December 2003 - cypherpunks-legacy

"GOOD" GOVERNMENT
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Carl Ellison wondered: To what extent is gov't a home for bullies and to what extent is it the collective defense against bullies ...? How do we turn it from the first to the second? As I see it, it's always a home for bullies masquerading as a collective defense. Sometimes it actually it actually has to perform its advertised defense function. Like naked quarks, purely defensive governments cannot exist. They are bipolar by nature, with some poles (i.e., the bullying part) being "more equal than others." S a n d y "There's no government, like no government" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Digital Cash mini-FAQ for the layman
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I recently wrote a description of digital cash for Tom Steinert-Threlkeld, Technology Writer for the Dallas Morning News. I figured I might as well post it here in case there are any newbies that are still coming up to speed. Keep in mind that my intended audience is a person who is in touch with the latest commercially available technology, but is not an engineer, mathematician, or scientist. I've intentionally generalized and oversimplified the descriptions to keep from getting bogged down in the details. If I've made any gross errors let me know, but I think most of the information is accurate. Q: How is digital cash possible? A: Public-key cryptography and digital signatures (both blind and non-blind signatures) make digital cash possible. It would take too long to go into detail how public-key cryptography and digital signatures work. But the basic gist is that banks and customers would have public-key encryption keys. Public-key encryption keys come in pairs. A private key known only to the owner, and a public key, made available to everyone. Whatever the private key encrypts, the public key can decrypt, and vice verse. Banks and customers use their keys to encrypt (for security) and sign (for identification) blocks of digital data that represent money orders. A bank "signs" money orders using its private key and customers and merchants verify the signed money orders using the bank's widely published public key. Customers sign deposits and withdraws using their private key and the bank uses the customer's public key to verify the signed withdraws and deposits. Q: Are there different kinds of digital cash? A: Yes. In general, there are two distinct types of digital cash: identified digital cash and anonymous digital cash. Identified digital cash contains information revealing the identity of the person who originally withdrew the money from the bank. Also, in much the same manner as credit cards, identified digital cash enables the bank to track the money as it moves through the economy. Anonymous digital cash works just like real paper cash. Once anonymous digital cash is withdrawn from an account, it can be spent or given away without leaving a transaction trail. You create anonymous digital cash by using numbered bank accounts and blind signatures rather than fully identified accounts and non-blind signatures. [To better understand blind signatures and their use with digital cash, I highly recommend skimming through chapters 1 - 6 of Bruce Schneier's book _Applied Cryptography_ (available at Taylor's Technical Books). It is quite readable, even to the layman. He doesn't get into the heavy-duty math until later in the book. Even if you don't write a digital cash column in the near future, I still recommend reading through chapters 1 - 6 of _Applied Cryptography_. Bruce does a very good job of describing the wide variety of interesting things you can do when you combine computers, networks, and cryptography.] There are two varieties of each type of digital cash: online digital cash and offline digital cash. Online means you need to interact with a bank (via modem or network) to conduct a transaction with a third party. Offline means you can conduct a transaction without having to directly involve a bank. Offline anonymous digital cash is the most complex form of digital cash because of the double-spending problem. Q: What is the double-spending problem? A: Since digital cash is just a bunch of bits, a piece of digital cash is very easy to duplicate. Since the copy is indistinguishable from the original you might think that counterfeiting would be impossible to detect. A trivial digital cash system would allow me to copy of a piece of digital cash and spend both copies. I could become a millionaire in a matter of a few minutes. Obviously, real digital cash systems must be able to prevent or detect double spending. Online digital cash systems prevent double spending by requiring merchants to contact the bank's computer with every sale. The bank computer maintains a database of all the spent pieces of digital cash and can easily indicate to the merchant if a given piece of digital cash is still spendable. If the bank computer says the digital cash has already been spent, the merchant refuses the sale. This is very similar to the way merchants currently verify credit cards at the point of sale. Offline digital cash systems detect double spending in a couple of different ways. One way is to create a special smart card containing a tamper-proof chip called an "Observer" (in some systems). The Observer chip keeps a mini database of all the pieces of digital cash spent by that smart card. If the owner of the smart card attempts to copy some digital cash and spend it twice, the imbedded Observer chip would detect the attempt and would not allow the transaction. Since the Observer chip is tamper-proof, the owner cannot erase the mini-database without permanently damaging the smart card. The other way offline digital cash systems handle double spending is to structure the digital cash and cryptographic protocols so the identity of the double spender is known by the time the piece of digital cash makes it way back to the bank. If users of the offline digital cash know they will get caught, the incidents of double spending will be minimized (in theory). The advantage of these kinds of offline systems is that they don't require special tamper-proof chips. The entire system can be written in software and can run on ordinary PCs or cheap smart cards. It is easy to construct this kind of offline system for identified digital cash. Identified offline digital cash systems can accumulate the complete path the digital cash made through the economy. The identified digital cash "grows" each time it is spent. The particulars of each transaction are appended to the piece of digital cash and travel with it as it moves from person to person, merchant to vender. When the cash is finally deposited, the bank checks its database to see if the piece of digital cash was double spent. If the digital cash was copied and spent more than once, it will eventually appear twice in the "spent" database. The bank uses the transaction trails to identify the double spender. Offline anonymous digital cash (sans Observer chip) also grows with each transaction, but the information that is accumulated is of a different nature. The result is the same however. When the anonymous digital cash reaches the bank, the bank will be able to examine it's database and determine if the digital cash was double spent. The information accumulated along the way will identify the double spender. The big difference between offline anonymous digital cash and offline identified digital cash is that the information accumulated with anonymous digital cash will only reveal the identity of the spender if the cash is double spent. If the anonymous digital cash is not double spent, the bank can not determine the identity of the original spender nor can it reconstruct the path the cash took through the economy. With identified digital cash, both offline or online, the bank can always reconstruct the path the cash took through the economy. The bank will know what everyone bought, where they bought it, when they bought it, and how much they paid. And what the bank knows, the IRS knows. By the way, did you declare that $20 bill your Grandmother gave you for your birthday? You didn't? Well, you wont have to worry about forgetting those sorts of things when everybody is using fully identified digital cash. As a matter of fact, you wont even have to worry about filing a tax return. The IRS will just send you a bill. Jim_Miller(a)suite.com

1 0

Re: How Did This Get Done?
by Matthew Ghio 17 Dec '03

17 Dec '03

> I picked this up from a post in alt.sex.stories (and yeah....man does not > live on talk.politics.crypto alone :>) : > > > ---------------------------------------------------------------------------- > Path: io.org!sun.cais.com!news.sprintlink.net!tequesta.gate.net!sysop > From: no_more_faggots(a)faggots.must.die.com <===== Is this a trick? > Newsgroups: alt.sex.stories > Subject: NO MORE FAGGOT STORIES! > Date: 5 Sep 1994 21:13:00 GMT > Lines: 1 > Message-ID: <34g1ks$jn1(a)tequesta.gate.net> > NNTP-Posting-Host: hopi.gate.net > > NO MORE FAGGOT STORIES DAMMIT > ----------------------------------------------------------------------------- > > How the hell did the poster "customize" his address to ...ummm...fit the > post??? The same way the remailers insert "nobody" or "anonymous". Read RFC 977... (telnet port 119) Whoever it is, I wish he would quit it, I've gotten several complaints about someone flaming gays via my remailer in that group.

2 1

prz in NYC on Saurday, Sunday
by Philip Zimmermann 17 Dec '03

17 Dec '03

Hello PGP users. I'm going to be in NYC on Saturday and Sunday. If anyone in New York wants to get together and conspire to subvert our way of life, send me some email and I'll pick it up on the road. I have become too used to never buying my own lunch when traveling to places where cypherpunkers live. I'll be arriving late Saturday morning and leaving Sunday evening. Saturday night is booked. On Friday I can be reached at 617 253-0161. Philip Zimmermann prz(a)acm.org

1 0

Re: Where can I get cypherpunk t-shirts?
by Matt Thomlinson 17 Dec '03

17 Dec '03

From: Greg Broiles <greg(a)ideath.goldenbear.com> I did, however, get my "Don't give Big Brother a master key" T-shirt very quickly. Would order from those folks again (sorry, don't have the address handy, though). at crypto I had a half-dozen requests for info regarding the big brother inside/1984 shirts. Is another run of these possible? I could probably scrape together that many orders just here in Msoft, I beleive. matt

1 0

Re: Where can I get cypherpunk t-shirts?
by David K. Merriman 17 Dec '03

17 Dec '03

> > at crypto I had a half-dozen requests for info regarding > the big brother inside/1984 shirts. Is another run of these > possible? I could probably scrape together that many > orders just here in Msoft, I beleive. > > matt > I'd still like to find one of the "eye" 1984 T-shirts; it's what I thought I was ordering when I got the Master Key shirt instead (though I still like the Master Key :-) Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Australian Crypto
by Sherry Mayo 17 Dec '03

17 Dec '03

Matthew Gream said... >Well, fuck that for thinking I was living under a less restrictive >regime -- and I can say goodbye to an international market for my >software. > [...snip] > >In short: Anything cryptographic, they want to know about, and they >want to know about it on a per end-user basis. They advise against >distribution on the "Internet" and any distribution without prior >approval otherwise there could be "problems". > >Matthew. I am more than a little concerned by this as I have just put PGP source and executables on my experimental WWW server (Australian based). I announced it on talk.politics.crypto yesterday before I read this post. I thought I was doing a service by providing a faster download for Aussie users (downloading big files from outside Aus is painfully slow). I hope I'm not taking an unacceptable risk with my temporary residence visa :-( I too made the mistake of assuming that the Aussie regulations were more relaxed (like those of the UK). Oh well for what it's worth, here's the address: http://rschp2.anu.edu.au:8080/crypt.html Sherry (waiting for those ASIO spooks :-)

1 0

Cypher related T-Shirts
by Joseph Block 17 Dec '03

17 Dec '03

All this talk about T-shirts has me lusting for a suitable cypher related shirt. I missed the initial offerings, so would anyone who has any shirts left they'd like to unload please email me with details of the shirt and prices? Thanks, jpb(a)gate.net "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A)

1 0

Justice Jackson on Diary Escrow
by frissell＠panix.com 17 Dec '03

17 Dec '03

Today's WSJ has an article by a Cato type about an Indiana businessman who told state labor investigators to get stuffed. In the course of this article, the author quoted a 1948 opion (in dissent?) by Justice Jackson: The government could simplify criminal law enforcement by requiring every citizen "to keep a diary that would show where he was at all times, with whom he was, and what he was up to." Now we know where they got the idea for various "escrow" and DTI schemes. DCF Who also fondly remembers Justice Jackson's strong dissent in Korematsu vs. US against those great civil libertarians Black and Douglas who voted to uphold that great liberal FDR's imprisonment of persons of Japanese ancestry.

1 0

Correction to CEB
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'd like to clarify something about the recent Cypherpunks Electronic Book that was posted: In the table of contents, the listing for the program WinPGP26 could be misunderstood as coming from me; I'd like to state that I simply forwarded a copy of the program (in it's shareware version) - I am *not* it's author (t'were that it were so!). The author is: Christopher W. Geib 7605 Mt. Hood Dayton, OH 45424 email: 72144.1426(a)compuserve.com I *have* however, registered the program, and am quite pleased with it - the author is _very_ responsive to feedback from users. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLm0qhcVrTvyYOzAZAQFE0gQAn4iDHD3T84scktaSY6OwY0MKu9L7areh wLKdrIpAm89Vmd5LHxhZADNZk43UR7xg6UnomGVkLdKq+T4tMH0ZnF1IR+b1/VmS XLS/K/cQ1TRzR18AgZXhavFOzrqNI0JsQrGVk/+nbrydeOvSEyP7N4LB1idvK3qq fTY8HCOD69E= =FGOM -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi3uZ2MAAAEEALWQtxX77SZSaFls6cVbPp+fZS4MNyKK3ZFYQo0qWyj+0tMq YgRTPRJRaCQixo63RttknogfPp514qdVMZw5iPeOXmD+RxrmTTwlbGqA7QUiG1x5 LG2Zims5zk4U6/rt8hwLh0/8E4lIb9r5d31qc8L1A9Twk/cmN8VrTvyYOzAZAAUR tClEYXZpZCBLLiBNZXJyaW1hbiA8bWVycmltYW5AbWV0cm9uZXQuY29tPokAlQIF EC3uaE3Fa078mDswGQEBbI8D/0FiwDcbfeNyDVJ+7EIWHjIxVkIGu+ArYUEllR3G SBHVZ9Vh7n8bNXeNHMnG5cZ23TLMVvweyhxFS+cDi+I7omeDNr6x65z500LxfUvL K5bSuSiBVkTp2z+/iojY/662JwKHzEEunuJ4CO8Yhxy11CdeszEX7DpXzRxLL92r EmO2 =4ZfP -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Reputation Capital papers?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:20 PM 9/6/94 -0700, Hal wrote: >P.S. I did find a paper on the net called "Endorsements, Licensing, >and Insurance for Distributed System Services", by Lai, Medvinsky, >and Newman of Information Sciences Institute. Here is the abstract: [snip...] >Unfortunately, I can't recall where I saw the pointer to this paper. >I'm sure other people read the same lists and newsgroups I do so perhaps >someone else can provide a pointer. Also, my copy of the postscript >paper would only print the first three pages, so I can't really evaluate >their ideas. Try this... >From: bcn(a)ISI.EDU >Date: Sun, 4 Sep 1994 13:05:42 -0700 >Original-From: Clifford Neuman <bcn(a)ISI.EDU> >To: www-buyinfo(a)allegra.att.com, kerberos(a)mit.edu >Subject: New paper available >X-UIDL: 778899999.011 > >A new paper is available by FTP that may be of interest to the readers >of this list. The paper will be presented in November at the Second >ACM Conference on Computer and Communications Security. > > Charlie Lai, Gennady Medvinsky, and B. Clifford Neuman. Endorsements, > Licensing, and Insurance for Distributed System Services. 2nd ACM > Conference on Computer and Communications Security, Fairfax VA, > November 1994. > >The paper discusses mechanisms for confidence building on the NII. In >particular it discusses methods by which users may assure themselves >of the competence and honesty of service providers on the network. >The paper is available as: > > ftp://prospero.isi.edu/pub/papers/security/insurance-cccs94.ps.Z > >Clifford Neuman > I didn't drop off the face of the earth, I just got a hot project thrown into my lap. I really want to come back and talk about offline cash some more, <groan!> but I won't have a chance for a bit. Anyway this thread is way cool.... Bye! Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

believing three impossible things before breakfast
by Carl Ellison 17 Dec '03

17 Dec '03

There was a news report/discussion tonight about birth control -- and someone advocating that all you need to do is just tell teens to say "no" to sex before marriage, then you won't need to distribute condoms without parental permission.... Suddenly it hit me that the same frame of mind was clearly behind the Clipper Initiative. Do you think there's a way to test for this ability to believe nonsense? Do you think there's a way to treat it? - Carl

1 0

AIDs testing and privacy
by Jeff Gostin 17 Dec '03

17 Dec '03

pstemari(a)bismark.cbis.com (Paul J. Ste. Marie) writes: > Of course, with ANI, calling an 800 number is not an anonymous act, > unless you one of the few that know you need to do it from a payphone. We tell children not to do things until they are old enough to be able to figure it out for themselves. If they cared enough about their privacy, they'd know. Hell, there's alot I don't know about maintaining privacy and security. However, I _do_ know that calling from a pay phone outside of 5 miles from your house is an easy way to take care of the problem. --J

1 0

Al Gore's home page
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

After reading the official announcement in "What's new with NSCA Mosaic" I just checked out Vice President Al Gore's home page at http://www.financenet.gov/vpgore.html Interersting that except for the "This is the Vice President's Mosaic Home Page" header, it is all empty. This from the man who wants to bring us the Information superhighway. Why can't politicians stay away from stuff they don't understand? Because that would mean that they have to stay away from everything. Just another anarchist, -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

4 3

The New World Order
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

John Young <jya(a)pipeline.com>: > Tim, would you expand the link to crypto of unipolar > superpower? > Maybe some of the non-US c'punks can add more. I'll illustrate by example. Two years ago, the US bullied Russia to renegue on a deal with the Indian Space Research Organization to transfer cryogenic rocket engine technology for the Indian Geostationary Satellite Launch Vehicle. The US claimed that the technology was dual-use and prohibited by the MTCR. India and the Russian company, Glavkosmos, suggested that the reasons were commercial rather than defence, as such engines are useless in ballistic missiles due to their lengthy preparation period, while an Indian GSLV would pose major competition to the US space industry. Russia backed down after Yeltsin's arm was twisted so hard that he negated a personal statement he made when in New Delhi. Recently the Defence Research and Development Organization made a secure phone for commercial (non-defence) use. It has yet to reach the market, and I am in the process of finding out what technology it uses, but if Clipper passes in the US, India could be pressurized into abandoning it in favour of a Clipper-like alternative. As an aside, the Indian government likes to show that it's not following US orders (not signing the NPT etc) and the GSLV will probably be launched with indigenously developed engines in 1998. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

PGP comes of age
by Dave Otto 17 Dec '03

17 Dec '03

Got the following blurb from ORA.COM last Friday. Pretty cool! ------- Forwarded Message O'REILLY'S FALL RELEASES PGP: Pretty Good Privacy by Simson Garfinkel 1st Edition November 1994 (est.) 250 pages (est),ISBN: 1-56592-098-8, $17.95 (est) PGP is a freely available encryption program that protects the privacy of files and electronic mail. It uses powerful public key cryptography and works on virtually every platform. PGP: Pretty Good Privacy by Simson Garfinkel is both a readable technical users guide and a fascinating behind-the-scenes look at cryptography and privacy. Part I of the book describes how to use PGP: protecting files and email, creating and using keys, signing messages, certifying and distributing keys, and using key servers. Part II provides background on cryptography, battles against public key patents and U.S. government export restrictions, and other aspects of the ongoing public debates about privacy and free speech. - -- Brian Erwin, brian(a)ora.com O'Reilly & Associates 103A Morris Street, Sebastopol CA 95472 707-829-0515, Fax 707-829-0104 ------- End of Forwarded Message Dave Otto -- dave(a)marvin.jta.edd.ca.gov -- daveotto(a)acm.org "Pay no attention to the man behind the curtain!" [the Great Oz] finger DaveOtto(a)ACM.org for PGP 2.6 key <0x3300e841> fingerprint = 78 71 3A 5B FD 8A 9A F1 8F BC E8 6A C7 BD A4 DD

1 0

Where to Get the Latest PGP (Pretty Good Privacy) FAQ
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 7 September 1994 by Mike Johnson) WHAT IS THE LATEST VERSION? There is more than one latest version. Pick one or more of the following that best suits your computer, patent restrictions, and export restrictions. Some countries (like France) may also restrict import or even use of strong cryptography like PGP. |-----------------+---------------------+---------------------------------| | Platform(s) | Latest Version | Distribution File Names | |-----------------+---------------------+---------------------------------| | DOS, Unix, | Viacrypt PGP 2.7 | disk sets | | or WinCIM/CSNav | | | |-----------------+---------------------+---------------------------------| | DOS, Unix, | MIT PGP 2.6.1 | pgp261.zip (DOS + docs) | | others | | pgp261s.zip (source) | | | | pg261s.zip source on CompuServe | | | | pgp261.tar.gz (source) | | | | pgp261.gz (same as above on DOS)| | | | pgp261.tar.Z (source) | | | | pgp261dc.zip (documentation) | | | | pg261d.zip (docs on CompuServe) | |-----------------+---------------------+---------------------------------| | Macintosh | MIT PGP 2.6 | MacPGP2.6.sea.hqx (binary+docs) | | | | macpgp26.hqx (same as above) | | | | MacPGP2.6.src.sea.hqx (source) | | | | macpgp26.src (same as above) | | | | MacPGP2.6-68000.sea.hqx (binary)| | | | mcpgp268.hqx (same as above) | |-----------------+---------------------+---------------------------------| | Mac Applescript | MacPGP 2.6ui v 1.2 | MacPGP-2.6ui-v1.2.sit.hqx | | | | MacPGP2.6ui_V1.2_sources.cpt.hqx| | | | MacPGP2.6uiV1.2en.cpt.hqx | | | | MacPGP2.6uiV1.2src.cpt.hqx | | | | MacPGP2.6uiV1.2.68000.hqx | |-----------------+---------------------+---------------------------------| | Amiga | Amiga PGP 2.3a.4 | PGPAmi23a_4.lha | |-----------------+---------------------+---------------------------------| | Atari | Atari PGP 2.6ui | pgp26uib.lzh (binary, docs) | | | | pgp26uis.lzh | |-----------------+---------------------+---------------------------------| | Archimedes | Archimedes 2.3a | ArcPGP23a | |-----------------+---------------------+---------------------------------| Note: there are other versions available, but these are either old, or outside of the mainstream PGP project. Look for signatures from one of three sources: Viacrypt (Commercial), jis(a)mit.edu (North American freeware), or mathew(a)mantis.co.uk (the unofficial international version source). The "unofficial international" versions are really just PGP 2.3a, modified just enough to make it compatible with MIT PGP 2.6, but do not include all of the fixes in MIT PGP 2.6 and MIT PGP 2.6.1. They are named pgp26ui* or have a "ui" somewhere in their file names. I recommend the use of the "ui" versions only if: (1) You are using a Macintosh; (2) You are using a platform for which there is no Viacrypt or MIT PGP; (3) You are outside of North America, and can't obtain Viacrypt or MIT PGP; or (4) You need to use a key longer than 1024 bits (i. e. a 1264 bit key generated with PGP 2.3a or PGP 2.6ui). WHERE CAN I GET VIACRYPT PGP? If you are a commercial user of PGP in the USA or Canada, contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial applications, and may be used in corporate environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for their version of PGP is 2.7. The Windows version is anticipated to ship by (or before) September 15, 1994; the Macintosh version is expected to ship in early October. The formal announcements will go out about one week prior to first ship dates. The Windows version is a high grade Visual Basic front end with the DOS program in the back end. It is a point-and-click, drag-and-drop operation. Here is a brief summary of Viacrypt's currently-available products: 1. ViaCrypt PGP for MS-DOS. Prices start at $99.98 2. ViaCrypt PGP for UNIX. Includes executables for the following platforms: SunOS 4.1.x (SPARC) IBM RS/6000 AIX HP 9000 Series 700/800 UX SCO 386/486 UNIX SGI IRIX AViiON DG-UX(88/OPEN) Prices start at $149.98 Executables for the following additional platforms are available upon request for an additional $30.00 charge. BSD 386 Ultrix MIPS DECstation 4.x 3. ViaCrypt PGP for WinCIM/CSNav. A special package for users of CompuServe. Prices start at $119.98 In September, 1994, ViaCrypt intends to announce two new major product additions: ViaCrypt PGP for Windows ViaCrypt PGP for Macintosh Prices start at $124.98 Viacrypt's licensing and price information is as follows: ViaCrypt PGP Version 2.7 for Windows (Single User $ 124.98 ViaCrypt PGP Version 2.7 for Windows (Five User) $ 374.98 ViaCrypt PGP Version 2.7 for Macintosh(Single User) $ 124.98 ViaCrypt PGP Version 2.7 for Macintosh(Five User) $ 374.98 ViaCrypt PGP Version 2.7 for MS-DOS (Single User) $ 99.98 ViaCrypt PGP Version 2.7 for MS-DOS (Five User) $ 299.98 ViaCrypt PGP Version 2.7 for UNIX (Single User) $ 149.98 ViaCrypt PGP Version 2.7 for UNIX (Five User) $ 449.98 ViaCrypt PGP for WinCIM/CSNav (Single User) $ 119.98 ViaCrypt PGP for WinCIM/CSNav (Five User) $ 359.98 UNIX platforms of Ultrix and BSD 386 have an additional $30.00 charge per platform. Please contact ViaCrypt for pricing of 20 users and above. Orders may be placed by calling 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. We accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET THE FREEWARE PGP? These listings are subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Because this list changes frequently, I have not attempted to keep it complete, but there should be enough pointers to let you easily find PGP. There are several ways to get the freeware PGP: ftp, WWW, BBS, CompuServe, America Online (maybe), email ftp server, and sneakernet (ask a friend for a copy). Just don't ask the author directly for a copy. FTP SITES IN NORTH AMERICA These sites generally have some mechanism to (1) discourage export of PGP and violation of the ITAR, (2) protect the site operators from harrassment by the Federal Government, and (3) still allow automated distribution of PGP as far as is allowed under all applicable laws. Telnet to net-dist.mit.edu, log in as getpgp, answer the questions, then ftp to net-dist.mit.edu and change to the hidden directory named in the telnet session to get your own copy. MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). 1. Read ftp://net-dist.mit.edu/pub/PGP/mitlicen.txt and agree to it. 2. Read ftp://net-dist.mit.edu/pub/PGP/rsalicen.txt and agree to it. 3. Telnet to net-dist.mit.edu and log in as getpgp. 4. Answer the questions and write down the directory name listed. 5. QUICKLY end the telnet session with ^C and ftp to the indicated directory on net-dist.mit.edu (something like /pub/PGP/dist/U.S.-only-????) and get the distribution files (see the above chart for names). If the hidden directory name is invalid, start over at step 3, above. You can also get PGP from: ftp.csn.net/mpj ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/ See ftp://ftp.csn.net/mpj/README.MPJ for the ??????? See ftp://ftp.csn.net/mpj/help for more help on negotiating this site's export control methods (open to USA and Canada). ftp.netcom.com/pub/mpj ftp://ftp.netcom.com/mpj/I_will_not_export/crypto_???????/pgp/ See ftp://ftp.netcom.com/pub/mpj/README.MPJ for the ??????? See ftp://ftp.netcom.com/pub/mpj/help for more help on negotiating this site's export control methods. TO GET THESE FILES BY EMAIL, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message for instructions. You will have to work quickly to get README.MPJ then the files before the ??????? part of the path name changes again (several times a day). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ ftp.wimsey.bc.ca /pub/crypto/software/dist/US_or_Canada_only_XXXXXXX/PGP (U. S. and Canadian users only) See /pub/crypto/software/README for the characters for XXXXXXXX This site has all public releases of the freeware PGP. WORLD WIDE WEB ACCESS http://www.matnis.co.uk/pgp/pgp.html http://rschp2.anu.edu.au:8080/crypt.html COMPUSERVE The NCSA Forum sysops have a library (Library 12: Export Controlled) that is available only to people who send them a message asserting that they are within the U. S. A. This library contains PGP. I have also seen PGP in some other places on Compuserve. Try searching for PGP261.ZIP in the IBMFF forum for up-to-date information on PGP in selected other areas. The last time I tried a search like this, PGP 2.6 was found in the PC World Online forum (GO PWOFORUM) new uploads area, along with several PGP shells and accessories. I've also heard that EUROFORUM caries PGP 2.6ui, but have not confirmed this. Compuserve file names are even more limited than DOS (6.3 instead of the already lame 8.3), so the file names to look for are PGP26.ZIP, PG261S.ZIP (source code), PGP261.GZ (Unix source code) and PG261D.ZIP (documentation only). BULLETIN BOARD SYSTEMS Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, of if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. Log in with your own name, or if someone else already used that, try a variation on your name or pseudonym. You can request access to crypto software on line, and if you qualify legally under the ITAR, you can download on the first call. For free access: log in with your own name, answer the questions, then select [Q]uestionaire 3 from the [M]ain menu. (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. Hieroglyphics Voodoo Machine (Colorado) Jim Still (aka Johannes Keppler), sysop. DOS, OS2, and Mac versions. (303) 443-2457 For free access for PGP, DLOCK, Secure Drive, etc., log in as "VOO DOO" with the password "NEW" (good for 30 minutes access to free files). Exec-Net (New York) Host BBS for the ILink net. (914) 667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP This information from: Jim Wenzel <jim.wenzel(a)grapevine.lrk.ar.us> Other BBS -- check your local BBS. Chances are good that it has any release that is at least a month old if it has much of a file area at all. AMERICA ONLINE: Try PC WORLD soft/lib. (key word PGP). Make sure you get ALL of the files, including the documentation. Somebody apparently split up the .ZIP file just to make life more difficult. OTHER FTP SITES These other ftp sites don't have the "export control" hoops to jump through that most North American sites have in deference to archaic laws. ftp.informatik.uni-hamburg.de /pub/virus/crypt/pgp This site has most, if not all, of the current PGP files. black.ox.ac.uk (129.67.1.165) ftp.netcom.com /pub/dcosenza -- Some crypto stuff, sometimes includes PGP. /pub/gbe/pgpfaq.asc -- frequently asked questions answered. /pub/qwerty -- How to MacPGP Guide, largest steganography ftp site as well. PGP FAQ, crypto FAQ, US Crypto Policy FAQ, Steganograpy software list. MacUtilites for use with MacPGP. Stealth1.1 + other steganography programs. Send mail to qwerty(a)netcom.com with the subject "Bomb me!" to get the PGP FAQ and MacPGP guide if you don't have ftp access. ftp.ee.und.ac.za /pub/crypto/pgp soda.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security/crypt/PGP ftp.tu-clausthal.de (139.174.2.10) (Atari ST/E,TT,Falcon) /pub/atari/misc/pgp/pgp26uib.lzh (2.6ui ttp, 2.3a docs) /pub/atari/misc/pgp/pgp26uis.lzh (2.6ui sources) /pub/atari/misc/pgp/pgp26ui.diffs (Atari diffs for 2.6 sources) wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) nic.funet.fi (128.214.6.100) /pub/crypt ftp.uni-kl.de (131.246.9.95) /pub/aminet/util/crypt qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) princeton.edu (128.112.228.1) pencil.cs.missouri.edu (128.206.100.207) soda.csua.berkeley.edu nctuccca.edu.tw /PC/wuarchive/pgp/ Also, try an archie search for PGP using the command: archie -s pgp26 (DOS & Unix Versions) archie -s pgp2.6 (MAC Versions) FTPMAIL For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "Help" to ftpmail(a)decwrl.dec.com. You will be sent an instruction sheet on how to use the ftpmail service. Another e-mail service is from nic.funet.fi. Send the following mail message to mailserv(a)nic.funet.fi: ENCODER uuencode SEND pub/crypt/pgp23srcA.zip SEND pub/crypt/pgp23A.zip This will deposit the two zipfiles, as 15 batched messages, in your mailbox with about 24 hours. Save and uudecode. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. IS MY COPY OF PGP GOOD? If you find a version of the PGP package that does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. PGP should be signed by one of the developers (Philip Zimmermann, Jeff Schiller, Viacrypt, etc.). If it isn't, the package is suspect and should not be used or distributed. The site you found it on should remove it so that it does no further harm to others. To be really sure, you should get PGP directly from MIT or check the signatures with a version of PGP that you trust. The copies of PGP on ftp.csn.net/mpj, ftp.netcom.com/pub/mpj, and the Colorado Catacombs BBS are direct copies of the ones on MIT, except that the ones on the BBS include a BBS advertisement (automatically added by the system when it virus scans new files) in the outer .zip files. OTHER PGP DOCUMENTATION PGP is rather counter-intuitive to a Mac user. Luckily, there's a guide to using MacPGP in ftp://ftp.netcom.com/pub/qwerty/Here.is.How.to.MacPGP. There is a Frequently Asked Questions document in ftp://ftp.netcom.com/pub/gbe/pgpfaq.asc For more information on the "time bomb" in PGP, see ftp://ftp/netcom.com/pub/mpj/pgpbomb.asc LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip (MIT version) * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26uir.zip (ui version) * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt ARCHIE WHO? There are many more sites. You can use archie and/or other "net-surfing" tools to find a more up-to-date listing, if desired. WHAT IS ALL THIS NONSENSE ABOUT EXPORT CONTROLS? For a detailed rant, get ftp://ftp.csn.net/mpj/cryptusa.zip The practical meaning, until the law is corrected to make sense, is that you are requested to get PGP from sites outside of the USA and Canada if you are outside of the USA and Canada. If you are in France, I understand that you aren't even supposed import it. Other countries may be worse. It is illegal to export PGP from the USA to any country except Canada, even if that version of PGP originated outside of the USA. Don't do it. Don't ask me to do it. The law is not rational, but it exists, and the Federal Government has no sense of humor. On the other hand, if you should discover a copy of PGP in some place other than the USA, then you are bound by the laws of both that country and your own country with respect to what you can do with it, not necessarily by U. S. Law. Your laws may be more or less restrictive, and may possibly refer to U. S. Law through some sort of treaty. If you live in a place where you can freely distribute and use PGP, then I applaud your government. In spite of the best efforts of MIT and the other primary developers and distributors of PGP not to violate the International Traffic in Arms Regulations, MIT PGP has been observed to migrate to many foreign sites. Whoever is responsible for this export is responsible for their own actions and is not encouraged or endorsed by myself, Philip Zimmermann, or MIT. This doesn't necessarily mean that we agree with the law, or even that the law itself is Constitutional. It just means that becoming a test case is not fun. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN THE USA? MIT PGP is only for noncommercial use because of restrictions on the licensing of both the RSA algorithm (attached to RSAREF) and the IDEA algorithm. PKP/RSADSI insist that we use RSAREF instead of the mpi library for reasons that make sense to them. For commercial use, use Viacrypt PGP, which is fully licensed to use both the RSA and IDEA algorithms in commercial and corporate environments. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN CANADA? MIT PGP is only for noncommercial use because of restrictions on the licensing of the IDEA algorithm. Because the RSA algorithm isn't patented in Canada, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license. For commercial use, use Viacrypt PGP, which is fully licensed to use the IDEA algorithm in commercial and corporate environments. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST OUTSIDE NORTH AMERICA? MIT PGP is only for noncommercial in areas where there is a patent on software implementations of the IDEA algorithm. Because the RSA algorithm isn't patented outside of the USA, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license. For commercial use, you cannot buy Viacrypt PGP, but you can arrange to license your use of IDEA directly from ETH Zurich. If software implementations of IDEA are not covered by a patent in your country, then you can use the freeware versions of PGP, provided that you compile it with the mpi library instead of RSAREF. WHAT IS THE "TIME BOMB" IN MIT PGP 2.6? As a concession to the RSA patent holders (in return for endorsement of the legality of the freeware MIT PGP 2.6), MIT placed an inducement in MIT PGP 2.6 to encourage upgrade from the alledgedly patent-infringing PGP 2.3a to the MIT version. The nature of this inducement is a change in a packet ID byte that causes PGP 2.3a and earlier to reject messages created by MIT PGP 2.6 after 1 September 1994. Altering MIT PGP 2.6 to bypass this annoyance (though technically an easy change to the LEGAL_KLUDGE), invalidates the blessing of Public Key Partners on the licence of MIT PGP 2.6. Therefore, it is a bad idea. On the other hand, it is trivial to hack PGP 2.3a to accept these packets, and that (plus a few other bug fixes) is essentially what PGP 2.6ui is. None of the versions of PGP greater than 2.3 have problems reading the old packet ID values, so for maximum compatibility, the ideal is to write the old value and accept either value. Unfortunately, this time bomb has a negative effect on Viacrypt PGP 2.4, as well, which never infringed on anyone's patents. Viacrypt's solution was to issue PGP 2.7, which, by default acts just like MIT PGP 2.6, but has a config.txt option (explained in the release) that allows compatibility with both PGP 2.4 and PGP 2.6. Naturally, this also allows compatibility with PGP 2.3a. The time bomb is annoying for those who still wish to use PGP 2.3a, and for those who use Viacrypt PGP 2.4 and don't want to spend US$10 to upgrade to Viacrypt PGP 2.7, but considering the magnitude of the concession made by Public Key Partners in legitimizing the freeware PGP for use in the USA, it was worth it. For more information on the time bomb, see ftp://ftp.csn.net/mpj/pgpbomb.asc ARE MY KEYS COMPATIBLE WITH THE OTHER PGP VERSIONS? If your RSA key modulus length is less than or equal to 1024 bits (I don't recommend less, unless you have a really slow computer and little patience), and if your key was generated in the PKCS format, then it will work with any of the current PGP versions (MIT PGP 2.6, PGP 2.6ui, or Viacrypt PGP 2.7). If this is not the case, you really should generate a new key that qualifies. Philip Zimmermann is aware of the desire for longer keys in PGP by some PGP fans (like me), but wants to migrate towards that goal in an orderly way, by first releasing versions of PGP in for all platforms and for both commercial (Viacrypt) and freeware (MIT) flavors that ACCEPT long keys, then releasing versions that can also GENERATE long keys. He also has some other neat key management ideas that he plans to implement in future versions. BUGS These are the most annoying: MIT PGP 2.6 -- the function xorbytes doesn't. Replace the = with ^= to fix it. The effect of this bug is that RSA keys aren't quite as random as they should be -- probably not a practical problem, but worth fixing if you are going to compile the code yourself. Fixed in 2.6.1. MIT PGP 2.6 -- DON'T SET PGPPASS when editing your keys, because if you do, and if you don't change your pass phrase, the key is lost. (If this happens, rename your backup keyring files to the primary files before you do anything else). Fixed in 2.6.1. PGP 2.6ui -- Conventional encryption -c option doesn't use a different IV every time, like it is supposed to. (PGP 2.3a had this problem, too). Fixed in 2.6 and 2.6.1. HOW DO I PUBLISH MY PGP PUBLIC KEY? There are lots of ways. One way is to use a key server. Send mail to one of these addresses with the single word "help" in the subject line to find out how to use a key server. pgp-public-keys(a)pgp.iastate.edu public-key-server(a)pgp.ai.mit.edu pgp-public-keys(a)demon.co.uk FTP: ftp.demon.co.uk:/pub/pgp/pubring.pgp (Updated daily) pgp-public-keys(a)cs.tamu.edu pgp-public-keys(a)chao.sw.oz.au pgp-public-keys(a)jpunix.com pgp-public-keys(a)dsi.unimi.it pgp-public-keys(a)kiae.su pgp-public-keys(a)fbihh.informatik.uni-hamburg.de There is also an experimental public key server at http://ibd.ar.com/PublicKeys.html Another way is to upload it to the PGP public keys area of the Colorado Catacombs BBS (303-772-1062). Another way is to just send it to your correspondents. You could add it to your .plan file so that finger returns your key. You could add it to some of your postings. No matter which way you do it, you should have your key signed by someone who verifies that your key belongs to you, so that you don't have someone else generating a key that has your name on it, but that isn't yours. Here is my public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAi4PT2QAAAEEAPPCZnrshEJ9PSnV+mXEwjM4kzJF0kyg2MnLMzo83vWI40ei jogncqdkXT0c2TQWg+Bsu9ckFoXdId0utumYv0aqd8yI/oU/DwJ1zJrqRL2PFbxe ZLofHoKFjvq1TiNiJq9ps3jW6iYS4IU1SzyKhjmyE+K0+WyrPPX0zg8FAL9FAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajiJAJUCBRAu G3chZXmEuMepZt0BAZtAA/0Rw5mintlUDgHycNbeoyIiMHoLu8jWaCSaiGSt+dDU 1A/bUCo+gorv5TYxOClRf3XHjD6zSooWyUz3ehotrzPYLunhVOE2YBxPU+OvKFOc 37mcZrnXGBlF5NblnSYxp0186tGaTm7WMWx7NDlHT4GvhzHJQSOoo48ykDkKm/mk LIkAlQIFEC4PWbs/ZwY8hTPrxQEBKyMD/A7kv91C1ZZIRtkbC9k9lsWOgOnO8wG8 bGMajaco465Z5llWD+Y8QCMdSWcowtOBGfW0Wv1bZ1uebeCpg1L66pJ7C+BOExrk gPqRVCstLLiVerKGeSOZo3yXtxYKYX7mHQPrHp98ef7fUG4IiKS+S+znmGxpJwrV sHZRlhJ3hXUsiQCVAgUQLg9ZefX0zg8FAL9FAQFBTAQAh4u4Vun7WhPuL6fsXiXm paaGfeLtd3biRj/aOMAG1eHuhVdWejx71ormyKTdNB2YV56bpsE3JQ/KhBuYDo0N SkRnqeM2S+Ef7aZEg6Q44uXG52pqCZUldtCeYfOs3aLCR9SMlc6Y3zmpSwB1wKP0 5+tN9zruNYVKKBLWEIFAY7W0K01pY2hhZWwgUGF1bCBKb2huc29uIDxtLnAuam9o bnNvbkBpZWVlLm9yZz60IE1pY2hhZWwgSm9obnNvbiA8bXBqQG5ldGNvbS5jb20+ tChNaWtlIEpvaG5zb24gPDcxMzMxLjIzMzJAY29tcHVzZXJ2ZS5jb20+tCtNaWNo YWVsIFAuIEpvaG5zb24gPG1wam9obnNvQG55eC5jcy5kdS5lZHU+tC1EbyBub3Qg dXNlIGZvciBlbmNyeXB0aW9uIGFmdGVyIDI3IEp1bmUgMTk5Ni4= =rR4q - -----END PGP PUBLIC KEY BLOCK----- ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mpj/README.MPJ -. --- ----- ....| | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLm3RD/X0zg8FAL9FAQGqnwQA5R8PVpgT0tHG7GSY2jjNM9EKnQAngOdy ByZYVhh9lm/7WywiiBsY5XWDwFUEwIC79e+UeCY+8lAhiUEEWQdCAvYO7b/LCtSn D9TL3teei4sH6Z4kpDFFn8peWVwoEc/2l9nWrtUlT1cFvBDKn1KRK8MlZgH0Gld4 J+vPYYYrDMg= =u06H -----END PGP SIGNATURE-----

1 0

Reputation Capital papers?
by John Young 17 Dec '03

17 Dec '03

Prompted by Hal's post I send the following FTP info on Information Sciences Institute. This is their README file. There is much more there, based on a quick look, juicy DoD stuff for the disloyal. John ------------------- USC INFORMATION SCIENCES INSTITUTE PUBLICATIONS Welcome to USC Information Sciences Institute FTP publications directory. When logging in, please use your complete email address as a password. For example: % ftp ftp.isi.edu NAME: anonymous PASSWORD: techlib(a)isi.edu (your_email_address@your_machine) ftp> cd isi-pubs ftp> use the standard ftp commands, such as "dir", "get", "cd", etc. ftp> "quit" when finished A few of our technical reports are now available, in postcript format, through ANONYMOUS FTP from ftp.isi.edu. If you would like to order hard copies of ISI technical reports, please send email to "techlib(a)isi.edu" or written requests can be sent to: USC Information Sciences Institute Library 4676 Admiralty Way, Suite 1001 Marina del Rey, CA 90292-6695 ATTN: Document Distribution If our stock has been depleted, you will be referred to the National Technical Information Service, NTIS. Here is a brief description of the files currently available online: -------------- -------------------------------------------------- ---- filename description -------------- -------------------------------------------------- ---- pubrec.ps This file contains a listing of all the technical reports published by ISI with abstracts. Approximately 50 pages. newpubs0794.ps This is our semi-annual publications announcement newpubs0194.ps newsletter and order form. It is published in January and July. Subsequent newsletters will follow the same filename format, newpubsMMYY.ps, e.g. newpubs0194.ps, newpubs0794.ps. isi-sr-93-374.ps Zoned Analog Personal Teleconferencing (ZAPT) isi-sr-93-374.ps.Z by J.D. Touch December 1993, 23 pages isi-rr-93-372.ps Employing Knowledge Resources in a New Text Planner Architecture by E. Hovy, J. Lavid, E. Maier, V. Mittal, C. Paris, 1992 (Not yet available online. Hard copy only.) 14 pages isi-rr-93-366.ps Synthesis of Asynchronous Systems from Data isi-rr-93-366.ps.Z Flow Specifications by T.-Y. Wuu, S.B.K. Vrudhula December 1993, 73 pages isi-rs-93-364.ps Security Services for Multimedia Conferencing by S. Stubblebine November 1993, 9 pages isi-rs-93-363.ps ATOMIC: A Low-Cost, Very High-Speed, Local Communication Architecture by D. Cohen, G. Finn, R. Felderman, A. DeSchon November 1993, 12 pages isi-rs-93-360.ps The Impact of Scaling on a Multimedia Connection Architecture by E. Schooler August 1993, 14 pages isi-rs-93-359.ps Case Study: Multimedia Conference Control in a Packet-Switched Teleconferencing System by Schooler August 1993, 18 pages isi-sr-93-358.ps The ISI "Tunnel" by A. DeSchon, D. Cohen October 1993 39 pages isi-rs-93-342.ps Parallel Communication by J. Touch March 1993, 12 pages isi-rs-93-301.ps Physics Analogs in Communication Models by J. Touch January 1993, 10 pages isi-rs-92-294.ps An Architecture for Multimedia Connection Management, by E. Schooler, S. Casner August 1992, 8 pages isi-rs-92-293.ps First IETF Internet Audiocast, by S. Casner, S. Deering July 1992, 6 pages isi-rr-92-291.ps ATOMIC: A Low-Cost, Very High-Speed LAN by D. Cohen, G. Finn, R. Felderman, A. DeSchon September 1992, 21 pages isi-rr-91-289.ps A Distributed Architecture for Multimedia Conference Control by E. Schooler November 1991, 18 pages isi-rs-91-286.ps Multimedia Conferencing: Has it Come of Age, by E. Schooler, S. Casner, J. Postel August 1991, 10 pages isi-rs-90-252.ps N-Way Conferencing with Packet Video, by S. Casner, K. Seo, W. Edmond, C. Topolcic April 1990, 10 pages

1 0

FW: believing three impossible things before breakfast
by Blanc Weber 17 Dec '03

17 Dec '03

From: Carl Ellison . . . . . someone advocating that all you need to do is just tell teens to say "no" to sex before marriage, then you won't need to distribute condoms without parental permission.... Suddenly it hit me that the same frame of mind was clearly behind the Clipper Initiative. ........................................................ Are you saying that they think that if the phone moderators could just say "no" for us, overt supervisory functions could be eliminated? Blanc

1 0

NYT Fears Cypherpunks
by frissell＠panix.com 17 Dec '03

17 Dec '03

The article suggested that unless people turn to the State for protection from "anarchy" the State will fade. Here is my argument (recycled from a few years ago) as to why State power is fading: I expect that State authority will continue to weaken over the next few years for the following reasons: 1) The ruled outnumber the rulers. 2) The ruled outmass the rulers. 3) Traditionally, the rulers used a number of techniques to maintain their rule: a) Ideology of acquiescence and consent - The will of God, tradition, the will of the people, 'you can't fight City Hall,' Death and Taxes, The Government is All of Us, etc. b) The application of superior mobility and organization - we are everywhere, omniscience, omnipresence, etc. c) Point force. A mass of armed men in the field. 'Reduce the city. Leave no stone standing upon stone and sow the ground with salt.' 4) The effectiveness of the above require an ignorant, docile, immobile, and uncritical population: a) Respect for authority is on a rapid downward trend. Disobedience is widespread. One-third to one-half of the housing units in Nassau and Suffolk counties are illegal "in-law" apartments. Seventy-five percent of those hiring domestic workers in the US do not comply with tax and employment laws. Hundreds of thousands of assault rifle owners in New Jersey and California have not turned in their guns. I see no examples of any increase in respect for state authority. b) The mobility and organization of bureaucratic organizations is now less than the average private organization. Nation states are still geographically bound, we are not. The individual or small group has always had better organization than the State - he/it has just had less power. c) Point force only works against concentrated opponents. It is useless against mass movements of goods nd people like the market unless a totalitarian clampdown is used. If movement continues, State power is lost. 5. Freedom is not only an ideology, it is also what you get when people make relatively unconstrained choices. Even the most broken slave makes choices. When a modern, technologically advanced, mobile people makes choices, they can overwhelm control mechanisms. All they have to do is *choose*. They need not be ideologically committed libertarians. 6. Is there immigration control if millions of immigrants are on the march (here *and* in Europe)? Is there gun control if the number of guns possessed by the population (here *and* in Europe) continues to increase. If the amount of the world's wealth that is legally or illegally outside of the tax system increases, is taxation succeeding? 7. Predictions. Per capita gun ownership will continue to increase in all of the OECD countries as it has for years. Legal and illegal immigrants as a percentage of total population will continue to grow. The percentage of the Gross World Product that does not flow through the coffers of the world's States will continue to grow as it has for the last ten years. 8. Unless the above trend lines reverse and the "coercive sector" regains some moral authority freedom of choice will continue to grow. For example, if gun ownership per capita continues to grow, at some point everyone who wants a gun will have one. No gun control. 9. Controlling people is difficult. It has all of the normal problems of hydrology with the added complication that in this case the "water" is intelligent. Controlling smart, rich, well- equipped people is a doomed occupation. Unless they can figure some way to chain us back in the fields, they're doomed. DCF "Though he may be poor He will never be a slave"

2 1

O'Reilly PGP book
by Stanton McCandlish 17 Dec '03

17 Dec '03

coming soon, PGP hits the mainstream: PGP: Pretty Good Privacy by Simson Garfinkel 1st Edition November 1994 (est.) 250 pages (est),ISBN: 1-56592-098-8, $17.95 (est) PGP is a freely available encryption program that protects the privacy of files and electronic mail. It uses powerful public key cryptography and works on virtually every platform. PGP: Pretty Good Privacy by Simson Garfinkel is both a readable technical users guide and a fascinating behind-the-scenes look at cryptography and privacy. Part I of the book describes how to use PGP: protecting files and email, creating and using keys, signing messages, certifying and distributing keys, and using key servers. Part II provides background on cryptography, battles against public key patents and U.S. government export restrictions, and other aspects of the ongoing public debates about privacy and free speech. -- <A HREF="http://www.eff.org/~mech/mech.html"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Fndtn. </A><P> Online Activist

1 0

MISC: public key revocation certificate
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 'punksters After carefull consideration of the matter I have decided to follow Philip Zimmermans request, revocation certificate follows. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiwobjEAAAEEAMvfOcPMSdd8EASpRCj5H2KdXR8f/nVcOyQ1vg6SaX6yCQb0 aO4fRgfZg2aoyQVLRPmrpV0YzeRjHwadUz3THLK3LUtA5RR6W+MHoxSQB5iVIqek Lzg5cl4O9wzovzDjc0zSQW/prCGLs9aYx/WYWWXaYngZe7kTRKKSjm8cgaFtAAUR iQCVAgUgLm34g6KSjm8cgaFtAQEunAP+MZB2xfL0mDP+OjjQDqpkn/u32SRKZ5ZF VjGhIFglJuyE+JehqmiT0liy8PJzeif95aWDtT1IOAuk9L6BwZpx9+m0PMRKkjNH 1InjapVYVPyb5JBJKo5LjcWLVdx3eyiJ0GOzb+zBQEnrBkGWe13xj9UNs37o/TjF utQ7Oi1jOAC0KEJyaWFuIEQgV2lsbGlhbXMgPHRhbG9uNTdAd2VsbC5zZi5jYS51 cz4= =3HLA - -----END PGP PUBLIC KEY BLOCK----- Please note the new key; - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.1 mQCNAy5t4PAAAAEEANaECzfBmf3e0wSsuObKfi0xVb74347rNH+HX3yEPPLi0b+Z pQFRLvw9ClCwOpRGBTNgaARp/Y8/eQeyzmSOIhwHfR57X5J/XGMYmGWbQ9+84jUD xE9m+2Gux1L9L0YvvekuG486PfpHNgP8US9KpOn9zXEJJ89VkFmp8FjpRfTVAAUX tChCcmlhbiBEIFdpbGxpYW1zIDx0YWxvbjU3QHdlbGwuc2YuY2EudXM+ =C1+Q - -----END PGP PUBLIC KEY BLOCK----- Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLm39GFmp8FjpRfTVAQGbggP+M0ulfpczRkDXz335N++miPPn0zkY1gJ6 XrfGuPjVUduxcj3flDBPXSw1MHi6AqB9Hv+X2+1eD9Vta9CHGEfcsdc7SVvuhyGD +xA8SLLkbrQjoYYpegFYi2cRCO7CJUGqB39bgnG0mXp1aKn5cfyKxa8cB22Uy5UO /ZE/dtRMK1I= =0Psj -----END PGP SIGNATURE-----

1 0

(fwd) Re: NETCOM/FBI Spying "Business as Usual"
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I found this in the eff group, and think it has some implications for remailer operators and their logs. (That the FBI is subpoenaing e-mail records is not news, but the connection to the Kevin Mitnick case is.) Explanation: In an earlier message, Glen Roberts of "Full Disclosure" gave his informed speculation that this subpoena has to do with the FBI's search for uber-hacker Kevin Mitnick. The guy being subpoenaed and monitored, Lewis De Payne, comments below. The concern for remailer operators is that while I was reading this saga, all I could think of was 'Why didn't they use remailers?" I planned to comment on this in the public groups. (And I may still, if somebody else doesn't beat me to it.) But of course the concern is that if the FBI is going on a fishing expedition (a legal term :-}) for e-mail records, and Netcom is cooperating, then had they used remailers to communicate, we could now be seeing subpoenas of *remailer logs*. (This will happen eventually. All the more reasons for multiple national jurisdictions, for destruction of logs, for bonding of remailers, and for "forward secrecy" (a la Diffie-Hellman) to be implemented somehow.) > Xref: netcom.com alt.2600:23077 alt.2600hz:100 alt.privacy:18575 comp.org.eff.talk:39275 > Newsgroups: alt.2600,alt.2600hz,alt.privacy,comp.org.eff.talk > Path: netcom.com!lewiz > From: lewiz(a)netcom.com (Lewis De Payne) > Subject: Re: NETCOM/FBI Spying "Business as Usual" > Message-ID: <lewizCvrsCz.E1B(a)netcom.com> > Followup-To: alt.2600,alt.2600hz,alt.privacy,comp.org.eff.talk > Organization: NETCOM On-line Communication Services (408 261-4700 guest) > X-Newsreader: TIN [version 1.2 PL1] > References: <CvqnGC.Csq(a)rci.ripco.com> > Date: Wed, 7 Sep 1994 17:24:35 GMT > Approved: mitnick(a)hideout.com > Lines: 25 > > Glen Roberts (glr(a)ripco.com) wrote accurately: > : > : Some of you may be aware of the FBI subpeona for email transactions of > : lewiz(a)netcom.com. > : > : She wouldn't discuss the particulars of lewiz(a)netcom.com, and said they > : were "not open to talking about it." > > I will be sending you a story for Full Disclosure. In it, I will discuss > how tech support at netcom told another party (whose name will remain > anonymous until I receive a subpoena) that the FBI was watching my acct, > and that they were served with an order. This was disclosed to a > third-party by tech support! I will also discuss my conversation with > the various people at netcom regarding this matter, as well as the > letter I sent to netcom explaining to them that their "monitoring" of > my account to conform with the _sealed_ court order was slowing me > down too much, and that if they didn't correct it, I might go find > another provider, and then they wouldn't be able to monitor me. > > Lots more to come... in Full Disclosure Live. > > -- > cc: Kathleen Carson, S.A., FBI, LA, CA. || Pursuant to Court Order > Kenneth G. McGuire, III. S.A., FBI, LA, CA. || served August 11, 1994 > Stanley E. Ornellas, S.A., FBI, LA, CA. || on Netcom Communications >

1 0

Social punishment 1/3: law without enforcers
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Social punishment 1/3: law without enforcers I live in a country where many laws are simply not followed. As laws are always behind the times, this can lead to an environment that, ignoring laws, follows the times. (For example due to no legal precedents there is theoretically no electronic privacy and all my mail is read. This is not, in practice the case - if my mail is indeed read, then it's probably by the NSA). When the legal system is lax, society falls back on age-old methods of keeping order - a system of taboos and 'social' punishment such as ostracization. In small tribes or villages ostracization is the most passive of punishments - indeed by definition it implies _non_-cooperation or having _nothing_ to do with a person. It is also the most powerful, often better for the society than capital punishment which simply gets rid of a person who might be useful if following the rules. Of course societies that continue to use 'social' punishment do so to enforce antideluvian values (don't talk to those people, don't engage in pre/extra- marital or deviant sex, etc). This is not the fault of the system of social punishment, rather that of the society itself. The system of social punishment can easily be adapted to educated, liberal inhabitants of cyberspace, much more easilty than can present law enforcement systems. My next post will examine the similarities between tribal and cyberspatial society. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

T-shirts
by vaccinia＠med.unc.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Since we're on the subject of T-shirts, does anyone have any X-large or XX-large T-shirts with the "1984, We're a little behind Schedule!" logo on them? If someone is ever going to do another run of them I would be interested in buying one or two of them. The "Big Brother Inside" on the front and the "1984" logo on the back would be an ideal shirt! Anyway, if anybody knows where I could purchase such a shirt please contact me at the below address. Thanks. Scott G. Morham !The First, VACCINIA(a)uncvx1.oit.unc.edu! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLmolmD2paOMjHHAhAQGBLgP/RipTDTCeY4IcGP3padoDcNWDexgy8M94 5YUZb4rzjmv3lu/WoSI4jXV4SZAxOW8F5lia8dkxtkeKAYTVwPdmWJvJ8V3BbEYv vg4juygrULe1wX3toHnI4ueQCFDoBxacCzM1KRhpcD6q2sKyWsfZKbMniko/AhvY InA/gnPiVJo= =akOU -----END PGP SIGNATURE-----

1 0