December 2003 - cypherpunks-legacy

Re: MIME based remailing commands
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

>Nathaniel Borenstein <nsb(a)nsb.fv.com> writes: > >>Excerpts from junk.interesting: 7-Feb-95 Re: MIME based remailing co.. >>"Perry E. Metzger"@imsi. (2553) > >>> > > It is being remailed via a MIME-based structure where two new >>>content types >>> > > are defined: multipart/remail and application/remail-commands. The >>> > > multipart/remail type is supposed to be composed of two parts, the >>> > > application/remail-commands part which has remailer commands, and the >>> > > other part which is the "payload" to be remailed. > >>Perhaps you might consider writing up an informational RFC to define >>these types? I think that would be very useful. -- Nathaniel > >Well, that was just an example; I was making those names up off the top >of my head in order to concretize what I understood Perry was suggesting. > >I can see that putting remailer commands into a specific part of a MIME >multipart message has some advantages. Right now we are basically >having the remailing commands be mail header fields. But really people >aren't supposed to just make up new fields like that. I think the >"name space" of these fields is protected somewhat more than many other >aspects of communication protocols on the net. Is there precedent for >adding service-by-mail functionality in this way? I am not completely >comfortable with it. And as we think of new functionality and new >commands they all have to get added at this top level, the same >visibility and name space as "Subject", "From", and "To". > >OTOH it does have the advantage that it is easy to do, at least with the >"::" pasting token idea (which perhaps would need to be documented in its >own right). > >If we did use a separate message part we'd have our own little name space >to use, with no fears of conflicting with someone else. (Maybe "Latency" >might be used in a future extension of RFC822 for some other meaning than >what we are using it for.) I am not sure what has to be done to get an >RFC approved but I suspect that adding mail header fields would be much >more likely to hit opposition than adding yet another MIME type. > >What does Mixmaster use for its commands? Does it use "::" followed by >Anon-Send-To: and such? Or some other format? Maybe it should be made >MIME compliant from the beginning. This way we are moving with the >current, the flow of the net, rather than across it. > >Hal With Mixmaster, everything is hidden inside the encrypted and ascii armored message structure. I use the :: token to let the remailer know that this is a remailer message of some sort. The Remailer-Type will eventually be used to indicate the version that created the message. It would be easy to add support for MIME. It would just replace the token and version number. All remailing instructions are inside the ascii armor. Note that the block of ascii armor is allways exactly the same length. :: Remailer-Type: 2.0 -----BEGIN REMAILER MESSAGE----- hQCMAgbmF1BLzawNAQP/RFw2/UagugMFPlnJ94KLmhaxDoplzAhNBCxuFRL2fosL V1YnFd2XVckJJ6vTe6DB+POO+V7HEdXkp3sWtjb56Am+/B+tM1TdeC6NPNV4g5PC 15oYl7eD0ZxyjB34GdN5z/C2mOMbvP3k9eK3pn3ffkaXHBt1Y0I9ZieHkE6erxem AAAAusuiqVunPh15+7gttD5pNuIAOFDKfH8NJ39ReSEFAeeiOun6KSneJT+2DJ9Q LbK14WqsBVu1kDaUOHKchE9hPSFfTijTJp7I+GuiuOkDChUzZNZ21xpBS+8xMg58 0i61z9EEf11G0G5JShTaeaGWNd14QxoyrxjTh9PrItOz49M9lSY71KoTP2+fVc0h xDGHw7iVeeToOtFqmDBI14FOVJz2rYuMu7vTD+MTwP3INkraCXqTeBoJ7g31Nhqj <SNIP> LbK14WqsBVu1kDaUOHKchE9hPSFfTijTJp7I+GuiuOkDChUzZNZ21xpBS+8xMg58 0i61z9EEf11G0G5JShTaeaGWNd14QxoyrxjTh9PrItOz49M9lSY71KoTP2+fVc0h xDGHw7iVeeToOtFqmDBI14FOVJz2rYuMu7vTD+MTwP3INkraCXqTeBoJ7g31Nhqj VYbH5jxvKPjF4HEaS++MaBwTvzBkEKxbS+6oh7G/ndkHBxA7d7C0sx+qX9sjJyAs OIpGERZYA9RVspXUWys5fihnwrhk90dDAVZb8hTsPQfTXLp4 =ouPq -----END REMAILER MESSAGE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Check out my essay on the next generation remailer Mixmaster on the WWW page. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

2 1

My pgp emacs code in ftp://ftp.markv.com/pub/jpp/pgpelisp/*
by jpp＠markv.com 17 Dec '03

17 Dec '03

I have been hacking yet another emacs to pgp interface for some time now. I am happy with the current state of affairs, and am releasing it for general consumption. It supports automatic decrypting, signing, signature checks and interfaces nicely with rmail.el and sendmail.el. Also it includes a set of remailer functions which parse the ping reports from Raph Levien <raph(a)CS.Berkeley.EDU> and give you a simple interface to chaining a bunch of remailers together. The code is liscense free; use it, sell it, hack it up, export it, claim it is yours, I don't care. Feel free. (How could I stop you any way? I suspect that number theory, and complexity theory *are* the real natural rights.) My code is in ftp://ftp.markv.com/pub/jpp/pgpelisp/* It is not yet very well packaged. Read 2b.emacs. I still want to clean up the remailer stuff a little before I spend time packaging. (C-C commands, reply block building, and estimates of a chain's reliability, (support for ghio and julf {pseudo, ano}nyms?)) Unfortuneately my net connection, and means of support here at markv will likely soon be gone :(... This may be the last chance I have to distribute or work on this code for a while. If the code impreses you with my ability to hack, you might want to make me a job offer :) Or point me to jobs. OTOH, if my ability to hack doesn't impress you, please be quiet until I do get another job :). j'

1 0

No Subject
by jltocher＠CCGATE.HAC.COM 17 Dec '03

17 Dec '03

From Edupage: ONLINE SPYING While you're connected to your favorite Web page, it's also connected to you, and could be copying all sorts of information off your hard drive, say industry experts. In fact, it happened last year when Central Point Software used registration software developed by Pipeline Communications, and inadvertently also gathered descriptions of the users' systems -- the type of microprocessor, the version of DOS and Windows, the type of display and mouse, and the amount of free space available on the hard drive. Customers squawked, and Central Point had Pipeline change the software. However, Pipeline reports that at least one of its clients is using the scanning feature now -- but only after getting the owner's permission. The lesson? "If you can't trust it, don't connect to it." (Forbes 2/13/95 p.186) John L. Tocher THE CITY-a bounded infinity. A labyrinth where JLTocher(a)ccgate.HAC.com you are never lost. Your private map where every PGP: CE 72 1A 11 07 47 35 block bears exactly the same number. Even if you 35 9A C1 DE EA 64 21 BC 94 lose your way, you cannot go wrong. --Kobo Abe

1 0

NYT on HR666
by John Young 17 Dec '03

17 Dec '03

Katherine Seelye writes on Page One today about House passage of the new Search and Seizure bill. It covers a parallel revision of appeals of the death penalty. And notes on abusive BATF. For email copy send blank message to <jya(a)pipeline.com> with subject: 666_zap

1 0

Re: skronk
by strick＠techwood.org 17 Dec '03

17 Dec '03

THUS SPAKE "Kipp E.B. Hickman" <kipp(a)warp.mcom.com>: # FYI: # # If you haven't already, I suggest you take a look at the SSL spec # (http://home.mcom.com/info/SSL.html) [ carbon to cypherpunks, whom i think would be interested] i've been looking at that. It seems that a special port has to be allocated for each TCP service. So it's not clear to me how to find out if others on the net offer SMTP with SSL, or how I can put SSL into my X11 clients & server. You see what I'm getting at? It also looks like some heavy equipment is necessary to manage these RSA certficiates. Is there anything like PGP's keyring management for manipulating my web-of-trust? Where do I find the docs? # It does what you are trying to accomplish (I think), and it is already deployed # in production code (the Netscape client and server products). In addition, we # announced this week a free (for non-commerical use) reference implementation. # The code will be out on the net as soon as the lawyers are happy :-) aha ... that's the missing link. I'd certainly like to add it to the protocols that SKRONK advertizes and negotiates, but doing my own implementation of these complex protocols, and building machinery for using non-PGP certificates, was way more than I could handle. Please beat your lawyers to a pulp, until they make it useful for us. If I can't create generally useful things with it, and share it with thousands of others on the net for free, it's not going to be used by the cypherpunk community. I recommend you put your reference implementation in the public domain (except for the RSAREF component). Or take Matt Blaze's crypto offerings from AT&T as your model. best regards, strick

8 9

Re: skronk
by Perry E. Metzger 17 Dec '03

17 Dec '03

Kipp E.B. Hickman says: > Har! Besides the certificate problems, are there other problems with > PEM that have prevented its adoption? Its kind of ugly, too. The new PEM-MIME stuff should do much better, but its no longer really PEM per se. Look at the drafts if you are interested. > > I don't really blame you much. I mean TIPEM handles all the X.509 > > stuff just fine and PGP can't get out even the simplest of libraries, > > or even a partial library. > > Our implementation supports this X.509 stuff as well. We don't have a > DUA yet though... Just so you know, Kipp, there is no real support for X.500 directories over the internet, and there never will be. No one likes the things outside of fogeys in MIS departments who program in Cobol. Certificates as currently envisioned by the IETF are probably going to be stored in the DNS. .pm

1 0

Re: S314 and potential hell-raising
by Jaeson.M.Engle＠josaiah.sewanee.edu 17 Dec '03

17 Dec '03

>enlisting the ACLU, the EFF, and any other group potentially willing >to pour money into a legal battle. Fuck the EFF, they already lost they're place in importance. The ACLU is a very good place to start however. Ideas?? _____________________________________ {-: Jaeson M. Engle || jme(a)josaiah.sewanee.edu :-} {-: www server: http://josaiah.sewanee.edu/ :-} {-: Finger 'jme(a)josaiah.sewanee.edu' for my Public :-} PGP block.

5 5

PEM
by Rich Salz 17 Dec '03

17 Dec '03

> Har! Besides the certificate problems, are there other problems with > PEM that have prevented its adoption? That's it. PEM "blew it" by relying on Internet-wide X.500/X.509 deployments. They're now looking at self-signed certificates as a transition aide to work around the adoption problems, particular in face of the pressure brought by the success of PGP. /r$

1 0

Re: Remailer Encryption Module
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.3.89.9502090612.E21224-0100000(a)lia.bga.com>, Nathan Zook <nzook(a)bga.com> wrote: >As I've considered this problem, I've arrived at essentially the same >conclusion. We need an RSA-IDEA package that does something very close to >Mixmaster. I'm a-hackin' as fast as I can! Seriously, this is exactly what I had in mind when I started out on the Hastur Crypto Toolkit. Data formats will be parameterized, with parameters for well-known systems like PGP included with at least minimal auto-selection support. See the Hastur Status thread for the one real problem that isn't just a SMOP: key management. - -- Todd Masco | "No matter how peculiar the medium or incongruous the scale, cactus(a)hks.net | the instinct to build persists." - Joy Of Cooking Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLzpvqSoZzwIn1bdtAQG2+AGA2mP0eRIcgMKBAaeeMPr2Ik/mTN1SZ5y8 9MA8dM11fOvKah/EJRMwaTZ2RGuE/bv6 =r9eh -----END PGP SIGNATURE-----

1 0

RE: a new way to do anonymity
by Wei Dai 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric Hughes wrote: > Now here's an important detail that needs to get done right. Is the > forwarding for fixed length packets, variable length packets, or > streams? Is this decision global or local? What are the latency and > aggregatation effects? How important are these for different classes > of data? (telnet v. voice, e.g.) I'm not sure I understand the first question. My idea was originally based on link encrypted streams. How can forwarding variable length packets help untracibility? Wouldn't an attacker just have to match up the sizes of incoming and outgoing packets? Forwarding fixed length packets, on the other hands, just makes the system a remailer-net (so you'll have to do mixing, etc.). What am I misunderstanding here? > I'd suggest just getting something running first, to get some > prototyping experience. I just finished hacking ESM to do link encryption. (see my other post) Now if someone is willing to run a MUD type program and hook LESM up with it, then we'd have the first prototype of a pipe-net. Wei Dai -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzrFzzl0sXKgdnV5AQFfOAP7BpGWmo7FLK02a10NVTfgLEeheBosazzz 0TbFs2dwhtL4IRtY6To25e7MN2cz4X+qKJOleWy6uGbUowygHKbd1uiHOS9DNRmx /fKeyIlGd/Ogv6hSpiL/JDd0vx7vVx9Ho1CIy+oAFq4v8Kwd0sqQenqqvhBdoEfA zmVUpc+82nU= =3mfe -----END PGP SIGNATURE----- E-mail: Wei Dai <weidai(a)eskimo.com> URL: "http://www.eskimo.com/~weidai" =================== Exponential Increase of Complexity =================== --> singularity --> atoms --> macromolecules --> biological evolution --> central nervous systems --> symbolic communication --> homo sapiens --> digital computers --> internetworking --> close-coupled automation --> broadband brain-to-net connections --> artificial intelligence --> distributed consciousness --> group minds --> ? ? ?

1 0