December 2003 - cypherpunks-legacy

RSA encryption
by Christopher Kotze 17 Dec '03

17 Dec '03

Does anyone know anything about RSA encryption, if so, please tell me about it ! cheers, chris

1 0

help writing code
by Pat Farrell 17 Dec '03

17 Dec '03

I've spent the summer working on a SMTP/POP client that runs under MS-Windows. There are two ideas behind it. First, widespread acceptance of global communication will require that mass market user don't have to learn vi/emacs/... and Second, once the email composing and reading is done on a local, controlled PC, we can trivially pipe messages in and out of PGP, RIPEM, or your favorite encryption algorithm. This second part will allow folks to send all their mail encrypted, which will not only spread the word, but hurt traffic analysis. But, I need help. I've got all the front-end stuff working, and can handle the SMTP/POP protocols. But I can't get Windows to talk reliably with a raw async link. (I don't want to require SLIP or PPP, as lots of sites are too clueless to offer it.) I need a robust communications library. It has to do as well as possible given an inherantly inreliable link. I've bought three commercial sibraries, and none work. Cypherpunks write code. I've been trying. If someone wants to help, please reply, and we can work out detailed specs of the API I have in mind. Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Re: More signs that key escrow is coming
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Tim wrote: >Things seem awfully quiet on the list the past 24 hours.... > >Lucky Green wrote: > >> This RFP contains the final specs for a new multimedia architecture the >> cable companies intend to deploy. >... >> ".c4.11.7.1.1 Security System Objectives: >> The Offeror shall specify [..] whether it is possible to hide information >> in the digital signature number of which the signer would be unaware, which >> could conceal information. " >> >> Such as parts of the key? > >This sounds like it's a concern about subliminal channels in the >DSS/DSA signatures, a la the concerns raised by Gus Simmons last year. >I don't know what the use would be, unless it's concern (by whom?) >that viewing preferences could be back-propagated. > The RFP is not just for a system that sends Multimedia to the subscriber. The specs call for Homeshopping, private financial transactions, encrypted credit card transaction, etc. Just what info do they intend to conceal that the "the signer would be unaware" of? Just wondering, -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

1 0

Security of PGP private keys
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

PGP secret keys are protected by a password. Yet people have said that one should not keep one's secret keyring on an insecure machine. Why? -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

5 4

Re: Security of PGP private keys
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: jrk(a)sys.uea.ac.uk (Richard Kennaway) > > PGP secret keys are protected by a password. Yet people have said that one > should not keep one's secret keyring on an insecure machine. Why? > > -- ____ > Richard Kennaway __\_ / School of Information Systems > Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia > uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K. 1. Why take chances? Once the evil intruder has the file, she can throw test passwords at it from now till doomsday and might be able to crack it. 2. On shared machines, there are ways for users with the appropriate access to read your keystrokes (like, for example, when you type in your pass phrase). Anyone with that access should also be able to grab your secring.pgp with no problem, and that's that. --Dave.

1 0

CASH: crosspost
by Karl Lui Barrus 17 Dec '03

17 Dec '03

At risk of irritating some folks who already saw this, a crosspost: > Medvinsky, Gennady and B. Clifford Neuman. "NetCash: A Design > for Practical Electronic Currency on the Internet" Proceedings > of the First ACM Conference on Computer Communications Security > (November 1993) [available via anonymous FTP, > <URL=ftp://prospero.isi.edu/pub/papers/security/netcash-cccs93.ps.Z>]. > Addressing the pressing problem of how to conduct fiduciary > business on the Internet, Medvinsky and Neuman describe a > system that allows clients, merchants, and currency servers to > interact in a secure fashion over an insecure medium. The > framework presented here addresses, to varying degrees, the > following issues: security, anonymity, scalability, > acceptability, off-line operation, transferability, and > hardware independence. The authors readily admit that this > scheme does not solve all of these problems perfectly, but it > does allow for the integration of other protocols when utmost > anonymity and offline capabilities are required. - DR

1 0

Re: a desperate plea
by lefty＠apple.com 17 Dec '03

17 Dec '03

> No, I wasn't complaining about his personal attacks per se but his long term >behavior on this list and Extropians which is mainly "hit-and-run" >attack posts about once a month which usually generate massive flame wars. >(the last of which ended up with Tim May leaving the extropians list) Let me make sure I understand this: are you claiming that _I_ caused Tim to leave the Extropians list? -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Help writing code
by Pat Farrell 17 Dec '03

17 Dec '03

Let me quickly try to clear up some confusion. I've gotten several replies (real quick response) that are answering a different question. I'm not trying to reimplement TCP/IP. I'm trying to provide a Windows version of NUpop, which is a DOS program that works fine over a simple serial line. Most folks automatically associate SMTP/POP with TCP/IP, but there is no connection. Admittedly they work better with a robust, end to end protocol. But I've been using NUpop for a year over a non-TCP/IP line. I get hundreds of messages a day. It works. But there are no sources available to NUpop, it is a DOS program, and it doesn't support piping messages thru PGP/RIPEM/... I have lots of DOS libraries that do exactly the simple things I need. I don't want to use DOS, I want native Windows code. Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: help writing code
by Pat Farrell 17 Dec '03

17 Dec '03

In message Wed, 27 Oct 1993 10:10:04 -0600 (MDT), mpjohnso(a)nyx.cs.du.edu (Michael Johnson) writes: > The only way to communicate reliably over the serial port in Windows is > to upgrade the UART in your serial port to a 16550AFN or equivalent. The > standard UART (16450 in AT class machines) has no buffer and suffers from > frequent dropouts due to data overwrite on receive. If you can't do that, > then an error correcting protocol such as SLIP or PPP is required. A 16550 is clearly a big help, but Microsoft admits that their comm.drv fails often when you are using speeds greater than 4800. I have 16550's in my PC. A step in the right direction is TurboComm, a replacement driver, but that is expensive. A hardware solution is to use an intellegent serial card, like Hayes ESP or Telcor's T/Port. An O/S solution is to use a real operating system, :-) I want a no cost, MS-Windows solution. But I think folks read too much into my use of "robust" NUpop works fine as a DOS program without end-to-end. I simply want that functionality in a Windows program. No more, no less. I'm aiming low end, the mass market with a 386sx and a 2400 modem. Folks like me with a network of PCs in their house and even cypherpunks are not my market. The English majors, history and art majors are the folks I envision when I see a "user" Pat Pat Farrell Grad Student pfarrell(a)netcom.com Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: Net Regs.
by kwaldman 17 Dec '03

17 Dec '03

In response to my reply to Duncan's *"Net Regulation" Perry wrote: >To: kwaldman <kwaldman(a)BBN.COM> >Subject: Re: Net Requlation >Date: Wed, 27 Oct 1993 09:53:47 -0400 >From: "Perry E. Metzger" <pmetzger(a)lehman.com> >You do realize that cypherpunks is not extropians... >kwaldman says: >> Say the best way to go is to become a perpetual tourist. That is >> you don't have US citzenship and thus are not subject to it's taxes and >> other nosy laws. [Not that other government's don't have nosier laws]. >> Anyway Yes I realize it, and perhaps Perry's right we should move this to extropians. Karl * BTW I spelled Duncan's name wrong twice in 1 paragraph in my last post. Sorry.

1 0