December 2003 - cypherpunks-legacy

PGP 5.5 and the corporate environment
by Roger J Jones 17 Dec '03

17 Dec '03

Just a small aside. Our help desk handles about 50 to 75 "I forgot my password" requests per day. This might be one small motivating factor why corporations desire an alternative method to recover encrypted files.

1 0

Unlocking crypto-secrets Wired article -- request for help
by Declan McCullagh 17 Dec '03

17 Dec '03

I'm working on a Netizen article for Wired Magazine on secret crypto-briefings and thought I'd ask the list for help. You know the briefings I'm talking about -- classified sessions where the FBI director, the Commerce Dept, NSA, and occasionally anti-drug officials pressure Congressmen to place restrictions on encryption. Sometimes it works, and our elected representatives vote to put strict limits on encryption technologies. (The secret briefings certainly seemed to work on the House Commerce committee.) I'd like to unlock those closed doors. If anyone has insights into what happens during these sessions, I'd be very interested in learning more. Pointers to open sources would be great. I will keep your identity confidential. I'd also be interested in learning more about the secret briefing practices of other countries. Please feel free to recirculate this message. I've attached my PGP key below. Please use it sparingly; I keep my private key on a non-networked machine and it's laborious to move data back and forth. If you want to send a tip through an anonymous remailer, a web-based one is at: http://www.replay.com/remailer/anon_no_ssl.html Thanks, Declan ****************** http://www.well.com/user/declan/.pgpkey PGP Key fingerprint = F4 0A 36 1F 7F B1 4B CB 5C 38 2C 13 FE 1E 4D 80 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzF5mVcAAAEEALKyL4tjF7t4h+hmbY+q0b0FdSZy3dx8LuUwkTmAY6Ib/YX7 WhZR22+T1Tts/JaC7iAhr/zfxI9IrHqT1C7NV/aqdEVAuI+pjYKpcRKOU7i0ccAx db/jddUvzX4bjqKQQLLcOihcle6BD2+7vEXxaaMOA5nTU5i/Sn7vt7V2BpKxAAUT tCJEZWNsYW4gTWNDdWxsYWdoIDxkZWNsYW5Ad2VsbC5jb20+iQCVAwUQMXmajn7v t7V2BpKxAQG6NAP/RUEBrnFfR6vbIdoAeyt2jXsuPPcH944mnyp4fNLH3OEzQlj6 tXee9eYaqazUgkLNCyWXDDGQJxsok58hqIEOHoTgilAcomMW3mIoqN7uMIevyvmo NH170+a6drNwY4kNXNUsDDx6qfgQz5wTxaVyxbZuyslX1k3kDID8vPSyxbs= =dofB -----END PGP PUBLIC KEY BLOCK----- ******************

1 0

Re: Bill Gates, the Bully Savior
by Paul Spirito 17 Dec '03

17 Dec '03

At 01:34 PM 10/22/97 -0700, Declan McCullagh wrote: >Or it's like buying a Ford Mustang that comes with brown carpets. Auto >manufacturers "bundle" lots of things with their cars... Where's the DoJ >when we need them?!? Not sure where I stand on this. An OS is more like a highway than a car. Or, better, a rail track -- since it imposes severe compatibility requirements on those who want to utilize it. Imagine that someone owned the rail track standard & had the exclusive IP-rights to manufacture it. Non-standard tracks exist, but they don't go nearly as many places. Then the company uses its position as owner of the tracks to demand... Oh screw it. I don't feel like going down analogy road any further. Detail is the enemy of ideology, & the significant detail re: Microsoft is the rare & happy (for Bill Gates) character of its business that it is more important to have a standard OS than to have a quality OS. Therein lies his billions, & it seems to me reasonable to scrutinize attempts to parlay that counter-ordinary-market reality into dominance in other areas. Perhaps this could be settled as the online service spat was: bundle Netscape with Win98 (& Opera, Arachne &c). Or perhaps the US could nationalize Windows. Whoo-hoo! Therein lies a Plan... Paul Her name was Julie, she wore Batman sneakers, And she laughed when she sang, "Money can't buy me love!" North of Petaluma where the 1 meets the 101 -- Oh man, we took a lot of drugs...

1 0

Laws recognizing digital signatures
by Vincent Cate 17 Dec '03

17 Dec '03

I have talked to people in government and the offshore private sector here and think Anguilla has a very good chance of passing a law making digital signatures legally recognized, at least for corporations. I think we would be the first taxhaven to do so. Currently companies use corporate seals. I mentioned that there were a few other jurisdictions that had passed some laws like this and they would like me to try to pin down which and, if possible, get copies of the laws. I remember some talk about this on cypherpunks, so I am hoping someone here can tell me which places (think there was some state) have such laws, and if possible tell me where I can get a copy. Thanks, -- Vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vincent Cate Offshore Information Services Vince(a)Offshore.com.ai http://www.offshore.com.ai/ Anguilla, BWI http://www.offshore.com.ai/vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

Re: PGP, Inc.--What were they thinking?
by Anonymous 17 Dec '03

17 Dec '03

>Agreed. What amazes me is how PGP, Inc. would decide this should be a core >part of their company. "PGP for Business," indeed. What were they thinking? Um, maybe that they wanted to stay in business?

3 2

Federal Key Recovery Demonstration Project ?!
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: 20 Oct 1997 14:29:39 -0400 From: Mark Atwood <zot(a)ampersand.com> (by way of rah(a)shipwright.com (rah-news)) To: rah(a)shipwright.com Subject: Federal Key Recovery Demonstration Project ?! Mime-Version: 1.0 Path: thing1.leftbank.com!thing2.leftbank.com!cam-news-feed2.bbnplanet.com!cam-news-hu b1.bbnplanet.com!cam-news-feed5.bbnplanet.com!news.bbnplanet.com!ftp.ampersand.c om!not-for-mail Newsgroups: talk.politics.crypto Organization: Ampersand, Inc. Lines: 62 NNTP-Posting-Host: colon.ampersand.com X-Newsreader: Gnus v5.2.40/Emacs 19.31 Xref: thing1.leftbank.com talk.politics.crypto:23766 X-Newsreader: Yet Another NewsWatcher 2.3.0 -----BEGIN PGP SIGNED MESSAGE----- Just saw the fallowing ad on pg 42 of Federal Computer Week, Vol 11, Num 33, Oct 20, 1997. If I was closer, I would go, just to see what the "enemy" has to demonstrate. ================================================== The Government Information Technology Services Board Federal Key Recovery Demonstration Project invites you to attend A TECHNOLOGY CONFERENCE Wednesday, November 15, 1997, Omni Shoreham Hotel, Washington DC 7.30 a. m. - 8: 00 a. m. Conference with exhibit demonstrations following from 8:00 a.m. - 5:30p.m. For details, visit out Web site: http://gits-sec.treas.gov or contact Lisa McGrady Pellegrin at (202) 293-3835 or Terry Painter at (202) 986-0200 Registration fee: $100.00 (includes breakfast, lunch) To register, please call and mail check by October 24, 1997 payable to: McPell Communications Company 1140 Connecticut Avenue, N.W. Suit 606, Washington, D.C. 20036 ================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBNEui9jecHWvdAD3dAQF2uAP+OJMD/t7wFl1YiHqS+P/Dor0D5lDXOk6S 0b4fkVqeBih/gRwM0UYOxqlpxh7uyHjXyQQIsaLRUtMD3f+Rg3vPkBHubGwPq513 98upODawMD5znT/xUT5TZHeWWxlnisBrmcH308jG1zLYh4Ls1qJat75n2ldj+HWI RhdMsNvIn/Y= =VJyz -----END PGP SIGNATURE----- -- Mark Atwood | Thank you gentlemen, you are everything we have come to zot(a)ampersand.com | expect from years of government training. -- MIB Zed --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

[rc5] The unknown message is...
by David McNett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It is a great privilege and we are excited to announce that at 13:25 GMT on 19-Oct-1997, we found the correct solution for RSA Labs RC5- 32/12/7 56-bit secret-key challenge. Confirmed by RSA Labs, the key 0x532B744CC20999 presented us with the plaintext message for which we have been searching these past 250 days. The unknown message is: Its time to move to a longer key length In undeniably the largest distributed-computing effort ever, the Bovine RC5 Cooperative (http://www.distributed.net/) under the leadership of distributed.net, managed to evaluate 47% of the keyspace, or 34 quadrillion keys, before finding the winning key. At the close of this contest our 4000 active teams were processing over 7 billion keys each second at an aggregate computing power equivalent to more than 26 thousand Pentium 200s or over 11 thousand PowerPC 604e/200s. Over the course of the project, we received block submissions from over 500 thousand unique IP addresses. The winning key was found by Peter Stuer <peter(a)dinf.vub.ac.be> with an Intel Pentium Pro 200 running Windows NT Workstation, working for the STARLab Bovine Team coordinated by Jo Hermans <Jo.Hermans(a)vub.ac.be> and centered in the Computer Science Department (DINF) of the Vrije Universiteit (VUB) in Brussels, Belgium. (http://dinf.vub.ac.be/bovine.html/) Jos only comments were that "$1000 will buy a lot of beer" and that he wished that the solution had been found by a Macintosh, the platform that represented the largest portion of his teams cracking power. Congratulations Peter and Jo! Of the US$10000 prize from RSA Labs, they will receive US$1000 and plan to host an unforgettable party in celebration of our collective victory. If youre anywhere near Brussels, you might want to find out when the party will be held. US$8000, of course, is being donated to Project Gutenberg (http://www.promo.net/pg/) to assist them in their continuing efforts in converting literature into electronic format for the public use. The remaining US$1000 is being retained by distributed.net to assist in funding future projects. Equally important are the thanks, accolades, and congratulations due to all who participated and contributed to the Bovine RC5-56 Effort! The thousands of teams and tens of thousands of individuals who have diligently tested key after key are the reason we are so successful. The thrill of finding the key more than compensates for the sleep, food, and free time that weve sacrificed! Special thanks go to all the coders and developers, especially Tim Charron, who has graciously given his time and expertise since the earliest days of the Bovine effort. Thanks to all the coordinators and keyserver operators: Chris Chiapusio, Paul Chvostek, Peter Denitto, Peter Doubt, Mishari Muqbil, Steve Sether, and Chris Yarnell. Thanks to Andrew Meggs, Roderick Mann, and Kevyn Shortell for showing us the true power of the Macintosh and the strength of its users. Wed also like to thank Dave Avery for attempting to bridge the gap between Bovine and the other RC5 efforts. Once again, a heartfelt clap on the back goes out to all of us who have run the client. Celebrations are in order. Id like to invite any and all to join us on the EFNet IRC network channel #rc5 for celebrations as we regroup and set our sights on the next task. Now that weve proven the limitations of a 56-bit key length, lets go one further and demonstrate the power of distributed computing! We are, all of us, the future of computing. Join the excitement as the world is forced to take notice of the power weve harnessed. Moo and a good hearty laugh. Adam L. Beberg - Client design and overall visionary Jeff Lawson - keymaster/server network design and morale booster David McNett - stats development and general busybody -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNE5sy7N5xKXkPF/DEQLBMwCfadBDxP97DhosT7ILs9vdYRha9nIAnRCl ydiRYhdAplj25nDSZNbXYILS =4dNQ -----END PGP SIGNATURE----- -/\/ugget ________________________________________________________________________ |David McNett |To ensure privacy and data integrity this message has| |nugget(a)slacker.com|been encrypted using dual rounds of ROT-13 encryption| |Birmingham, AL USA|Please encrypt all important correspondence with PGP!| ---- To unsubscribe, send email to majordomo(a)llamas.net with 'unsubscribe rc5' in the body.

4 4

World-wide GAK
by Jeffrey Gold 17 Dec '03

17 Dec '03

For those who thought GAK was merely a local political issue, isolated to those barbarians in the USA, one that they could afford to ignore and morally refuse to address -- Quelle surprise! It's spreading: FRANCE PROPOSES KEY ENCRYPTION LAW The French government has proposed a law that would mandate a key-recovery system for all encrypted electronic documents, a move that is opposed by the business community and the European Commission. Earlier this month, the European Commission rejected the key-recovery approach to encryption, which some believe would make it easier for competitors to gain access to a company's business secrets. "I do not say this is the best system," says the chief of France's Central Service for the Security of Information Systems. "It is the least bad in trying to find a balance between national-security interests, economic interests and the protection of personal privacy." (Wall Street Journal 20 Oct 97)

3 2

Re: PGP, Inc.--What were they thinking?
by spencer_ante＠webmagazine.com 17 Dec '03

17 Dec '03

With all due respect to Tim May: As a person whose been at work on a very long feature about PGP Inc. for Wired, I can tell you that businesses really don't care that much about PGP's civil liberties advocacy. In fact, its rep could hurt as much as help them. The Fortune 500 is much more pragmatic: They want solutions that work, that help them maintain security for their intellectual property and capital. To that extent, PGP 5.5--which enables IS directors to manage a public key infrastructure and enforce company-wide security policies-- is a step in the right direction. But with this new product, I agree that they run the risk of alienating their core user group of cypherpunks and hackers. Encryption is a very complicated topic that doesn't lend itself well to sloganeering and histrionics. And one major thing that needs to be pointed out: PGP's key recovery system is *voluntary and private*--not mandatory and gov. controlled, which is what the Feds and Louis Freeh have been pushing for. One potential positive side effect of PGP 5.5 is that it could realign the crypto debate and force people to consider this question: Whose back door should netizens be more worried about: Big Brother or The Boss? Spencer E. Ante Associate Editor THE WEB Magazine To: cypherpunks(a)toad.com, fight-censorship(a)vorlon.mit.edu cc: (bcc: Spencer Ante/PCWORLD) Subject: Re: PGP, Inc.--What were they thinking? At 1:45 PM -0700 10/22/97, Anonymous wrote: >>Agreed. What amazes me is how PGP, Inc. would decide this should be a core >>part of their company. "PGP for Business," indeed. What were they thinking? > >Um, maybe that they wanted to stay in business? This is a truism, that businesses want to stay in business. (And thrive, etc.) The interesting question is whether this action will help them. Why it may not is what we're talking about. For example, if PGP loses its "little guy fighting the system" image, and the company is seen as a major supplier of snoopware and GMR systems, it will have squandered the good will which led many of us to support PGP. And it's by no means clear that corporations will pay enough for PGP for Business if this good will has been squandered. The free status of most versions of PGP is indeed an impediment to PGP making a profit. That's an unchangeable situation. Lots of copies of PGP are already out there, and lots more are available from many sites. The "commercial use" vs. "personal use" dichotomy is largely unenforceable. If Joe Employee uses PGP 2.6 or even 5.0 for his messages, PGP, Inc. will have a very hard time proving in court that Joe or his employer can be held liable for this use (at most, maybe Joe will have to pay $50 or so...and probably not even that, as PGP 5.0 is not serialized (so far as I can find) and records aren't kept...Joe can just claim he did in fact buy it, blah blah). This means PGP, Inc. faces a Netscape-like battle in finding revenue sources. Will they succeed? Will people like us continue to give PGP, Inc. the good will it has enjoyed? Stay tuned. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 10

SSZ - ISDN repairs today...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, As most of you are aware SSZ has been experiencing a great deal of ISDN stability issues the last 4-6 weeks (since the move to the new location). To date we have been through a cable throw from one trunk line to another which involved switching CO's. Since that throw we have seen intermittent outages lasting from a minute or so up to 15 minutes (perhaps longer but I didn't see them since logging is not always turned on). Well I get up this morning and find the ISDN exhibiting the exact same sort of intermittetent outages from last weekend, except now they ain't so intermittent. Seems the cool weather and light rain have exacerbated the issue such that we are in a nearly continous connect-disconnect cycle. We are still passing packets with no loss, beit slowly. I called SWBT and they are sending a installer out to put the line on another distinct pair as well as putting in a repeater to boost the pair-gain. Expect there to be intermittent outages of an hour or more today. If the fixes work we should be rock-solid again. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Freeh-style Encryption needed to fight infowar threat
by Tim May 17 Dec '03

17 Dec '03

I just saw the principle author of the recently released report of the "Commission on Critical Infrastructure Protection," interviewed on CNBC, a business program. Robert Marsh called for increased use of encyption to proect the nation's computer networks against hackers and crackers and info-terrorists. The catch? It's the FBI proposal he wants to see adopted. Personally, I think this issue, and Marsh in particular, are sleep-inducers to most people, so I don't see this as a driving force for GAK the way a building being blown up, or a child porn ring, will be. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^2,976,221 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

A5
by klockstone＠cix.compulink.co.uk 17 Dec '03

17 Dec '03

The A5 code in the back of Schneier's 'Applied Cryptography' seems to have some errors in it - has anybody else had a serious play with it? Keith.

1 0

Re: puff pieces vs tough crypto issues (Re: Singapore TOILET ALERT)
by Ariel Glenn 17 Dec '03

17 Dec '03

Kent Crispin writes: >They could wave around TIS's products (designed by noted cypherpunk >Carl Ellison, I believe), or NorTel's Entrust, just as well. Hell, in >a few months they may be able to wave around Adam Backs CDR product, >which also facilitates GAK...[deleted] sure, but PGP has a certain name recognition that appears to extend beyond the computing business community; ask your average cs student what PGP is and they'll have heard of it *and* its reputation. Ask them about Entrust and see if you get the same result. (I could do that here with my managers as a demo. :-) Now figure out what your representatives in Congress know: even less. So, PGP gets cited by Congress as an example, and the other corporations building in GAK or who have signed on to get that good export license for DES don't. Ariel Glenn ariel(a)columbia.edu

1 0

Re: PGP, Inc.--What were they thinking?
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

I should point out before starting that I now work for Verisign. This following personal opinion however and may not reflect any corporate policy that may or may not exist. I can understand the pressures on PGP to support key escrow. When I designed the Shen trust system for the Web I allowed for an escrow facility for much the same reasons that have been cited. If it was not for the unrelenting pressure from the US government to support GAK I am sure that commercial escrow would be a checkbox item. The problem is that as long as the pressure is there any step towards commercial escrow is also a step towards GAK. The problem with PGP's move is that it is the first significant break by the Internet software provider community. This will make it much easier for Netscape or Microsoft to cave in. It will also build the pressure on them. I wonder what would happen to Bills problem with the DoJ if he had a sudden change of heart. Somehow I don't see Netscape and Microsoft holding the line on GAK if PGP are happily exporting their product and grabbing market share. I really did not expect Phil Zimmerman to be the first to blink. I also don't understand it from the corporate perspective. PGP may be picking up some business in the corporate market but at the cost of alienating a significant part of the hacker community which has been his best supporter up till now. I would think his best strategy would have been to build on this customer base rather than sell it out at the first opportunity. If Phil Z. wants to get into the Enterprise market he is going to have to start speaking their language. Most companies today are looking for open standards. PGP may have been the de facto security solution three years ago but the reality today is several million copies of Comminicator and Explorer with S/MIME built in. If you are prepared to load certs manually for each person you communicate with you can even use the Web of trust model with S/MIME. Its easier if you can rely on a CA. I probably don't have to remind many people on this list that few people make security a priority although they are prepared to do so if it has little impact on them personally. I really don't want to get into a standards flamewar, the point I'm making is that this is a bigger issue in the Enterprise market than key escrow at this point. Phil claims to have an RSA license, if he wants to go after the enterprise market he can support S/MIME. Phill

4 3

Use crypto, face a death squad
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

There have been various rumours and comments over the past few years that the use of crypto in certain countries (Syria, Iraq, possibly China) is very dangerous for the end user, but very little actual evidence to substantiate this. About a week ago I got some evidence (well, something better than the usual rumours) on the situation with using crypto in Iraq which people might find interesting. I was talking to someone who worked for a large multinational corporation which maintains a comprehensive directory of who to contact in each country they operate in (basically every country on earth, this was before the gulf war so Iraq was included) for any kind of emergency. This consists of a huge file of data intended to cover every imaginable type of situation. Included in the information on Iraq was a comment to the effect that you should never, ever use any form of encryption when sending messages to the contact people there. He can't remember the exact details any more, but the implication was that any encrypted messages sent to them would result in them quietly disappearing. Since this was a very big company with a lot of sensitive information which it would go to great lengths to protect, I would assume they had very good reasons for advising against the use of crypto in this instance. Peter.

4 3

Re: PGP, Inc.--What were they thinking? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 22 Oct 1997 19:57:59 -0600 > From: TruthMonger <tm(a)dev.null> > Subject: Re: PGP, Inc.--What were they thinking? > *Starts* eavesdropping? Where you been, Bubba? > When a Company has the 'right' to wiretap you, search you, and make > you piss in a jar, as well as having their own armed forces monitoring > you and patrolling your workplace, the main difference between them > and the government is that the corporation usually doesn't pretend > to allow you to vote. This is plain and simple bullshit. There are a variety of differences between a government and what they can do by general charter in a democracy and a company which operates on specific contracts. > TruthMonger ParanoiaMonger is more like it. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Trip to SF/Bay Area around November 24, cypherpunk meeting?
by Declan McCullagh 17 Dec '03

17 Dec '03

I'm thinking of spending a few days in the Bay Area in about a month, maybe the week of Thanksgiving. My S.O., a cypherpunkish Net and telecommunications lawyer here in DC, seems likely to join me. I'd love to come to a Bay Area cypherpunk meeting if there are any then, and spend some time with folks out there. Any plans to have one around Nov 24-27? This is more of a pleasure than a business trip, though I'll write an article if there are any interesting developments on the crypto-front. (Any suggestions on places to stay?) -Declan

1 0

Proof IE4 not an OS, was Re: Bill Gates, the Bully Savior
by James Love 17 Dec '03

17 Dec '03

Nifty comment by Michael McMain on JavaLobbyCafe(a)iceworld.org list: -------------------------- A friend at work made an interesting point about MS's claim that IE4 is simply an OS extension and not an application. All the DA has to do is turn on a Power Mac, start IE4, turn to MS and say "So what other parts of your OS run on the Macintosh exactly?".

1 0

DC cypherpunks party on Sunday, November 2
by Declan McCullagh 17 Dec '03

17 Dec '03

A DC cypherpunk working meeting and party is tentatively scheduled for Sunday, November 2. The party is open to all, including non-cypherpunks and even (especially?) NSA spooks. (I somehow got suckered into organizing this portion.) Folks who showed up to my party and the cypherpunk meeting before it last month remember that Marc Rotenberg and his wife at that time volunteered to host the next one. Their home is near the National Cathedral in NW Washington, DC. About a 20 minute walk from the Woodley Park Metro, lots of parking. Special guests likely will include Peter Neumann and Simon Davies. Details forthcoming. -Declan

1 0

(Fwd from f-c) Note from PGP employee on MRK
by Declan McCullagh 17 Dec '03

17 Dec '03

>X-POP3-Rcpt: declan(a)relay.pathfinder.com >Subject: Re: PGP, Inc.--What were they thinking? >Date: Wed, 22 Oct 97 20:38:14 -0400 >x-sender: Jamie-McCarthy.org(a)mm.mailbank.com >From: Jamie McCarthy <jamie(a)mccarthy.org> >To: <fight-censorship(a)vorlon.mit.edu> >cc: "Jason Bobier" <jason(a)pgp.com> >Mime-Version: 1.0 >Sender: owner-fight-censorship(a)vorlon.mit.edu >X-Loop: fight-censorship(a)vorlon.mit.edu >X-FC-URL: Fight-Censorship is at http://www.eff.org/~declan/fc/ >X-FC-URL: To join send "subscribe" to fight-censorship-request(a)vorlon.mit.edu > >A friend of mine by the name of Jason Bobier <jason(a)pgp.com> happens >to work at PGP, Inc. I'll preface his comments by pointing out that >I'm sure he doesn't speak for the company in any way. > >> Unfortunately these people just don't get it. Corporations refused >> to buy 5.0 because it did not have any way for the corps to get at >> email encrypted to their employees. There are some very legitimate >> uses of this, such as when an employee dies and someone else has >> to take over for them. >> >> Without corps buying the product, there is no PGP, Inc., and thus >> no dedication of resources to the production of PGP. This leads us >> back to the floundering state of development that PGP was in >> before 5.0. >> >> They also don't seem to realize that you always have the ability >> to remove the MRK from your list of recipients. >> >> Sometimes I really feel like screaming at these people. _All_ of >> the developers at PGP are personal privacy zealots and no one >> likes the idea of the MRK. That is why we refuse to make them >> required. It is also why there still are freeware and personal >> versions of the product. I wish they would just realize that we >> aren't some evil group of people that are solely plotting how to >> make the most money off of this. Most everyone at PGP has >> internalized personal privacy as a cause (actually most had it >> before they joined PGP). >> >> *sigh* OK, enough ranting. Feel free to quote various parts of >> this if you feel like responding to the list. >> >> Jason > > >-- > Jamie McCarthy new email => jamie(a)mccarthy.org > homepage: http://www.absence.prismatix.com/jamie/ > fan of: http://www.nizkor.org/ >

3 2

Very important ! global minutes?
by newsglob＠tnlb.com 17 Dec '03

17 Dec '03

MAKE SURE YOU ARE GETTING ALL THE MINUTES BEING GENERATED TO YOUR NUMBERS NOT JUST U.S. TRAFFIC!! CHAT LINES FOR YOUR SITE OR ADVERTISE IN NEWSPRINT Best customer service for your audiotext advertising needs. Fill out the form here: http://www.stsim.com/info/ Don't just stick with one service bureau ! you might not be getting paid for all your global minutes ,most service bureaus are paying you just for your U.S. traffic and keeping the rest this is how service providers make the most of their profit. PAYOUTS ARE ON THE 1st AND ON THE 15th OF EVERY MONTH..... NUMBERS MUST BE DISPLAYED ON YOUR FRONT PAGE FOR BEST RESULTS!!!! YOUR ACCOUNT WILL BE SETUP WITHIN HOURS !!! Top rates for 011- 592 / 1- 664 / 1- 809 / the international pay-per-call industry is bringing in millions upon millions each year. Get in on the the 1+ dialing prefixes and watch your revenue increase. Advertise by mass emailing, tv, web site, newsprint, magazine in any country!!!! You the advertiser will get a flat rate paid to you for every minute generated on your line(s). Your ad could look something like this. -------------------------------------------------------------------------------------------------------------- The internet's all new interactive date line talk to people live or just listen in call now! 1-664-410-3348 Regular Long Distance Only. --------------------------------------------------------------------------------------------------------------- Talk to Hot Ladies Now! 1-644-410-3349. --------------------------------------------------------------------------------------------------------------- People looking to meet people call now 1-664-410-3350. ---------------------------------------------------------------------------------------------------------------

1 0

Re: Technical Description of PGP 5.5
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <3.0.2.32.19971022210316.00727944(a)netcom10.netcom.com>, on 10/22/97 at 09:03 PM, Lucky Green <shamrock(a)netcom.com> said: >At 07:12 AM 10/15/97 -0700, Kent Crispin wrote: >>Correct me if I'm wrong, but this seems to imply that the CMR fields >>in the key structure are really just a convenience -- if PGP, Inc. >>didn't write an smtp filter that enforced a CMR key, someone else >>(say a firewall vendor) could do so easily, defining whatever >>relationship between keys they wanted. >Anybody with half a brain, a copy of perl, and the PGP 5.0 source from >http://www.pgpi.com/ could write a similar filter in a matter of hours. I made this point at the very begining. Source code is not even needed, all one needs to know is the encryption & signature packet formats to be able to pull the keyID's. >I am going to install PGP's SMTP filter on my box. To make it impossible >to accidentally send unencrypted mail to certain people. :-) I already have this inplace as a Rexx script on my E-Mail client. :)) >>To make that a bit stronger, it seems like *any* model that uses >>persistent encryption keys essentially enables CMR-like functionality >>in a smtp filter -- it could be done using pgp 2.6. My set-up works with 2.6->5.0. It's just not persistent keys but the ability to encrypt to multiple recipiants. Of cource even without these features this functionality can implemented by moveing encryption to the server. Only signing & decryption need to be on the client machines. It may even be more efficent in a corporate enviroment to do so. There are performance questions in a high volumn enviroment but I have developed techniques that greatly enhance the perfomance of PGP when working with large keyrings. I know C2-Net has done work with their Stronghold product for supporting hardware based encryption to improve performance on high volumn servers, it would be intresting to see how well these cards would lend themselves to PGP. >Correct. But this isn't going to stop people from complaining. >PGP 5.5 is considerably better than PGP 5.0. The LDAP support alone is >reason to upgrade. The UI is improved and if you don't want to use >message recovery, just don't turn it on. I will agree that 5.5 is an improvement but to be honest I am not that crazy about it. Not that all of it is PGP's fault alot has to do with the OS it runs on. NT just isn't ready for prime time. I have my own GUI I designed for PGP on the OS/2 platform so I am a little biased in that area. :) - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE7+aY9Co1n+aLhhAQFhwgP/SdJSeNgbG/SRgR15gwtb22QFOF/VBEL6 K047yXYEwJ/2Vd/zEwJ8AU/6ycVawtGMFpIGyLQHG91ATVear7CSHmsa6KMPH7EC dtK2bbEQlpJsgGbQpXNt6gHOuKYRZIXp65XIlEvu8qW3CJLUGz+RTNnKOAIFkUe2 JWWYRj7N5Wc= =xwCN -----END PGP SIGNATURE-----

1 0

Re: Singaporean control freaks & CMR
by Anonymous 17 Dec '03

17 Dec '03

Adam Back writes: > The problem is that pgp5.x is both an email encryption system and a > file encryption system. So PGP Inc argue that they need the recovery > features for files. Well OK, but for emails in transit? Define "in transit". Specifically, when exactly does email stop being "in transit". When it is received on a mail server? Transfered to the destination computer? Displayed to the user? Saved in an archive? How long might a piece of email spend "in transit"? Compare and contrast with the amount of time a piece of data from an encrypted phone call spends in transit. Or an SSL protected HTTPS web transaction. Do you understand the difference between transit times of a fraction of a second and of days or weeks? Does this suggest any differences in the need for recovery of encrypted data "in transit"? Not all communications are alike. The longer data spends "in transit" the more need there is for recovery features.

3 2

What RSA & Netscape have to offer
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, While the list is busy knocking PGP for not doing the "right thing" or being the "first ones to blink" I though I would share with the list what some of the "big boys" are doing for the spread of "Strong Crypto to the Masses". Below is from the most current S/MIME draft "draft-dusse-smime-msg-05" dated 19-Oct-1997: 2.6 ContentEncryptionAlgorithmIdentifier Receiving agents MUST support decryption using the RC2 [RC2] or a compatible algorithm at a key size of 40 bits, hereinafter called "RC2/40". Receiving agents SHOULD support decryption using DES EDE3 CBC, hereinafter called "tripleDES" [3DES] [DES]. Sending agents SHOULD support encryption with RC2/40 and tripleDES. I think that when taking pot-shots at PGP, Inc. and Phil Zimmerman one should look at what the alternatives are and who are really are friends here. IMNSHO companies like RSA, Netscape, Microsoft, Verisign, et al, who would sell us all out if it improved their bottom lines do not qualify. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBNE8Iqo9Co1n+aLhhAQGWswP+MnvOCL1EoURWpEPt23I/UIuRWBovby8d AxZS3N8/exnI2M3kDCC2mTUWmvaKdsUnwErnXCQ9nQTDa9B+2VUBlijtkC+nsTV8 Vuv484AU51havdyttE87YMDXx8LSkdWnGXLs8TpjrRXiDZlxPJWIif3haK1hC5kg I3VmdwaZc/4= =7Fan -----END PGP SIGNATURE-----

2 1

Re: PGP 5.5 CMR/GAK: a possible solution
by mark＠unicorn.com 17 Dec '03

17 Dec '03

jon(a)pgp.com wrote: > This is exactly CMR. The only thing that Business 5.5 does is automatically > add the department for you, and put up the recipient dialog so it can be > taken off. Congrats. On the contrary, it is *not* CMR. CMR encrypts to multiple keys for a single recipient. This system only ever encrypts to one key per recipient. PGP 5.5's ability to force people to encrypt to multiple keys for one recipient is the evil aspect of the design, because it's the one which allows it to be used to enforce GAK. PGP's CMR can be used to force everyone to encrypt to the FBI as well as the NSA. My system can't. I tried very hard to make this distinction clear in my description. I'm amazed that so many people seemed to miss it. Mark

1 0