December 2003 - cypherpunks-legacy

MAIL: commercial remailers
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I wrote: >>Interesting point... I guess that is a good reason why free anonymous >>remailers might not ever die out, but pay remailers may be able to >>offer enhanced features and services that would tend to attract the >>vast majority of customers (assuming such a service would be >>considered as valuable by enough people ;) Scott wrote: > In actuality having only purely commercial remailers in a chain > would likely lead to security concerns of the following nature. When > remailers end up requiring postage, people will tend to use the > cheapest remailers to cut down on costs. Who will be in a position to > offer the cheapest rates under a commercial proposition? Someone who But this assumes that commercial remailers will not take in enough money to keep themselves afloat. Which could very well be true! What you describe is a serious problem indeed: in which only a "deep pockets/government front/whatever" can run a pay remailer and most free remailers exist on unsecure systems. > This speaks highly for the "every man a remailer" concept. If you know > people who run remailers and trust that they are not compromised But this is the problem, if the remailer operator is just an ordinary user, he/she may not even know their remailer is compromised, since there is only so much an ordinary user can do. You're trustworthy friends may be victim of a sysadmin who does sendmail logging, etc. Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkxBbsSF/V8IjI8hAQF4rQP+NOtdzvtGUSK6sZzR1BL6fVAuehZGMM1A bjlGmPFOjN3G+44AsL8+l2BF4RvujGZ7YCRwvhggjpQC2yqI02m7xqlgIukqQlQR zUec88zzGi+XC0CrBovOXZVzlbkl8UxdQXa/FNTjczf4QLd1+8hv7h2D1wb0J0yD BknFwcAibZw= =QhUQ -----END PGP SIGNATURE----- -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu 2.3: 5AD633; D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 2.6: 088C8F21; 97 73 9E 8B 98 3E DD B5 E8 97 64 7E 20 95 60 D9 "One man's mnemonic is another man's cryptography" - K. Cooper

1 0

Re: EFF on why they did it.
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 7:37 AM 8/12/94, Brian D Williams wrote: >Leahy and Edwards introduce a narrow Digital Telephony bill >with major new privacy protections >============================================================ > >Today Senator Patrick Leahy (D-VT) and Representative Don Edwards >(D-CA) introduced their version of Digital Telephony legislation. >[. . . .] The prisoner was served a meal of fresh lobster and fine wine. All were moved by the priest's blessing, and touched by the prisoner's speech. The doctor signed the death certificate shortly after midnight. b& -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: My key is not 'escrowed' with any government agency. iQCVAgUBLkxYOkNl71nP8jvVAQHrMQP+Pd8l8tCN0oMEhuc77VZIoAnK6Z/KGGJ3 7wSSANYo/lSP6qkt+lmYIuf4FoelCHe6GZNS9yt92H3d2opcs0TTPjkXfkQu8scj XE0/ggwhg8IwvRkB5mj0JzsUH6p0cOr6HSLPXmkzDGP5OYpjPOK+TGp9mO8oa08b oxTDn81SQwg= =nRqo -----END PGP SIGNATURE----- -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): We won! Clipper is dead! BUT! Just say no to key escrow. And stamp out spamming, too. Finger ben(a)tux.music.asu.edu for PGP 2.6 public key CFF23BD5.

1 0

Re: Bug in PgP2.6???
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 4:06 PM 8/12/94, Derek Atkins wrote: >Gee, Claude, where have _you_ been hiding? Look at the date >on that message. > >As for using 2.6 -- I do. It's _only_ a factor in key generation, >and it doesn't weaken key generation enough to be a concern. > >Also, there is a planned bugfix release for sometime soon that >will have the one character patch that fixes that problem. Except that the fix has been a *long* time coming. Hasn't it been about a month since I complained about this? And there's still not even a simple readme on the distribution site. As I said before, if it's serious enough to shout to the world, "we goofed," then it's serious enough to take the ten seconds necessary to make the fix or make the instructions on how to do so obviously available. The EFF has sold us out, and this is making MIT look rather unprofessional. >-derek b& -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: My key is not 'escrowed' with any government agency. iQCVAgUBLkxYmkNl71nP8jvVAQFh4QP/dKmW/OV4nLHknfFVKgJJqgwV9mwjsZ9n myekwvvI8liZmcjSwAJDxTjk4V7xMMrRbE/2zC1fcl7bstgP+5SvbQ/c0jMlPJJ6 i81CXYcIY8WQ5stQmNN+9Qi0wU8E2KUiw96+LgH4P9kc6059aKQYOb26qF3bypQB g5G015QkOQo= =8ala -----END PGP SIGNATURE----- -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): We won! Clipper is dead! BUT! Just say no to key escrow. And stamp out spamming, too. Finger ben(a)tux.music.asu.edu for PGP 2.6 public key CFF23BD5.

4 3

RE: RemailNet
by John Young 17 Dec '03

17 Dec '03

Responding to msg by nobody(a)kaiwan.com (Anonymous) on Sat, 13 Aug 8:2 AM >There might be at least one good reason for NOT going >overseas on that first leg. The NSA's charter >restricts it to international operations. According to published reports, such as Bamford's "Puzzle Palace", NSA does not have a "charter", in part because the originators intent to avoid limitations on operations. The CIA has a charter like you suggest. If you have a public reference on *any* limitation of NSA's operations please post here or send by email. Thanks. John

2 1

That NYT article...
by L. Todd Masco 17 Dec '03

17 Dec '03

We're talking to the author -- FWIW, he'll be printing a retraction. Off to HOPE. -- L. Todd Masco | Bibliobytes books on computer, on any UNIX host with e-mail cactus(a)bb.com | "Information wants to be free, but authors want to be paid."

1 0

WWW> ANNOUNCE: PGP Encrypted Mosaic Sessions for Purchases (fwd)
by Robert A. Hayden 17 Dec '03

17 Dec '03

Forwarded from Net-Happenings... ---------- Forwarded message ---------- Date: Fri, 12 Aug 1994 10:23:58 -0400 SENDER: Guy H. T. Haskin <guy(a)netmarket.com> Subject: WWW> ANNOUNCE: PGP Encrypted Mosaic Sessions for Purchases -----BEGIN PGP SIGNED MESSAGE----- The NetMarket Company is now offering PGP-encrypted Mosaic sessions for securely transmitting credit card information over the Internet. Peter Lewis wrote an article on NetMarket on page D1 of today's New York Times (8/12/94). For more information on NetMarket, connect to http://www.netmarket.com/ or, telnet netmarket.com There is no charge to browse around the service and no charge to set up an account. The NetMarket Company is currently offering CDs from Noteworthy Music and flowers from 800-THE-ROSE. If you do not have access to a PGP-capable version of X Mosaic, NetMarket also allows accounts to be set-up toll-free by calling 800-867-3777 or by sending PGP encrypted e-mail to pgp(a)netmarket.com. NetMarket was able to offer this service because Phil Zimmerman's PGP is now free and available for personal use and because support for encryption functions had been added to the recent versions of X Mosaic software from the NCSA. NetMarket has secured a commercial license for PGP, configured our server to allow encrypted transactions and provided directions for configuring X Mosaic and exchanging public keys. For more information on NetMarket, please e-mail or finger info(a)netmarket.com or use the automated comments page after connecting to our server. NetMarket's public key is available by fingering pgp(a)netmarket.com and on our WWW server. - -- guy(a)netmarket.com (Guy H. T. Haskin)| Noteworthy Music on the Internet The NetMarket Company | Multimedia interface to 17,000+ CDs www: http://www.netmarket.com/ | finger/email: info(a)netmarket.com ftp/telnet/gopher: netmarket.com | voice:603-881-3777 fax:603-881-3776 -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLkuCw8ov4aYyIJbZAQFcuAP+O4LTod9047nKuubRtVeH/kwcp/0At4To 3C5cee6jUb/2ETzavoDyRz3X4edsMzOgCtvBtmMB1tuqqBSMs0xh0eXnUiQ6oRTI JSu9Z/UmIBofUPC5lGd9gyoMjVJaVv41R8SMI1R9XD9WBFwlyrAifimiLo6zs4ML tqnXeAJ4F54= =jBCt -----END PGP SIGNATURE-----

1 0

Re: Bug in PgP2.6???
by Jeff Gostin 17 Dec '03

17 Dec '03

Ben.Goren(a)asu.edu writes: > The EFF has sold us out, and this is making MIT look rather unprofessional. Wild conspiracy theories aside for the moment, I back MIT on this one. People are only beginning to get clued in as to what version the current version is. Releasing a new version at this point, IMHO, would be a MAJOR headache. If you've ever worked for a software company, and tried to deal with the maintenance-version-of-the-day, you'll understand where I'm coming from. OTOH, guys [Hey you! MIT!], if it's an easy bug to fix, at least post a SOURCE PATCH. --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

appropriate laptop
by Loren Fleckenstein 17 Dec '03

17 Dec '03

Advice, please: I plan on purchasing notebook PCs for myself and colleagues to that are capable of running much-awaited Phil Zimmermann's voice encryption program. I'll probably get something based on the 486 DX2 chip. What type of sound card must these computers be capable of accepting in order to run the encryptor?

1 0

Secret sharing made short
by Hal 17 Dec '03

17 Dec '03

I came upon a paper with this title in the 1993 Crypto conference proceedings, by Hugo Krawczyk. He pointed out that with the Shamir-type secret splitting which we discuss here periodically you have considerable space expansion. Splitting a message of M bits into N shares causes each share to itself be M bits. Krawczyk shows a simple system which basically has each share be only M/N bits. (I will ignore for simplicity the issue of providing a threshold K<N such that any K of the N shares are sufficient to restore the message.) He achieves this be foregoing "pure" information-theoretic secrecy in favor of "mere" computational secrecy. This is a reasonable tradeoff since most implementations of Shamir sharing end up relying on computational secrecy for their random numbers, anyway. Krawczyk's idea, in the simple subset I am describing, is almost embarrassingly easy. Take your message M and encrypt it using a random IDEA or DES key. Split the resulting cyphertext into N pieces (just carve it up) and give each piece to a shareholder. Take the IDEA/DES key and Shamir-split it into N pieces and give those out as well. (Shamir splitting for this case can be done simply by having N-1 of the pieces be totally random, and having the last piece be the xor of the IDEA/DES key and the N-1 random pieces. Only by xor'ing all N pieces can the original key be recovered.) Everyone ends up with slightly over M/N bits; they have M/N plus the size of a DES or IDEA key. But that is pretty close. And unless IDEA or DES can be broken they will have to recover all of the shares in order to recon- struct the key and read the message. For generalization to the K<N case you still use Shamir splitting on the IDEA or DES key, but the message itself gets split up using an error-cor- recting code concept so that K pieces are enough to reconstruct the message. This requires M/K bits per share, plus the overhead for the DES/IDEA key. This sounds like it would be a good enhancement to the Shamir splitting code that was posted here. The IDEA or DES module could be a source of random bits for the Shamir splitting. PGP's IDEA module is pretty self-contained and has a random-number entry point. (Oh, well, I've come this far, I might as well finish it. The message distribution scheme Krawczyk gives is this: split the message into K pieces. Treat each piece as the coefficient of a K-1 degree polynomial. Evaluate the polynomial at X=0,...,N-1 and let the results be the shares. Now any K of the shares will allow the polynomial to be reconstructed, and by concatenating the coefficients we recover M. This is similar to Shamir's scheme but is not informationally secure and has shares of size M/K.) Hal

1 0

Re: appropriate laptop
by Michael Handler 17 Dec '03

17 Dec '03

On 13 Aug 1994, Loren Fleckenstein wrote: > Advice, please: I plan on purchasing notebook PCs for myself and > colleagues to that are capable of running much-awaited Phil > Zimmermann's voice encryption program. I'll probably get something based > on the 486 DX2 chip. What type of sound card must these computers be > capable of accepting in order to run the encryptor? The specs I have say SoundBlaster, which I assume means just standard 8-bit SoundBlaster minimum, with 16-bit ASP or WaveBlaster not necessary or supported (at least at first...). All will become clear when Nautilus 0.2 is released, as VoicePGP will use that as its code base. The Mac version will just use the built-in sound hardware. The 486DX2 will be more than sufficient. Initially, the specs called for a 486 chip at least, but the Nautilus developer (forgot his name... Bill someone) said that a 386/33Mhz would be sufficient. ------------------------------------------------------------------ ------ Michael Brandt Handler -- Philadelphia, PA -- <grendel(a)netaxs.com> \bi/ PGP v2.6 public key available -- 1984: We're Behind Schedule \/

1 0

pubring
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

I just abused the school computer by downloading the public keyring for pgp at ftp.demon.co.uk. It's dated July 30, which is fine... but they have a caution about it no longer being updated automatically. Will anyone be starting a new public keyring after Sept 1? Regards, Dave

2 1

Tommy the Tourist's New Home
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- werewolf(a)io.org (Mark Terka) asked: > > Tommy the Tourist <nobody(a)CSUA.Berkeley.EDU> (Anon User) wrote: > > > > Welcome back, Tommy, we missed you! <g> Hope you're enjoying your > > new (CSUA) "home"... (Time for everyone to update their > > "chain.ini" file, BTW.) > How come? Has soda gone down or something? Or has there been an address > change? Soda was down for a week while it was moved to a different location. The new address is "remailer(a)soda.csua.berkeley.edu". I'm told that the old address will continue to work for a limited time, but it's best to get in the habit of using the correct one. I also understand that the crypto archives have also moved, but I'm not really sure of the details. --- Diogenes -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkWDGuRsd2rRFQ1JAQH9UQP/Y5IVnEPiOVtxYmaakHMxK9huPvdsOqsC qgaH9OUKEc6MDVz7NWI/ZtW9V8FqMGfEXEN0a4rMuvgyeq5P2VgqOuMWUcOOKwKP m8jEioG+AoJy6ZWRdufz8rkkc7rU73s9a2Xfktf62rG0PSjs7g9xJrjXPCKSk+PT 2iq18F2sBPo= =5LAw -----END PGP SIGNATURE-----

2 1

Re: Anonymous posters & Misinformation
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

-=> Quoting Jason Burrell to All <=- JB> mcdaniel(a)u.washington.edu (McDaniel) wrote: > Anonymity is possible with any e-mail address. I have noticed > however that a higher proportion of anonymous posters abuse > the trust of their fellow (and often gullible) netters with > clever deceptions and so on. I would love to see examples of this. "Macho" McDaniel seems to have a weed up his ass over the whole concept of anonymity on the net, and will flame any anonymous poster in any newsgroup. He simply doesn't get it. He presumably wants us all to wear red uniforms and advance in ranks in frontal assaults, "fight fair" and generally act like stationary targets in controversial netvenues. I was astonished to see the completely irrational flap the control addicts in rec.guns, talk.politics.guns and ca-firearms@ shell.portal.com put up when several people objected to the unilateral banning of anon posts. It was just incredible how these "freedom-loving Americans" couldn't handle the concept of anonymity or posts they couldn't _control_. I can't understand why they don't go get a job with Sarah Brady, the NSA or the BATF so they can make a paying career of oppressing others. Not once was a logical refutation of the anon argument posed but in spite of this the anti-anon hysteria prevailed. JB> Now, I could go into the process of forging mail using JB> the "magic 5*5", but I won't. I don't want to teach a bunch JB> of people to forge mail and give them a false sense of security. Yes, this is the whole point. If someone wants to hoax a newsgroup, he can _easily_ fabricate an "good" ID in the time it has taken me to write this message so far. If McDaniel is so phobic about remailered posts, _why doesn't he scroll past them and shut the fuck up?_ Anon posts _say_ they're anon and are posted on a take-it-or-leave-it basis. Obviously McDaniel is too neurotic to do either and wishes us to share his personal problem. His argument about anon "net pollution" is also absurd, considering the staggering differential level of "pollution" generated by other perennial net-banes such as gross over-quoting and irrelevant cross-posting. This reminds me of the stingingly accurate net adage... "Sig files are annoying, juvenile, stupid and a waste of bandwidth. Of course, so are 90% of the posts on Usenet." McDaniel can save his tantrums and stick to moderated newsgroups populated by like minded netnazis. > My proposal would only make anonymos posters known to the list > owner. I believe it is a pretty much accepted belief that NSA > keeps track of atleast those users of anon.penet.fi.. so > who are they being anonymous from? Just the general readers. JB> Now here we go. The cypherpunks remailers don't have mapping tables. JB> They don't send back confirmations. The messages come out in JB> a form like: "From: nobody(a)shell.portal.com". Ignorance strikes again, as it did in the rec.guns exchange! Penet is a trivial, unencrypted remailer. It provides only the most simple anonymity. Other remailers are run from private, unlogged machines using PGP and sophisticated traffic-analysis countermeasures. If PGP has been made transparent by NSA cryptanalysts all bets are off, but otherwise the sophisticated use of chained, encrypted cypherpunks remailers makes anon-posting virtually bulletproof. JB> These remailers are designed to PREVENT the kind of thing you want to JB> do. Indeed! > Perhaps a crack-down on current anonymous abuses would encourage > responsible parties to develop services more responsive to > taking care of abusive usage and educating their users as to > their own responsibility. "Crack-downs"... I'm really getting tired of this mindset. No doubt McDaniel is salivating profusely waiting for Gore's Federally controlled "Information Superhighway" with all e-mail identified and tracable by use of Clinton's National ID "SmartCard" (don't laugh - this was a specific, stated purpose of the project). JB> This defeats the purpose of an anonymous remailer. If I'm going JB> to send anonymous E-MAIL/posts and then have someone else know about JB> it, it isn't very anonymous, is it? I should say not. > There are some groups where I would never want to see anonymous > posting restricted. Having seen McDaniel's flames of anon users in other forums, I _really_ doubt the sincerity of this statement.

1 0

Bruce Schnier Posting....
by werewolf＠io.org 17 Dec '03

17 Dec '03

Anybody else notice that Bruce Schnier (author of Applied Cryptography) appears live and well on the Internet ... at least judging from his recent post to sci.crypt. He did return my E-Mail admitting to be the author, so it was rather interesting seeing someone known to us posting. sort of like seeing a message from Sterling or Gibson (although Gibson isn't connected).

3 2

Re: POST:Gaining ISDN Privacy with data encryption
by andreas.elbert＠gmd.de 17 Dec '03

17 Dec '03

> >Making the public ISDN network private is possible though data encryption to >maintain security, say a pair of ISDN researchers whose organization is soon >to become and ISDN user. > They probably are right :-) A daughter of the german PTT has been offering ISDN-DES-phones for some years now. Welcome to the Club !

1 0

Zimmermann & Johnson at Sept. RMIUG
by adwestro＠ouray.Denver.Colorado.EDU 17 Dec '03

17 Dec '03

I have been told that noted Colorado crypto experts Phil Zimmermann and Mike Johnson, along with Phil's attorney, Phil Dubois, will be panelists at the September meeting of the Rocky Mountain Internet Users Group. The meeting will be on Tues. 9/13, 7-9 pm at NCAR in the Sovereign Republic of Boulder. Corrections/additional info gratefully accepted. Alan Westrope <awestrop(a)nyx.cs.du.edu> __________/|-, <adwestro(a)ouray.denver.colorado.edu> (_) \|-' PGP 2.6 public key: finger/servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23

1 0

FYI
by Carl Ellison 17 Dec '03

17 Dec '03

Path: news.clark.net!news.sprintlink.net!neon.house.gov!hr.house.gov!JPX From: JPX(a)hr.house.gov Newsgroups: talk.politics.crypto Subject: Congressional Committee takes to the Net (long) Date: Fri, 12 Aug 1994 16:35:20 GMT Organization: Committee on Science, Space & Technology Lines: 130 Distribution: na Message-ID: <JPX.38.2E4BA4C8(a)hr.house.gov> NNTP-Posting-Host: 143.231.251.142 Summary: House Science Committee goes on-line Keywords: Congress House Science Committee This is the initial posting from the Committee on Science, Space, and Technology of the U.S. House of Representatives, chaired by the Honorable George Brown of California. We have agreed to serve as the "beta" testers for House Committees trying to learn how to use the Internet. We posted this message to some of the USENET newsgroups that discuss topics relevant to our jurisdiction over Federal civilian research and development activities to: (1) Increase the number of people who know we do have Internet access; (2) Indicate how we can be reached on the net; and (3) Start learning how to take advantage of this information system in our daily activities. Getting the Congress to use Internet has been discussed in a few threads on various USENET newsgroups of late. Some of you may be familiar with the E-Mail Pilot Project established by the Committee on House Administration, chaired by the Honorable Charlie Rose of North Carolina. Those Members of the House currently maintaining an electronic mailbox for constituent communications may be found by e-mailing "congress(a)hr.house.gov" with the text "HELP" or "INFO" in the message body. You will receive an automated response with the necessary instructions. Also, the text of legislation introduced in the U.S. House of Representatives during the current Congress is now available on a W.A.I.S server located at the House Information Systems data center. The server may be accessed from the directory at quake.think.com or using the following information: Server: diamond Port: 210 Database Name: USHOUSE_house_bill_text_103rd It can also be found on gopher.house.gov in: Congressional Information/Legislative Resources The database contains the text of House bills beginning with October 1993 and is updated daily. What follows now is the message you will automatically receive in response to messages sent to housesst(a)hr.house.gov, the Committee's Internet address. It describes items like the Committee's gopher server, which you can also find at gopher.house.gov. ----------- begin ----------- Welcome to the electronic mailbox system for the Committee on Science, Space, and Technology of the U.S. House of Representatives. This Internet service is provided for ease of communication with the Members and staff of the Committee. If your message is addressed to a specific Member, it will be printed out in hard copy and forwarded to the Member's office for response by U.S. Mail. If your message is addressed to a staff member of the Committee, it will be forwarded electronically to that staff member for response. Depending on the nature of the response, it might reach you in either electronic or postal form. Messages for the Committee press office will be acknowledged electronically and then followed up on, if necessary, with material by post or fax. You can reach the press office directly via Internet at "sstpress(a)hr.house.gov". The Committee also maintains a bulletin board on the House of Representatives Internet gopher server at "gopher(a)hr.house.gov". Much of the public information material provided by the Committee is available on this gopher system. Much of this information also is available on the Committee's "Straight Talk" voice-response system. Dial 202/225-3018 and follow the menu instructions for a touch-tone telephone. Thank you for contacting the House Science Committee. Please be patient as we experiment with this new way of better serving your communications needs. If you wish to write to the Committee, please direct your correspondence to: Committee on Science, Space, and Technology 2320 Rayburn House Office Building U.S. House of Representatives Washington, DC 20515 ----------- end ----------- At this time, we suggest you supply both your e-mail and postal addresses in any communication to the Committee. Each office in Congress has its own policy for responding to public inquiries. So, if we forward your e-mail to a particular Member's office, they may choose to respond with a regular letter. Our Committee hopes to increase our use of e-mail in responding to public inquiries. We have chosen the following subset of USENET groups for our initial foray into the net.world: alt.california alt.cyberspace alt.dcom.telecom alt.politics.datahighway comp.dcom.telecom comp.org.cpsr.talk comp.org.eff.talk misc.education misc.education.science misc.legal sci.agriculture sci.astro sci.bio.ecology sci.chem sci.energy sci.engr sci.environment sci.geo.geology sci.math sci.med sci.misc sci.physics sci.research sci.space.policy talk.environment talk.politics.crypto Please feel free to repost this message to other groups that might find the information of value. Your comments on what should be carried by this channel of communications would also be welcomed. --------------- Committee on Science, Space, and Technology U.S. House of Representatives Washington, D.C. 20515 HOUSESST(a)HR.HOUSE.GOV DISCLAIMER: Opinions expressed in this posting are those of the sender and do not necessarily reflect those of the Committee, the Chairman or any Member of Congress.

1 0

number of 2-way radios
by Carl Ellison 17 Dec '03

17 Dec '03

Does anyone have rough figures on the number of cellular phones produced versus the number of military 2-way radios ever produced? I'd be willing to bet the former far exceeds the latter, but it would be nice to have real figures. - Carl

1 0

e$: Economic Development of the Caribbean
by rah＠shipwright.com 17 Dec '03

17 Dec '03

In article <CuIyqC.MHA(a)ecf.toronto.edu>, francis(a)ecf.toronto.edu (FRANCIS ALVIN CYRILLE) wrote: > What are the major factors hindering economic development in the Caribbean..? I've been interested in this for a long time. I've started to form some ideas about it, and here they are. 1. No effective public health system. (Not really socialized medicine, just sanitation, epidemiology, etc.) 2. No educational infrastructure. 3. Monopolistic control of political structures. 4. Monopolistic control of critical markets. The above are interrelated, thus the ranking is only superficial. As island states with few resources, the nations of the caribbean can't afford to have political and economic monoculture. Small islands with few resources (Singapore, Hong Kong, Japan and the British Isles) must trade or die. Uniparty states, with sweetheart deals to extract resources and ship them away, tend to make their people poorer, unless there's an extreme premium on the resource (oil, guano, etc). Brunei, where the sultan owns everything and is the country's the richest in the world anyway (per capita) is a great example of being able to "afford" monopolistic political and market control. They have enormous oil reserves with which to pay for all the eggregious excesses of the government/theocracy, and still have lots left over for education, public health, and universal health access. It's interesting to think that that's pretty much what Fidel did in Cuba. His "premium resource" was a strategic position 90 miles off of Florida that was very very valuable to the USSR. Life gets better someplace only as the life expectancy goes up. This is called the Demographic Transition, and it is marked by a sharp decline in population growth as life expectancy crosses 50 years. People won't have children as a substitute for retirement pensions when they can see that they will be healthy enough to take care of themselves for most of their whole life. Children become a want rather than a need, and population growth tapers off. Most of the USA's population growth comes from immigration. Singapore has state-sponsored latin dance classes to get their citizens interested in having families earlier. (Go figure) The quickest way to drive up life expectancy is through public health. If people won't die from malaria or typhus or cholera or diptheria, or river blindness, or whatever, because their water's clean, and their wastes don't get back into their food chain, then their life expectancy doubles overnight. I stayed in the Galleon House in downtown Charlotte Amalie for a week a few years ago, and the open sewers are still right there out on the street. I remember seeing a "creek" running through an alluvial plain of shacks just outside St. John in Antigua, and the water was purple-green with raw sewage. The reason that this hasn't changed is because the population hasn't demanded it, and the reason for that is that they're not given enough education. The reason for that is that the governments are filled with people who want to line their own pockets, and can do so because they hold generational political dynasties. This is usually because of some sweetheart deal with an extractive monopoly/oligopoly, which can "contribute" large piles of cash to whoever does them a favor. If there was more of a trading tradition in the caribbean it would help drive growth. There are a few places where that has happened before and can happen again. St. Thomas, unencumbered by US government subsidy and regulation might be one, if those if monoparty cronyism didn't kill it. It had been a huge shipping and trading port for centuries. Now its primary function seems to be shaking down tourists. Trade of a sort, I suppose. Which leads me directly to another reason I'm interested in the small island nations of the caribbean. The idea of internet commerce. There are people in some circles in the net who think that the internet provides a perfect opportunity for people to buy and sell software and information securely and even anonymously. To do this properly one would need to reduce restrictions on cash transactions, the transfer of capital, and the use of strong cryptography. Cryptography is the enabling technology for the transfer of assets and money in a secure fashion over unsecure networks. The first result is that people can work anywhere they want. Personally, I think Boston is nice, but I'd rather hang in Cruz Bay for most of the year if I could get away with it. We just had a discussion in soc.culture.caribbean about the lack of full-blown USVI internet access which talked about that. You could have a whole class of "lifestyle refugees" coming from the developed world to the caribbean because they can work anywhere they want. This literally foriegn trade, only now a nation is re-exporting intellectual property. Sort of like a fair-weather maquilladora with imported gold-collar workers. Think about the development of america in the 19th century. The railroads brought immigrants from europe, who then homesteaded land and sold the agricultural products they grew to people who processed them into goods which generated foriegn exchange, which paid for interest on bonds that J.P. Morgan & Co. sold to the european money centers. Some of those bonds were then used to build more railroads, which brought in more settlers, etc. The other neat thing about this process is that it automatically brings in foriegn exchange and development capital which is independent of monopolistic controls. These "refugees" have to buy things, but they buy them from local, distributed sources: shops, builders, tradesmen, etc. Those people automatically have an independent entrepreneurial outlook, which is reflected eventually in the political and economic structure of the nation. You get a quasi-Jeffesonian nation of shopkeepers, tradesmen, and as their children are educated, technical/information professionals who work on the net for a living. This is how a nation can build a trading tradition from the ground up. Finally, the electronic money (e$ for short) which enables this commerce has to be denominated in something, probably dollars. The entities (call them banks, for the time being) have to live somewhere. These entities are responsible for moving assets and money on and off the internet and make their money by either taking a small fee (called a spread) when converting money from one form to another, or from collecting the interest (called the float) on the dollars that were converted into e$, but haven't been converted back to other dollars yet. The cool thing is that some caribbean nations have figured out offshore banking already. The reason this kind of banking is valuable is the concept of regulatory arbitrage. Regulations impede the flow of money. The Netherlands Antilles have made a reasonable living domiciling corporations whose sole purpose is to keep money out of the american banking system and thus its tax mechanism. Money made offshore which stays offshore doesn't get taxed as easily by the IRS. Regulatory Arbitrage is also exemplified by the banking and insurance industries of the Bahamas, the Caymans, Bermuda, and to a lesser extent, Antigua and the EC (Eastern Caribbean) nations. In those cases, those nations have modeled bank secrecy laws like those of the swiss. In order for a nation to become an e$-center, they would have to allow the creation of e$, particular dollar-denominated e-cash on their shores. There are enourmous regulatory hurdles in the US, but with a sufficiently arbitrary and capricious political infrastructure, it could happen pretty soon in the caribbean, if it was worth someone's while... Ah, the ironies of economics... Cheers, Bob Hettinga -- Robert Hettinga (rah(a)shipwright.com) "There is no difference between Shipwright Development Corporation someone who eats too little 44 Farquhar Street and sees Heaven and someone Boston, MA 02331 USA who drinks too much and sees (617) 323-7923 snakes." -- Bertrand Russell

1 0

The Law and the Network
by cjl 17 Dec '03

17 Dec '03

C-punx, The following was retyped from SCIENCE magazine (vol 265:p691). I haven't seen it in E-circulation, and thought it would be of revelance to the recent discussion of remailer liability. Anyone out there feel like standing up to express one of the many Cypherpunk points of view in front of the ABA and the AAAS? I'd be curious to know who is attending from any of our favorite TLA's? This looks like just the kind of forum they might use to drop ominous hints about their real intentions. It would be good for there to be C-punk observers there at the very least. Someone with a better usenet feed might want to repost this to the usual newsgroups. IMPORTANT NOTE: Application deadline, August 19th 5pm EST Computer Issues: Call for Applications Applications are invited for participation in the second conference on "Legal, Ethical, and Technological Aspects of Network Use and Abuse" cosponsored by the National Conference of Lawyers and Scientists, a joint committee of the American Association for the Advancement of Science and the American Bar Association. The workshop, scheduled for 7 to 9 October 1994 at a conference center not far from Washington DC, will weigh ideas about what is acceptable behavior in a shared computer environment. Discussions will center on three themes: 1) determining accountablilty and liabiltiy for network content; 2) defining what network content is "public" and what is "private"; and 3) what ethical, legal, and administrative frameworks should be employed for the global information infrastructure. Up to three successful applicants will receive expenses to attend the workshop, which will have 40 participants from a variety of perspectives and disciplines. Each applicant must submit a 1000-word paper addressing one of the three themes above (the papers will be circulated prior to the meeting), a short resume or biographical sketch, and a brief statement of how one's expertise or perspective might contribute to the meeting. The application deadline is 19 August at 5pm EST. E-mail responses are preferred. Those selected will be notified by 9 September. Send applications or requests for more information to: Deborah Runkle Directorate for Science and Policy Programs American Association for the Advancement of Science 1333 "H" Street, NW Washington, DC 20005 Phone: (202) 326-6600 Fax: (202) 289-4950 E-mail: drunkle(a)aaas.org C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

1 0

Eric Hughes talking in NYC on tuesday
by L. Todd Masco 17 Dec '03

17 Dec '03

At the Hughes/Blaze/Stratton talk at HOPE, Eric announced that he'd be speaking for the Society for Electronic Access in NYC on "Pivacy, Anonymity, and Money" on Tuesday. I don't remember seeing it on cypherpunks and don't know whether Eric would get a chance to announce it, so what the hell. It'll be Tuesday, August 16th, 1994, at 49 Chambers St., Room 610, in Manhattan. ("Where's the CRIME?"? Maybe that was Detweiler.) -- L. Todd Masco | HKS encrypted Point of Sale system for Internet commerce cactus(a)bb.com | "Information wants to be free, but authors want to be paid."

1 0

RE: Tommy the Tourist's New Home
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- werewolf(a)io.org (Mark Terka) wrote: > > Soda was down for a week while it was moved to a different location. The > > new address is "remailer(a)soda.csua.berkeley.edu". I'm told that the old > > address will continue to work for a limited time, but it's best to get in > > the habit of using the correct one. > > Ok, I take it this is the one that posts directly to the USENET groups? Yes it is, although I haven't seen any posts from "Tommy the Tourist" for several days, now. A test post sent a few days ago has still not shown up. Also, there seems to be some sort of problem with soda's public key on chained remailings. Even when the Usenet gateway was operational, chained posts where the message to soda was PGPed seemed to go into the bit bucket. Also, FYI, Matt Ghio's remailer now offers Usenet posting as well. > > I also understand that the crypto archives have also moved, but I'm not > > really sure of the details. > > Well as of about 3pm EDT today they seemed to still be at > ftp.soda.berkeley.edu as I scooped a couple of files from that > site at that time. Through the magic of dual entries in a Domain Naming server somewhere, no doubt. Next time, you might try the new "csua" name and see if that's working, too. --- Diogenes -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLk4kXORsd2rRFQ1JAQGjkQP+NVQ8X5Q/W40MpdMEah7aKZY7jT4HaR++ vZbegzYPZOX3dKhxPnVizr2znj+qYnJQeBwsHb0BvvI+V711U8UYpl6JFsGqFIRj MZzofuhDQzXvqaWmKaOvKlhmbgWHOIdlRCnLU3W3fLw6zvGJlUj0MNTxmnZmnkSh ycL6mXhzPq8= =I+lP -----END PGP SIGNATURE-----

2 1

Where to get the latest PGP (Pretty Good Privacy) FAQ
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 11 August 1994 by Mike Johnson) WHAT IS THE LATEST VERSION? There is more than one latest version. Pick one or more of the following that best suits your computer, patent restrictions, and export restrictions. Some countries (like France) may also restrict import or even use of strong cryptography like PGP. |-----------------|--------------|-------------|---------------------| | Platform(s) | Countries | Allowed Use | Latest Version | |-----------------|--------------|-------------|---------------------| | DOS, Unix, | USA & Canada | Commercial | Viacrypt PGP 2.7 | | or WinCIM/CSNav | | Personal | | | | | Research | | |-----------------|--------------|-------------|---------------------| | DOS, Unix, Mac, | USA & Canada | Personal | MIT PGP 2.6 | | OS/2, others | | Research | | |-----------------|--------------|-------------|---------------------| | DOS, Unix, Mac, | Most of the | Personal | PGP 2.6ui | | OS/2, others | world except | Research | ui=unofficial | | | the USA. | | international | |-----------------|--------------|-------------|---------------------| | Mac Applescript | Most of the | Personal | MacPGP 2.6ui v 1.2 | | | world except | Research | | | | the USA. | | | |-----------------|--------------|-------------|---------------------| | Mac Applescript | USA | Research | MacPGP 2.6ui v 1.2 | |-----------------|--------------|-------------|---------------------| | Amiga | Most of the | Personal | Amiga PGP 2.3a.4 | | | world except | Research | | | | the USA. | | PGPAmi23a_4.lha | |-----------------|--------------|-------------|---------------------| | Amiga | USA | Personal | Amiga PGP 2.6 0b0.6 | | | | Research | | |-----------------|--------------|-------------|---------------------| | Atari | Most of the | Personal | Atari PGP 2.3a | | | world except | Research | | | | the USA. | | | |-----------------|--------------|-------------|---------------------| | Atari | USA | Research | Atari PGP 2.3a | |-----------------|--------------|-------------|---------------------| | Any of the | Countries | Commercial | Any of the above | | above | where IDEA | Personal | | | | is not | Research | | | | patented and | | | | | cryptography | | | | | is not | | | | | restricted. | | | |-----------------|--------------|-------------|---------------------| Note: there are other versions available, but these are either old, or outside of the mainstream PGP project. Look for new versions from one of three sources: Viacrypt (Commercial), MIT (North American freeware), or mathew(a)mantis.co.uk (the unofficially non-designated holder of the unofficial international version that parallels what Philip Zimmermann and the rest of the PGP development team is doing in the USA. Note that the MIT PGP 2.6 is illegal to export from the USA or Canada, but using it outside of the USA and Canada for noncommercial use is not illegal in most countries. In spite of the best efforts of MIT and the other primary developers and distributors of PGP not to violate the International Traffic in Arms Regulations, MIT PGP 2.6 is available on some of the same sites listed for PGP 2.6ui, below. The noncommercial use restriction comes from both the RSAREF license and the patent on the IDEA cipher in Europe and North America. WHAT IS ALL THIS NONSENSE ABOUT EXPORT CONTROLS? For a detailed rant, get ftp://ftp.csn.net/mpj/cryptusa.zip The practical meaning, until the law is corrected to make sense, is that you are requested to get PGP from sites outside of the USA and Canada if you are outside of the USA and Canada. If you are in France, I understand that you aren't even supposed import it. Other countries may be worse. WHAT IS THE "TIME BOMB" IN MIT PGP 2.6? As a concession to the RSA patent holders (in return for endorsement of the legality of the freeware MIT PGP 2.6), MIT placed an inducement in MIT PGP 2.6 to encourage upgrade from the alledgedly patent-infringing PGP 2.3a to the MIT version. The nature of this inducement is a change in a packet ID byte that causes PGP 2.3a and earlier to reject messages created by MIT PGP 2.6 after 1 September 1994. Altering MIT PGP 2.6 to bypass this annoyance (though technically an easy change to the LEGAL_KLUDGE), invalidates the blessing of Public Key Partners on the licence of MIT PGP 2.6. Therefore, it is a bad idea. On the other hand, it is trivial to hack PGP 2.3a to accept these packets, and that (plus a few other bug fixes) is essentially what PGP 2.6ui is. None of the versions of PGP greater than 2.3 have problems reading the old packet ID values, so for maximum compatibility, the ideal is to write the old value and accept either value. Unfortunately, this time bomb has a negative effect on Viacrypt PGP 2.4, as well, which never infringed on anyone's patents. Viacrypt's solution was to issue PGP 2.7, which, by default acts just like MIT PGP 2.6, but has a config.txt option (explained in the release) that allows compatibility with both PGP 2.4 and PGP 2.6. Naturally, this also allows compatibility with PGP 2.3a. The time bomb is annoying for those who still wish to use PGP 2.3a, and for those who use Viacrypt PGP 2.4 and don't want to spend US$10 to upgrade to Viacrypt PGP 2.7, but considering the magnitude of the concession made by Public Key Partners in legitimizing the freeware PGP for use in the USA, it was worth it. ARE MY KEYS COMPATIBLE WITH THE OTHER PGP VERSIONS? If your RSA key modulus length is less than or equal to 1024 bits (I don't recommend less, unless you have a really slow computer and little patience), and if your key was generated in the PKCS format, then it will work with any of the mainstream PGP versions (PGP 2.3a, Viacrypt PGP 2.4, MIT PGP 2.6, PGP 2.6ui, or Viacrypt PGP 2.7). If this is not the case, you really should generate a new key that qualifies. Philip Zimmermann is aware of the desire for longer keys in PGP by some PGP fans (like me), but wants to migrate towards that goal in an orderly way, by first releasing versions of PGP in for all platforms and for both commercial (Viacrypt) and freeware (MIT) flavors that ACCEPT long keys, then releasing versions that can also GENERATE long keys. He also has some other neat key management ideas that he plans to implement in future versions. WHAT ARE THE KNOWN BUGS IN PGP? These are the most annoying: MIT PGP 2.6 -- the function xorbytes doesn't. Replace the = with ^= to fix it. The effect of this bug is that RSA keys aren't quite as random as they should be -- probably not a practical problem, but worth fixing if you are going to compile the code yourself. MIT PGP 2.6 -- DON'T SET PGPPASS when editing your keys, because if you do, and if you don't change your pass phrase, the key is lost. (If this happens, rename your backup keyring files to the primary files before you do anything else). PGP 2.6ui -- Conventional encryption -c option doesn't use a different IV every time, like it is supposed to. (PGP 2.3a had this problem, too). WHERE CAN I GET VIACRYPT PGP? Versions are available for DOS, Unix, or WinCIM/CSNav Commercial software. Call 800-536-2664 to order. If you are a commercial user of PGP in the USA or Canada, contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial applications, and may be used in corporate environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for their version of PGP is 2.7. Upgrade from Viacrypt PGP 2.4 to 2.7 is free if you bought version 2.4 after May 27, 1994, otherwise the upgrade is US$10. Viacrypt's licensing and price information is as follows: ViaCrypt PGP for MS-DOS 1 user $ 99.98 ViaCrypt PGP for MS-DOS 5 users $ 299.98 ViaCrypt PGP for MS-DOS 20 users or more, call ViaCrypt ViaCrypt PGP for UNIX 1 user $ 149.98 ViaCrypt PGP for UNIX 5 users $ 449.98 ViaCrypt PGP for UNIX 20 users or more, call ViaCrypt ViaCrypt PGP for WinCIM/CSNav 1 user $ 119.98 ViaCrypt PGP for WinCIM/CSNav 5 user $ 359.98 ViaCrypt PGP for WinCIM/CSNav 20 users or more, call ViaCrypt If you wish to place an order please call 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 2104 W. Peoria Ave Phoenix AZ 85029 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET MIT PGP? MIT PGP is Copyrighted freeware. Telnet to net-dist.mit.edu, log in as getpgp, answer the questions, then ftp to net-dist.mit.edu and change to the hidden directory named in the telnet session to get your own copy. MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). 1. Read ftp://net-dist.mit.edu/pub/PGP/mitlicen.txt and agree to it. 2. Read ftp://net-dist.mit.edu/pub/PGP/rsalicen.txt and agree to it. 3. Telnet to net-dist.mit.edu and log in as getpgp. 4. Answer the questions and write down the directory name listed. 5. QUICKLY end the telnet session with ^C and ftp to the indicated directory on net-dist.mit.edu (something like /pub/PGP/dist/U.S.-only-????) and get the distribution files (pgp26.zip, pgp26doc.zip, pgp26src.tar.gz, MacPGP2.6.sea.hqx, and MacPGP2.6.src.sea.hqx). If the hidden directory name is invalid, start over at step 3, above. File names (shortened file names are for DOS BBS distribution): pgp26doc.zip - documentation only pgp26.zip - includes DOS executable & documentation pgp26src.zip - source code pgp26src.tar or pgp26src.tar.gz - source code release for Unix and others macpgp26.hqx or MacPGP2.6.sea.hqx - Macintosh executable & documentation macpgp26.src or MacPGP2.6.src.sea.hqx - Macintosh source code mcpgp268.hqx or MacPGP2.6-68000.sea.hqx - Macintosh executable for 68000 pgp26os2.zip - OS/2 executable (may not be on the MIT archive) RSA and IDEA algorithms licenced for personal and noncommercial use. Uses RSAREF, which may not be modified without RSADSI permission. Contains "time bomb" to start generating messages incompatible with PGP 2.3 and 2.4 on 1 September 1994 as an incentive for people to not use PGP 2.3a in the USA, which RSADSI claims infringes on their patents. Mac versions are not yet Applescriptable. This version is not intended for export from the USA and Canada due to the USA's International Traffic in Arms Regulations and Canada's corresponding regulations. You can also get MIT PGP 2.6 from: ftp.csn.net/mpj ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26.zip ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26src.zip ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26os2.zip ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26src.tar.gz ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/mac MacPGP2.6.sea.hqx MacPGP2.6.src.sea.hqx MacPGP2.6-68000.sea.hqx ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/amiga/ pgp26-amiga0b0.6-000.lha pgp26-amiga0b0.6-020.lha pgp26-amiga0b0.6-src.lha amiga.txt See ftp://ftp.csn.net/mpj/README.MPJ for the ??????? See ftp://ftp.csn.net/mpj/help for more help on negotiating this site's export control methods. ftp.netcom.com/pub/mpj ftp://ftp.netcom.com/mpj/I_will_not_export/crypto_???????/pgp/pgp26.zip ftp://ftp.netcom.com/mpj/I_will_not_export/crypto_???????/pgp/pgp26src.tar.… ftp://ftp.netcom.com/pub/mpj/I_will_not_export/crypto_???????/pgp/ MacPGP2.6.sea.hqx ftp://ftp.netcom.com/pub/mpj/I_will_not_export/crypto_???????/pgp/ MacPGP2.6.src.sea.hqx MacPGP2.6-68000.sea.hqx See ftp://ftp.netcom.com/pub/mpj/README.MPJ for the ??????? See ftp://ftp.netcom.com/pub/mpj/help for more help on negotiating this site's export control methods. TO GET THESE FILES BY EMAIL, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message for instructions. You will have to work quickly to get README.MPJ then the files before the ??????? part of the path name changes again (several times a day). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ COMPUSERVE The NCSA Forum sysops have a library that is available only to people who send them a message asserting that they are within the U. S. A. This library contains PGP. I have also seen PGP 2.6 in some other places on Compuserve. Try searching for PGP26.ZIP in the IBMFF forum for up-to-date information on PGP in selected other areas. The last time I tried a search like this, PGP 2.6 was found in the PC World Online forum (GO PWOFORUM) new uploads area, along with several PGP shells and accessories. I've also heard that EUROFORUM caries PGP 2.6ui, but have not confirmed this. Compuserve file names are even more limited than DOS, so the file names to look for are PGP26.ZIP, PGP26S.ZIP (source code), and PGP26D.ZIP (documentation only). Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, of if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. Log in with your own name, or if someone else already used that, try a variation on your name or pseudonym. You can request access to crypto software on line, and if you qualify legally under the ITAR, you can download on the first call. Download file names: pgp26.zip (DOS version with documentation) pgp26src.tar (Unix version and source code) pgp26doc.zip (Documentation only -- exportable) macpgp26.hqx (MacPGP executables, binhexed .sea) macpgp26.src (MacPGP source, binhexed .sea) mcpgp268.hqx (MacPGP executables, binhexed .sea for 68000 processor). (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. Verified: This morning. Hieroglyphics Voodoo Machine (Colorado) Jim Still (aka Johannes Keppler), sysop. DOS, OS2, and Mac versions. (303) 443-2457 For free access for PGP, DLOCK, Secure Drive, etc., log in as "VOO DOO" with the password "NEW" (good for 30 minutes access to free files). Other BBS and ftp sites do have these files, as well. I noticed that PGP26.ZIP is being distributed on FIDONET. WHERE CAN I GET PGP FOR USE OUTSIDE OF THE USA? The latest for outside the USA is the "Unofficial International" PGP 2.6 for most platforms, MacPGP 2.3aV1.2 for the Mac (although 2.6ui is under development and should appear very soon), and 2.3a.4 for the Amiga. The latest amiga version is fully compatible with MIT's PGP 2.6. Copyrighted freeware. Version 2.6ui released by mathew(a)mantis.co.uk. Amiga version 2.3a4 released by Peter Simons <simons(a)peti.gun.de> These versions do NOT use RSAREF. No RSA patent problems outside the USA, but this version is not legal for commercial or extensive personal use in the USA. IDEA licensed for presonal use only in countries where the IDEA patent holds. The freeware version of PGP is intended for noncommercial, experimental, and scholarly use. It is available on thousands of BBSes, commercial information services, and Internet anonymous-ftp archive sites on the planet called Earth. This list cannot be comprehensive, but it should give you plenty of pointers to places to find PGP. Although the latest freeware version of PGP was released from outside the USA (England), it is not supposed to be exported from the USA under a strange law called the International Traffic in Arms Regulations (ITAR). Because of this, please get PGP from a site outside the USA if you are outside of the USA and Canada. Even though the RSAREF license associated with PGP 2.6 from MIT no longer prohibits use outside the USA, it still carries the not-for-profit restriction that the original RSA code in PGP 2.6ui doesn't have. On the other hand, patents on the IDEA cipher may limit PGP use in your country to nonprofit applications, anyway. Indeed, I understand that there are some countries where private electronic mail is not legal, anyway. These listings are subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Source code (gzipped tar format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26ui-src.tar.gz * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26ui-src.tar.gz.sig * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp26ui-src.tar.gz * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp26ui-src.tar.gz.sig.gz * _TW:_ ftp://nctuccca.edu.tw/PC/wuarchive/pgp/pgp26ui-src.tar.gz * _TW:_ ftp://nctuccca.edu.tw/PC/wuarchive/pgp/pgp26ui-src.tar.gz.sig.gz Source code (zip format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uis.sig * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uis.zip * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp26uis.sig * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp26uis.zip * _TW:_ ftp://nctuccca.edu.tw/PC/wuarchive/pgp/pgp26uis.zip Executable for DOS (zip format): * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uix.sig * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26uix.zip * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp26uix.sig * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp26uix.zip MacIntosh: * _DE:_ ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/pgp/mac /MacPGP2.6ui_beta.sit.hqx * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/PGP/MacPGP2.6ui_V1.2sources.cpt.hqx Other sites to look for the above mentioned files at: ftp.informatik.uni-hamburg.de /pub/virus/crypt/pgp This site has most, if not all, of the current PGP files. ftp.wimsey.bc.ca /pub/crypto/software/dist/US_or_Canada_only_XXXXXXX/PGP (U. S. and Canadian users only) See /pub/crypto/software/README for the characters for XXXXXXXX This site has all public releases of the freeware PGP from 1.0 through 2.6 and 2.6ui. black.ox.ac.uk (129.67.1.165) /src/security/pgp26uix.zip (MS-DOS executables & docs) /src/security/pgp26uis.zip (Unix, MS-DOS, VMS, Amiga sources, docs, info on building PGP into mailers, editors, etc.) There are several other versions of PGP here, including the MIT release. ftp.csn.net /mpj/public/pgp/ contains PGP shells, faq documentation, language kits. ftp.netcom.com /pub/dcosenza -- Some crypto stuff, sometimes includes PGP. /pub/gbe/pgpfaq.asc -- frequently asked questions answered. /pub/qwerty -- How to MacPGP Guide, largest steganography ftp site as well. PGP FAQ, crypto FAQ, US Crypto Policy FAQ, Steganograpy software list. MacUtilites for use with MacPGP. Stealth1.1 + other steganography programs. Send mail to qwerty(a)netcom.com with the subject "Bomb me!" to get the PGP FAQ and MacPGP guide if you don't have ftp access. ftp.ee.und.ac.za /pub/crypto/pgp soda.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security/crypt/PGP ftp.tu-clausthal.de (139.174.2.10) wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) nic.funet.fi (128.214.6.100) /pub/crypt/pgp23A.zip /pub/crypt/pgp23srcA.zip /pub/crypt/pgp23A.tar.Z ftp.uni-kl.de (131.246.9.95) qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) princeton.edu (128.112.228.1) pencil.cs.missouri.edu (128.206.100.207) StealthPGP: The Amiga version can be FTP'ed from the Aminet in /pub/aminet/util/crypt/ as StealthPGP1_0.lha. Also, try an archie search for PGP using the command: archie -s pgp26 (DOS & Unix Versions) archie -s pgp2.6 (MAC Versions) ftpmail: For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "Help" to ftpmail(a)decwrl.dec.com. You will be sent an instruction sheet on how to use the ftpmail service. Another e-mail service is from nic.funet.fi. Send the following mail message to mailserv(a)nic.funet.fi: ENCODER uuencode SEND pub/crypt/pgp23srcA.zip SEND pub/crypt/pgp23A.zip This will deposit the two zipfiles, as 15 batched messages, in your mailbox with about 24 hours. Save and uudecode. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. World Wide Web URLs: (Thanks to mathew(a)mantis.co.uk) _________________________________________________________________ MACPGP 2.3 Program * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/MacPGP/MacPGP2.3.cpt.hqx * _UK:_ ftp://black.ox.ac.uk/src/security/macpgp2.3.cpt.hqx * _SE:_ ftp://isy.liu.se/pub/misc/pgp/2.3A/macpgp2.3.cpt.hqx * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/macpgp2.3.cpt.hqx * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/macpgp2.3.cpt.hqx * _US:_ ftp://soda.berkeley.edu/pub/cypherpunks/pgp/macpgp2.3.cpt.hqx.gz Source code Requires Think C. * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/MacPGP/MacPGP2.2src.sea.hqx -- version 2.2 only * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/macpgp2.3src.sea.hqx.pgp * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/macpgp2.3src.sea.h qx.pgp Documentation PGP is rather counter-intuitive to a Mac user. Luckily, there's a guide to using MacPGP in ftp://ftp.netcom.com/pub/qwerty/Here.is.How.to.MacPGP. _________________________________________________________________ OS/2 PGP You can, of course, run the DOS version of PGP under OS/2. * _DE:_ ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/pgp/2.6ui/pgp26ui-os2.zip * _US:_ ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/pgp26os2.zip ftp://ftp.csn.net/mpj/README.MPJ for the ??????? _________________________________________________________________ AMIGA PGP 2.3 * _DE:_ ftp://ftp.uni-kl.de/pub/aminet/util/crypt/PGPAmi23a_3.lha * _US:_ ftp://ftp.wustl.edu/pub/aminet/util/crypt/PGPAmi23a_3.lha Source * _DE:_ ftp://ftp.uni-kl.de/pub/aminet/util/crypt/PGPAmi23a3_src.lha * _US:_ ftp://ftp.wustl.edu/pub/aminet/util/crypt/PGPAmi23a3_src.lha _________________________________________________________________ ARCHIMEDES PGP * _UK:_ ftp://ftp.demon.co.uk/pub/archimedes/ArcPGP23a _________________________________________________________________ DOCUMENTATION ONLY * _US:_ ftp://net-dist.mit.edu/pub/PGP/pgp26doc.zip * _UK:_ ftp://ftp.demon.co.uk/pub/pgp/pgp26doc.zip * _US:_ ftp://ftp.netcom.com/pub/mpj/public/pgp/pgp26doc.zip * _US:_ ftp://ftp.ftp.csn.net/mpj/public/pgp/pgp26doc.zip _________________________________________________________________ LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip (MIT version) * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26uir.zip (ui version) * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt _________________________________________________________________ OTHER SITES Some cryptographic software is available from ftp://van-bc.wimsey.bc.ca/pub/crypto/software/. Read the README file and proceed from there. BBS sites: Colorado Catacombs BBS (See also the entry above for PGP 2.6) (303) 772-1062 Longmont, Colorado (2 lines) (303) 938-9654 Boulder, Colorado (free call from Denver CO, but 1 line) For free access: log in with your own name, answer the questions, then select [Q]uestionaire 3 from the [M]ain menu. Verified: This morning. Hieroglyphics Voodoo Machine (Colorado) Jim Still (aka Johannes Keppler), sysop. DOS, OS2, and Mac versions. (303) 443-2457 Verified: 5-2-94 For free access for PGP, DLOCK, Secure Drive, etc., log in as "VOO DOO" with the password "NEW" (good for 30 minutes access to free files). Exec-Net (New York) Host BBS for the ILink net. (914) 667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP This information from: Jim Wenzel <jim.wenzel(a)grapevine.lrk.ar.us> If you find a version of the PGP package on a BBS or FTP site and it does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. If it isn't, the package is suspect and should not be used or distributed. The site you found it on should remove it so that it does no further harm to others. ARCHIE WHO? There are many more sites. You can use archie and/or other "net-surfing" tools to find a more up-to-date listing, if desired. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAi4PT2QAAAEEAPPCZnrshEJ9PSnV+mXEwjM4kzJF0kyg2MnLMzo83vWI40ei jogncqdkXT0c2TQWg+Bsu9ckFoXdId0utumYv0aqd8yI/oU/DwJ1zJrqRL2PFbxe ZLofHoKFjvq1TiNiJq9ps3jW6iYS4IU1SzyKhjmyE+K0+WyrPPX0zg8FAL9FAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajiJAJUCBRAu G3chZXmEuMepZt0BAZtAA/0Rw5mintlUDgHycNbeoyIiMHoLu8jWaCSaiGSt+dDU 1A/bUCo+gorv5TYxOClRf3XHjD6zSooWyUz3ehotrzPYLunhVOE2YBxPU+OvKFOc 37mcZrnXGBlF5NblnSYxp0186tGaTm7WMWx7NDlHT4GvhzHJQSOoo48ykDkKm/mk LIkAlQIFEC4PWbs/ZwY8hTPrxQEBKyMD/A7kv91C1ZZIRtkbC9k9lsWOgOnO8wG8 bGMajaco465Z5llWD+Y8QCMdSWcowtOBGfW0Wv1bZ1uebeCpg1L66pJ7C+BOExrk gPqRVCstLLiVerKGeSOZo3yXtxYKYX7mHQPrHp98ef7fUG4IiKS+S+znmGxpJwrV sHZRlhJ3hXUsiQCVAgUQLg9ZefX0zg8FAL9FAQFBTAQAh4u4Vun7WhPuL6fsXiXm paaGfeLtd3biRj/aOMAG1eHuhVdWejx71ormyKTdNB2YV56bpsE3JQ/KhBuYDo0N SkRnqeM2S+Ef7aZEg6Q44uXG52pqCZUldtCeYfOs3aLCR9SMlc6Y3zmpSwB1wKP0 5+tN9zruNYVKKBLWEIFAY7W0K01pY2hhZWwgUGF1bCBKb2huc29uIDxtLnAuam9o bnNvbkBpZWVlLm9yZz60IE1pY2hhZWwgSm9obnNvbiA8bXBqQG5ldGNvbS5jb20+ tChNaWtlIEpvaG5zb24gPDcxMzMxLjIzMzJAY29tcHVzZXJ2ZS5jb20+tCtNaWNo YWVsIFAuIEpvaG5zb24gPG1wam9obnNvQG55eC5jcy5kdS5lZHU+tC1EbyBub3Qg dXNlIGZvciBlbmNyeXB0aW9uIGFmdGVyIDI3IEp1bmUgMTk5Ni4= =rR4q - -----END PGP PUBLIC KEY BLOCK----- ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mpj/README.MPJ -. --- ----- ....| | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLkq2xfX0zg8FAL9FAQFTNgP+MRZEelkRWavsKsLKgTpZEXix++Bhk8CW s1jgJkyFEgEjS5EDPsKUOZKT+peohlfSmMO1dvO4125b+g+jg3rI/BQQOnWA65PT 8ylmelaoQSrzPhbYvPCk/a7zzOqoGnfa3x4C3ECJBRKFvofaZOgo1pzzCxwwa/wW PtYKpgCtp34= =H24Y -----END PGP SIGNATURE-----

1 0

Zimmermann & Johnson at Sept. RMIUG
by mpjohnso＠nyx10.cs.du.edu 17 Dec '03

17 Dec '03

> I have been told that noted Colorado crypto experts Phil Zimmermann > and Mike Johnson, along with Phil's attorney, Phil Dubois, will be > panelists at the September meeting of the Rocky Mountain Internet > Users Group. The meeting will be on Tues. 9/13, 7-9 pm at NCAR in > the Sovereign Republic of Boulder. Duane Thompson tells me that cookies will be served starting at 6:30pm, so the early comers get more than the good seats. :-) I'm not sure if I'm REALLY a crypto expert, but I plan to be there. :-) ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mpj/README.MPJ -. --- ----- ....| | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________|

1 0

Ecash beta test
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

I assume we all signed up for the e$ beta test. Has anyone received a reply yet? -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

2 1