current manner. The only reasonable solution I have come up with is to allow the remailers themselves to choose routing, given that they have full knowledge of the current state of the froth. This also confers additional benefits. It has been pointed out that most traffic across the web is currently unencrypted. It seems to me that any such message should be fair game. The remailer should be allowed to encrypt the message and pick a pseudo-random path through the web, incorporating transient remailers along the way. This adds greatly to the encrypted traffic on the net, as well as making sure that the transient remailers are used. It even provides some degree of privacy to originally non-encrypted messages. We could of course still allow users to statically route their messages through the web, or allow combinations (I want this message routed through remailers A and B to endpoint C; however, remailers are granted authority to route this message through a maximum of three additional, randomly chosen remailers between each step). This has the added advantage of taking the work of routing messages off the user (unless they really want it). Think about the proposed extension to MixMaster to allow separate parts of a multi-part message to be routed separately, and consider whether you really want to have to do this by hand. I strongly suspect that most messages are currently routed via boilerplate scripts, which has to make the job of traffic analysis much easier for our good friend Eve. By the way, a brief rant on a related topic; people speak of not trusting remailers any further than necessary, while I am clearly suggesting granting more authority and trust to the remailers. This notion of not assigning trust is simply nonsense. When you send a piece of mail to a remailer, encrypted or not, you are assigning complete trust in that remailer to keep you anonymous and not to forward your mail to the NSA immediately. This does lead to a related problem, however; if we allow remailers to pop up at random and join in the froth, how do we know that Deitweiller won't set up a number of black hole remailers that take your mail and throw it away, disrupting the froth, or forward it to nphard(a)nsa.gov? Fortunately, we already have the PGP web of trust model in place and can use it to good effect in this case. Remailers should simply not route mail through any remailer whose public key is not trusted unless explicitly ordered otherwise. This requires remailer operators to cooperate to some extent to validate one another's remailer keys, but does confer the great advantage of portable remailers as mentioned above; if I run a trusted remailer on one machine, I can move it to another machine, and as soon as I advertise the new address and the PGP public key, it is a trusted and useful part of the froth. While we are advertising a PGP key and internet address, we might as well incorporate other useful information. For instance, remailers could advertise their maximum latency. This would allow us to send messages into the froth with the instructions "Keep this message moving for at least one hour and at most three hours and then deliver to endpoint C" and allow remailers to make informed decisions about routing this message (there are some interesting issues in making routing decisions; if we can assign a cost to the link between each pair of remailers, do we want to attempt to optimize the route for least cost? Or stick with random routing to attempt to hinder traffic analysis?). I'm sure that we can come up with other useful information to assist routing decisions (available bandwidth, cost per letter, protocols supported, etc.) Now, the question of implementing remailer advertising. If there is an existing internet protocol for advertising entities with sufficiently low latency, I am not aware of it (my background is in Novell and OS/2, so I'll happily be corrected!) DNS is the closest model to what I want, but is excessively tied up in bureaucracy and has horrific propagation times. Thus, we will have to roll our own. I can think of two reasonable solutions to this problem. The first is a central authority model: there exist well known servers that each remailer has to report into when starting up and shutting down. This model has obvious benefits (ease of use and implementation, minimal bandwidth usage) and obvious drawbacks (a single point of failure, or at best very few, distinctly against the cypherpunk philosophy, requires high-bandwidth, stable servers (read expensive)). The second solution involves a broadcast model; each remailer periodically broadcasts its presence to the entire net (say every T minutes). Any process wanting a full list of all remailers simply has to monitor the broadcast channel for T minutes to get at least a good approximation. The problem here is one of delay (to locate a remailer, I might have to wait T minutes) and bandwidth choking. Obviously, spamming the entire internet with UDP packets advertising remailers would earn us no friends (I'm not even sure that it's technically feasible). What we need is a net of machines to carry the broadcast messages with numerous well known access points. By happy coincidence, there exists just such a network (actually, several of them) that we can subvert for our twisted purposes. It's called IRC. We can create a dedicated channel that carries the remailer broadcast messages (to be honest, I have no real idea how to do this, but one of the wonderHackers out there surely does? otherwise I might actually be forced to read the RFCs (oh horror!)). I doubt that any remailer operator will have trouble finding an IRC host to attach to in order to monitor the broadcasts. This is obviously a stopgap solution, but provides a method for jumpstarting the froth without requiring a froth to advertise the froth. With regard to the bandwidth concerns, I can't imagine that less than a hundred remailers generating <1K messages every few minutes (about ten minutes feels like a good value for T) can bring IRC to its knees. When we get more than a hundred or so remailers up, we'll worry about bandwidth! And to the inherent latency problem of the broadcast model, the easiest solution is to have well known servers cache the advertising information for immediate access. Not too coincidentally, these caching servers look a lot like the central point of authority servers in the first solution. Thus, we can have both the convenience of a central authority model with the dependable broadcast model to fall back on if it becomes necessary. Unsolved problem, by the way: it would obviously be nice to have human-readable names for remailers (the PGP key becomes the true unique identifier, but I'd much rather pick "Soda remailer" from a list than four lines of armored ASCII). How can we guarantee unique names and/or prevent problems resulting from collisions? Obviously, this process hasn't reached more than the pipe-dream stage yet. I am very interested in comments and proposals before I start trying to create some trial implementations. Be gentle, though - it's my first time. -- Kevin

2 1

Re: ESP Unix encrypted session protocol software
by Marc Horowitz 17 Dec '03

17 Dec '03

Matt, why did you choose to implement your own protocol instead of adding a DH authentication/encryption type to telnet? Marc

1 0

Re: ESP Unix encrypted session protocol software
by Matt Blaze 17 Dec '03

17 Dec '03

>Matt, why did you choose to implement your own protocol instead of >adding a DH authentication/encryption type to telnet? > > Marc I've got one of those, too (it won't be ready for release too soon, though - telnet is big and ugly). An encrypting telnet and telnetd almost always provide a more appropriate way to do session encryption. However, there are some situations where ESM is really the only option. One is when you can't or don't want to install a daemon (e.g., for very occasional use). More importantly, by running within the session, ESM can provide end-to-end encryption across an untrusted application-layer firewall (like the one I go through to get between home and work). Since part of my motivation for working on these tools comes from wanting to use them myself, I'm building the stuff I need the most first. -matt

2 1

Re: Frothing remailers - an immodest proposal
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 6:55 PM 01/31/95, Robert Rothenberg wrote: >Without quoting the entire message, I think I better solution, in terms of >ease to implement as well as conserving bandwidth would be to have a >sophisticated remailer script-language. Yeah, this is really an excellent idea, that I don't see happening any time soon. Although of course if anyone wants to write code for such a beast, that would be really excellent. If someone gets around to writing it, it'll happen, but it would be a fairly big project, so I wouldn't hold my break. Safe TCL, anyone?

3 2

Re: Z-Mail
by Chris Claborne 17 Dec '03

17 Dec '03

I would be interested also. How about cc this list... > Can someone please email me with details about obtaining and > configuring Z-Mail for use with PGP? > Thanks, > John > >John L. Tocher THE CITY-a bounded infinity. A labyrinth where >JLTocher(a)ccgate.HAC.com you are never lost. Your private map where every >PGP: CE 72 1A 11 07 47 35 block bears exactly the same number. Even if you >35 9A C1 DE EA 64 21 BC 94 lose your way, you cannot go wrong. --Kobo Abe > > > > > ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

1 0

CD-ROM [brief addition]
by sameer 17 Dec '03

17 Dec '03

I forgot to mention that the CD-ROM in development will be export restricted. It isn't going to be sold outside the united states and canada. -- sameer Voice: 510-841-2014 Network Administrator Pager: 510-321-1014 Community ConneXion: The NEXUS-Berkeley Dialin: 510-549-1383 http://www.c2.org (or login as "guest") sameer(a)c2.org

2 1