December 2003 - cypherpunks-legacy

Re: Active Eavesdropping of Clipper
by catalyst＠netcom.com 17 Dec '03

17 Dec '03

Mike Ingle quotes Matt Blaze (and I paraphrase): >[...] so the procedure for placing a secure call is to recognize >each other's voice in the clear mode, go secure, and read the hash >value to each other [...] you have to rely on prior knowledge of each >other's voice. [...] This is out of band WRT the encryption engine. Note that it can be used exactly like an asymmetric encryption key for authentication. You know the other persons signature/voice in advance and it is hard for an attacker to reproduce it. >[an attacker could] trick you into saying some numbers, digitally record >them, and then rearrange them and play them back. The 'replay' attack. Of course you always make the other person say the hash _and_ some (never reused?) data in a lump (re: my earlier post -- concatenate your challenge data with their a^x before signing) for instance: "Bob, please sing me the hash to the tune of 'Raindrops Keep Fallin' on My Head'" (Security can be fun). >Or introduce enough line noise so the person couldn't recognize your >voice, and read the fake key Signature not valid. Sorry Bob, I'll have to call you back. That is, _if_ it's really you. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Source for MacPGP 2.3
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

I wrote: >I have MacPGP 2.3 (the Macintosh application). From what ftp site can I >obtain the source? soda only has Mac source for 2.2. In fact, I've found that I do have the source for MacPGP 2.3 (although someone told me the source wasn't released yet). I can't remember where I got it though. I won't undertake to email it to anyone, nor to place it on anonftp indefinitely, as the only anonftp area I have is on my desktop machine. However, I'm not going to be around for about a week, so I'm willing to make it available during that time. Any last-minute demands for me not to do this for some reason? Tough, I'm about to leave, after which it's out of my hands. One-time offer, valid for one week only!! ========================================= MacPGP2.3 application, documentation, and source (for Symantec (Think) C 5.0.4), will be available by anon ftp on jrk.sys.uea.ac.uk, from Thurs 30 Sep (today) 14:00 GMT until Fri 8 October 08:00 GMT. Note that this machine is in the UK. It is the responsibility of those accessing it to satisfy themselves of the legality of their actions. These files are available strictly on an "as-is" basis, with no warranty, express or implied, concerning their contents. Instructions: ftp to jrk.sys.uea.ac.uk and give the following commands. user anonymous (Give your email name as password...or not. All transfers will be logged.) cd "RK's Public Folder" (Yes, there are spaces in the name of the directory. This is a Macintosh.) ascii get macpgp2.3src.sea.hqx.pgp (NB. If you are ftp-ing from anything but another Mac, the above file must be transferred in ASCII mode.) binary get macpgp2.3.sit Once you have these files, you need to do the following steps: 0. Put both files on a Mac, if they aren't there already. 1. Use Stuffit 1.5.1 or any decoder (such as DownLine) which understands that format to decode macpgp2.3.sit. This will give several files, one of which is the MacPGP 2.3 application. 2. Use the application to verify the signature on macpgp2.3src.sea.hqx.pgp and to strip the ascii armoring from it, creating a file macpgp2.3src.sea.hqx. (If you already have PGP on a unix machine, you can do this there and then transfer the .hqx file to the Mac.) 3. Use a BinHex decoder to decode macpgp2.3src.sea.hqx. This yields an application macpgp2.3src.sea. 4. Run that application, and it will decode itself into the source for MacPGP2.3. Paranoids should note that macpgp2.3.sit is not PGP-signed, and you only have my word that it does what I say it does. macpgp2.3src.sea.hqx.pgp is signed, but not by me, and I am not in a position to certify its signature. I use MPW C, so I haven't even compiled the source myself. I am *not* able to answer any questions about MacPGP itself, nor will I or anyone else be available during the coming week to sort out any ftp problems. I will probably be out of reach of email during that time as well. -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

A Word From Bill
by Duncan Frissell 17 Dec '03

17 Dec '03

Since president(a)whitehouse.gov is not yet a full duplex operation, I wanted to take this opportunity to speak personally to all you cypherpunkian-Americans (and the odd foreigner) out there. I feel your pain. I understand your concerns. Your concerns are my concerns. As I said on September 14th: I want to say to my fellow Americans, when you live in a time of change, the only way to recover your security and broaden your horizons is to adapt to the change, to embrace it, to move forward. Nothing we do, nothing we do in this great capital can change the fact that factories or information can flash across the world, that people can move money around in the blink of an eye. Nothing can change the fact that technology can be adopted, once created, by people all across the world and then rapidly adapted in new and different ways by people who have a little different take on the way that technology works... ...I tell you my fellow Americans, that if we learn anything from the collapse of the Berlin Wall and the fall of the governments of Eastern Europe, even a totally controlled society cannot resist the winds of change that economics, and technology, and information flow have imposed on this world of ours. That is not an option. Our only realistic option is to embrace these changes... William Jefferson Blythe Clinton --- WinQwk 2.0b#0

1 0

reading mail
by lowton＠typhon.dra.hmg.gb 17 Dec '03

17 Dec '03

> My question is this: how does he know that the mail is encrypted if he's > not examining the mail that passes through his system? If he *is* > examining the mail that passes through his system, it seems likely that he > is violating the Electronic Communications Privacy Act. > > > --Mike He could be using an automatic search for the string at the beginning of pgp encrypted messages. Maybe someone on his system could check this out by removing the strings and seeing if he notices it then. Not that I'm encouraging anyone to break the rules of the system you understand :) mr lotion

1 0

key-server down?
by J. Michael Diehl 17 Dec '03

17 Dec '03

Hi guys. I've been using the pgp key server for some time now, but lately I've been having problems with it. I send it commands (last 30 for example) and never get a reply. I believe I'm using the one on toxicwaste, but can't be sure since I have an alias for it and I'm not at my email account at the moment. Is this site down or am I just impatient? Thanx in advance. Lagers, J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politicly Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703. PGP Key = 7C06F1 = A6 27 E1 1D 5F B2 F2 F1 12 E7 53 2D 85 A2 10 5D

2 1

Communications Week Article
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

In the Sept 28 issue of Communication Week, Pg 35-36. _Who will hold the Clipper Keys?_ *Last Paragraph* The administration will choose the escrow agents based on experience in handling sensitive information, according to the EFF report. It will avoid choosing low enforcement agencies to avoid conflicts of interest and it will not choose private companies because of concerns about the companies' longevity, the report said. Well hmm... what about the longevity of governmental agencies, or even the government itself?

1 0

Re: Active Eavesdropping of Clipper Phones
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

There are a variety of ways around Diffie-Hellman spoofing. The current STU-III phones from AT&T, Motorola, etc., use several approaches - there's the Crypto Igniter Key dongles that you need to authorize your phone, which provides one form of out-of-band authentication (partly authentication of the DH keys, but more important is authentication that the person at the other end is probably cleared for the level of classification you're running the call at); there's also an LCD display on the phone that shows the other person's DH half-key, so you can do voice verification if you want. They may do other stuff as well. Scott Collins mentioned the "digital signature on RSA keys", which the Capstone phones probably do even though Clipperphones probably won't. There are also tricks about sending half the key at a time, though they're apparently still hackable. Bill

1 0

DES Implementations
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>koontz-des.tar.Z >David G. Koontz <2004ktz%ucsbuxa(a)hub.ucsb.edu> >Fast but large DES C functions and main program. >Dates to March 1991, at which time it was one of the fastest around. >Good verification suite included. I have three or four faster versions, when I think about it I try and produce smaller code (Cache size limits, don't you know)

1 0

fido encryption.
by J. Michael Diehl 17 Dec '03

17 Dec '03

Hi all! I just conducted an experiment whose results indicate how far we (Cypherpunks) have to go in educating the American Public WRT encryption technology: I send an encrypted message via fidonet! (awk!) I had heard a rumor that fidonet forbade encrypted e-mail, but I had to find out for myself. Well, they do. Now I understand that these sysops are spending their own money and equipment to provide these services and have the right to regulate it in any way they see fit. That's not the point. The point(s) is/are: 1) They ACTIVELY enforce this policy. They don't simply say "no," they check (presumably) all of their user's email to enforce this policy. 2) They seem to be afraid to pass/store encrypted messages on their system. This indicates to me a lack of understanding of the concept of privacy. They seem to buy into the idea that "only BAD people encrypt email." We need to educate the electronic community before we can hope to educate the general public. The text of the messages follow with the names removed. BTW, the text of the plaintext message was "this is a test." Just thought you'd be interested. Comments? =========================================================================== BBS: The Tech Source Date: 09-16-93 (00:00) Number: 261 To: MIKE DIEHL Recvd: YES (PVT) Subj: Encrypted Mail Conf: (0) PrivateE-M --------------------------------------------------------------------------- This is a test. -----BEGIN PGP PUBLIC KEY BLOCK----- version: 2.2 mQCNAiu/jPkAAAEEAMGeUcJS+AfY32cDfy/v/UcA9JdqNOBOl/K37jFOBuCkXCSp lBa ---END PGP PUBLIC KEY BLOCK----- Mike, Please advise the sender of this message that I DO NOT allow encrypted mail to pass thru this system. I expect folks to abide by this rule voluntarily... I would hate to have to block all messages from this source becuase someone wishes to violate my policy :) BTW, the debate about "encrypted" mail with me is MOOT... I will not vary from my position... (just thought I'd let you know in case you wanted to try to convince me it is OK to allow encrypted mail...) please have the other person send encrypted mail directly to your machine... Thank you.. Sysop of Another BBS?

4 3

POISON PILL
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, Here is probably one of those dumb questions we non-technical types ask from time to time on this list. Please indulge me though, in case there is something to it. In today's America, we live under the constant threat of police seizure of our computer equipment and other assets. Of course, we can encrypt the information our files, but this is, at best, a passive solution. Are there any positive actions we can take? POISON PILL--What, if anything, can be done to booby-trap a computer? Once the cops have a machine, one would expect that they will paw through everything in it. In addition, they will probably use the stolen computer for their own data processing needs. What could be done have the computer screw up the cop's data days, weeks or months after the seizure? Of course, I would never do such a thing myself, nor would I advise anyone else to do so. I do, however, have a passing academic interest in the subject. Same for you folks too, right? S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3