December 2003 - cypherpunks-legacy

ANNOUNCE: bruteRC4, 40 bits all swept
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Well we have demonstrated that 40 bit RC4 can be brute forced in around a weeks compute time. (We've also learned a list of thinks to fix for the next attempt as no key was forthcoming :-|, details on why not and what is being fixed to ensure this doesn't happen with a future RC4-40 or with the coming 40+88 SSL brute forceing are given below) The problems are logistic, human error, etc, from a compute time point of view it *really* was a full sweep of a 40 bit keyspace. And on average you would expect to sweep in half this time. The bulk of the work was done in under one weeks compute time, but problems with people forgetting to acknowledge what they swept, meant that 3 or 4 people swept the remaining key space over, which slowed down this announce. Here's the hall of fame, for bits/percentage swept per identifiable contributer (this is tallied by acknowledgement, if you swept but did not acknoweldge quickly enough or at all, that work won't show as the last keyspace was re-swept to hurry things up. The first acknowledgement to be recieved counts, the rest get ignored). bits/40 percent contributer ---------------------------------------------------------------------- 37.2 bits (14.063%) Jon Shekter <jshekter(a)alias.com> 36.4 bits (8.081%) Alvin Brattli <alvin(a)phys.uit.no> 36.1 bits (6.909%) anonymous 36.1 bits (6.836%) Dan Bailey <merzbow(a)ibm.net> 36.1 bits (6.812%) Piete Brooks <Piete.Brooks(a)cl.cam.ac.uk> 35.6 bits (4.688%) Loren Rittle <rittle(a)comm.mot.com> 35.6 bits (4.663%) Adam Back <aba(a)dcs.ex.ac.uk> 35.4 bits (4.102%) Eric Young <eay(a)mincom.oz.au> 35.4 bits (4.004%) Fred <admin(a)dcwill.com> 35.3 bits (3.809%) Martin Hamilton <martin(a)mrrl.lut.ac.uk> 35.2 bits (3.711%) Kevin Wang <kwang(a)blackbox.punk.net> 35.0 bits (3.125%) Richard Martin <rmartin(a)alias.com> 34.7 bits (2.490%) Dan Oelke <droelke(a)aud.alcatel.com> 34.3 bits (1.978%) Branko Lankester 34.0 bits (1.611%) Simon McAuliffe <sai(a)comp.vuw.ac.nz> 34.0 bits (1.562%) Mike Gebis <m-gebis(a)uiuc.edu> 33.8 bits (1.392%) Pat Finerty <zinc(a)zifi.genetics.utah.edu> 33.8 bits (1.367%) <hodgeman(a)csd.uwm.edu> 33.5 bits (1.123%) Panu Rissanen <Panu.Rissanen(a)lut.fi> 33.4 bits (1.001%) Paul Bell <pjb(a)23kgroup.com> 33.3 bits (0.977%) Matt Thomlinson <phantom(a)u.washington.edu> 33.3 bits (0.952%) Will Kinney <kinney(a)colorado.edu> 33.2 bits (0.903%) T J Hardin <hardin(a)cyberspace.com> 33.2 bits (0.879%) Patrick May <pjm(a)ionia.engr.sgi.com> 32.8 bits (0.684%) Stephane Bortzmeyer <bortzmeyer(a)cnam.fr> 32.7 bits (0.635%) anonner 32.5 bits (0.537%) Matt Pauker <mpauker(a)peganet.com> 32.5 bits (0.537%) Ed Kern <ejk(a)digex.net> 32.5 bits (0.537%) Andrew Kuchling <andrewk(a)cst.ca> 32.5 bits (0.537%) <rmtodd(a)mailhost.ecn.uoknor.edu> 32.4 bits (0.513%) <somogyi(a)digmedia.com> 32.3 bits (0.488%) Jon Baber <jbaber(a)mi.leeds.ac.uk> 32.2 bits (0.439%) Bryce Boland <bryce(a)cybernet.co.nz> 32.0 bits (0.391%) Thad Beier <thad(a)thresher.uucp.netcom.com> 32.0 bits (0.391%) Per Stoltze <stoltze(a)fysik.dtu.dk> 32.0 bits (0.391%) Glenn Powers <gpowers(a)bradley.edu> 32.0 bits (0.391%) <janzen(a)idacom.hp.com> 31.8 bits (0.342%) Mike Bailey <bailey(a)computek.net> 31.7 bits (0.317%) Robert Hayden <hayden(a)krypton.mankato.msus.edu> 31.7 bits (0.317%) John Limpert <johnl(a)radix.net> 31.6 bits (0.293%) Opus 31.6 bits (0.293%) Mark Rogaski <rogaski(a)phobos.lib.iup.edu> 31.6 bits (0.293%) <josh(a)silicon.net> 31.5 bits (0.269%) Michael Bacon <mbacon(a)dfw.net> 31.3 bits (0.244%) Jim Gillogly <jim(a)acm.org> 31.3 bits (0.244%) David Zuhn <zoo(a)armadillo.com> 31.2 bits (0.220%) Russell Ross <rross(a)sci.dixie.edu> 31.2 bits (0.220%) Don Kitchen <don(a)cs.byu.edu> 31.0 bits (0.195%) Scott Renfro <csylvix!srenfro(a)cuok.cameron.edu> 31.0 bits (0.195%) Planar <Damien.Doligez(a)inria.fr> 30.8 bits (0.171%) Matt <panzer(a)dhp.com> 30.8 bits (0.171%) Joe Thomas <jthomas(a)access.digex.net> 30.8 bits (0.171%) Adrian Thomson <a.thomson(a)nexor.co.uk> 30.6 bits (0.146%) Michael Axelrod <mja(a)cacs.usl.edu> 30.6 bits (0.146%) Mark Eichin <mark(a)kitten.gen.ma.us> 30.6 bits (0.146%) Jason Burrell <jburrell(a)crl.com> 30.3 bits (0.122%) Will Ware <wware(a)world.std.com> 30.3 bits (0.122%) Kevin Maher <kmaher(a)ucsd.edu> 30.3 bits (0.122%) Josh Sled <jsled(a)cello.gina.calstate.edu> 30.3 bits (0.122%) Checkered Daemon <cdaemon(a)goblin.punk.net> 30.3 bits (0.122%) Andrew Roos <andrewr(a)realtime.co.za> 30.0 bits (0.098%) Jason Weisberger <jweis(a)primenet.com> 30.0 bits (0.098%) <pdlamb(a)iquest.com> 30.0 bits (0.098%) <matt(a)comp.vuw.ac.nz> 29.6 bits (0.073%) Mark Grant <mark(a)unicorn.com> 29.6 bits (0.073%) Lou Poppler <lwp(a)mail.msen.com> 29.6 bits (0.073%) Edwin de Graaf <graaf(a)iaehv.nl> 29.6 bits (0.073%) David Conrad <conrad(a)detroit.freenet.org> 29.6 bits (0.073%) Dan Tauber <dat(a)netcom.com> 29.6 bits (0.073%) Alexandra Griffin <acg(a)kzin.cen.ufl.edu> 29.6 bits (0.073%) <pkronenw(a)erc.cat.syr.edu> 29.6 bits (0.073%) <ghazelwo(a)cs.oberlin.edu> 29.0 bits (0.049%) Stuart <stu(a)nemesis.wimsey.com> 29.0 bits (0.049%) Pekka Riiali <Pekka.Riiali(a)lut.fi> 29.0 bits (0.049%) Jeffrey Ollie <jeffo(a)noc.netins.net> 29.0 bits (0.049%) James Hightower <jamesh(a)netcom.com> 29.0 bits (0.049%) Hadmut Danisch <danisch(a)ira.uka.de> 29.0 bits (0.049%) Bob Snyder <rsnyder(a)janet.advsys.com> 29.0 bits (0.049%) <stevet(a)smeg.net4.io.org> 28.0 bits (0.024%) Sang Hahn <sghahn(a)math1.kaist.ac.kr> 28.0 bits (0.024%) Roy Silvernail <roy(a)cybrspc.mn.org> 28.0 bits (0.024%) Ollivier Robert <roberto(a)keltia.freenix.fr> 28.0 bits (0.024%) Lucky Green <shamrock(a)netcom.com> 28.0 bits (0.024%) L Futplex McCarthy <futplex(a)pseudonym.com> 28.0 bits (0.024%) Jeff Licquia <jalicqui(a)prairienet.org> 28.0 bits (0.024%) J Francois <frenchie(a)magus.dgsys.com> 28.0 bits (0.024%) Brian LaMacchia <bal(a)mit.edu> 28.0 bits (0.024%) Andy Brown <a.brown(a)nexor.co.uk> 28.0 bits (0.024%) Adam Morrison <adam(a)math.tau.ac.il> 28.0 bits (0.024%) <mikew(a)nersc.gov> ---------------------------------------------------------------------- 40.0 bits (100.000%) 89 cpunks + x * anonners in 1 weeks compute Report is on the brute-rc4.html page also: http://dcs.ex.ac.uk/~aba/brute-rc4.html Problems. --------- But, briefly these are the things which may be responsible for the failure to find a key: a) We weren't sure if we had a known plaintext / ciphertext pair This due to lack of Microsoft Access specs, this was known from the begining, but we thought we'd try it and see. b) Eeek! There was a bug in bruterc4.c for some time which affected Alphas, and possibly other BSD machines. This meant keyspace wasn't being searched when the -v option was used. c) Some people reported that their browser / uuencode software combination meant that cutting and pasting of the uuencode plain text and cipher text files was silently failing due to extra spaces inserted by a flawed pasting operation. d) Human error - it is possible that some keys were unswept - by accident. e) Malicious humans - we don't know, but think this was not a problem. Solutions. ---------- Proposed solutions for future brute forcing efforts (such as the upcoming SSL effort), for respective points above: a) Need better spec of MA, or more experimentation / reverse engineering. For SSL this is not a problem as the SSL specs are openly available and very detailed. b) Write bug free software :-) Test more rigourously on multiple unixs and architectures with a brief test run. c) Use hex numbers in a config file. Ie don't use uuencode on web page. d) We're going to have the programs (bruteRC4.c and bruteSSL.c) produce a checksum on completion. Acknowledgements of swept keyspace must be with checksum. Crude check to reduce chances of mistyped big hex nums. Represent the key space as a 4 digit hex number like this: 1a23, in terms of 24 bit keyspaces, and represent keyspace to sweep in terms of numbers of those, lots of people had difficulty reasoning in log base2 for bits. e) Do nothing yet. If we get lots of compute and it proves to be a problem perhaps implement some redundancy into the system. Coming soon brute force attempt on Hal Finney's brute of 40+88bit SSL. Watch this space, several cypherpunks are hard at work optimising their bruteSSL.c code, and also writing farming software via a system of servers connected via sockets. The WWW page doler will still be available for those with out direct IP. Hal Finney's SSL challenge is here: http://www.portal.com/~hfinney/sslchal.html More on SSL later, but we hoped to give the SSL one a wider announce in sci.crypt, and see how *fast* we can brute 40 bit keyspace. Hope to see your compute in the brute SSL effort when it is announced, Adam -- HAVE *YOU* EXPORTED A CRYPTO SYSTEM TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365

1 0

Re: Government Mandated Keys
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 11:02 AM 7/19/95 PDT, rick hoselton wrote: >I want to register the 1-bit key of "1". I expect to >send about half my message bits encrypted, the rest will be clear-text. Oh, go ahead, register 0 also. You'll probably want to switch keys occasionally during sessions. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: cypherpunk "Zen" victories
by Doug Hughes 17 Dec '03

17 Dec '03

Vladimir Z. Nuri scribbled: > >I was recently marvelling at how much the "cypherpunk agenda" >is being advanced even in light of what would seem to be setbacks. >Particularly in the area of anonymous remailers. We now have a very >major article on remailers and Julf's setup in the NYT that portrays >them in an unbiased, unhysteria-stricken mode. Also in the article, >it quotes the police as regretting their falling victim to >Scientology manipulation and investigating the remailer "without >cause". A major officer is quoted as saying, roughly, "we are >going to need a crime before we investigate in the future". > Could you provide a page, date, and title for this article? I would like to read it but don't get a daily subscription. Muchas gracias Doug Hughes Engineering Network Services doug(a)eng.auburn.edu Auburn University

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!" (plus: "help me with my PGP problems!") (fwd)
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 19 Jul 1995, Bryce Wilcox wrote: [lots of really really good stuff deleted, because I really don't have anything good to add to it] > I am fond of saying that we PGP enthusiasts have two choices ahead of us > within a couple of years: either 5,000 enthusiasts using PGP with > MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL > SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with > push-button interfaces and multi-user remote systems. I said it last week, and I'll say it again. From a sociological standpoint, it's those 10,000,000 computer-illiterate e-mail users that we need to focus all of our efforts towards. Those 5,000 literate people we really don't have to care about. I will say, and this makes for interesting commentary, over the last week or so, I've released those simple scripts for Pine (and today for Tin) that integrate digital signing fairly seamlessly with those programs. I've received about 200 requests since Monday from people asking where to find PGP, asking about similiar scripts for Windoze or Dos or Mac, or thanking me for providing an easier way to do digital signatures. And that was a simple sh script! Imagine if some people with REAL writing ability worked on some programs... Pushing for wide use of digital signatures is one way to get PGP to be a "household" name for people writing on the net. I now sign everything I post and mail. It gets people's attention and interest. Interest leads to use. > The important thing, of course, is the easy-to-use, e-mail-integrated > software (version 3.0, I hope?), but it would also help if Zimmermann's > PGP Doc didn't tell those computer-illiterates to either "become enthusiasts > or don't use it." I think the politics of PGP is stagnated at about two years ago or so. The demographics are no longer accepting to long technical rants. Today's generation of net.user doesn't need 100% security 100% of the time, what they need is "good" security when they want it, but in a way that they don't have to think much about. Sorry if I'm ranting again abotu everything I said last week. I'm in the process of doing research on social evolution using the net as an example of accelerated cultural change. I'm kinda in a specific mindset right now :-). -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.1 iQCVAwUBMA1WVjokqlyVGmCFAQEtJgP+JPbrM4KSQGiIznlnghYs1FEizGGhHLJZ +cSz36jatErJ/kFOEsNSwLz0crjdyHtv2v3ojsExTQVgQxzS/U60zwNR+gPxwdr7 bpIoEaZwGtANmsrkUtTqIwEncs7WPAF08ZbbaZpeB58qcvnpAergshrJya7gtOSM Wp8BqFcU+84= =TOLZ -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> Cthulhu Matata \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> hayden(a)krypton.mankato.msus.edu \/ Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

1 0

Adding
by netchaos＠ix.netcom.com 17 Dec '03

17 Dec '03

I would like to be added to your list.

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!" (plus: "help mewith my PGP problems!") (fwd)
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Robert A. Hayden writes: > I said it last week, and I'll say it again. From a sociological > standpoint, it's those 10,000,000 computer-illiterate e-mail users > that we need to focus all of our efforts towards. Those 5,000 > literate people we really don't have to care about. [...snip...] > Imagine if some people with REAL writing ability worked on some > programs... [...snip...] > I think the politics of PGP is stagnated at about two years ago or > so. The demographics are no longer accepting to long technical > rants. Today's generation of net.user doesn't need 100% security > 100% of the time, what they need is "good" security when they want > it, but in a way that they don't have to think much about. This has been hashed over on the list many, many times in the past. I suspect there are competent programmers out there who want to write easy-to-use interfaces for PGP (I know at least one), but there are problems. To write a good GUI interface (with proper key-management features) on Windows or Mac, for instance, you need to have access to PGP's internal crypto routines as well as the routines for reading and writing PGP messages and key certificates. The problem is that the PGP 2 code does not have the internal 'core' routines separated from it's command-line interface. The answers are to either shell out to PGP (which, AFAIK, is what every interface except MacPGP does), hack the PGP 2 code, or use PGPTools. Shelling out to PGP isn't going to cut it for a slick GUI package, especially if you want to have a decent key-management interface. You could do it, but it will be slow and kludgy and you will have to change it all when PGP 3 comes out. Hacking PGP would be a major effort. Additionally, there is risk of introducing a subtle flaw in the crypto routines. However, the main killer is that PGP 3 is going to have a brand new key-ring format along with many other enhancements, fixes, and other changes to the crypto code. All of the work will have to be done again to bring the interface up to date when PGP 3 is released, which could be within 6 months (who knows?). PGPTools is buggy and not supported. Any effort to bring PGPTools up to a stable level would likely be thrown away when PGP 3 is released. The real solution is that PGP 3 will have all of it's core routines in a separate library with a stable API specifically for the purpose of writing slick interfaces. So basically all of the would-be PGP interface developers are waiting for beta releases of the library. Unfortunately, this has been the situation for almost two years now. By now the PGP 2 code could have been completely turned into a library with a clean API and no command-line interface remnants, but developers have been discouraged by the promise of PGP 3 coming out 'RSN'... andrew ...still waiting for pgp 3 news...

1 0

cfs on linux - rpcgen broken in slackware distribution!
by zinc 17 Dec '03

17 Dec '03

cpunks, yesterday i requested some help compiling cfs on my linux system. well, after some serious help i got it to work. the problem was that my copy of rpcgen was broken. this was the copy installed with the slackware distribution. damn, this is some sort of never ending contest between my sanity and the slackware distribution! -pat patrick finerty = zinc(a)zifi.genetics.utah.edu = pfinerty(a)nyx.cs.du.edu U of Utah biochem grad student in the Bass lab - zinc fingers + dsRNA! ** FINGER ME for my pgp public key ** crypto for the masses! zifi runs LINUX 1.2.11 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!" (plu
by jfmesq＠ibm.net 17 Dec '03

17 Dec '03

>I've received about 200 requests since Monday from people asking where to >find PGP, asking about similiar scripts for Windoze or Dos or Mac.... If anyone asks about OS/2, a good script is available at ftp.gibbon.com. FWIW. --JFM

1 0

Why no action alert, coalition opposing S. 974?
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have read the EFF analysis of Senate bill 974, which is designed to inhibit encryption on Networks. I think that it is a thoughtful document but I am concerned that there has been no action alert produced to tell people the most effective way to oppose this horrible Bill. People who are concerned about the bill need to know what Senators could most profitably be contacted. Also why has no coalition been formed to oppose this bill? I am aware that many people are busy opposing S314, but S974 is equally terrible as it attempts to suppress free expression. I could try to produce an action alert myself, but I would probably make errors as I am not up on the legal subtleties and the intricacies of Congress. Could some of the savvy people please write an action alert? Otherwise I will be forced to take a stab at it. - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMA10YfBUQYbUhJh5AQFMBAQAgUJAj1nNdG54IxIFAboCw+Q/E8WWOvEO 9Aazj9hjHK7VeHi+vpTY7eJRbQq7LyQq/ex41PE+QXu+mjWe3c1si8HmhherA22i CUGv3UI8L/Z43zLtN2TI9reJsizeYnmHlO3uUffP3vnhwBJm1G7EAlXvKFqikC90 q1DUqqgq7k4= =4yQ7 -----END PGP SIGNATURE-----

3 2

Investigate Your Federal Building :)
by The Gate 17 Dec '03

17 Dec '03

Had problems with the original transmission... 21:22 EST July 17th, 1995 New Haven, CT Day One, Investigation Begins. Of course, I've been researching THE FACTS all my life, but never before have I gone to the FBI to ask for information. Also of course, they gave me none, or practically none, just this: (202) 324-3000. Can anyone guess? FBIHQ it says on the yellow post-it note. That's all she could give me. I have been incredibly scared these last couple of days, wondering exactly what I was doing, but I feel better this evening. Just going down to the Federal Building and poking around asking questions has not gotten me killed, and I don't think it will. Check. In a recent post to this list I said I was going to go to the Federal Building here in New Haven to begin a local investigation of Federal Events. So I put on my coat and tie, washed up a little (long-hair and beard couldn't be controlled, will not cut) and started walking, stopping off at Kinko's Copies to make a free local phone call to one of my partners and grab some note paper for the session. Then on across the green towards the courthouse, town hall and on Orange Street, the Robert N. Giaimo (sp) Federal Building. Of course, I'd been there before, to the post office, and it was always a rather non-descript affair. But now I was looking for something, and though I didn't find what I was looking for, I did find out a lot. Alot of it was disturbing, alot of it was funny, and alot of it was encouraging, especially the print of the original Declaration and Constitution/Bill of Rights, as well as the posted Code of Ethics for Government Service, Public Law 96-303, passed unanimously in Congress on June 27, 1980, signed by the President (Carter?) on July 3, 1980: Article One of Ten: "Put loyalty to the highest moral principles and to country above loyalty to persons, party or Government department." No problem, I thought, I'll keep that in mind. Article 9: "Expose corruption wherever discovered." Whoa, that's a tough one, where are you going to find corruption in the United States of America? Article 11:"Uphold the Constitution, laws and regulations of the United States and all governments therein and never be a party to their evasion." Well, the Constitution I can uphold, as it upholds me, but I don't know about all the other laws and regulations...I'm not sure everything signed since 1776 passes my muster. You? But though I had been to the Federal Building several times previously, I wasn't ready for what I encountered this time, as it had never before been present: heavy security presence. No secret service types, just rent-a-cops with a metal detector and baggage x-ray device. But they were bustling, somewhat loud, and definitely a presence. A humorous note: Usually the electro-magnetic energy that I generate because of meditation and honest emotional presence is enough to kick the metal detectors, but I thought if I took my belt off, I could get through. No such luck, and when I took my belt off, my pants, which were bought for my bigger brother, started to fall off. I don't wear underwear either, so I ended up walking through security holding my breeches up by hand. I thought, mmm the joy of security...of course, it was *my* costume (cover) that was falling apart, but I got back together without real embarassment. That's when I started to look around the building lobby. First I checked the directory. Yup, there it was, FBI, fifth floor, right underneath the penthouse cafe. BATF on the second floor, IRS third. Department of Protective Service (SS) first floor, though I saw no evidence of their lair or personnel. Bill Clinton and Al Gore on the wall, of course...Recycling bins for paper, cans, bottles and something else, perhaps newpapers. Nice touch I thought, it would be nice to see more of those. I wandered over to the bulletin board: Arson informants offered rewards $100,000 to $250,000 rewards offered to informers leading to convictors of international terrorists - mostly airplane and boat hijackers. The Code of Ethics for Government Service as mentioned above. Help for choking victims... (At this time, I was rushed by the closing of the computer center. The facts are flear though...) Anyway, on to greater heights... Elevator, fifth floor, get in, man there, looks like FBI, look at numbers in elevator, 5 already lit. A real live FBI agent and I in the elevator together, wow. Day already made, still only ten o'clock or so. Get off 5th floor. Man goes one way, I go another, meet another real live FBI guy, "Where's the receptionist?" "Through that door" came the warm reply from a brown-suited man with a pock-marked face. Hmm, definitely FBI. Into FBI visitor center, one small room, bulletproof glass, Time magazines, American Flag with gold tassels in corner, photos of Agents, woman behind the counter: "Uh, I'm something of a freelance reporter for Citizen's Television and Internet newsgroups, and I'd like to know if you can confirm whether or not someone worked for the FBI..." Polite no from FBI woman. "Is there a public information office?" No, then checks mind, goes to back to talk with all male contingent, at least seven agents in back room, including the one I saw on the elevator, all are rustled into alert by the inquiry from CTV producer and Searchnet Reporter. I can just hear them saying, by gosh they were right, the Internet really is spawning investigators... Then all I get back is the phone number, but it was a lot of fun. Down to the BATF? nah, enough for the day. Thoughts on the way to the library... Next time, maybe I'll deliver a message. Gotta run, Lee. ____________________________|||||||||||||||||||||______________________________ R. Leland Lehrman@The Gate, New Haven, CT. http://id.wing.net/~gate/gate.html God, Art, Technology and Ecology Research and Development >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Do you love the Mother?>>>>>>>>>>>>>>>>>>>>>>>>

3 2

Re: (Cracking) Netscape (is) the Big Win
by Peter Trei 17 Dec '03

17 Dec '03

> > Timothy C. May writes: > > Integration of crypto into Netscape is thus the Big Win. > Crypto *is* integrated into Netscape. Unfortunately, the crypto is SSL > -- a complete waste of time. >[snip] > Perry This is why it's imperative for cpunks to work on the SSL challenge recently posted. Cracking 40 bit RC4 will provide a strong industry incentive to move towards stronger crypto standards, and to pressure the government to relax ITAR. If the SSL crack looks like it will take a while to gear up, perhaps we should work on an interim project, cracking a straight 40bit rc4 encrypted message. If there is interest, I can create such a text, and escrow the key and plaintext in a PGP-encoded posting. While such a crack will not be as strong a blow against SSL and 40-bit crypto as cracking a complete SSL transaction, it will be a lot better then only being able to say 'Well, we didn't find a key, but we *did* sweep 40 bits of keyspace', which is all we have now. If need be, we can follow up with a crack of full-bore SSL. Disclaimer: I work on a competing product, but am posting this in my private capacity. We've bigger fish to fry than Netscape. Peter Trei ptrei(a)acm.org Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

EVENT: NY-only, non-NY folks ignore (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=================================================================93======= + ^ + | Ray Arachelian | Amerika: The land of the Freeh. | \-_ _-/ | \|/ |sunder(a)escape.com| Where day by day, yet another | \ -- / | <--+-->| | Constitutional right vanishes. |6 _\- -/_ 6| /|\ | Just Say | |----\ /---- | + v + | "No" to the NSA!| Jail the censor, not the author!| \/ | =======/---------------------------------------------------------VI------/ / I watched and weeped as the Exon bill passed, knowing that yet / / another freedom vanished before my eyes. How soon before we see/ /a full scale dictatorship in the name of decency? While the rest / /of_the_world_fights_FOR_freedom,_our_gov'ment_fights_our_freedom_/ ---------- Forwarded message ---------- Date: Tue, 18 Jul 1995 01:12:41 -0400 (EDT) From: She Devil With A Modem! <redsonja(a)computel.com> To: sunder(a)escape.com Subject: EVENT: NY-only, non-NY folks ignore (fwd) Also Sprach Shabbir J. Safdar: >From shabbir(a)panix.com Mon Jul 17 23:51:37 1995 Date: Mon, 17 Jul 1995 23:45:32 -0400 From: "Shabbir J. Safdar" <shabbir(a)panix.com> Message-Id: <199507180345.XAA05923(a)panix3.panix.com> To: stop314(a)panix.com Subject: EVENT: NY-only, non-NY folks ignore ====================================================================== Campaign to stop the 1995 Communications Decency Act FREE NEW YORK WORKSHOP We encourage you to forward this to friends DO NOT REDISTRIBUTE AFTER July 22, 1995 ______________________________________________________________________ WORKSHOP DETAILS What: A free workshop on current online censorship legislation and the viable alternatives. When: Saturday July 22nd, 1-4pm Where: ACLU offices at Times Sq (132 West 43rd St at 6th Ave) Who: Everyone (teachers, librarians, businesses, everyone!) Agenda: Crash Course on the First Amendment and the New Censorship Legislation Questions and Answers About How the CDA Affects You and Your Business How to Lobby Your Representative Plans for the New York Lobby Day Against the CDA: Wednesday, July 26th ______________________________________________________________________ WHY YOU SHOULD ATTEND THE WORKSHOP Are you interested in seeing our government become less intrusive, not larger, and less involved in personal decisions about what you read? Do you believe that Constitutionally-protected speech should not be regulated by the FCC (or any other Federal agency)? Do you believe that computer networks are a tremendously powerful tool for giving many more people in our society a voice, bypassing traditional forms of media? If you find the above three questions compelling, you should be concerned about the 1995 Communications Decency Act (CDA). Having already passed the Senate, the CDA is headed for the House and has favorable odds of passing there as well if nothing is done. The CDA was passed by the Senate 84-16. It was voted on by many legislators who not only never use a computer, but have never read email, logged onto a BBS, read Usenet news, or seen a Web page. They were simply voting with their gut reaction, unaware that they were disastrously affecting the future of American expression and the most explosive industry seen in the last ten years. It *doesn't* have to be that way. We as New Yorkers can't expect our elected officials to vote out of a vacuum. We need to tell our Representatives that online systems are a new medium, not the same as a telephone, nor the same as television. They need to understand that the Internet and bulletin boards aren't simply Dial-A-Porn lines, or adult cable channels. However they won't come to these conclusions themselves; they need your help. Come to this free workshop and learn what you can do to help ensure that online communication isn't restricted unreasonably. _______________________________________________________________________ SUPPORTING ORGANIZATIONS American Civil Liberties Union, College Art Association, Creative Coalition, Feminists for Free Expression, and the Voters Telecommunications Watch _______________________________________________________________________ FOR MORE INFORMATION For more information about the CDA Workshop on July 22nd, contact: Shabbir Safdar, Voters Telecomm Watch Email: vtw(a)vtw.org (718) 596-7234 Ann Beeson, American Civil Liberties Union Email: beeson(a)aclu.org (212) 944-9800 x788 For more information about the CDA, see: Web Sites URL:http://www.panix.com/vtw/exon/ Gopher Archives: URL:gopher://gopher.panix.com/11/vtw/exon Email: vtw(a)vtw.org (put "send cdafaq" in the subject line) ________________________________________________________________________ LIST OF PARTICIPATING ORGANIZATIONS In order to use the net more effectively, several organizations have joined forces on a single Congressional net campaign to stop the Communications Decency Act. American Civil Liberties Union * American Communication Association * American Council for the Arts * Arts & Technology Society * Association of Alternative Newsweeklies * biancaTroll productions * Californians Against Censorship Together * Center For Democracy And Technology * Centre for Democratic Communications * Center for Public Representation * Citizen's Voice - New Zealand * Computer Communicators Association * Computel Network Services * Computer Professionals for Social Responsibility * Cross Connection * Cyber-Rights Campaign * CyberQueer Lounge * Dutch Digital Citizens' Movement * Electronic Frontier Canada * Electronic Frontier Foundation * Electronic Frontier Foundation - Austin * Electronic Frontiers Australia * Electronic Frontiers Houston * Electronic Frontiers New Hampshire * Electronic Privacy Information Center * Feminists For Free Expression * First Amendment Teach-In * Florida Coalition Against Censorship * FranceCom, Inc. Web Advertising Services * Friendly Anti-Censorship Taskforce for Students * Hands Off! The Net * Human Rights Watch * Inland Book Company * Inner Circle Technologies, Inc. * Inst. for Global Communications * Internet On-Ramp, Inc. * Joint Artists' and Music Promotions Political Action Committee * The Libertarian Party * Marijuana Policy Project * Metropolitan Data Networks Ltd. * MindVox * National Bicycle Greenway * National Campaign for Freedom of Expression * National Coalition Against Censorship * National Gay and Lesbian Task Force * National Public Telecomputing Network * National Writers Union * Oregon Coast RISC * Panix Public Access Internet * People for the American Way * Rock Out Censorship * Society for Electronic Access * The Thing International BBS Network * The WELL * Voters Telecommunications Watch (Note: All 'Electronic Frontier' organizations are independent entities, not EFF chapters or divisions.) ________________________________________________________________________ End Alert ======================================================================== -- ()()()()() All that matters is that ]{ |BTCOMH|-| Eileen Tronolone -===========================]*\\\{O | (tm) | | System Administrator two stood against many... ]{ |______|-/ redsonja(a)computel.com

1 0

Re: Is it legal for commercial companies to use PGP?
by tim werner 17 Dec '03

17 Dec '03

>From stewarts(a)ix.netcom.com Tue Jul 18 02:51:50 1995 >Date: Mon, 17 Jul 1995 23:52:35 -0700 >At 09:07 PM 7/17/95 -0400, tim werner wrote: >>>... I was talking to one of the sys admins at >>>A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >>>because Viacrypt owned the commercial rights. >Actually, it's less clear than that. >Selling software containing the code is pretty clearly commercial. >Non-commercial messages from your personal non-business machine are >clearly non-commercial. Providing a service of encrypting and decrypting >messages for people for money sounds like it's _very_ probably commercial. >Encrypting and decrypting messages to/from your business that deal with money >are a very gray area. Maybe "commercial company" is the wrong expression. All I meant was that my company is not non-profit, or a university, or a government organization. It is an engineering firm. What I have in mind is nothing to do with a commercial use of encryption per se. If they decided to put encryption into a product, that would be something else entirely. I doubt they would ever be using it to accept payment for the stuff they sell, although I don't really know much about the marketing aspect of the business. Basically, I have two potential uses for it: 1) I have some email pen-pals that I would like to be able to use PGP to talk with. All my other accounts (freenet, school) have mail forwarded to what I think of as my email "home address", which is my work address. I would like to use that work account to process my email. Is it legal to use PGP 2.6.2 for this purpose? I'd also like to be able to tell fellow workers that they can use it, and show them how. 2) It's entirely likely that people within the company may wish to get into the habit of transmitting company data in encrypted form. This is not a question of incorporating the encryption technology into a product, or even into the sale of a product -- it's just a question of keeping intra-company information transfers private. The first is the one I'm really concerned with. The second would be sort of a natural extension that, if legal, would be nice. I can't imagine that these uses are subject to the ViaCrypt license, but I need some reassurance/ammunition in order to be a little more open about getting it installed on the machines in my department. thanks, tw -- Well, Bust My Britches! Eggs Almondine and a Bottle of Beaujolais!

1 0

Re: cypherpunk "Zen" victories
by H Keith Henson 17 Dec '03

17 Dec '03

> 4) only *one* address was compromised on Julf's system. a small price > to pay for all this Just for what it is worth, there has been considerable speculation as to the fate of -AB-, whoes real login was tc(a)alumni.caltech.edu. The real world name was supplied by Caltech to the LAPD who, it seems, turned it over to the scientologists. Caltech has been trying to contact this person for some time now, after being presented with a very irregular written request to turn the backup tapes on this act over to the CoS reps. CoS upper management has long showed the willingness to kill (as exposed by affidavits) but has failed in the "execution" phase. It really makes me wonder if they managed it this time. Keith Henson

1 0

Data Havens and Intellectual Property
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Ahh, a meaty subject at long last! At 9:59 PM 7/19/95, Ray Arachelian wrote: >On Thu, 13 Jul 1995, Jon Lasser wrote: > >> How about "not respecting international copyright law, and not having >> extradition treaties with the US" ... set up a data haven, we now know >> why we need it soon... charge by the Kbyte, automate the billing, and relax. > >Seriously bad for my financial health. I write code for a living (though >I'm a Netware LAN Admin in this incarnation of a job.) Going somewhere >where I can't make money writing code because 10 billion folks will have >it after one pays is my idea of jumping out of the microwave oven into >the boiling lobster stew. :-) Agreed, things may be rough for the folks profiting from the current intellectual property laws. But many nations don't agree with our notions of what is one's intellectual property. ("Galombosians" believe one's _ideas_ are one's property, subject to collection of fees. "You mentioned "remailers"...please remit $1.33 to....") >If such systems would be maintenance free, it would be cool going around >place to place installing data heaven servers all over the place. > >Hell a 1Gb hard drive is only $350 or so. A cheap XT, or lap top hooked >upto such a drive, say 4Mb of RAM and a 28.8Kbps modem would be good enough. >Say some junky assed machine no more than $500 a pop... I think you're making the point: machines on the Net are getting much, much cheaper, which will make "Mom and Pop remailers" much more common. Importantly, these remailers will be common--someday, if not this year--in non-U.S. jurisdictions. The growth of Net and Web services has been astounding, even to me (someone whose first Arpanet account was in 1973). This will put Cypherpunks services into many more places. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Netscape the Big Win
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Here is my experience with the last month of heavily using Netscape (1.1N), after several years of using a mix of Unix-based tools on a Unix shell account at Netcom (and several years of using Portal before that, beginning in 1988). (And intermittent Net use from 1973, when I had a very primitive account in college at UC Santa Barbara, on the "Arpanet," to the mid-80s, when I had various accounts while still at Intel.) * I use Netscape to read News. * I use Netscape to access the Web. * I still use Eudora to send and receive Mail. (Netscape can currently send mail, but not receive it. This is likely to change soon.) Why is this important? I believe, quite strongly, that we are headed toward a situation where the large majority of Net/Web users are using some variant of Netscape, or Mosaic/MacWeb/etc. (but probably Netscape, for various reasons). Integration of crypto into Netscape is thus the Big Win. I felt this was the case as far back as last fall, but my recent experiences tell me this is more important than ever. Integration of PGP and other crypto routines into Tin, Pine, Elm, Joe, Emacs, etc., is just not as important. IBM just paid nearly $3 billion for Lotus, largely for the "common platform" of Lotus Notes. I believe Netscape is an even more important common platform, and will displace Notes. I have been asked many times by various of you about investments, as I've been making my living the past decade through investments. The message here is my strongest statement about what to invest in. (I'm not saying one has to stand in line for the August IPO of Netscape Communications, but the overall market will favor the Web browsers, especially Netscape.) The relevance for Cypherpunks interested in writing code is that, in my carefully considered opinion, writing for Netscape and other Web browsers is the Big Win. Even over Windows (except Windows browsers, of course). --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

7 6

PS/2 passwd bypassed at bootup?
by jon cameron 17 Dec '03

17 Dec '03

I know that removing the battery in a PS/2 "disengages" the password. But can it be disengaged if a person has an administration-type of diagnostic/setup/boot-up floppy?

1 0

Re: Netscape the Big Win
by cman＠communities.com 17 Dec '03

17 Dec '03

>Integration of crypto into Netscape is thus the Big Win. > This is why Amanda and I have been working on crypto tools for Java, a "safe" programming language that will be embedded in Netscape in the (hopefully) not-too-distant future. In addition to eventual incorporation in Netscape, it is currently available on Suns running Solaris 2.4 and PCs running Windows NT. See: http://www.cs.utexas.edu/users/achou/JCrypt/packages.html This is also why October is "Java month" for the cypherpunks Bay Area meeting. Marianne Mueller (mrm(a)eng.sun.com) is organizing speakers and coordinating the schedule for that month's meeting. Java will be available for Windows 95 about the time Win 95 is released, and a Mac version is due out "Real Soon Now." The Mac version has been demoed to industry insiders already. One of the obvious advantages is that it should be possible to write a nice, GUI interface once, and be done with all of the tiresome porting that seems to occupy too much of our time.

8 7

Re: Stego Standards Silly
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

LM> I think I need to clarify my threat model. I'm positing a scenario in which LM> transmission of ciphertext and stegoed anything is illegal, but transmission LM> and use of "conspicuous" digital signatures is legal. Furthermore, the govt. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Ah. No big deal then. After stegoing, you sign the GIF. LM> sanitizes the LSBs of digital images for our protection, perhaps distorting LM> a mean of X% of the LSBs of a mean of Y% of transmitted images. Out-of-stego- LM> channel checksummation would IMHO be crucial in such a situation. Sending multiple copies of the same GIF would go a long way toward solving this, if X% and Y% were low enough. Say I get 5 copies, and reconstruct the origial via a "voting" protocol. Also, if we break down the file into smaller blocks, and sign each block individually, we can narrow down the errors. But I am having a real problem with an overt policy of fiddling with people's mail. If they did that, it would likely cause a huge backlash that would be felt at the ballot box. * --- * Monster(a)FAmend.Com *

2 1

FWD:Speaker needed
by corbeau＠seanet.com 17 Dec '03

17 Dec '03

>Sender: html-authors-guild-owner(a)lists.Stanford.EDU >Status: > >Two topics to this post: > >1. I have been asked to speak at an Internet/WWW conference that will be >held in Charlotte, NC on October 23rd. Is the SC gonna jump on me for >mentioning my membership in the Guild in the bio that they will print in the >advertising flyers? <g> > >2. I have been contacted by the producer of the conference and asked to >contact the Guild for help in finding an Internet Security Guru to speak at >the conference... If interested, point of contact is: > >rstoker(a)accunet.com > > >I will be posting more info (costs, location, times, etc.) as they come to me. > >BTW: Speaking of security, I have asked a question that has gone unanswered >(possibly due to being sidetracked by flamewars & whatnot)... anyone out >there know how to set up password security on pages running off >MacHTTP/WebStar servers? Any help is appreciated! > >TIA > > -AL GORDON > ProEMail Internet Services **************************** Thot one o' y'all might fit this bill... -corbeau

1 0

Re: (Cracking) Netscape (is) the Big Win
by Andrew Roos 17 Dec '03

17 Dec '03

Peter Trei says: > This is why it's imperative for cpunks to work on the SSL challenge > recently posted. Cracking 40 bit RC4 will provide a strong industry > incentive to move towards stronger crypto standards, and to pressure > the government to relax ITAR. The SSL project is at an advanced stage. I am regression testing the third (and, I hope, final) version of the SSL bruter, while Adam and others are working on the key distribution mechanism. It is important in a project of this nature that everything be thoroughly tested before we start, so we don't waste thousands of hours of CPU time... Andrew ___________________________________________________________________________ #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) Andrew Roos Realtime PO Box 15170 Vlaeburg 8018 Phone: +27-21-244350 Cape Town Cape Town Fax: +27-21-221507 South Africa

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by an253398＠anon.penet.fi 17 Dec '03

17 Dec '03

Ray Arachelian writes: > Hell, at this point, my guess is that the mafia(s) doesn't use crypto, or > that if it does, it can be caught via other means. A strong, well > developed crypto system in use by the mafia would more than likely never > happen... not until mobsters get into computers. Ditto for terrorists. Sounds like an untapped market segment. In which periodicals should one advertise consulting services in order to cover the mobster market? Seriously, I imagine that organized crime, like any other business, uses computers. Their level of crypto usage could be impressive, given the incentives. > If they did use crypto, I suspect they wouldn't get caught. (For the > paranoid, assuming they used crypto, and they didn't get caught, then the > FBI or other TLA is doing the same as the gov't in Farenheight 451... > pick someone else, and jail them. Otherwise, how do you explain all the > jailbird mobsters?) "There is no honor among thieves." Wiretaps, bugs, tails, informants, and good, old-fashioned, physical intimidation probably produce plenty of leads. I wasn't entirely facetious above about working for the mob, they probably pay well and don't bother with FICA and such. Plus there's that "family" atmosphere.... ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

"Cypherpunks Write Code" as a Putdown
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 5:25 PM 7/20/95, Patrick J. LoPresti wrote: > If it is ever feasible to >do what you suggest, someone will do it; your musings will have no >effect on that. If you want to make a difference, try writing some >code yourself... I want to comment on this latest version of the "Cypherpunks write code" universal putdown. It's become common for debates on what is possible, what is likely, and what should be done for someone to "trump" the argument with the mantra of "Cypherpunks write code." In my posting on why I think Netscape and related operating environments represent the likeliest targets for widespread crypto use (the "big win" I used in my title), I did not whine that others ought to write code for me. I said that this is where users were going in massive numbers. Take it or leave it, as an analysis, but the "try writing some code" is a meaningless insult. The world is made up of bridge designers, legal experts, authors, chip designers, and on and on. Not just programmers. The line "Cypherpunks write code"--which is sometimes treated here with a reverence its origins do not support--was a reference to our view that technology, meaning actual deployment, was more important and interesting than yet more gabbing about liberty and privacy. And what is "writing code"? Is it only Perl and C? Or does defining what a remailer needs to do count as writing code? (Attendees at the first Cypherpunks meeting, almost 3 years ago, can confirm that I was the one who spend about two hours describing Chaum's mix work, and running the "remailer experiment"...we debated how a remailer could actually work, and Eric Hughes took on the task of writing the first one.) The "BlackNet" experiment I ran actually worked...the keys worked, the mechanisms worked, and the experiment has been used by many as an actual concrete illustration of how untraceable information markets will develop. An actual demonstration is worth more than mere speculation, and this was an actual demonstration. I call this "writing code," albeit not C code. (My actual code writing, in real computer languages, is oriented toward Mathematica, on my Mac, and Smalltalk Agents. Not all programming is oriented toward writing Unix tools, and I think the narrow interpretation of "Cypherpunks write code" to mean this is misleading.) In any case, even the ur-crypto hacker Zimmermann is writing very little actual code in PGP these days...does this mean he should "try writing some code" instead of doing what he apparently does best? In short, the insulting tone of many Cypherpunks these days is saddening. I plan to continue to speak my mind, to point out what I think are the more important routes to a desirable future, and to criticize what I think are dead ends and ghettoized approaches. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

8 7

Re: "Hey Phil! Stop telling people *not* to use PGP!"
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:00 PM 7/19/95 -0500, Robert A. Hayden wrote: >> I am fond of saying that we PGP enthusiasts have two choices ahead of us >> within a couple of years: either 5,000 enthusiasts using PGP with >> MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL >> SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with >> push-button interfaces and multi-user remote systems. >I said it last week, and I'll say it again. From a sociological >standpoint, it's those 10,000,000 computer-illiterate e-mail users that we >need to focus all of our efforts towards. Those 5,000 literate people we >really don't have to care about. But there are two different classes of issues here - the convenience-only issues, which can be fixed with bells and whistles and GUIs and audio-enhanced-RTFM-buttons, and the security-related issues. For security, there are three classes of users: 1 - folks with standalone systems and dial-up mail - no problem This is a _lot_ of users - AOL, Compuserve, etc. 2 - folks with single-user systems on networks - they need to make sure they've got PGP installed right (relatively easy, with local disks, but fancy install widgets may help), but beyond that they've got to know that PGP is only as secure as their machine and network configuration. Mostly ok, and to the extent it's not, they've got other serious problems. This is also a lot of users. 3 - folks with shared machines - these folks (mostly Unix users and college students, plus people who have web-space they need to telnet to, like me) do need to know their limitations, and currently have the most problems with convenience, having to haul files back to a secure machine to encrypt securely. The first step is education - manuals that say "Don't Panic Unless You Need To Be Paranoid" instead of "Panic Immediately", that can make them aware of the risks and tradeoffs. It's about two pages of well-written stuff, if someone wants to write it. The next step is either building convenient tools to help them with encryption, or building convenient installation scripts for the tools that already exist (e.g. mail, or scriptable terminal emulators which can automate a lot of the hauling around.) The big payoffs are for groups 1 and 2, but a lot of the technically savvy people who read manuals and have to convince system administrators to install stuff are in group 3. So this is basically a writing job, plus talking the PGP 3.0 people and maybe Phil into including the discussion with the manuals. Remailers, btw, are in this class, since they need to leave their passphrases out in relatively unprotected shell scripts. I used to run PGP on a diskless workstation (at least I was one of the people with the root password :-), but I was aware of the risks. I'm now using it both on my Netcom+Eudora+PrivateIdaho system and on the machine where I have web space, which I have to telnet to across Netcom. I take care of the trust problem there by using a short key with a big ugly "untrustable" string in the user name, and using S/Key to log in; if I had an encrypted telnet to run on both ends I'd probably want to use it, so I'm watching the Stel and other new stuff coming out. Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: You can get PGP by anonymous ftp from ftp.ox.ac.uk iQBVAwUBMA4HvfthU5e7emAFAQFrMwH9Hh1oYQKvsuV/IyVUskv2aZbmuh8fXQgK XpSpucrJV27tlFbjIDVqmapMR77arZVOm2Hs0/NTB2uT2jDG1r5+Lw== =fRtS -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 PM 7/19/95 -0400, tim werner wrote: >>From stewarts(a)ix.netcom.com Tue Jul 18 02:51:50 1995 >>Selling software containing the code is pretty clearly commercial. >>Non-commercial messages from your personal non-business machine are >>clearly non-commercial. Providing a service of encrypting and decrypting >>messages for people for money sounds like it's _very_ probably commercial. >>Encrypting and decrypting messages to/from your business that deal with money >>are a very gray area. > >Maybe "commercial company" is the wrong expression. All I meant was >that my company is not non-profit, or a university, or a government >organization. It is an engineering firm. What I have in mind is >nothing to do with a commercial use of encryption per se. That's what I thought you meant. >1) I have some email pen-pals that I would like to be able to use PGP to That would be fine to use PGP 2.6.2 for; there's realky no question. >2) It's entirely likely that people within the company may wish to get > into the habit of transmitting company data in encrypted form. This > is not a question of incorporating the encryption technology into a > product, or even into the sale of a product -- it's just a question > of keeping intra-company information transfers private. >The first is the one I'm really concerned with. The second would be >sort of a natural extension that, if legal, would be nice. I can't >imagine that these uses are subject to the ViaCrypt license, but I need >some reassurance/ammunition in order to be a little more open about >getting it installed on the machines in my department. The ViaCrypt license only matters if you're using ViaCrypt. The question of whether you can use PGP 2.6.2 for these is something you _do_ need to read the RSAREF license about, and maybe ask Jim Bidzos <jim(a)rsa.com> or a company lawyer-type about; encrypted mail within the company is probably ok, encrypted mail sending credit card numbers to pay for stuff is more questionable. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0