December 2003 - cypherpunks-legacy

PGP 2.5 on ftp.csua.berkeley.edu
by Sameer 17 Dec '03

17 Dec '03

PGP 2.5 is now available at ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp/pgp25 -Sameer

1 0

c meeting...
by lile＠netcom.com 17 Dec '03

17 Dec '03

What time does the next meeting start? Noon? or !pm? thanks, -lile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

1000 extra lines....
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May say's, >Several people have written me to inform me that my last mail >message to the list had 1000 lines of extra junk appended at the >bottom: >501 macrakis(a)osf.org~h... 550 Host unknown (Name server: host not >found) >501 macrakis(a)osf.org~h... 550 Host unknown (Name server: host not >found) >...etc... >I've informed the folks at Netcom. If _this_ message has the same >extra junk, then I'll of course cease posting until the problem is >fixed. >Thanks, >--Tim For a minute I thought you'd gotten hold of a bad Hypercard....Snow Crash anyone? Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdPbTNCcBnAsu2t1AQHioAP8DHbClMRSkVFxKJcZHLugPu9yfxMno3TM t0nxN1V3TrUAqWcUl+M5EiqH7MiLzC/UzEJjBPcCjg+AnlVvDRw/WdBKCxuOArd5 U5j+i9x6CpnIx1jHzEX2105nxC9AIvn8W9vaX6usDLWXw5foeCBfYl7bE6EdLeDR Bp1VcQc4OzA= =BNqE -----END PGP SIGNATURE----- .\

1 0

Re: Message Havens, gopherholes
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Okay, I think the discussion has forked somewhere along the way to "gopherholes" and "message havens". While I described the message havens, maybe I didn't do so clearly (after all, it's all worked out in my mind!) and I may be overlooking something a fresh perspective will see. But, the advantages of a message haven are: * it doesn't send mail, thus eliminating what are the strongest objections to anonymous mail - you can't harrass somebody * it doesn't require you to tell it what messages you want to retrieve * it doesn't keep a list of pseudonym and true identity mappings, which seems to be required for "gopherhole" operation * it doesn't even need to have a public key: you and your partner can use each other's keys, and in every response to a message, you can specify what to name the next message, and even include a brand new public key if you want, etc. * if you retreive all the messages, the haven can't figure out who you are communicating with (actually, it can't figure out who is communicating with you) Now, about gopherholes: [description of how randomization and tag changes will make it hard to associate pseudonyms and true names] > Yeah, it certainly isn't trivial to attack. However, I'd like to Unless I missed something, you have to tell the "gopherhole" what messages you want to receive. This allows the goperhole to associate your psuedonym and true identity. More comments! About message havens and gopherholes. Nice to see some crypto being discussed ;) Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdMGfYOA7OpLWtYzAQHT2gP9GEpOePu8gUp/u4E37pWF8WhkyFaGwpqw nAkpqhanf8gCOsvPRhk4lvwETZ20hoCRzgR2bZzIq4F4bgtvx659bbElNBZv8kKu 5xYlMm+cV3MCwwTYXaBz7ItIl8ZC6rfQLdc2LAXhvJvjdaxHTpDeySN5l1gTdCII j9SQvUGYG1w= =/NkS -----END PGP SIGNATURE-----

2 1

Mail to ftp?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Is there any way to get a new crypto application up for widespread ftp access while remaining anonymous? Something like a mail to ftp gateway that would do a "put"? Or is there someone here willing to receive an anonymous crypto package and put it up for ftp at the CP site? Thnx.

1 0

Re: Message Havens
by David Scheidt 17 Dec '03

17 Dec '03

Thus spake SINCLAIR DOUGLAS N <sinclai(a)ecf.toronto.edu>: > klbarrus(a)owlnet.rice.edu (Karl Lui Barrus) writes: >> Maybe I wasn't clear in what the "message haven" offered... I'm trying >> to get away from the penet style mapping tables, persistent >> information tying you and your pseudonym, and solve the "unsolicited >> anonymous mail" problem. The message haven requires no trust, no >> tables, no information since it just accepts message and files them, >> and if you retrieve all the message, the haven can't figure out which >> ones you are interested in! >This flavour of message haven would not require persistent tables. >A crooked operator /could/ maintain them, but unlike penet they are >not required. Every time you log into a message haven, you tell it >what tags you are interested in. Here the level of trust is similar >to that of a regular remailer. The remailer /could/ keep logs to >destroy your anonymity, but we hope it doesn't. > >I realize this solution is far from ideal. But as I posted before, >I don't believe the numbers favour a message haven where everything >is downloaded. I have this nagging feeling that there is some >very elegant cryptographical way of doing this employing secret >sharing, but I can't actually think of how to do it. Couldn't each message have a short header, which is encrypted with the final recipent's public key? When you go to retrieve mail from the haven, you request the complete list of headers (or at least those that are new). If you can decrypt the header, then the message is for you. You then request that those messages, and also some random messages, be sent to you. If the sender uses one or more current-style remailers to send his/her message to the haven, it would much more difficult to work out a map of who is talking to whom. david -------------------------------------------------------------------------------- David Scheidt PGP 2.3 key by email scheida(a)yang.earlham.edu or finger scheida(a)earlham.edu "If we don't remember what we do, how will we know who we are?" -Ronald Reagan

3 2

PGP 2.5 info...
by lile＠netcom.com 17 Dec '03

17 Dec '03

I got this from the WWW. -lile Date: Fri, 13 May 1994 15:09:37 +0800 X-Url: http://web.mit.edu/network/pgp.html MIT PGP Release Beta Test Release of PGP version 2.5 May 9, 1994 The Massachusetts Institute of Technology announces the distribution of PGP version 2.5, incorporating the RSAREF 2.0 cryptographic toolkit under license from RSA Data Security, Inc., dated March 16, 1994. In accordance with the terms and limitations of the RSAREF 2.0 license of March 16, 1994, this version of PGP may be used for non-commercial purposes only. PGP 2.5 strictly conforms to the conditions of the RSAREF 2.0 license of March 16, 1994. As permitted under its RSAREF license, MIT's distribution of PGP 2.5 includes an accompanying distribution of the March 16, 1994 release of RSAREF 2.0. Users of PGP 2.5 are directed to consult the RSAREF 2.0 license included with the distribution to understand their obligations under that license. This distribution of PGP 2.5, available in source code form, is available only to users within the United States of America. Use of PGP 2.5 (and the included RSAREF 2.0) may be subject to export control. Questions concerning possible export restrictions on PGP 2.5 (and RSAREF 2.0) should be directed to the U.S. State Department's Office of Defense Trade Controls. Users in the United States of America can obtain information via FTP from net-dist.mit.edu in the directory /pub/PGP. *** Beta Release Note -- May 7, 1994 *** Today's release of PGP 2.5 is a beta test release, designed to permit users to familiarize themselves with the program and to give us feedback before we make the final release. This version of PGP2.5 has been tested on the following platforms: MSDOS, Sun381i, Solaris 2.X, Ultrix 4.X, Linux, RS6000, HP/UX Over the next few days, we will be testing PGP2.5 on a variety of other systems and collecting bug reports from this release. Please send bug reports to pgp-bugs(a)mit.edu. If you obtain a copy of this beta release code, please keep checking http://web.mit.edu for the announcement of the final release, so that you can update your copy of PGP2.5. We expect the final release to occur within a week. *** To Get PGP2.5: The directory where PGP2.5 is located is hidden. To get it you need to telnet to "net-dist.mit.edu" and login as getpgp. You will be asked to confirm that you will abide by the terms and conditions of the 3/16/94 RSAREF 2.0 license. The license is in the file "license.txt" in /pub/PGP on net-dist.mit.edu you can see it now by clicking here.

1 0

Quantum Computers and stuff
by John K Clark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I found this in the May 6 issue of Science: >At the same press conference where Lenstra and company announced >the defeat of RSA-129,he promised a "surprise" for the next >factoring feat. He hinted at a new, faster algorithm- and >perhaps a test involving a number with quite a few more digits >than 129. Then I found this in the May 7 issue of Science News: >In a startling theoretical result that could call into question >any cryptosystem based on factoring, Peter W Shore of AT&T Bell >Laboratories in Murray Hill, N.J., has just proved that >factoring is "easy" when done on a special type of computer >operating according to quantum mechanical principles . Although >such a quantum computer does not yet exist, this finding has >shaken the cryptographic community. By "easy" I presume they mean solvable in Polynomical time. I'm not saying the writing is on the wall or anything but it might be prudent to start thinking about Diffe-Hellman, perhaps using elliptic curves. John K Clark johnkc(a)well.sf.ca.us -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCzAgUBLdbskn03wfSpid95AQFZuwTvVug954sJilmhlyR3Sye+LpCB9ktG+erw mfDHBbAUpYC34P/lL81dzekGj7hmMhOIgZklZn7h/XfgCydQihm0e+DHGC9h64nT AI6g2xHI5k/hH9QZRUPjFLwreaFeKX4ARy3rfWEgpGC7g1qqyPnKQi7TBuffyYCV 51NJ9lGzGjuSVIcDdHcGBIoTkMg1T8pH+Yr44jo/MehE86KB+/0= =pxVR -----END PGP SIGNATURE-----

2 1

Re: Message Havens (fwd)
by Karl Lui Barrus 17 Dec '03

17 Dec '03

[Douglas asked me to forward this to the list] > I disagree. The only resource that will be hit is the message haven > (unlike say every computer in the world that carries the certain > usenet group you have chosen to use as a communications vehicle). > Geez, think of like a place that offers anonymous ftp. It's resources > are hit, but I don't buy the "massive load on net.resources". You think so? Hm. I'm just pulling numbers out of the air here, but... Let's say the cypherpunk dream is realized, and everyone on the net uses anonymous mail through a message haven. I believe there are 20 000 000 InterNet users right now. Lets say each person sends one piece of mail every day, and also checks the message haven each day. Each day there are twenty million new messages on the message haven. These are downloaded by twenty million people each day. That's 400 trillion messages that the message haven must send each day. Let's say the average size of a message is 1Kb. This gives a total of 3 Petabits a day. At 86400 seconds in a day, this requires a bandwidth of 30 Terabits/second. This is, of course, far beyond practicality. I'm allso being a little silly here, assuming there is only one message haven for the world. With distributed havens the load on each haven decreases. However, the load on each recieving terminal is the same. Each terminal must process 20 Gigabytes of mail to look for messages to the user. Maybe that'll be practical in a few years, but then again in a few years there will be more internet users. > This scheme is precisely what I described earlier! The two users > agree on what to name/tag the file, and that's how they get messages > to each other. The problem is Bob can't just retreive that one file > (if he is concerned about traffic analysis), so he can get them all so > a watcher learns nothing. You have suggested downloading a smaller > portion of the available message base instead of the whole thing. I'm sorry, I must not have read your post carefully enough. I understood there to be no tag outside the encryption wrapper. I thought you were implying attempting decryption of every post on the haven until one worked. My appologies.

1 0

Re: Message Havens
by Karl Lui Barrus 17 Dec '03

17 Dec '03

> Let's say the cypherpunk dream is realized, and everyone on the net > uses anonymous mail through a message haven. I believe there are Well, if the cypherpunks "dream" is realized then there won't be a need for message havens since anonymous mail will be accepted net-wide. People wouldn't go after anonymous remailer operators because somebody harrassed another person. But back to the problem at hand... Your analysis is interesting, but so far fetched I'm not going to worry about it. I mean, yes, if the 5 billion people of earth decide to do this, or decide to call each other, or decide to send each other snail mail, everything will collapse. Considering this as a worst case, in my opinion, is a waste for right now, and will deter useful work before it even starts. Planning for this is about as useful as worrying about all 20 million net users will access the same Mosaic page, the same gopher site, the same ftp site, etc. I just don't expect traffic to be that heavy. And I base it on personal experience from running anonymous remailers. Plus, it is ONLY necessary to retreive all messages if you don't want it know who you are communicating with. If you don't care if it is known you communicate with some psuedonym, then you don't have to get all the messages. The primary goal is to not mail messages out since that is where most the complaints against anonymous remailers lie. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0