December 2003 - cypherpunks-legacy

Re: LD Admits he is S.Boxx (oops!)
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

Kudos to Mike Ingle for his diligent record keeping and powers of observation. As much as I like the computational solution for these problems, there's no substitute for documenting a mistake that blows somebody's cover. Curtis D. Frye cfrye(a)ciis.mitre.org "If you think I speak for MITRE, I'll tell you how much they pay me and make you feel foolish."

3 2

"Root Canal" questions
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <00541.2835966052.614(a)washofc.cpsr.org> dsobel(a)washofc.cpsr.org writes: > "Root Canal" questions > BTW, anyone have ideas about that name!? Having just been through this procedure (UK National Health, $70), I can tell you - It's all about *Deep Drilling*. Presumably for data, in this case. And it hurts. G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

2 1

DC-Nets
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Jim McCoy has asked me about the DC-Nets references I have cited. Here they are. The seminal Chaum articles are not cited--the main one has been posted to this List more than once. Clearly the Eurocrypt '89 book is the one to get. If your library does not carry it, Springer-Verlag (1-800-SPRINGE) can ship it (and please don't write to me asking for the ISBN!). Also, "Computer Literacy Bookstore" in Sunnyvale (408 area code) usually has a bunch of these Proceedings in various years and can also ship. Disruption is the main problem addressed in these papers. Given the malicious disruption we've seen on our List lately, it is of course a very real problem. Even more so if and when DC-Nets get deployed and some agents/entities seek to automate the disruption process (a likely prospect, given the way they work). A reminder to you all, even though I am not myself working on DC-Nets (trying to program them in Mathematica is pointless, I think), that there are several groups currently interested in DC-Nets: * Jim McCoy and the Austing group (I think they run the DC-Net mailing list...I'm on too many mailing lists, so I skipped this one) * Henry Strickland (Strick) is interested, has plans, and is putting together his crypto toolkit in TCL. * Yanek Martinson, of whom little has been hear lately, was once hot on doing this, and even got a basic DC-Net running. Anyway, here are some important references: - J. N. E. Bos and H den Boer, "Detecting Disrupters in the DC Protocol," Eurocrypt '89, pp. 320327. - M. Waidner and B. Pfitzmann. "The Dining Cryptographers in the Disco," Eurocrypt '89, p. 690. - A. Pfitzmann and M. Waidner, "Networks without User Observability," Computers and Security 6 (No 2, April 1987), pp. 158-166. - B. Pfitzmann and A. Pfitzmann, "How to Break the Direct RSA-Implementation of Mixes," Eurocrypt '89, pp. 373-381. (In case you're curious, the Pfitzmanns are husband and wife.) - J. N. E. Bos, "Disruption and Synchronization in Untraceable Sending," in "Practical Privacy," the 1992 Ph.D. thesis of Bos. Technische Universiteit Eindhoven (Netherlands). (This little book is not published, in purchasable form. The relevant chapter was included in the Xeroxed handout at the first Cypherpunks meeting. You might be able to get the book by contacting Eindhoven directly.) --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Portable crypto code
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

One thing that frustrates me is the difficulty of easily providing implementations of cryptographic algorithms that would be useful on a wide range of machines. A lot of these algorithms are really simple, almost trivial. Yet to write programs to implement them takes pages and pages of code, and making them portable so that people on PC's, Mac's, and Unix machines can use them is almost impossible. Take the simple Chaum cash we have discussed here a few times. The user picks a random x and a random r, calculates r^3*f(x) where f is some one-way function, and sends it to the bank. The bank takes the cube root and sends it back, then the user divides by r. That's pretty simple. Yet to actually implement software to perform these steps raises a host of complications. First, we want to choose a "random" x and r in the range 0..m-1, where m is the bank's public key modulus. But we want these to be strong, unguessable random numbers. We need an unpredictable RNG, and we need to seed it. There are various URNG's that are provably as strong as breaking factoring, discrete logarithms, and such, so these would have to be implemented (as before, most are conceptually trivial). Or you could run DES or IDEA in a feedback mode and take bits from there, for a little less security but more speed. For seeding the RNG you could do like PGP does and retain random numbers from earlier runs, mixing in new randomness when feasible; you could do like RIPEM and scan disk partitions hoping for randomness (I think RIPEM has a lot of other ways of looking for entropy); you could use hardware features like /dev/audio or the free-running, high-speed timers some PC's have; you can get the user to click the mouse or type keys at random. OK, we've got our random numbers. Now we want a one-way function. Again, there are several choices: MD4 and MD5 from RSA; the Secure Hash Standard NIST is pushing; Ralph Merkle's (I forget the name); others based on conventional ciphers like DES or IDEA. Implementations of these are probably available, but portability is a question mark. Now we need a multi-precision math package. We may have needed one for the URNG, too. There are a lot of libraries available in source code for these, but not many of them will work with 16-bit ints, and are tested on DOS and Mac's as well as Unix. Finally, to send the data around, we may want to convert to and from ASCII, and once again there are a lot of choices, but perhaps not too many portable libraries. I suppose RFC1113 and MIME, which are similar but not quite identical, would be the encodings of choice. The point I'm getting to is that it would be nice if all this were done ONCE, and a library made and tested which would work on a wide range of machines. Entry points for one-way functions, multi-precision arithmetic, unpredictable random numbers, conventional encryption, and ascii conversions could all be provided. Multiple alternatives would be supported as much as possible and it should not be difficult to add more as time goes on. Once you had such a library, it would be possible to add a user interface to allow interactive use of the routines. It could be as simple as the Unix "bc" program where you can say "x = y*z" to do arithmetic, or perhaps "x = md5(y)" to call a one-way function. Or the library could perhaps be linked into perl or some other high-level program (does mathematica have hooks for compiled user code?). The nice thing is that since most of the compute time is spent doing the MP arithmetic in these algorithms, an interpreted system which calls compiled libraries can be as efficient as a purely compiled program. I know that others here have made similar proposals in the past, but I have not heard of many results. I'd like to hear more about whether these efforts have produced anything that could be incorporated. It would also be good to hear suggestions for specific existing packages that would meet the portability requirements. I've looked at a couple of MP packages from ripem.msu.edu but so far I haven't had much luck running them under DOS. Perhaps a project like this could allow progress to be made more easily toward cypherpunk goals. By providing a toolkit to programers newly interested in cryptography people will be able to try out ideas more easily without having to re-invent the wheel each time. Let me know if you would be interested in participating in this effort. Hopefully a lot of the pieces already exist and it will just be a matter of pulling them together. Hal Finney hfinney(a)shell.portal.com

3 2

BAY AREA: Schneier Book gone from Cody's
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

(If we had a newsgroup instead of a mailing list, I could send this to ba.cypherpunks instead) I got their last one about 5pm Sunday; when I went to the information desk to ask if they had it, the clerk's response was along the lines of "Cryptography - oh, the blue one? It's been really selling hot - we just got tehm in this morning and you're getting the last one." Bill

1 0

All our eggs in one basket?
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- As cryptography and cryptographic techniques are developed, we tend to put more and more trust in them. It is probably not a bad idea to step back from time to time and ask ourselves if the risks are still reasonable. There is no better example of this than digital cash. Many techniques have been proposed for this as for other applications. It is usually not long before someone finds a critical flaw in the various implementations under consideration. The consequences are usually a loss of confidentiality or embarassments. For example, in the early days of Julf's remailer people came up with surprizing new ways to defeat it, and the consequences were that some identities were revealed and we all marvelled at how this hole had escaped us until that point. Digital cash is another ball game. Before any scheme is adopted we need total confidence in the security of the cryptographic algorithms, protocols, and implementation details. We need a risk analysis to tell us exactly what will happen if two principals collaborate or the bank cheats etc... Schemes such as Chaum's are provocative, but what if 2 years after a digital cash scheme is implemented, someone publishes an easy way to defeat it or cheat? The consequenes could be total chaos. Think of the mental poker problem. A solution was given that seems reasonable. However, someone showed that by taking certain properties of the encryption technique, a bit of information could be learned that would compromise the integrity of the system. In mental poker, no big deal, we stop playing poker. What would happen if your bank suddenly told you that it had no proof that you really had an account there? Wonderer -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLOkFlx1kTJuroDD9AQEnpgH9GNMpcbjnwDzoNFdhPw5wTBdUQolvCAxk r643e/qOjnnlsL99IazAhCnTucRbaOm/v50HcwPcP2698UYWAX1GTg== =Ud6i -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: The Courtesies of Cypherpunks
by owen＠autodesk.com 17 Dec '03

17 Dec '03

Before I start I wish to express that on many occasions Perry has earned my utmost respect, and that the sarcasm I express here is not offered as flame bait, but as an expressions of the ironic nature of this affair. as such it migrates from *wry* comments on Perrys post into a more general rant. > From: "Perry E. Metzger" <pmetzger(a)lehman.com> > Look, everyone -- Is this a command, a request, a plea, or a futile gesture? > Detweiler is a seriously disturbed individual. In your opinion. No matter how common that opinion may be amongst other participants, stating such as *fact*, only opens pandoras box that much further. > Sending him mail saying > "what the hell are you doing -- you're nuts" isn't going to do any > good. Isn't going to what? Good in whose opinion? relative statements with open ended conjecture dangling unspecified but none the less qualified negations of hypothetical scenarios are doing some good? > Crazy people don't think they are crazy. Ignoring his rantings > works a whole lot better than any other strategy. towards what end, assuming that all share the same goal? > I only mailbombed him because he was sending me unsolicited personal > mail and wouldn't stop. Otherwise I ignore him, and I advise others to > do the same. Do you dump your nose-goblin collection into the neighbors mailbox if their dog shits on your front stoop? doing so would be a federal crime would it not? Mailbombing is considered an anti-social act by everyone I know whose ever been the recipient of one. Blaiming your actions on the other guy is just a version of a *He started it* argument, something I find to be more common to adolescents and mental inferiors. Not the kind of thing I usually see from bright people like you Perry! phade to more general rant................................... I am finding this situation most enlightening myself. It directly parallels the situation that I outlined regarding the electronic version of Fag bashers in the queer newsgroups, and the subsequent e-terrorism that has been perpetrated against myself and other admitted homo-sek-shuals who don't take any shit from homo-haters. Larry has simply created a campaign against a different un-natural lifestyle choice, the perverted and obviously criminal desire to remain anonymous. (thats satire BTW) Showing us how to harangue your target with the techniques of mindless prejudged bigotry, and how they usually only engender more of the same. (ala *my mind is made up, don't confuse me with facts) It reminds me of some things I've seen all too often in other corners of the matrix; the subsequent flame wars that ensue from the use of inflamatory terms, (in this case the spoof word. Made more poignant due to the similarity to the british slang word poof.) the inevitable escalation of miscommunication that occurs between people who are talking *at* each other rather than with each other, the reality that electronic freedom still requires some forms of accountability, the fantasy that anonymity makes you free, the irony that those who expand their gripes against individuals as foolish campaigns against whole groups of individuals, are engaged in destroying the very freedoms they claim to be defending. (kinda like sawing off the limb your sitting on, to keep others from sitting next to you!) and that ultimately the only punishment available to an online personality for transgression is exclusion. (so far) ................. To those who wrote to me a while back, telling me to get a thicker skin, and learn to deal with it. I can now say, just get over it. To those who didn't understand the logistics of gaining concensus regarding how to deal with such situations, I am eagerly awaiting your guidance to show me how its done. I think this issue points out the need to develop systems that foster a better quality of communication in a medium that hampers quality at the expense of ease-o-use. I think that examining this situation as an example of a much wider problem will illuminate some of the points I tried to make some months ago. It is my opinion that the situation regarding the use of anonymous systems to harrass and terrorise queers on the net is a laboratory for the study of this issue. Ignore it at your peril IMNSHO. And I think that if any group of people on the net is qualified and capable of dealing inteligent solutions out, this is the group. I think you gotta widen your focus and recognise the broad issues before you narrow in on the specifics, I don't think that solutions to the issues involved can be integrated at the end of a patch-work quilt of solutions that only get implemented after the fact. In short Detweiler isn't the problem, he has merely provided you with some examples to chew on. So go ahead, chase him away, perhaps the next case will not be one that just involves simple neurosis, perhaps it will be full blown psychosis and e-terrorists like we have experienced in the queerer corners of the matrix. (as if this one isn't pretty odd ;-) LUX ./. owen

1 0

Quotable Quotes
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

who was the cypherpunk who said, ``Cypherpunks, It's such a feeling of raw power over lesser intelligences''? I can't remember. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Windows NT password Encryption.
by Darren Reed 17 Dec '03

17 Dec '03

Does anyone know what algorithm Microsoft are using for password encryption on Windows NT ? I've just been to a talk and told it was a proprietry 1-way algorithm, but not DES based (so as to avoid US export laws).

2 1

Duking it out for the decoder ring
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Once again encryption is on the minds of the business community. In the Nov. 22 issue of business week, Carl Ellison is highlighted along with Whitfield Diffie in an article which asserts that those of us once considered paranoid are soon to be considered prescient. Excerpts from the article: >When executives at Stratus headquarters hold teleconferences with the >company's with San Jose (Calif.) engineering center or other offices, >Ellison insists that their words and video be encrypted. He *even* (emphasis >mine) encodes routine electronic mail...Some coworkers call Ellison paranoid. I will venture to say that paranoid (in this context) will soon be synonymous with cautious. >Cryptography is absolutely essential to any kind of electronic business >communication", says Price Waterhouse partner Douglas Kalish. >While AT&T, a big government supplier, has agreed to put clipper in its >secure phones, many companies simply don't trust the governments promises >not to snoop illegally. It would be interesting if the gov't ended up with a cryptography system that has a back door and everyone else had a secure system. Fun with reversal of fortune. Finally, Whitfield Diffie's quote, "Clipper is the most rancid idea to come along in quite some time". As the pendulum swings further toward freedom to encrypt, it's going to take ever more of us to keep it there. Teach anyone who will learn so the pendulum rests on many shoulders. Also here is my Cypherpunks ID Key, I swear that it belongs to the nym my mom gave me and who signed this message, when a better verification method presents itself I will avail myself of it. Scott G. Morham !The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAizKBaAAAAEEANxU5ykmCxvPdC+zKUg99WH7u1/yyVsImtXJClRMvjcPtQ+2 2ilzsjn7wPz//fmKnJkN7dbqSbMy0cUF78+fI8iMsdAOTdO/MpfjNmRylF7sb7aM Fn4DxIBENsJrdLnnLJ9pDWFmVEOUZ+S+n8Thi+mvRovEAcmbhT2paOMjHHAhAAUR tBhTR00gPEN5cGhlcnB1bmtzIElEIEtleT6JAJUCBRAsyzBcnN9G4AhMxxkBAaao A/9primmEtNa2wpNH06dLIkUeTinPFRSnMSb/DG3w+k4NmWLfTsqkG9JwDQx7xeh 4vbf8CiU+JZ31M8ndSdgD5iBnHFiqbzDrxyRn+Vq0Ypj8q4fdxli3YWdEgJa7joT /xrVKAZ9oPEonFOSvcujGbSpazCSEP2UoNMEgzWWNJ4Px7QkU2NvdHQgRy4gTW9y aGFtIDxDeXBoZXJwdW5rcyBJRCBLZXk+ =IyPi - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOWmiD2paOMjHHAhAQFFGQQAvkHnjWkLtRxSKR9jmiUD1NwWocsOyqjR ewuXN2HuwWYmH8lmiSEKTovT2vUp6GjNLfbtQ0fTlxmbwYp0dxZ4mw7BZJWPCLBp vOiDWJSg3o5QNtYkL0kdxjxMYbl8sc4dbNR5vulWE0tB4PHgJXPxwW4+p9/YkLwP oih4XErLStk= =hCwP -----END PGP SIGNATURE-----

2 1

procmail-pgp
by J. Michael Diehl 17 Dec '03

17 Dec '03

Well, I had a few set-backs, but the alpha version of my procmail pgp preprocessor is ready to test. I've been using it for about a week now, and it seems to work well. I hope you enjoy it. Comments are welcome. The procmail recipes in this file will make using many of pgp's Email-related features automatic. What they will do for you is: 1) Automatically verify pgp signed messages. 2) Automatically determine who a pgp encrypted message is intended for. 3) Automatically add mailed pgp keys to your pubring.pgp file. 4) Allow people who do not use pgp to request that their messages to you get stored in an encrypted form. This will prevent nosy systems administrators from reading your mail. 5) Allow people to also request that the entire message, including the header, be encrypted. This will prevent anyone from even determining where you get your mail from, mail logs not withstanding. 6) Modify a message's subject to inform you that it contains a key (key), a signed message (sig), and/or an encrypted message (prv). There are a few things I'd like to add to this file. I'd like to search messages for references to "pgp", "finger" and have procmail finger the sender's account and send the output to pgp - kaf. These recipes are writen in a modular form. The recipes which make up this system can be extracted from the rest of your .procmailrc file with the command: awk '/#.pgp-start/,/#.pgp-end/ {print $0} {continue}' > out.pro To get the system working, you have to have procmail installed, and in your path. You will need to edit the included .procmailrc file as described below. Then you have to put a (the?) .procmailrc file in your home directory. Next, you have to modify your .forward file to look like: (change it as appropriate) mdiehl(a)triton.unm.edu "|IFS=' ';if test .`/bin/hostname` = .triton.unm.edu; then exec /nfs/dorado/u11/mdiehl/bin/procmail -p ; else exit 0; fi" Finally, you will have to configure the .procmailrc file. You will have to change these variables to something appropriate to your environment. PATH= ME= HOME= MAILDIR = /usr/spool/mail SENDMAIL= /usr/lib/sendmail TMP= /usr/tmp The previous ones are self-explanitory. SECSTR= =-=-=-=-=-=-PGP-INFO-=-=-=-=-=-=-= Set this one to something pleasing to the eye, but that only you know. This will prevent others from spoofing the procmail-pgp validation info. Trust me. LOGFILE = $HOME/PROCMAIL_LOG The logfile is invaluable for debugging..... AFROM= "root(a)can.see.this (Big Brother isn't watching me!)" ASUB= "How's the wife?" When a person requests that all of his message is to be encoded, procmail-pgp uses AFROM as the new From: header, and ASUB as the new Subject: header. Be creative. BTW, if you want to request that either all of a message, or just the body is to be encrypted, you include either: X-request-pgp-encoded: all X-request-pgp-encoded: body at the beginning of a line in the body of the message, or in the header. I hope you have lots of fun with this. ;^) ----------cut----here------ ;^) # pgp-start PATH=/usr/local/bin:/usr/ucb:/bin:/usr/bin:/nfs/dorado/e1/ultmips4.2/gnu/bin:/usr/new:$HOME/bin:/nfs/dorado/unsup/bin/:. ME= mdiehl HOME= /nfs/dorado/u11/mdiehl MAILDIR = /usr/spool/mail SECSTR= =-=-=-=-=-=-PGP-INFO-=-=-=-=-=-=-= LOGFILE = $HOME/PROCMAIL_LOG TMP= /usr/tmp AFROM= "root(a)can.see.this (Big Brother isn't watching me!)" ASUB= "How's the wife?" SENDMAIL= /usr/lib/sendmail DEFAULT = $MAILDIR/$ME TMPFILE= $TMP/procmail.$$ VALIDATE= "echo $SECSTR" PGPMSGS= "(^Good)|(^Valid)|(^.WARNING)|(^.ERROR)|(^.Key)|(^.Error)|(^No)|(^File)|(^.You)|(^Bad)|(^pub)|(^sig)" PGPPATH= $HOME DELIVER= "procmail -p $HOME/.procmailrc" LOCKFILE= $MAILDIR/$ME.lock # This will remove the global lockfile # $HOME/.lockmail and the new lockfile # will be $MAILDIR/whatever # # Lets take care of some business first. # VERBOSE=NO DO= `rm -f $HOME/pubring.bak` FROM= `formail -rx"To:"` SUBJECT= `formail -x"Subject:"` LOG= "======$FROM " # pgp-end # # This retains a list of everyone who sends me mail # :0whc | echo $FROM >> $HOME/HEADERS ; sort -u < $HOME/HEADERS > $TMPFILE ; mv -f $TMPFILE $HOME/HEADERS # # # Send and delete PROCMAIL_LOG # :0 * ^Subject:.+PROCMAIL_LOG | cat > /dev/null ; elm -sLog me < $HOME/PROCMAIL_LOG ; rm -f $HOME/PROCMAIL_LOG # # This one sends an automatic reply to special people. # I think I broke this one. :0c * ^Subject:.+1234567890 * !^FROM_DAEMON * !^From.+$ME * !^X-Loop: | (formail -r -A"X-Loop:$ME" ; cat $HOME/AUTO-REPLY) | $SENDMAIL -t # # Forward to my novell account # :0c * ^Subject:.+Urgent ! miked(a)anderson.unm.edu # # From peb(a)procase.com Tue Oct 26 18:03:16 1993 # #:0B #* subscribe|unsubscribe|sign.on|sign.off|signon|signoff|remove|add|SUBSCRIBE|UNSUBSCRIBE #/$HOME/SUBSCRIBTIONS # # DeDigest digests. # :0 * ^From:.+linux-activists@ | formail +1 -A"X-from:Linux-Activists" -ds $DELIVER :0 * ^Subject:.+Homebrew.Digest | formail +1 -A"X-From:Homebrew-Digest" -ds $DELIVER # pgp-start VERBOSE=YES # # Validate pgp signed messages. # :0chHBw * ^-+BEGIN.PGP.SIG * !^X-Loop-signed: | cat > $TMPFILE ; $VALIDATE >> $TMPFILE :0wbAc | pgp -f +batchmode |& egrep $PGPMSGS >>& $TMPFILE ; $VALIDATE >> $TMPFILE :0Ab | cat >> $TMPFILE ; formail < $TMPFILE -i"X-Loop-signed:$ME" -i"Subject: (sig) $SUBJECT" | $DELIVER ; rm -f $TMPFILE ; # # Adds included pgp public keys to keyring. # :0chHBw * ^-+BEGIN.PGP.PUBLIC * !^X-Loop-key: $TMPFILE :0Awc | cat > /dev/null ; $VALIDATE >> $TMPFILE :0wbAc | pgp -kaf +batchmode |& egrep $PGPMSGS >>& $TMPFILE ; $VALIDATE >> $TMPFILE :0bA | cat >> $TMPFILE ; formail < $TMPFILE -i"X-Loop-key:$ME" -i"Subject: (key) $SUBJECT" | $DELIVER ; rm -f $TMPFILE ; # # Validate pgp messages. # :0chHBw * ^-+BEGIN.PGP.MESSAGE * !^X-Loop-message: $TMPFILE :0Awc | cat > /dev/null ; $VALIDATE >> $TMPFILE :0wbAc | pgp -f +batchmode |& egrep $PGPMSGS >>& $TMPFILE ; $VALIDATE >> $TMPFILE :0bA | cat >> $TMPFILE ; formail < $TMPFILE -i"X-Loop-message:$ME" -i"Subject: (prv) $SUBJECT" | $DELIVER ; rm -f $TMPFILE ; # # These two are used to encrypt email that has a specific header in it. # :0hcHBw * ^X-request-pgp-encoded:.+body * !X-Loop * !X-Loop:.+$ME | cat > $TMPFILE :0Ab | pgp -fet $ME >> $TMPFILE ; formail < $TMPFILE -A"X-Loop:$ME" | $DELIVER ; rm -f $TMPFILE ; :0bhHB * ^X-request-pgp-encoded:.+all | pgp -fet $ME | formail -A"From: $AFROM" -A"Subject: $ASUB" | $DELIVER ; rm -f $TMPFILE ; # pgp-end #:0Hbcw #* ^Subject:.+(hacker)|(Hacker)|(HACKER)$ #* ? grep $FROM < $HOME/members #* !X-Loop:.+$ME #| egrep "^((do)|(DO)|(Do)|(password))" > $TMPFILE #:0Ac #| set PASS1=`grep password < $TMPFILE | awk '{ print $2}'` ;\ # set PASS2=`grep $FROM < $HOME/members | awk '{ print $2}'` #LOG= "$PASS1 $PASS2" #:0A #? test "$PASS1 -eq $PASS2" #| elm -s$PASS1 me

2 1

Kiddie Porn Alert
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com There's a Subject Line to Grab You For you Fox TV fans Inside Edition on Tuesday 16 November apparently features "International (Danish) Kiddieporn Downloaded Over the Nets -- and the Government is Powerless to Stop It." Happy viewing. Duncan Frissell Sorry I haven't posted much lately. When one agrees to talk at a conference, one actually has to *write* the talk not to mention clear the decks for the trip. Hope to see some of you at The First European Conference on Computers, Freedom and Privacy next Saturday in London. --- WinQwk 2.0b#1165

1 0

OOPS!
by J. Michael Diehl 17 Dec '03

17 Dec '03

I forgot to extract just the pgp-related stuff from my .procmailrc file. OH well, at least I told you how to do it. ;^) Just save the whole message, and type awk '/#.pgp-start/,/#.pgp-end/ {print $0} {continue}' < msg > .procmailrc Sorry about that. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

Fascism...?
by J. Michael Diehl 17 Dec '03

17 Dec '03

I got this from a friend. While I don't dispute this school's right to do this, I do question the ethics. Just thought I'd send out some non-Detweiler traffic. ;^) > >A revised Computer Use Policy was approved the CS Department Faculty > >on November 3, 1993. The revised policy has been placed on the doors > >of SH 118, SH 169, and SH 123. The substantive change to the policy > >is that users now give explicit permission to the Department to > >inspect their accounts when necessary. > > > >Continuing to use your account past November 19 will constitute > >acceptance of the revised policy. If you prefer, you may contact the > >COG to have your account removed. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

Re: procmail-pgp (fwd)
by steve willey 17 Dec '03

17 Dec '03

jmd, asked me to forward this to the list, i think, i was testing his procmail recipe and all that was ever seen of his most recent message was the subject line and a bunch of error messages in my procmail log file :) ---------- Forwarded message ---------- Date: Tue, 16 Nov 1993 01:14:20 -0700 (MST) From: "J. Michael Diehl" <mdiehl(a)triton.unm.edu> To: steve willey <willey(a)seattleu.edu> Subject: Re: procmail-pgp According to steve willey: > any thoughts on procmail version specificy for this pgp recipie? i am > currently using v2.03, which, i am pretty sure, is not the current version. > i'm ready to try it but..., please let me know if you know of any problems > with older procmail versions. I'm using v2.91. I don't think you will have a prob. tho. Let me know. Send yourself a few messages. You need to send a key, a signed message, and an encrypted message. You also might want to try the requests. Hope you like it. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

secure phones - STU3
by lear35!mdbomber＠nebula.acs.uci.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I browsed through the owner's manual for the AT&T STU-III secure phone unit today. It has no technical information whatsoever (security through obscurity?). It uses a so called CIK (Crypto Ignition Key), which resembles one of those electronic keys that hotels use. It must be inserted in a "lock" in the phone, and turned 90 degrees. This will enable one of the crypto keys that is stored in the phone's battery backed up memory (loaded previously by a "COMSEC custodian" through a data port on the phone. The manual warns the phone must be in a relatively secure location and points out an emergency erase button that wipes out the keys stored in memory. Then you call someone, say you want a secure channel, wait for them to insert their CIK (and tell you so), then touch the "secure voice" button on the panel. The manual then says it will go through an "authentication process", the results of which will be displayed on the STU-III's screen. It will show data such as the other stations ID number, the security level of the channel (secret, top secret, etc), and the baud rate. Does anyone know how this works technically? My speculation: It seems to be a public key system. The phone's memory seems to contain a secret keyring, and a CIK is a 'passphrase' to a secret key, to make an analogy to PGP. Then the authentication process includes exchanging a session key for a conventional crypto system - no doubt DES. Apparently the NSA issues the keys to authorized agencies and contractors. The public keys contain information such as the ID number of the key, possibly the authorized user's name, the security clearance level for that key, etc, which is exchanged during authentication. Am I on the right track? Comments and speculations welcome. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLOg+wDSSmvXojb+5AQEplQH+JdiaWbzgXiWPtqVaQcPIo4arzOI8Fl1Z 6ylkT9UL/Qh8BpoyVK9PqiEwazaLPxCxWYksOty7LlRy0zByVXqWHw== =8E4k -----END PGP SIGNATURE-----

1 0

ENCLOSING SOMETHIN
by thomas.hughes＠chrysalis.org 17 Dec '03

17 Dec '03

Sa> Isn't it a problem to enclose PGP-blocks within a clearsig'ed Sa> message, as the initial -'s in his public key here are slightly Sa> mangled. I've seen this before, and tried to manually reconstruct the Sa> keyblock headers, but with no luck. Sa> Anyone know what one can do about this? pgp signed_message_with_keyblock.asc -o unsigned_message_with_keyblock.asc pgp +force -ka unsigned_message_with_keyblock running a signed message through PGP will return it to it's original pre-signature form. go figure .... ___ Blue Wave/QWK v2.12

1 0

ENCRYPTED FILE SYSTEMS
by thomas.hughes＠chrysalis.org 17 Dec '03

17 Dec '03

>> ObCrypt: I'm looking for info on designing a distributed encrypted >> filesystem. Any pointers? in the "PC" world, look for DISKREET (with Norton's Utilities). it simple, "Stacker"-like, and user friendly. it seems to offer "feeble DES" and "even more feeble DES" it's speed is almost negligable when in use. (which doesn't say very much for the "stength" of the encryption.) ObInTheSameVein?: anyone ever thought of taking a "software MNP" program and creating a "V42enc" software modem protocol? auto-generate unique/random keys after the connection is etablished, allow for "re-training" the connection by generating/switching to a new key. maybe re-train every "set number of seconds" ... pick a "fast" encryption method, and a RSA public key length that is proportional to the strength of the encryption, and have at it. talk about "just like uncle sam does it!" ... If the NSA is paranoid over PGP, what will they think of plug in pirate PROMS for USR Couriers that will create obscenely secure connections? (although the encrypted connections might not fly along at full speed, that tis but a small price to pay...)

1 0

No subject
by an50060＠anon.penet.fi 17 Dec '03

17 Dec '03

Something like this is probably more practical: 1. Driver's license is presented in person to you or qualified staff. 2. Driver's license and two other ID from list are presented in person to you or qualified staff 3. Driver's license is presented in person to registered notary public and stamped certificate sent to you. 4. Driver's license and two other ID from list are presented in person to registered notary public and stamped certificate sent to you. I would avoid accepting xeroxes altogether; too easy to forge. would you change your mind if i told you that i hold three passports in three differe nt names? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

ENCRYPTED FILE SYSTEM
by Mike Ingle 17 Dec '03

17 Dec '03

"thomas.hughes(a)chrysalis.org" wrote: >Subj: ENCRYPTED FILE SYSTEMS >>> ObCrypt: I'm looking for info on designing a distributed encrypted >>> filesystem. Any pointers? >in the "PC" world, look for DISKREET (with Norton's Utilities). >it simple, "Stacker"-like, and user friendly. >it seems to offer "feeble DES" > and "even more feeble DES" >it's speed is almost negligable when in use. > (which doesn't say very much for the "stength" of the encryption.) No, don't use Diskreet. Use my Secure Drive. Beta now if you want it, and release with source soon. Uses IDEACFB, protects a hd partition and floppies, takes only 2K ram, and is very fast. Reasonably user-friendly. You have to create a D: partition to use on a hard drive. >If the NSA is paranoid over PGP, what will they think of plug in pirate >PROMS for USR Couriers that will create obscenely secure connections? > (although the encrypted connections might not fly along at full speed, > that tis but a small price to pay...) What's the CPU in a Courier? Is the hardware well enough documented to hack something like this up? I once burned a rom for a friend's courier, from a file which he had, to give it V.32 instead of just HST which it previously had. Not sure where the file came from. An SRAM also had to be installed. --- MikeIngle(a)delphi.com

3 2

Secure phones - STU3
by Mike Ingle 17 Dec '03

17 Dec '03

"lear35!mdbomber(a)nebula.acs.uci.edu" wrote: >Subj: secure phones - STU3 >I browsed through the owner's manual for the AT&T STU-III secure phone >unit today. It has no technical information whatsoever (security >through obscurity?). Never Say Anything... >It uses a so called CIK (Crypto Ignition Key), which resembles one of >those electronic keys that hotels use. It must be inserted in a >"lock" in the phone, and turned 90 degrees. This will enable one of >the crypto keys that is stored in the phone's battery backed up memory >(loaded previously by a "COMSEC custodian" through a data port on the >phone. The manual warns the phone must be in a relatively secure >location and points out an emergency erase button that wipes out the >keys stored in memory. They should put a mercury switch in it, so if you steal it and move it around much, it wipes the keys. Also a "duress number" which works okay, but displays a warning on the other party's phone display, in case you're forced to call someone with a gun to your head. >Then you call someone, say you want a secure channel, wait for >them to insert their CIK (and tell you so), then touch the "secure >voice" button on the panel. What all buttons does the phone have? Normal dialing, secure voice, self-destruct, anything else? >The manual then says it will go through an "authentication process", >the results of which will be displayed on the STU-III's screen. It >will show data such as the other stations ID number, the security >level of the channel (secret, top secret, etc), and the baud rate. What baud rates does it use? How is the sound quality in secure mode? It must use either a DSP (good sound, high baud) or a vocoder (robot voice, low baud). >Does anyone know how this works technically? My speculation: It seems >to be a public key system. The phone's memory seems to contain a >secret keyring, and a CIK is a 'passphrase' to a secret key, to make >an analogy to PGP. Then the authentication process includes >exchanging a session key for a conventional crypto system - no doubt >DES. It could be public-key or DH exchange. Does the manual tell you to read a hash value to the other party and verify it? If so, it's DH and that's the protection against the man-in-the-middle. If not, it's either public-key or DH-like but with authentication. In any case, the key probably contains a small EPROM which selects and decrypts one of the keys in the memory. If classified secret and top secret info is involved, DES would not be used. The NSA wants us to use DES, but they know better than to use it for classified info. Probably something similar to Skipjack, in a similar tamper-proof chip. >Apparently the NSA issues the keys to authorized agencies and >contractors. The public keys contain information such as the ID >number of the key, possibly the authorized user's name, the security >clearance level for that key, etc, which is exchanged during >authentication. NSA issues the keys...I feel safer already! Can you say, "key escrow"? --- MikeIngle(a)delphi.com

2 1

No Subject
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

>From: thomas.hughes(a)chrysalis.org > >Date: Tue, 16 Nov 93 02:38:02 >Subject: ENCRYPTED FILE SYSTEMS >To: cypherpunks(a)toad.com > ObInTheSameVein?: > anyone ever thought of taking a "software MNP" program > and creating a "V42enc" software modem protocol? > auto-generate unique/random keys after the connection is etablished, > allow for "re-training" the connection by generating/switching to a new > key. maybe re-train every "set number of seconds" ... > pick a "fast" encryption method, and a RSA public key length that is > proportional to the strength of the encryption, and have at it. Yep.

1 0

Re: The Courtesies of Cypherpunks
by Clark Reynard 17 Dec '03

17 Dec '03

yep, it's happened before. and loudly; it repeats itself about once every couple months; some people have even been _more_ floridly and spectacularly whack-o.

1 0

Re: Info on L.Detweiler
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> On Mon, 15 Nov 1993, Douglas Barnes wrote: > > > Here's some info folks might appreciate (all numbers area code > > 303, unless otherwise noted): [handy info to help you ruin Detweiler's life deleted] > > Note that this is just the easy stuff, I have folks digging deeper. > > More to come... > > > > -- > > ---------------- /\ > > Douglas Barnes cman(a)illuminati.io.com / \ > > Chief Wizard (512) 448-8950 (d), 447-7866 (v) / () \ > > Illuminati Online metaverse.io.com 7777 /______\ I'd just like to say that I think this sucks bad. I don't like cops, and you're being one, or worse. And with a team of folks helping you to dig even deeper? This is ugly, vicious, and authoritarian, and I can't believe that you would actually BRAG to hundreds of people that you're doing it. Sounds to me like you're a very frustrated person. You are clearly an insensitive bastard. I just hope that you encounter this kind of sympathy if YOU go through a "difficult period" in your life. --Dave.

1 0

Re:Info on L. Detweiler
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Douglas Barnes wrote: >here's some info folks might appreciate (all numbers area code 303, unless >otherwise noted). >[irrelevent information] I know that I do not appreciate knowing this and it is difficult to believe that you would actually waste your time by digging up information to make someone's life difficult (even if he does keep the list noise level up). Use the delete key or kill file. If you really succeed in annoying him enough, I hope for your sake you have few leaders as to where you reside and that you live far away. Gestapo tactics such as these, used by certain governments, are what we seek to eliminate in the digital world. Why would you seek to implement on the list that which we (at least some of us) are trying to eliminate from the net? It's crap that can be done without. Direct your efforts more profitably. Scott G. Morham !The First, VACCINIA(a)uncvx1.oit.unc.edu! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOhyqz2paOMjHHAhAQHrSwP9GXG6nv1/ICtwCgvWte7Z15nhL/+wPSz2 LWFgFdJ/mJ1ecf9SVSNp2m3uyAoxG0ZARY/5Q6dPEm917W7gxCMxJ/JAFeNoH2hU 1FBLiP4vzNQYlqhiexqFQFOO4SgMLO6QNEAK2zLSv00SwQhqVdMHEHkp7KCMpESg bO46x8BGaYk= =D0tP -----END PGP SIGNATURE-----

1 0