December 2003 - cypherpunks-legacy

Privacy? Not in Canada!
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

From: ag434(a)freenet.hamilton.on.ca (David Buchanan) Newsgroups: alt.security.pgp,talk.politics.crypto Subject: Re: If you want privacy, don't come to Canada! Date: 30 Mar 1997 22:26:41 -0500 Organization: Hamilton-Wentworth FreeNet, Ontario, Canada. CRIMINALS WON'T BE THE ONLY TARGETS Criminals won't be the only targets if strong non-escrowed encryption is outlawed although criminals provide a convenient excuse for governments seeking to extend their power over their own citizens. Even in Canada, a nation which can hardly be described as a police state, there is good reason to fear the security and intelligence apparatus will be used by the government against its legitimate and law-abiding political opponents. Let me give you two examples. 1) BUREAUCRAT'S "LET'S GET HIM" MEMO Within the last couple of weeks, the Canadian public learned from news reports about a meno written by a top level federal bureaucrat in which he complained about the activities of a private citizen and suggested that his fellow government officials should "take a look at this guy." The private citizen was a law-abiding, former military officer whose freedom of information requests had exposed mismanagement and corruption in the government. This memo was particularly chilling because the recipients included officials of the tax department and the Canadian Security and Intelligence Service (CISIS) -- two agencies well suited to bringing pressure to bear on private citizens. Although the bureaucrat was caught in the act this time, it is quite disturbing that a senior civil servant believes such a memo to be normal and acceptable. 2) NEO-NAZI PLANTED IN OPPOSITION PARTY During the last Canadian federal election, the ruling Progressive Conservative Party (PCs) was losing voters to the Reform Party, a moderate, small "c" conservative party based in Western Canada. The PC's campaign strategy was to accuse Reform of being "extremists" or "racists." About the only evidence of this that the PCs were able to produce was the founder and leader of a small neo-nazi style group who had attempted to infiltrate the Reform Party with little success. Subsequently the public learned that the neo-nazi was actually a paid agent of the Canadian Security and Intelligence Service (CISIS), an agency ultimately controlled by the Progressive Conservative government. There have been the expected denials from CISIS but the most plausible interpretation of these events is that the Progressive Conservative government tried to sabotage the electoral chances of the Reform Party by planting a neo-nazi on its fringes. CISIS is one of the government agencies that definitely would have access to all of the material obtained from the proposed key escrow or key recovery type systems. WHY HONEST CITIZENS SHOULD BE WORRIED The increasing use of email and other data telecommunications will greatly expand the amount of private and personal information on private citizens that governments can collect, archive, and sift through whenever they need weapons to use against their legitimate political opponents. This information can be collected very cheaply and used in ways that are difficult for the government's victims to counter or even detect. For example, a simple telephone call to a cooperative bank official just before the a target attempts to renew a line of credit for his business. The only effective way to prevent this is with the wide availability and use of strong non-escrowed, non-key-recovery encryption. As for those trusting souls out there who still believe they have nothing to hide, ask yourself this question: Would you be willing to email carbon copies of all your email messages and online data transmissions to one of your political opponents? If secure encryption is banned, this is exactly what you will be doing and you had better be prepared to agree with everything the government does on every issue or take the consequences! DB --

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 31 Mar 97 6:49:14 PST remailer email address history latency uptime ----------------------------------------------------------------------- hidden remailer(a)hidden.net **######.### 51:35 99.99% lucifer lucifer(a)dhp.com ++++++++++++ 36:24 99.98% cyber alias(a)alias.cyberpass.net *+**+++*+++* 38:16 99.91% weasel config(a)weasel.owl.de ++--++-++++ 2:21:10 99.89% replay remailer(a)replay.com **-**-+*-+-* 1:32:14 99.81% balls remailer(a)huge.cajones.com ###+*##* +## 2:27 99.73% squirrel mix(a)squirrel.owl.de ++--++-++++ 2:44:37 99.58% dustbin dustman(a)athensnet.com + ++ +-++ + 49:04 99.35% exon remailer(a)remailer.nl.com #*+# +##* ** 4:34 99.25% reno middleman(a)cyberpass.net +-++ +.-+- 50:50 98.87% winsock winsock(a)rigel.cyberpass.net -----+---- - 3:56:33 98.65% jam remailer(a)cypherpunks.ca * ** ** * 11:13 98.54% extropia remail(a)miron.vip.best.com ___.._.-.- 27:38:30 96.60% mix mixmaster(a)remail.obscura.com ___.+_.-* 33:58:31 94.45% shaman remailer(a)lycaeum.org ++-++-+ -+ 28:03 86.87% nym config(a)nym.alias.net ***#**-#-# 13:11 80.62% haystack haystack(a)holy.cow.net 52:19 -4.36% middle middleman(a)jpunix.com + 35:43 2.13% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Stego Question
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Stego Question: How many bodies does it take to spell, "I _told_ you I was crazy!"

1 0

Re: PRESS REPORT - IMPORTANT?????
by Ray Arachelian 17 Dec '03

17 Dec '03

Is this for real or a troll??? On Mon, 31 Mar 1997, Anonymous wrote: > *** London Times, 30/03/1997 *** > > >Factoring problem broken: > > > >One of the main systems used by computer privacy > >programs around the world such as those used on > >the internet to prevent third parties eavesdropping > >on credit card transactions has been proven insecure, > >The RSA algorithm, based on the difficulty of "factoring" > >large numbers appears to have a weakness, a press > >release by the IACR (International Association for cryptologic > >research) reads as follows: > > >"Leading researcher Ari Lenstra last night announced major > >progress had been made towards a solution to the factoring > >problem, a result obtained by Sergei Ripov, researcher at > >an obscure university in the former Soviet union, shows > >conclusively that there exists a solution to the problem > >that is of polynomial time complexity, although this solution > >has yet to be found this signals the beginning of the end for > >a number of cryptosystems based on this problem, please note > >a trivial solution to factoring also suggests a trivial solution > >to the ECDLP and therefore a number of other systems such as > >Diffie-Hellman and the El-Gamal group of cryptosystems should > >be considered insecure" > > > >We were unable to contact the IACR for futher information. > >The leading internet products company Netscape refused to > >comment saying only "We regularly review data security > >issues concerning all of our products". > > =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0

Re: [NTSEC] Re: Internet Explorer Bug #4 (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die. ---------- Forwarded message ---------- Date: Sat, 29 Mar 1997 14:37:43 -0800 From: Chris Plunkett <chris.plunkett(a)opensys.com> To: pmarc(a)cmg.FCNBD.COM Cc: Romulo Moacyr Cholewa <rmcholewa(a)poboxes.com>, Windows NT BugTraq Mailing List <NTBUGTRAQ(a)rc.on.ca>, "ntsecurity(a)iss.net" <ntsecurity(a)iss.net>, hughtay(a)microsoft.com Subject: Re: [NTSEC] Re: Internet Explorer Bug #4 > > We are aware of this, but the report is misleading. The report states > > that both times the password sent from the client to the server is > > encrypted. It would take quite a while for even a Cray Supercomputer to > > decrypt the password, even if it was dedicated to that sole task. For > > the average network server (and a powerful one), it would take a few > > human lifetimes to decrypt them even if they were dedicated to that sole > > task. > > Arrggghhh! Nothing sets off my ignorance alert more quickly than somebody > who mentions a Cray in conjunction with attempts to brute force crypto > algorithms. I won't bother to explain all of the reasons why that is a > foolish thing to say. Instead I will share a little story about some folks I > know from about 3-4 years ago. (Greetings to any of these individuals who > may be lurking on NTSEC or NTBUGTRAQ.) > > Apparently they had some good reasons to go after the encryption algorithm > used by WordPerfect. After several ineffective implementations, a > WordPerfect engineer developed a DES based encryption algorithm. His claim > was that it would take a room full of Crays to break the algorithm. Hmmm... > sounds familiar. Needless to say, shortly after a successful attack on the > algorithm by those mentioned, there was a certain 486 with a YMP sticker > plastered to its front. > > Sure, brute force attacks can be expensive when an algorithm is implemented > correctly. However, I can't let it pass when these facts are expressed in > such a patronizing manner. > > --- > Paul M. Cardon - System Officer > Capital Markets Systems - First Chicago NBD Corporation > pmarc(a)cmg.fcnbd.com - (312) 732-7392 > I heard a story one time. It evolved around a college student in France doing some cyptography work in school, working nights as a backup operator at some large computer center. He didn't need a cray. A little knowledge and some creative programming, and a center full of computers (problably around the size of a Sparc 10). The story ended explaning how one of the encryption schemes that would tale a Cray week to break, was broken in one night, by a bunch of computers running backups. It might be hard to find a cray, but I know a guy, he works at this place where they got them 15 pentium pros. The average network server has another server for some other task on the same wire. ------------------------------------------------------------ Chris Plunkett System Technician Breakwater Technologies Inc. phone:(206)803-5000x112 Fax:(206)803-5001 http://www.breakwater.net mailto:chris@breakwater.net ------------------------------------------------------------

2 1

Re: PRESS REPORT - IMPORTANT
by Toto 17 Dec '03

17 Dec '03

Huge Cajones Remailer wrote: > > Anonymous writes: > > > > *** London Times, 30/03/1997 *** > > > > >Factoring problem broken: > > > > > >One of the main systems used by computer privacy > > >programs around the world such as those used on > > >the internet to prevent third parties eavesdropping > > >on credit card transactions has been proven insecure, > > >The RSA algorithm, based on the difficulty of "factoring" > > >large numbers appears to have a weakness, a press > > >release by the IACR (International Association for cryptologic > > >research) reads as follows: > > A little early for April Fools'. "Sergei Ripov" indeed. I did a search through the online edition for anything to do with encryption, RSA, algorithms, etc., and nothing came up for the last few months. Maybe it's in the April 1st edition. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by Ray Arachelian 17 Dec '03

17 Dec '03

On Thu, 27 Mar 1997, Kent Crispin wrote: > > The PGP web of trust idea is more than sufficient. > > No, it is completely inadequate. I am the office-supply manager the > San Francisco branch of Big Well-known Company, Inc. I have > signature authority in the company for purchases up to $5000, > otherwise I have to get higher-up approval. I have a "company > signature" which is authorized for that amount, one of about 800 such > signatures. I wish to purchase office supplies from a large office > supply wholesaler in New York, which has literally tens of thousands > of customers. The "web of trust" model simply does not handle this > kind of situation well. I realize that some of the keyservers are > very high performance -- that's not the problem. The problem is the > structure of the web itself. If there were some trusted *authority* that > could sign keys... Sure there is. The HR department of Big Well-known Company, Inc. can sign the employee's keys. What's the problem? If you want to order something you do so by generating a P.O. or by using a credit card. What does the web of trust have to do with this? If you need approval, it's simple, you ask for it. When you get it, you order your 10,000 pencil erasers. You don't have to use PGP signatures for orders, but you can if the infrastructure is there between both companies. > > If you > > want, you can designate a third party as a trusted > > authority. However, this is not needed if you meet > > the person with whom you will communicate in person > > and exchange public keys. Further this trusted > > authority needn't be a government entity thank you. > > This could easily be your lawyer, Verisign or some > > other entity. > > This is no longer a web of trust model, it is a Certificate Authority > model. Certificate authority standards are developing at warp speed. No shit. Both are possible. Whichever your company wants it will use. > > The only legal support needed for digital signatures > > is for the courts to recognize that digital signatures > > are equivalent to their analog counterparts. > > The *only* legal support? This is a *big* deal, and the issues are > very complicated. Handwritten signatures and digital signatures are > really quite different. I claimeth not lawyerhood, but IMHO, it can stand up in court if both parties agree to it by analog signatures infront of a notray. Any lawyers care to comment? > > This could > > be binding if the two parties sign something that says > > "If I use PGP to sign a document I agree to allow that > > document to be treated as if I signed it." (IMHO) > > Sure. It's been done, in fact. However, pairwise contracts with > everyone you do business with is not going to cut it. You need laws > for this. Not if it is agreed by all parties involved and their lawyers to honor such signatures. (IMHO) > [...] > > > > > 4) Businesses, especially large businesses, will (and do) > > > want common standards for key and DS management. > > > > Yeah, and they also want standards for software. I.e. > > Word Perfect Office versus Microsoft Office. Lotus > > Notes Domino versus Netscape Enterprise server. However > > neither of these examples show a need for government > > entities. They can easily say "We use PGP as our > > signing standard, and our notary will be shown > > a person driver license and will sign a printed email > > with that person's key for proof." > > This is pair-wise contracting again. Note, incidentally, that > standards concerning signatures are of a different order than > standards concerning office software. There far more pressing > liability issues with digital signature. Really? you must not have been gotten infected by the slew of Word and Excel viruses out there. Might be a very good lawsuit against Micro$oft that they allowed such things to happen. Standards for a company are standards for a company. Which standard has more weight or importance is up to that company. Sure, it is on a bigger scale that installing XYZ OfficeWare and getting your ass fired, but it is still a standard. Is there any reason that a specific company CAN'T decide to use PGP? (or PEM, or some other scheme) if it so choses? > > > 9) There is a high probability that a widespread standard > > > for enterprise level key management including key escrow > > > will develop in the next few years. > > > > Why jump to key escrow all of a sudden? You see, a > > corporation can escrow its own keys in a fire proof > > safe off site. Why use a government agency where any > > two bit crooked employee can access the keys of that > > corporation? > > I didn't say "government agency". I said "Enterprise level". A > fireproof safe offsite is indeed a crude form of enterprise level key > escrow. But it's not really very useful. Imagine a company with > several thousand employees, with each employee having a company > signature key. You use your key for all kinds of mundane things -- > signing your time sheet, signing purchase orders, signing memos, > etc. (This is not one of your personal keys that you use when you > send email to your lover.) You have a turnover of several people a > month, people forgetting passphrases, people invalidating keys > because of a passphrase compromise, etc. These are company signature > keys, also used for encrypting email, so the company escrows all the > secret halves of the keypairs. (There is no privacy issue here -- > these are all company keys used for company business, all the > encrypted documents are company documents.) So what's the problem? You hire people to keep track of assigning, escrowing, and signing keys for your employees. You have IS staff and security staff to watch for breeches. You can automate tons of this with good written scripts that automatically scan all email for valid signatures and raise alarms when signatures don't match. Where is this not useful? For a small company a locked safe is plenty. For a large company, you hire HR/Security folks to be your "Key Agents" or whatever. > In this scenario there is daily access to the key escrow system. A > fireproof safe offsite is not the most convenient way to deal with > the problem, and so the company will buy a software solution -- a > nice, cryptographically secure, software solution. (This is > obviously not a hard problem -- any cypherpunk should be able to > design such a system.) Yeah, ditto. We agree on this. We also would want something sent offsite incase of nuke, flood, fire, or mass suicide. :-) (sorry had to throw in a Heaven's Gate ref somewhere.) > > > 10) This will converge with legal developments motivated by > > > Digital Signature and support for electronic commerce, so that > > > the standards will actually be government standards with at > > > least partial force of law. > > > > Why do commercial standards need be the same as those > > dictated by govermental standards? > > Many commercial "standards" are legal standards, supplied by the > government. In fact, the whole legal infrastructure of business law > is really, when you get right down to it, a set of legally mandated > standards. Standards are all over the map, when it comes to legal > status. Because there are laws that force such standards on the company. So far are there any laws that say you can't use anything but DSA? (Or Clipper, or whatever NSA backed scheme d'jour is being pushed?) If there were such laws in progress, they would be fought. :) > > Why does there need > > to be a law that says "All businesses MUST use clipper > > (or whatever) and escrow keys with the FBI/CIA/etc.?" > > There doesn't need to be such a law. So we agree. :) > [...] > > Sure, hence the old "When encryption is outlawed only outlaws will > > encrypt" slogan. Why do we need laws to state what a company is > > allowed to encrypt or not encrypt? And why must those state > > what cypher, bit lengths, and methods they must use? And that they > > must be escrowed in a certain way? > > How about a law that stated that all RSA keys used for digital > signature must be at least 4096 bits in length before they will be > accepted as legally binding? Would that be a good law or a bad law? It would be cool by me to impose a minimum provided that the current state of hardware could process such keys without too much of a delay factor, but not a maximum. If I am sick enough to want a 16384 bit RSA key, why force me to use something lesser? But within a company, were I insistent enough for whatever reason to use 384 bit RSA keys, as weak as they are and that was my company's policy I should be able to allow it. (Just as employers can read email if you expect that you have no privacy on the company email system.) > > Where I work, we keep in "escrow" a key database (on index cards) > > with all the passwords for all the machines. Also in that fire > > proof safe live all the backups. > > Funny, we do exactly the same thing. Except once a year or so > complete backups are carted off to the desert, and stored > forever. Ours is a bit more paranoid. We offsite a tape on the 15th and last day of every month. Every few months we burn a pair of CD's of the important stuff, keep one in the local safe, one offsite. > > Yeah, and likely you should change your underwear since it is soaked in > > it. :) > > Over the years I've developed an asbestos butt. It helps (looking at my own flame resistant shorts...) =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= For with those which eternal lie, with strange eons even death may die.

1 0

Looking for a c'punk volunteer in the East Bay
by John Gilmore 17 Dec '03

17 Dec '03

Date: Fri, 21 Mar 1997 17:54:11 -0800 (PST) From: Dennis Derryberry <dennis(a)eff.org> To: gnu(a)toad.com John - do Cypherpunks like to play superhero and help people who are being hacked? A woman called who says someone had rboken into her system reprogrammed certain controls causing her to be instantly trackable whenever she logged in, no matter what account she used, no matter from where, etc. She says it happens *every* time. Law enforcement is baffled and has no advice (surprise, surprise). She said the FBI even recommended she hire a hacker to play along with the culprit and see if they couldn't catch him that way. So, if you or anyone you know is interested in a weekend sporting event, you can reach Debra Wellman at the home of her mother 510 855 9744 I spoke with her on the phone. She is not crazy, just frustrated. Dennis -- Dennis Derryberry Executive Administrator Electronic Frontier Foundation Web: http://www.eff.org tel: 415 436 9333 x104 fax: 415 436 9993 email: dennis(a)eff.org

2 1

Re: PRESS REPORT - IMPORTANT?????
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:05 AM 3/31/97 -0500, Ray Arachelian wrote: >Is this for real or a troll??? > It's not in *my* copy of the Sunday Times. Sounds like the Russkies haver broken RSA" trolls we've seen before. It's a 'Ripov'. DCF

1 0

The Zimmermann Telegram
by Alec 17 Dec '03

17 Dec '03

>Date: Mon, 31 Mar 1997 11:59:49 -0800 >To: telegram-request(a)pgp.com >From: Dave Del Torto <ddt(a)pgp.com> >Subject: The Zimmermann Telegram > >-----BEGIN PGP SIGNED MESSAGE----- > > >Ladies, Gentlemen & Cryptographers, > >I'm pleased to announce the imminent release of the premier issue of the >new "Zimmermann Telegram" newsletter. The Zimmermann Telegram will be a >regularly-published, paper-based, English-language technical update >newsletter from PGP's engineering staff, and will cover a variety of >cryptographic and other lighthearted topics which we may otherwise be >restricted from discussing via electronic media. The newsletter will be >sent, in compliance with US law, by regular postal mail to anyone >interested in technical information about PGP -- anywhere in the world. > >If you are now developing PGP-related freeware, shareware, commercial or >academic cryptographic software, or you plan in future to become a >registered PGP Developer or PGP World Partner (those programs are currently >under construction and will be formally announced later) or if you are just >interested in technical information about cryptography, we think you'll >enjoy reading our newsletter. > >In the premier issue, along with important updates regarding changes to the >PGP packet format, CRC security problems and new extensions to the PGP key >format which are not available through any other medium, you'll learn about >the significance of the "Zimmermann Telegram" name. Meanwhile, visit this >page: <http://www.nara.gov/nara/digital/teaching/zimmermann/zimmerma.html>. > >Scheduled to be mailed imminently, the premier issue will be sent free to >anyone who provides us with a postal mail address. After that, regular >subscriptions will require a modest fee (to be announced) to cover our >mailing costs, but we've committed to offering a limited number of free >one-year subscriptions to interested members of the cryptography community. >To request your free subscription, please send email to me at: > ><mailto:telegram-request@pgp.com?subject=first_issue_free_subscription_req> > >In the body of your request, please include the form below (items between >the cut-lines ONLY, and preferably PGP-signed), and replace the lines with >your complete postal mail address info as indicated. We'll put an HTML >subscription form on our website, but for the premier issue, we're managing >the subscription process via email. Thank you for your patience as we >deploy rapidly. :) > >............................. form begins here ............................. >The Zimmermann Telegram >PGP's Technical Newsletter > > - Premier Issue & One-Year Free Subscription Request - > >Subscription Information (Premier Issue): > > name (optional, but appreciated) > title (optional) > organization/dept (optional, as appropriate) > street address > mailstop (optional) > city/state/province > zip-/postal-code > country > >Free Subscription Category: (please [x] only one) > > [ ] academic > [ ] public library > [ ] media maven > [ ] human-rights/privacy activist > [ ] corporate security > [ ] impoverished cypherpunk > [ ] software analyst > [ ] law enforcement > [ ] freedom-fighter > [ ] intelligence agency > [ ] freeware developer > >.............................. form ends here .............................. > >Privacy Lock: If you are concerned about the privacy of your personal >information when sent over unsecured public networks, please feel free to >encrypt your subscription request to my key, which can be found at: ><http://swissnet.ai.mit.edu:11371/pks/lookup?op=index&search=0x4AAF00E5>. >Pretty Good Privacy Inc will take all reasonable precautions to protect >this information and will not use it for any other purpose without first >asking your permission. Also, PGP will not sell or give the information to >another entity and will store the list securely between mailings. > >Please feel free to circulate/forward this message (with PGP-signature) >among your friends and colleagues (remember: the free subscription offer >expires on 30 April 1997). We look forward to your comments on The >Zimmermann Telegram and thank you for your continued support of PGP. > > > dave > >_________________________________________________________________________ >Dave Del Torto +1.415.524.6231 tel >Senior Technical Evangelist +1.415.572.1932 fax >Pretty Good Privacy, Inc. http://www.pgp.com web > X-PGP header key > > >........................ "The Zimmermann Telegram" ........................ >Copyright © 1997 Pretty Good Privacy, Inc. All Rights Reserved. PGP and >Pretty Good Privacy are registered trademarks of Pretty Good Privacy, Inc. >Permission is granted to the reader to reproduce and distribute exact >copies of this document, in physical or electronic form, on a >non-commercial basis (i.e., at no direct or indirect charge). This document >has been made available in hard copy on a subscription basis and is >available in public libraries in the United States. Accordingly, and solely >for purposes of U.S. Export Control laws and regulations (but not copyright >or other intellectual property laws), this document is considered in the >"public domain." The information in this document is of an exploratory or >experimental nature. As such, it is subject to change without notice and is >provided "AS IS." No guarantee is made that it is free of errors or that it >will meet your requirements. While we welcome your feedback on this >document, we are unable to provide any technical support for its contents. >...........................................................................

1 0