December 2003 - cypherpunks-legacy

ECO_do
by rmccoy＠mercury.interpath.net 17 Dec '03

17 Dec '03

-----BEGIN PGP MESSAGE----- Version: 2.6.2 owEBWQCm/4kARQMFAC7fVUcqGc8CJ9W3bQEBftkBgNi8riTLJAuBf/hCkbdRicFy PTPzF712eXT/MuB4TrzU97Dga24NH0ievt1kjZqZnawPYgliYWFhMTUwNzgAAAAA =7wNp -----END PGP MESSAGE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

ECO_do
by vvallopp＠eniac.seas.upenn.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP MESSAGE----- Version: 2.6.2 owEBWQCm/4kARQMFAC7fZIgqGc8CJ9W3bQEB4KoBfiMUs2jPnVVoze7+Hm0GT6mc tDTwXfvs+Wt+jhhvFql0tAC4hrVXoJ5aXlOu78g9FKwPYgliYWFhMTU2MjAAAAAA =WGc6 -----END PGP MESSAGE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Re: ECO_do
by cjl 17 Dec '03

17 Dec '03

>From the messages appearing on the list it would seem that responding to messages sent via Masco's auto-signer needs to be done carefully, apparently the less-than-less diligent will just respond to the From: address instead of to the automagical response demon at jya(a)pipeline.com I would hate to see the valuable service provided by jya become a source of noise. In an ideal world everyone would be more careful about responding to the right address, but this is a far from ideal world. An appropriately Cypherpumpkin solution is left as an excercise to the reader. C. J. Leonard ( / "DNA is groovy" \ / - Watson & Crick <cjl(a)welchlink.welch.jhu.edu> / \ <-- major groove ( \ Finger for public key \ ) Strong-arm for secret key / <-- minor groove Thumb-screws for pass-phrase / )

1 0

Easy-to-use signature software
by abostick＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN ROT13 SIGNED MESSAGE----- People who aren't yet able to securely use PGP to post to the cypherpunks mailing list, take heart. Eric has indicated that he doesn't care which flavor of encryption software you use. I have a user-friendly version of the encryption algorithm most widely used on the Internet. I haven't uploaded it to any FTP sites yet, but if you email me, I can send you a copy of the source code. -----BEGIN ROT13 SIGNATURE----- Version 2.71828 V jebgr guvf zrffntr. Abobql ryfr qvq. Nalbar jub fnlf bgurejvfr vf n yvne. Guvf uvtu-grpu qvtvgny fvtangher vf gur cebbs bs zl pynvz. nobfgvpx(a)argpbz.pbz (Nyna Obfgvpx) -----END ROT13 SIGNATURE----- | For me, to be a feminist is to answer the Alan Bostick | question "Are women human?" with a yes. abostick(a)netcom.com | finger for PGP public key | Katha Pollitt, REASONABLE CREATURES Key fingerprint: | 50 22 FB 46 41 A3 17 9D F7 33 FF E1 4E 1C 89 79 +legal_kludge=off

1 0

pgp / passphrase / capture / yikes!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

just wondering , if i use pgp on my pc , and lets say while on my unix connection to the net i shell to dos to do encryption or decryption , does this compromise my security in any way ? can some admin catch my passphrase, i don think so , but i'm really fucken paranoid ! thanks for any answers felloe punks ! -feast oh , msg to larry detweiler : your really looney man , cracked me up ! :*)

2 1

Re: The thread that would not die. (Mandating signatures)
by owner-cypherpunks＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <9412021551.AA04657(a)snark.imsi.com>, Perry E. Metzger <perry(a)imsi.com> wrote: > >John Schofield says: >> It is silly to talk of someone "owning" the list. The list is a >> community. The only possible owners are the people in the community. If we >> all left, Eric would still have control over the list--but the list would be >> worthless. > >It is silly to talk of someone "owning" a restaurant. The restaurant >is a community. The only possible owners are the people in the >community. If the patrons all left, Chef Joey would still have control >over the restaurant -- but the restaurant would be worthless. You continue to confuse (deliberately?) a community with the place it meets. "List" is being used in two senses -- and you continue to interpret it only as the instance of majordomo on toad.com. That's a worthless interpretation as nobody disputes that Eric controls that agent. As far as I'm concerned, if a message has gone out to every address on the "cypherpunks" list, I don't give a shit whether or not it went through toad.com first: it went to cypherpunks. - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt9v/CoZzwIn1bdtAQFY6gGA0EVd9/2BIoe5ORzfPePZxxoA7WJs/jkm PEMkdRGJNpih+x6xLOnlv2+BoBTdEXgj =Qrv2 -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

2 1

Re: cypherpunk signing service
by owner-cypherpunks＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <199412020736.CAA10394(a)bb.hks.net>, <sglass(a)netcom.com> wrote: >Does this look right? > >pub 384/27D5B76D 1994/12/01 Cypherpunk signing agent <cypherpunks(a)hks.net> > Key fingerprint = 85 BA D4 6D B8 9D B6 B7 EB 74 11 48 42 45 61 F2 Yes, that's correct. >| I welcome any suggestions on the format of the message and the prepended >| message. > >Why not stealth it and just appear as if the sender signed it? Because the sender didn't sign it. I don't want to misrepresent what the service does. It guarantees messages have gone through cypherpunks(a)hks.net and, by implication, cypherpunks(a)toad.com. Nothing more, nothing less. >| Thanks for y'all's comments: keep 'em coming. > >Good work. Thanks! By the way, here's the server's key, signed by me: - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQA9Ay7eB60AAAEBgOGkDzo6mkSp3G4W3EXwMWK8SrTVSmosuN5Y7Z2FdBS5uJ3o 1O0XNAwqGc8CJ9W3bQAFEbQuQ3lwaGVycHVuayBzaWduaW5nIGFnZW50IDxjeXBo ZXJwdW5rc0Boa3MubmV0PokAlQMFEC7fdxkTYYKL6zwe3QEBq3kEAJ9WxYXnOVXb yz8bTBJpKWhEVWXzpIq7ApDTjmK6e7GoF+FFsdy7ZTsNLpsDa0huijXRZJ9Fcvcx ioAQVHfNkXr6hFVxFkttztggKMlpzYtfUGnyiR+abgUUkVvEIfn0z5mzfbvnHLSa baZE6VrDFwa8Hnf2GVLLPOBkiLAGZTB0 =CHvA - - -----END PGP PUBLIC KEY BLOCK----- - -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAwUBLt93aRNhgovrPB7dAQGRrAP9GS0HAa3zaCCKGUdpH3V+ur5i/YgF2Jxk wY8jlyXz/pazsv8GQw55Nl3bMKwGSkpng6aM9MNV1koGP5BBY1gw2gsVhzYi28QQ +ANreE32N3Rn0Kb2mH8WA88TG+bmWLH/Xs5ABGVIXO08VpLoJjrxuPaCxSBQYvGS XMBDrQ+P07o= =Cdif - -----END PGP SIGNATURE----- - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt932SoZzwIn1bdtAQFZhQGAlORDYu6ulXfhEcIm8JUIcHJHHZKfwzfN 6HP4xRr9Q/0j9HtOkdoHRZ7QoiE2iFrr =ikLM -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Re: First Virtual?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

FV does in fact have a bunch of e-mail addresses that will auto-forward some info sheets to you. I have attached the info to this message. After having read Doug Barnes message (<9412021548.AA17294@tadpole>) I'm glad I'm not the only one who thinks FV is a joke. The entire security of the system rests on the difficulty of intercepting and forging e-mail. Forging e-mail is dead easy, intercepting isn't much harder. While the implementors are correct that an online payment-system will have to be simple to use in order to gain wide acceptance, sacrificing all security for ease of use is a grave mistake. It just begging to be ripped off, providing people actually sell something via FV worth ripping off. andrew Begin forwared message: Where can I find out more about First Virtual? The First Virtual GENERAL INFORMATION FAQ is the best place to start if you are looking for information about First Virtual. It provides details about all the FAQ documents available via email, and about additional information available from our anonymous FTP and Gopher servers and our World Wide Web database. To receive a copy of the GENERAL INFORMATION FAQ, send an email message to "help(a)fv.com"; the GENERAL INFORMATION FAQ will be sent to you by email automatically. You can also find a copy in other places: * Connect to ftp.fv.com, our anonymous FTP server, and look in the directory /pub/docs for the file called "FAQ- general.txt". * Using Mosaic, Lynx, or another World Wide Web browser, connect to our Web page using the URL "http://www.fv.com". Look for the link to the "Frequently Asked Questions" page. Here's a summary of other First Virtual FAQ documents; to receive a copy by email, send a message to the specified address: * 1-2-3 FAQ -- Steps for getting started -- 123(a)fv.com * SIGNUP FAQ -- Signing up for an account -- signup(a)fv.com * BACKGROUND FAQ -- Our company and our vision -- background(a)fv.com * BUYING FAQ -- Buying information -- buying(a)fv.com * SELLING FAQ -- Selling information -- selling(a)fv.com * INFOHAUS FAQ -- Using the Infohaus -- infohaus(a)fv.com * SECURITY FAQ -- Security issues -- security(a)fv.com * CASHFLOW FAQ -- Flow of money in our system -- cashflow(a)fv.com * PROBLEMS FAQ -- Dealing with problems -- problems(a)fv.com For information in languages other than English, send email to "international(a)fv.com". To help us provide our services to the public at the lowest possible cost, please search the FAQs before sending email to our human operators. Thanks for understanding. And welcome to First Virtual!

3 2

Disclaimer within signed body?
by cactus＠hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It's been suggested that I put my "signature disclaimer" within the signed block. There are several pluses and minuses to this, and I wanted to see what others think (As an aside, by the way, I think the aesthetics of the output are important). As Eric pointed out to me last night, in general it's bad to modify the body of a message. I think that what I've been doing is fine, as the clear distinction betweem original message and additional stuff is maintained. However: the disclaimer should really be bound to the signature. Using the "comment" block won't do this, since PGP does not use it as part of the signature. Additionally, people whose software runs the messages through PGP will never see the disclaimer if it's outside of the signed block. What are folks' opinions on this? My options are: - Do nothing. Memory and the general appearance of the disclaimer are enough that people won't be fooled by a message with a removed disclaimer. - Put the disclaimer within the signature block. In essence, doing nothing as above, but that's what the comment block is there for and it might look nicer. - Put the disclaimer at the top of the signed body. Ugly, since it immediately forces its presence in a message, but effective for the same reason. - Put the disclaimer at the bottom of the signed body. It's still modifying the signed body, but in a much less obtrusive manner. Input? - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt+AfCoZzwIn1bdtAQF0uQF/R2+Wc4tKXs0/+Qc79ln01EUOT8seW4wC tKLa8H8CGAI33Exh/FeMvtYjnUEdPcXL =5852 -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

2 1

Voice over data
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Eric Hughes wrote: > the great voice-over-data protocols and products introduced by > Intel, Rockwell, ZyXEL and others at Comdex which will make > Voice-PGP so much easier > > As I understand these voice-over-data products, the voice goes over > analog, added to the modem signal. The modem signal is interpreted, > and then reconstructed and subtracted from the incoming signal, > leaving voice. Very clever, but insufficient for secure phones. I don't think that's how they do it. As far as I know, most methods multiplex digitized audio with the data. One system used by some people in India provides a dynamic combination of fax, (digitized) voice and data, depending on the throughput - eg vox/9.6 data if 14.4kbps, fax as well if 19.2, etc. While Intel and others are proposing standards, ZyXEL does it with software along with a voice card or possibly RJ11 input. A friend of mine saw a demo of it at Comdex, on an old 1496E (16.8 kbps zyxel to zyxel). The new v.34 does 28.8k - lots of room for clear digitized voice and high speed data. This is exactly why I thought it would make secure voice easier, if not secure phones (who wants to lug a modem and PC around as a 'handset'?). I'll be testing some Onetics Rad VFAST modems this week, which apparently do digitized voice over v.34 as well. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

Digicash trial
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Geoffrey Faivre-Malloy <vikram!geoffrey(a)crl.com> > DigiCash trial? Tell me more! I got my account a couple of weeks ago, I just downloaded the software. (I'm a buyer, though I was hoping to sell too.) Recent 'shops' include HotWired. I suspect one of the problems is that the software is not 'licensed for use in the US' possibly for patent reasons? It says this clearly in the pre-download license agreement. The trial gives you 100 dummy units of currency, which you can use to 'buy' from 'shops'. > Now THAT sounds cool! :) Wonder how long it will be before someone uses > PGP in a phone :) How much processing power would it take to do that on > the fly anyway? Actually not too much - PGP can process fast enough on a 486 as it is. > > Now what _I_ want is some way to integrate PGP with Netscape... > What's Netscape? The 'new improved' commercial version of Mosaic, by those who left to form a company. The freeware version of Netscape is probably the best WWW browser for a number of platforms right now. Of course, PGP wouldn't be integrated with Netscape as such, but into a local Web page - I'm looking at Web pages as simple interfaces to various ordinary, not necessarily 'netted' tasks. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

VOTE NO!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On mandatory sigs: I personally don't fathom the idea (as some of you do), I've always perceived PGP(Tm) as something I would use when I really had something sensitive to send a friend, or when I was making a public announcement to a mailing list or newsgroup. But to use it to sign EVERY single piece of mail I send to cypherpunks is asking a lot from me as my setup is very similar to Tim Mays', and I don't want to be singled out because of it! I think the list should proceed as it has since its formation, and subscribers should just sign their messages as they see fit. I know I'm not posting anything new, but considering the torrential flood of trash that Detweiler posted, it's not that much of a waste. :-)= Good evening.

2 1

Term Emulators (was Re: public accounts / PGP / passphrases)
by JEFF LICQUIA (CEI) 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From: Adam Shostack <adam(a)bwh.harvard.edu> > Derek wrote: > > | It would be nice to integrate PGP into terminal emulators, too, like > | kermit or seyon or red ryder or whatever, so that you could easily use > | PGP locally to sign/encrypt things on the remote end. Wishful > | thinking, I guess... > > I think terminal emulators are the wrong layer for PGP > integration. PGP support is needed in document editors and viewers, > rather than in network layers. I think you misunderstood. I took Derek as saying that 'modem programs' (as in the Procomm/Crosstalk kind) should have PGP integration. If these truly provided a full-featured network, then yes, the focus would need to be on the local editors/viewers we'd all use. As it is, these programs only provide a narrow window into a far-off environment, with varying degrees of security. As a positive proposal, I noticed Greg Broiles's posts with the scripts and came up with an idea. Would it be possibly a step forward to write similar scripts to allow for local agency? I envision two stages here: 1. Scripts on the remote end substituting for your editor that actually run your editor, then ask (once you're done with the plaintext) whether you'd like to process the message locally. If so, it would send the file via sz, wait for a Enter: press, then rz the file back, substituting the rz'd file for the original. You'd still have to mess with files on the local end, though. 2. Local control of the term emulator to automate the local agency part of the transaction. > With direct ip connectivity becoming commonplace, we're seeing > PGP integrated into mail & news tools, which is a great thing. (There > is also a use for encrypting networks, but I think it is different > from the use for PGP, which is a document oriented system.) True. However, the plight of the poor user who must use dial-up to connect is still one where all the agency must happen on the other end of the wire. I don't think these are going to go away any time soon, and by the time they do, we'll probably all have moved on to some new GeeWhizBang system developed commercially (my guess is it'll come out about a year after the RSA patent expires... :-) and integrated via OLE4 into our Windows 5.2 messaging systems (whoops! sorry, Tim, I meant via AppleMindMeld into our System 9.3 messaging systems :-). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt+VqDER5KvPRd0NAQG2JQQAk3dLJW+eoHxqJZbE8Ofcf/oNg7zOgrAJ zjpKwmM6PNFMsvsiI84jBkENHBhaItIMtuPCh+RCR6lS7JVaoAIlLOJ3e+5Kb8uM B9nrZ9BMzro275wjC1Ubmh2+hLtSVRVU0lqoGi7JiEv/fSWdlBCXdLqztiVsMvn5 fMBPqQY07o8= =InPY -----END PGP SIGNATURE-----

1 0

Re: Brands excluded from digicash beta
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

PAP wrote: >I just want, in a short message, let you know that there exist some >satisfied ecash testers (the system itself and the support when we >set-up our digishop and our plain customers cyberwallets). > The only thing I could eventually complain about is that I even received >a second (unsollicited) account Id and password to retrieve ecash >software because of a bug in the requests management :-) I have been a beta tester since the days of the very first Ecash clients which would freeze my computer when run ;-) I am very impressed with the latest clients. They work flawlessly. The only thing missing is off-line transfer capability. Since the current beta has a (dimmed) button for this, I don't think we will have to wait much longer. -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: He's the Big Kahuna
by lmccarth＠ducie.cs.umass.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Tim May writes: > Eric Hughes wrote: > > Someone else wrote: > > > I'd feel just about as strange (I hope) if people were saying "Look, > > > Tim's the boss. He's the Big Kahuna. If you don't like his policies on > > > his list, leave." > > "This is one _tasty_ burger" > Something to do with the metric system? Security through obscurity. - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLt+fJ2f7YYibNzjpAQEWRAP/d0dYaMQf0R4XZZRuIwW8kzqZj8p/27XA +TDupyHkn2Bpu/02JziAccWbRVLyA8XgVwN69Su1TBrqhRTEI8cQZG7jC/WJ4HHl iYV50CnKyoz3d5peAowI14BD6x7EnJkR70TomnyEsxQhK60E1VDpZDrxV2EsGqNI n9PQpw6SCPg= =woV8 - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt+gXyoZzwIn1bdtAQFQMwF/YbIgSqTwy1c2dGhbGPvZD226C1jgPDfU 6RSkqzK1nRujQfC8CMuaOlHW9/HjC3S9 =Wb4P -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Re: First Virtual?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

Mark Terka writes: > Ok, so what are our options, given that this company seems to think > of security in terms of a plastic padlock. From corresponding posts > on the list, the only other alternative, Digicash, doesn't seem to > be too responsive to anyone's participation right now. It seems to me that DigiCash mistakenly 'jumped the gun' and announced before they were truly ready to test. This is such a common ocurrance in the computer industry that I'm suprised people are making noise over it. However, it indicates their reluctance to ship something before it's ready, which is good considering the technical and political challenges of the task they are undertaking. How can you really compare the proposed DigiCash systems versus FirstVirtual? One is a 'toy' system for moving credit card numbers around without actually broadcasting them in the clear, the other is a cryptographically secure digital cash type system. It's not suprising that FirstVirtual is ready sooner than DigiCash. However, assuming each system was ready and working as advertised, which would you trust for your financial transactions? With the possibility of millions and billions of dollars of commerce ocurring on the net in the near future, which do you think most people will want to use? While FirstVirtual may have it's place in the world of online payment systems, it is IMHO no replacement for a real digital cash system. The fact that most of the people who have even heard of these new payment systems are unaware of the not so subtle differences should alarm most cypherpunks. Digital cash isn't going to happen overnight (although most of us would like it to), and the last thing we want is for systems like FirstVirtual to become the de facto standard for online payment... andrew

3 2

New version (1.2) of CFS now available
by Matt Blaze 17 Dec '03

17 Dec '03

Source code for the latest version of CFS (release 1.2), the Cryptographic File System, is now available upon request for research and experimental use in the US and Canada. CFS pushes encryption services into the Unix(tm) file system. It supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. You must have "root" access to install CFS. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze, "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps.) and in Matt Blaze, "Key Management in an Encrypting File System", Proc. Summer '94 USENIX Tech. Conference, Boston, MA, June 1994. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfskey.ps.) The new version differs from the version described in the papers in a few ways: * The encryption scheme has been strengthened, and now provides greater security but with the online latency of only single-DES. * Support for the smartcard-based key management system is not included and a few of the tools are not included. * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. * User-contributed ports to a number of additional platforms. * Hooks for adding new ciphers. * 3-DES and MacGuffin encryption options. * Timeout options allow automatic detach of encrypted directories after a set time or period of inactivity. CFS is being distributed as a research prototype; it is COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if the system deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. The software was developed under SunOS and BSDI, and there are also unsupported user-contributed ports available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really can't promise to provide any technical support at all, beyond the source code itself. We also maintain a mailing list for CFS users and developers; subscription information is included with the source code. Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. You may * not export it, in whole or in part, or cause or allow such export, * through act or omission, without prior authorization from the United * States government and written permission from AT&T. In particular, * you may not make any part of this software available for general or * unrestricted distribution to others, nor may you disclose this software * to persons other than citizens and permanent residents of the United * States and Canada. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please send email to: cfs(a)research.att.com DO NOT REPLY DIRECTLY TO THE SENDER OF MESSAGE. You must include a statement that you are in the US or Canada, are a citizen or legal permanent resident of the US or Canada, and have read and understand the license conditions stated above. Also include an email address in a US or Canada-registered domain. The code will be sent to you via email in a uuencoded compressed tarfile.

1 0

Re: The Market for Crypto--A Curmudgeon's View
by Amanda Walker 17 Dec '03

17 Dec '03

> I disagree here -- I've gotten a couple of jobs where my net > reputation preceded me and was the primary motivator for my getting > an interview. I was also told at one of them to continue posting as I > did because they felt that their reputation was enhanced by mine. Indeed. Every job I've had since part-time consulting in college has been gotten through the net, and with me electronic presentation and reputation a large factor in getting hired. My official title at InterCon is "Software Engineer / Net Goddess", and among my official responsibilities are to competently and professionally represent myself and my employer on the Internet. The whole reason I'm on cypherpunks, in fact, is because we're ramping up on supporting encryption & authentication in our commercial software, and this is where the ideas are. > And "cannot make money on the net"? How do you see this? Much as I > hate the metaphor, I don't make money on the local highways either, > but they're a part of real life. It would also be hard to ship things without highways & airports :). This is why the net is an example of infastructure. InterCon probably makes more money from people who download our demos over the net, or see reviews and recommendations on comp.sys.mac.*, than we do from our traditional printed advertising (and given the quality of a couple of our MacWeek ads, this is a darned good thing :)). > Just because the reputations aren't digital yet, nor is the cash, > doesn't mean that the Net isn't real life. It's as real as nearby > I-94. And a lot more interesting and complex. I agree. And reputations *are* becoming at least partially digital. I've refused to hire people because I've seen them being twits on the net, and I've hired people (and been hired) because I make a generally good net.impression. It even got my picture in Fortune magazine this spring. If that's not at least a start at a digital reputation, I'm not sure what is. Amanda Walker InterCon Systems Corporation

1 0

Re: recent voice over data (fwd)
by Dave Emery 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Re: Scalability of Ecash System / Article on Internet Cash available.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:33 AM 12/2/94 -0500, Robert Hettinga wrote: >Filched from buyinfo, where they've been talking a lot about e$ lately... Oops. Sorry folks. That's what I get for letting my outbound mail stack up... Call it a prequel to the Brands excluded thread... Sorry again. Long story. Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: ERIK HUGHES: EGOTISTICAL PRICK
by ddt＠lsd.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Subject: ERIK HUGHES: EGOTISTICAL PRICK FWIW, I know Eric and can spell his name properly. From the numerous times I've been in his presence, it's my humble opinion that he's about the furthest thing from the bozo described in this flame that I can imagine. Whoever posted this rudeness is cruelly clue-challenged about Eric's character. From the content of his/her attack, this person should really apologize, but from the puerility of it, I doubt the author is mature enough to admit it. BTW, Eric was and is an early and consistent contributor of quality thinking to this list as far back as I can remember, which is early '92, has donate a lot of time and effort to helping maintain it, and I have no problem with him being photographed or known as a "founder." He's never in any way abused or even preened about it, afaik, and seems appropriately non-egotistical at all times, both in person and in posts. I'm pretty sick of ad hominem attacks like this on the net, but they usualy emanate from sleep-deprived teenagers with no manners who post anonymously, and not from responsible individuals trying to add a voice of humility to an important debate. Laugh it off, Eric, and ignore it (as I know you will). As for the idea of mandatory signatures: on the surface it's a pain and I don't much like it, but then, it does do an important thing in promoting "verifiable" posts. I don't post much material to the list (mostly I learn from you guys), and don't find it particularly onerous. Someone who contributes regularly might find it an inconvenience. Lots of things are way more inconvenient, if you ask me (like applying for an FOIA report). I think it might have the positive side-effect of providing an incentive for people to post meaningful information, and not lots of noise to the list (thereby somewhat diminishing the high volume). What effect does it have on anonymity, though? That could be a serious sticking point: as much as I dislike flames and idiocy from anonymous posters, I will defend their right to post anonymously regardless of how unpleasantly it smells. dave ____________________________________________ "Even the mad scientists called me crazy!" -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLt/zWaHBOF9KrwDlAQFzfAP+MusVHsSaPVq0jzLvqBCUVf8O+JAFbQXZ PKNHai6WXNJqECknifZ9GTYg0tccKY4G+xWjED6oLjeK3V1ds7hIaWNUrFg8Ok6r hH1oPnIMqxY6Iqc0XrgyY+5JnOBVWILA+Iwxy1I0UP+J10Tz8qUY1Q4CL5Ld7yqd FE7JafKUxOw= =Yoe9 -----END PGP SIGNATURE-----

1 0

AA BBS case
by moulton＠netcom.com 17 Dec '03

17 Dec '03

A few months ago there were several posts about the AA BBS case. Here is the info about the sentencing. According to an AP story, Robert and Carleen Thomas were sentenced December 2, 1994 to 37 and 30 months in prison respectively for "transmitting pornography via computer and selling obscene videotapes". The defendents will be ordered to surrender their computer equipment according to U.S. District Judge Julia Gibbons. The defendants will begin their sentences in about two months and will not allowed to remain free during appeal. The Thomases' operated the members-only Amateur Action Bulletin Board System in California. They were tried and convicted in Tennesse.

1 0

Re: using us crypto sw outside usa
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I was wondering what is the legal status for using rsaref ooutside usa. > Is it legal or not? There are three problems - getting a copy, patent, and copyright. Getting a copy of RSAREF means that somebody has to export it, which the US government strongly disapproves of. On the other hand, if you're not a US citizen, and not in the US, and your government doesn't have laws against possessing things that other governments don't want you to have, no problem. Patent - the RSA algorithm patent doesn't apply outside the US, so no problem. Copyright - Most governments do honor U.S. copyrights. Some of the early RSAREF versions said that you may not export it, so there may be copyright problems if you use them outside the US. Newer versions have a warning that the US government doesn't permit export, and recommends talking to a lawyer if this affects you, but doesn't say that you may not do so - so there isn't a problem with permission, and therefore not with copyright. That's nice, because otherwise I would have had to pay somebody outside North America to write a clone. (I had offered anybody on the net outside the US/Canada $100 to do so, but nobody took it, and I now cancel that offer because RSA doesn't forbid overseas use and copies have apparently gotten distributed.) > Also, what is the legal status of RC4 code posted to the net? Uncertain. It was protected by trade secret (not giving anybody copies unless they sign a license contract), but somebody apparently violated their contract and disclosed it anyway. Some places have laws against using information released like that, some don't, some allow the originator of the information to sue. There's also the problem of verifying whether that *really* is RC4. Bill Stewart

1 0

Info about Linux
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

Joe Block, jpb(a)gate.net, sez: > I want to run linux on this beast and would like some suggestions from the > list - which of the linux CDs do you recommend? Hi, I've got Linux. Linux comes in different "distributions" - collections of files that have been integrated into a coherent system. My distribution is sold by Yggdrasil, (408) 261-6630, (800) 261-6630, for $39.95. I like it because it comes with a single boot floppy, and will run off the CDROM once it boots, so you can check it out without even having a hard disk installed. If you've got time, patience, a good, fast net connection and a whole lotta floppies, the slackware distribution (and a couple of others) are available via anonymous FTP from sunsite.unc.edu. There are also several other distributions available on CDROM from various vendors. Check the ads in the Linux Journal (subs(a)ssc.com for subscription info, (206) 527-3385, or at one of the bookstores I mention further down). If you know about computers, and are willing to put some time into mucking around fixing little petty problems, you can get a very nice system. Mine is a 33 MHz 386 (this is a little too slow for me, but works well), with 8MB of memory (sufficient, should have more), and a nice fast 2.1 GB Fast SCSI-2 Quantum Empire 2100S hard disk. I invested in the hard disk as I felt it would be a lasting value in future computers. I'm skimping on ISA bus cards for the PC as I want to get a PCI bus machine, probably a 100MHz 486, in a few months. You will be able to install Linux, the compiler, basic utilities, and the kernel sources with the disk space you have. You'll want to get more hard disk. I would recommend installing Linux a couple of times, just to see how it goes, before committing to a permanent installation. If you can't get more disk space, you can leave the Yggdrasil CDROM in your drive all the time and run the programs off the CDROM. Slower, but it works OK. I highly recommend the Linux Bible, from Yggdrasil, whatever distribution you get. Read the "How To's" on the various hardware options _before_ purchasing any new hardware. There are many supported peripherals, but I understand many of them work only marginally. For example, the UART chips generally used in PC serial ports are quite inadequate for driving an internet connection, as your machine will spend all its time servicing one-interrupt-per-character interrupts, but a serial card with a 16 character buffer that works just fine is available quite cheaply. You can FTP the bible from ftp.yggdrasil.com, but you'll want the hardcopy as it is over 1000 pages. The cover price is less than the cost of the toner cartridge you'll burn printing it. The How To's, the Linux MetaFAQ and lots of other info are on rtfm.mit.edu and sunsite.unc.edu. I've used lots of Unix systems, from System V on a 286, to Sun workstations, Vaxes, and even a Cray running Unicos, and I can say that Linux is equal to or better than any of them as far as what the OS can do, in some respects much much better. (I removed SCO ODT from my hard disk to install Linux. I might reinstall it on a second drive just to test my programs). There are still lots of glitches, but you have the source code, and access to comp.os.linux.help, where everyone else has the source code too - it beats the Hell out of Sun's technical support, IMHO. With about two thousand dollars more hardware, I would have a machine I would enjoy as much as a fifteen thousand dollar Sun, with the source code to boot ;-). One thing I highly recommend: if you or anyone you know is planning on setting up a full-time Internet connection, use a Linux box as a router, running PPP or SLIP out a modem, and ethernet on your LAN. Even a slow 386 has enough performance to service a SLIP connection at 28 kbaud, and since you have the source code to the kernel and all the internet server software, you can implement a firewall any way you like. I'm contemplating preparing my own distribution, which would be a very stripped-down Linux kernel and OS utility set, on a small number of bootable CDROMs, to allow one to install a firewall router on a small hard disk. Don't hold your breath waiting for this though. There is a security enhancement I mean to try once I've set up my own full-time router (watch for http://crawford.sc.scruznet.com, in about two weeks, maybe a month). I want to remove the ability to set the setuid bit from the kernel. Trying to set the setuid bit on a file will abort the process. Of course you can't install system software if this is done - but I could boot off a different kernel to do maintenance. This would prevent the problem of a hacker breaking in and dropping a program in my path that the hacker intends me to accidentally execute as root. There would be ways to set the bit (writing into the raw disk special file) but it would require more effort to accomplish. Crypto enthusiasts in the US and Canada can get Matt Blaze's CFS - I just got the sources, and haven't tried them out yet, but I understand there is already a Linux port. Now here's a puzzler for you. The People's Republic of China is working very hard to modernize, but still lacks capital for much hardware investment, so you see banks using 386 boxes to run an entire bank, if the bank uses a computer at all. A couple of years ago I heard that the PRC signed a deal with some big Unix vendor to supply the nation with computers and software, for many millions of dollars. Why don't they use Linux? The PRC is certainly not lacking for educated people who could do all the development they need. You can get Linux books and CDROM's from the Computer Literacy bookstore on North First Street in San Jose, and Powell's technical books in Portland Oregon. Powell's does mail order, and has a Web page which allows you to search their inventory for books. They've got lots of crypto books too, 2600 Magazine and lots of engineering books. I think the URL is http:technical.powells.portland.or.us. Development versions of Linux are available for Macintoshes and MIPS machines. If I were to use a Linux Laptop, I would put it on a Macintosh Powerbook. Regards, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Kudos
by usura＠xs4all.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks and congratulations to Todd for a job well done with the CP signing service and Raph for his excellent work with premail. An appreciative lurker/learner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuA9wioZzwIn1bdtAQFXnwGAitqcooxfEeABifXLhmxmRAQKlM90Gm6K Y2vmZi3kjSYWpDMYQNkID+HXYTeps30Q =oN3X -----END PGP SIGNATURE-----

1 0