December 2003 - cypherpunks-legacy

Some info of interest (possibly)
by Jim choate 17 Dec '03

17 Dec '03

Hi all, Any cypherpunks who would like to do public demonstrations or talks is invited to attend the sixth annual RobotFest held here in Austin, TX. It will be held in the city coliseum on April 1 & 2. If interested then please contact me through e-mail or call voice to 512-458-5818. The Central Texas Linux Users Group Meeting will be held Dec. 17, 1994 (this Saturday) at the downtown library here in Austin. We will be located in the 4th floor conference room. We will have several versions of PGP available for dos, amiga, and Linux boxes. If any c-punks would like to address the group please come on by. As of yesterday I got the ISDN link from my internet provider to ssz working and it should be accessible both dial-up and from internet some time next week. We have the full C address 204.96.173 for our use and have about 16 machines assigned at this time. We plan on dedicating at least one machine (and IP) to crypto related issues and software. Anyone who has experience doing crypto in Linux is eagerly sought for reference. Any c-punks who are planning on attending HoHoCon here in Austin are invited to drop by and party while they are in town..... Merry Christmas.

2 1

Re the Pentium Bug
by NetSurfer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- NASIRC BULLETIN #94-36 December 13, 1994 Floating Point Divide Flaw in Intel Pentium Processor Chip ============================================================ __ __ __ ___ ___ ____ ____ /_/\ /_/| /_/ / _/\ /_/| / __/ \ / __/\ | |\ \| || / \ \ | /\/ | || | /\ \/ | | \/ | ||\ \ || / /\ \ \ \ \ | || |_\/ /\ | | | || \ \|| / /--\ \ \ /\_\\ | || | |\ \ \ | \_/\ |_|/ \_|//_/ \_\/ \/__/ |_|/ |_| \_\/ \___\/ NASA Automated Systems Incident Response Capability ============================================================ NASIRC has become aware of a floating-point division problem in some versions of the Pentium processor chip, manufactured by Intel. Although this is not a security issue, NASIRC is bringing this to your attention because the defect could cause erroneous results for NASA projects which rely on complex mathematical computations involving double-precision arithmetic. Information on this problem is currently being propagated through the Internet and both technical and general publications. We are issuing this bulletin to provide a synopsis of what is known about the problem, how to check for the flaw, and what to do about it. It is important that any individual who uses a computer utilizing a Pentium processor perform the test(s) described in this bulletin on his/her machine to check for the bug. Although there have been reports the Pentium/60 is not affected, NASIRC recommends these units also be tested. There is no part number or other marking which would designate the flawed processor chips from the later revisions, which do not contain the bug. Intel considers this flaw to be minor, and has stated: "the average spreadsheet user should only be affected by this bug once every 27,000 years". However, NASIRC feels there is a high probability that work done on this class of desktop system in NASA is most likely to be computationally intensive, and the likelihood of achieving erroneous results is strong. From a reliability and reputation standpoint, NASA must ensure that the tools it uses to accomplish its mission perform properly. The president of Intel has issued a communique, stating his company's position on the problem, and the the process to follow should a site discover a flawed system. The communique is available via WWW at the URL: http://www.intel.com/about-intel/press/andy-msg.html. Pentium machines can be tested by using any of the following three methods: 1) Using the Microsoft Windows calculator, perform the following computation: x = 4195835 y = 3145727 z = x - (x/y)*y If z = 256, your chip has the bug. The Windows calculator is the easiest way to run this test. If you program this calculation, be sure to use to use double-precision variables! 2) Using any spreadsheet application (Lotus 1-2-3, Excel, etc), perform the following test: Enter the following data: In cell A1: 4195835 In cell A2: 3145727 In cell A3: 3145727 Calculate the following value: (A1 * A2)/A3 A correct result is: 4195835 An incorrect result (FDIV bug) is: 4195579 3) A small program named P87TEST.COM, to test for the existence of the bug was written and made available over the Internet by Terje Mathisen of Norsk Hydro A/S in Norway. A binary copy of P87TEST.COM can be obtained via anonymous FTP from the NASIRC online archive at the following URL: ftp://nasirc.nasa.gov/toolkits/diagnostics/Intel/p87test.com The Checksums are as follows: MD5: 322E8857C126D7CA336E7FFC31800939 SunOS: 08334 2 To run the program, simply type: P87TEST. An example of the program output is as follows: Pentium FDIV bug finder. (c) Terje Mathisen 1994 This is a Pentium or better cpu CPUID reports back: Vendor id = "GenuineIntel" Family (4=486, 5=Pentium etc.) = 05, stepping = 05, model = 01 CPU feature list: 1 : FPU (NDP) onchip 2 : Virtual 86 Mode Extensions 4 : I/O Breakpoints 8 : Page Size Extensions 10 : Time Stamp Counter 20 : Pentium stype MSRs 80 : Machine Check Exception 100 : CMPXCHG8B instruction available It has a 387 or later ndp It has the FDIV bug: (1.0/824633702449.0)*824633702449.0 is not equal to 1.0! Intel has stated that any site experiencing problems from this bug can obtain a replacement processor chip at no charge. Intel has set up a special customer service phone number for users affected by this bug. The Intel customer service desk can assist with obtaining replacement processor chips for affected systems. Any site confirming the existence of the bug in their Pentium chipset should contact Intel at 1-800-628-8686. If you have any questions about this bulletin, please contact the NASIRC Helpdesk. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NASIRC ACKNOWLEDGES: Mr. Bob Solomon of the NASA Lewis Research Center for providing the information used in this bulletin, and Mr. Terje Mathisen of Norsk Hydro A/S for creating the pro- gram to test a system for the bug. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= =============================================================== For further assistance, please contact the NASIRC Helpdesk: Phone: 1-800-7-NASIRC Fax: 1-301-441-1853 Internet Email: nasirc(a)nasa.gov 24 Hour/Emergency Pager: 1-800-759-7243/Pin:2023056 STU III: 1-301-982-5480 =============================================================== This bulletin may be forwarded without restriction to sites and system administrators within the NASA community. The NASIRC online archive system is available via anonymous ftp. You will be required to enter your valid e-mail address as the "password". Once on the system, you can access the following information: ~/bulletins ! contains NASIRC bulletins ~/information ! contains various informational files ~/toolkits ! contains automated toolkit software The contents of these directories is updated on a continuous basis with relevant software and information; contact the NASIRC Helpdesk for more information or assistance. ----------------- PLEASE NOTE: Users outside of the NASA community may receive NASIRC bulletins. If you are not part of the NASA community, please contact your agency's response team to report incidents. Your agency's team will coordinate with NASIRC, who will ensure the proper internal NASA team(s) are notified. NASIRC is a member of the Forum of Incident Response and Security Teams (FIRST), a world-wide organiza- tion which provides for coordination between incident response teams in handling computer-security-related issues. You can obtain a list of FIRST member organizations and their constituencies by sending email to docserver(a)first.org with an empty "subject" line and a message body containing the line "send first-contacts". ************************************************************************* * Richard K. Yamane Leeward Community College * * Manager, Computer Center 96-045 Ala Ike * * Pearl City, Hawaii 96782 * * EM: sysrich(a)lccada.lcc.hawaii.edu * * Ph: (808) 455-0493 (Univ. of Hawaii campus) * ************************************************************************* ************************************************************************** *Marv Weissman * UH Computer Specialist * Leeward Community College * *cs_weissman(a)lccada.lcc.hawaii.edu (808)455-0465, voice. 455-0471, fax * * * * "Don't worry about what may happen tomorrow; just correct what you * * spoiled yesterday" * * * * (Midrash ) * * * ************************************************************************* - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu8yTyoZzwIn1bdtAQFVBgF6Agd6s2YAeRmBSsUiyLzvN15OoRdQObIk A0F8v9dG5xuHXyp/hWYHKzX6QIA0a6KP =544j -----END PGP SIGNATURE-----

1 0

(fwd) I don't use PGP. (Was:I NUKED PGP.)
by Black Unicorn 17 Dec '03

17 Dec '03

Path: news1.digex.net!access1!unicorn From: unicorn(a)access1.digex.net (Black Unicorn) Newsgroups: alt.security.pgp Subject: I don't use PGP. (Was:I NUKED PGP.) Date: 14 Dec 1994 18:11:29 GMT Bretton Wade (bw16(a)cornell.edu) wrote: : In article <3clri0$jqn(a)crl.crl.com>, jdulaney(a)crl.com (John Dulaney) wrote: : > 1) Too difficult to setup for the average user. : The "average" user of PGP is somebody who understands why they need PGP. : I'd say almost everybody with that level of knowledge is capable of : understanding "type randomly for a while", and the three or four standard : options to pass to PGP for day to day use. : > 3) I may forget to decrypt and miss an important note. : pay attention. If you need the security... : > 2) Requires that I exit my E-mail reader to decrypt which takes : > too much time. : > : > Suggestions: : > 1) Make it operable INSIDE PINE for example. : > 2) Put it in EUDORA or other MOSAIC/NETSCAPE browser and make it : > work AUTOMATICALLY, seemlessly, in the background. : > : read the newsgroup for about 30 seconds before you post. A lot of people : have put a lot of work into this sort of stuff. Some good, some not so : good, but that is for you to evaluate. : Bretton I'm a Mac user. MacPGP is a general nightmare. For those of us who have shell accounts, it is such a annoyance as to cause me to dislike using it at all except for the most extreme messages. I fear I am not of the ability, or of the spare time to work on making a seamless application myself or else it surely would have been a project on the top of my list. PGP needs to be a drop and drag application. I want a box sitting on my desktop, a box I can drag any document to and press two buttons after a mouse click and drag and encrypt/decrypt/sign a message which can then be copy/pasted to Zterm. Currently the only thing that nears the transparancy of this sort of thing is the bulky, annoying, poorly packaged and massively oversized, not to mention rarely working, MacPGP Kit. It doesn't seem to work out to any time advantage when I factor in the debugging and outright code crashes into my computation. The modular PGP project has been out there for almost a year. Any progress on this front? Does anyone care? Now that some lists are beginning to delay or reject unsigned messages altogether, I would really like to be able to reply to a simple note in less than the 7 minutes it currently takes me. This is the single most problematic hitch in PGP. It's not easy to use, to install, or to apply. Every move toward transparent crypto simply serves to increase user base and deter a prospective ban. It should be in EVERYONE's interest to try and push for a easier front end, while still allowing a flexible and detailed set of advanced options for the expert user. Curve Encrypt is a classic example of simplicty and ease. PGP front end designers for the Mac should take its example. -uni- (Dark) Spelling errors disclaimed, I've been up for 30 hours. -- 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 1

(fwd) I don't use PGP. (Was:I NUKED PGP.)
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: (fwd) I don't use PGP. (Was:I NUKED PGP.) From: "Connie Sadler"@MR.STANFORD.EDU Date: Wed, 14 Dec 1994 10:28:00 PDT A1-type: DOCUMENT Posting-date: Wed, 14 Dec 1994 00:00:00 PDT <Black Unicorn says: <I'm a Mac user. <MacPGP is a general nightmare. For those of us who have shell accounts, <it is such a annoyance as to cause me to dislike using it at all except for <the most extreme messages. <I fear I am not of the ability, or of the spare time to work on making a <seamless application myself or else it surely would have been a project <on the top of my list. <PGP needs to be a drop and drag application. I want a box sitting on my <desktop, a box I can drag any document to and press two buttons after a <mouse click and drag and encrypt/decrypt/sign a message which can then be <copy/pasted to Zterm. Currently the only thing that nears the <transparancy of this sort of thing is the bulky, annoying, poorly <packaged and massively oversized, not to mention rarely working, MacPGP <Kit. It doesn't seem to work out to any time advantage when I factor in <the debugging and outright code crashes into my computation. <The modular PGP project has been out there for almost a year. Any <progress on this front? Does anyone care? <Now that some lists are beginning to delay or reject unsigned messages <altogether, I would really like to be able to reply to a simple note in <less than the 7 minutes it currently takes me. <This is the single most problematic hitch in PGP. It's not easy to use, <to install, or to apply. <Every move toward transparent crypto simply serves to increase user base <and deter a prospective ban. It should be in EVERYONE's interest to try <and push for a easier front end, while still allowing a flexible and <detailed set of advanced options for the expert user. <Curve Encrypt is a classic example of simplicty and ease. PGP front end <designers for the Mac should take its example. <-uni- (Dark) <Spelling errors disclaimed, I've been up for 30 hours. I just have to say AMEN to this message. I LOVE PGP but agree with the writer that until we make it easier to use (drag and click!), we're losing many, many potential users out there. I, too, will keep my fingers crossed. And who knows? Maybe one day, I'll develop enough technical skill to do something about it myself - I'm working on it. Connie

1 0

Less Flaming, More Civility
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Folks, the level of flaming and gratuitous insulting (insultations?) is getting in the way of our message. We have on our list folks from Netscape, First Virtual, and (maybe) Digicash. Amongst others. And we certainly know that some of our messages are being forwarded to others. It behooves us to bear this in mind. If we can't calmly and clearly make our points about why privacy is important (and I mean in the sense of personal responsibility, not just the buzzword), about why end-to-end encryption is generally better than transport-level security, and about why "certifying authorities" is (to many of us) a flawed approach, then we are failing. More concisely, the Cypherpunks list is one of several "watering holes" that have appeared. Rather than trashing schemes which are not "'punkly correct" (PC, to coin a term), or which seem to have been put together in haste (perhaps for good reason)), we should instead use this golden opportunity to influence things. Call me an elitist, but I think the Cypherpunks list has an important role to play in influencing: -- Web development (Netscape, InterCon, others) -- digital cash (DigiCash, First Virtual, others) -- key escrow policies and plans (TIS, Microsoft, etc.) -- the future of PGP, tools, etc. -- etc. These things will have more of an effect on the future than convincing Aunt Erma to encrypt her mail. It may be that the comments made here about the security model of Netscape and First Virtual are on the mark, that these models need a lot more work. But I don't know see how insults or derision, or imputing bad motives to these folks, will help. (I think I was careful this past motive to avoid slinging mud at Bill Gates, for example, during the debate about reports that Microsoft could be including some form of key escrow in future OS releases. Not to say I've never flamed...) One lesson that's become clear is to expect that derisive comments made here will often find their way back to those derided. I always write with the expectation that folks as disparate as David Chaum and Dorothy Denning will perhaps be reading my words! (Hi, David! Hi, Dotty!) They may read them because someone forwards the messages to them, or because in 1996 the Cypherpunks list is sold on CD-ROM, or because one of them has access to the main NSA search engines (:-}). Whatever, my point is that insults are rarely helpful, and are unpersuasive. Insults also set a tone for later debate that is hard to get beyond. Not all debate recently has been insulting, of course. In fact, most hasn't been. But the insulting tone persists in some of the thread titles, and in the generally adversarial nature. (If I were Marc A. or Kipp, I'd not feel very welcome here....a situation which is counterproductive to our presumed goals.) Hal Finney nicely summarized why folks want some privacy on Web pages, and why transport-level security is generally less desirable than end-to-end security (including the special case of anonymous origination). This is the usual "who do you trust?" motif, which comes up in mail delivery _and_ in key certification. (Sidebar: In my view, Web browsers like Netscape and Mosaic, etc., should not get overly involved in these issues. These are issues for Web page owners to worry about and set policy on. The browsers may want the right hooks in them to allow authentication policies to be implemented, but the browser-makers should probably stay out of the gory details of which crypto algorithms are used, what access policies are set, etc. This makes it easier to drop-in stronger systems at a later time. I may be misunderstanding plans, I admit.) So, this is my little rant on "Can't we all just get along?" expressed in a different way. The Cypherpunks list has become one of several de facto "watering holes" where diverse participants interact. Let's not blow it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

14 33

<none specified>
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn writes: > The modular PGP project has been out there for almost a year. Any > progress on this front? Does anyone care? I percieve a 'chilling effect' going on with PGP compatible application development. Nobody wants to extract the core PGP code into a library because the code is dense and who wants to do that every update? Likewise with using PGPTools. Who wants to re write their application when the official PGP library materializes? So people are waiting... Could we get some updates on what is happening with the official pgp development? If it's not coming soon, or not at all, it would be nice to know so we can get going on improving PGPTools or writing our own. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu9MqioZzwIn1bdtAQGUpgGAoyg9xD7355aypqebsUwrQdS8rfPH4Oiz NxrVnNp5L247pZRftliqdwO8Sh0OzgTZ =B8B5 -----END PGP SIGNATURE-----

2 1

Re: News->Mail & CMU's Andrew Message System
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Big Lama wrote; >A, B, C and D and E and AMS and AFS and DCE and DFS and IPC and RPC >and MDA and STP and LSD and THC... >...and amphetamine. > >Big Lama (remembering an old hit, from the Flower Power period) "The Alphabet Song" by "David Peel and the Lower East Side." -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: PGP 2.7
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

--> I keep seeing pgp 2.7 in public key & sig blocks. --> Where do we get it? 2.7 is a ViaCrypt product which you have to pay royalties for, and last I heard they didn't include sources with their distribution. Anybody know if they've started sending the sources with the executables?? Here's their addresses and tel #'s: Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41

1 0

Re: Clarification of my remarks about Netscape
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <199412140047.QAA17489(a)jobe.shell.portal.com>, you write: > -----BEGIN PGP SIGNED MESSAGE----- > > "Amanda Walker" <amanda(a)intercon.com> writes, quoting someone from > Netscape: > > >> I didn't bother imbedding the RSA Unaffiliated User CA because I > >> didn't think server operators would use it to get certificates. > > >Well, it's what Apple is using for PowerTalk signers (which are a key pair and > >X.509 certificates, by default from the Unaffiliated User PCA). It makes > >sense for personal (as opposed to organizational) servers, such as someone > >running MacHTTP for their home page... > > >On the other hand, if RSA has set up a server PCA, that should be suffcient > >for now. I wonder what the certification policy is, though--how do you prove > >that you control a given server? For an Unaffiliated User CA certificate, you > >just have to show a notarized application and two forms of ID, one with a > >photo (driver's license, passport, etc.). I can't off hand think of an > >equivalently strong way to ID control of a server... > > This relates to the other part of my question, which didn't get answered: > what is the relationship between the name found in the X.509 certificate > and the server? Does X.509 include an internet address like mcom.com, > and the Netscape client checks that this matches the address of the > server it is connecting to? I am not very familiar with the certificate > format but I had the impression that it used a very different naming > scheme. > > Or does the client accept any valid certificate without regard to the > connection if any between the name in the certificate and the server to > which it is connected? This whole area was left undefined in the SSL > spec but will be important for interoperability. > > Hal > > -----BEGIN PGP SIGNATURE----- > Version: 2.6 > > iQBVAwUBLu5AkhnMLJtOy9MBAQEFQgH/dmiiEjycULNdDCNiU8SkoB57bHv9W5Lc > d+K7cBqq0ZknCwXtqZtbPTR7d8F1z0WFbMlP6QF3zywVz2GrDIg5kg== > =qQ9u > -----END PGP SIGNATURE----- >From the spec, the appendix on certificates: Certificates are validated using a few straightforward steps. First, the signature on the certificate is checked and if invalid, the certificate is invalid (either a transmission error or an attempted forgery occurred). Next, the CertificateInfo::issuer field is verified to be an issuer that the application trusts (using an unspecified mechanism). The CertificateInfo::validity field is checked against the current date and verified. Here is what we do in Netscape (for now). We have imbedded a set of certificates in the client. The certificates are for issuers of certificates that "we" trust. Any server which is certified by one of these issuers will be automatically trusted by the Netscape Navigator... Admittedly this is primitive, but it's a start. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

1 0

Re: BofA+Netscape
by kipp＠warp.mcom.com 17 Dec '03

17 Dec '03

In article <199412132218.QAA06065(a)pentagon.io.com>, you write: > jamesd(a)netcom.com (James A. Donald) writes: > [regarding Netscape and IETF work...] > > > > Perry, they are not in trouble. They are the number one supplier > > of the internet killer app. > > They are the supplier of the current app-du-jour. What things look lie in > five months is another issue completely. > > > The plug for crypto that they have placed in Netscape 0.96 is > > the number one force bringing crypto awareness to the masses. > > Increasing use of PGP is the number one force bringing crypto awareness to > the masses, Netscape is just bringing bad crypto to the masses. > > > He said that Netscape would look at IPSP when it was beyond > > the "near" phase. [...] The correct response is "Gee that is great. > > Here are some working demo systems, and some slabs of documentation." > > No, the correct response is to stop idotic measures before the build up > enough inertia behind them to make it difficult to prevent mistakes from > being made. It is interesting that the creators of Netscape quite > frequently harp on "it is us against the goliath of Microsoft, so we > deserve the support of the net" and then they go out and do exactly the > sort of thing that makes Microsoft so unpopular; they take advantage of > thier market position to force bad technology on others. If the technology is so "bad", would someone please be so kind as to inform us what is so "bad" about it? We have a solution for a piece of the security puzzle: transport security. We admit its limitations. People keep saying its "bad". Please put some meat behind the commentary: Is it insecure? If so, how? Is there some cipher techonology that it absolutely must support? If so, which one? why? etc. --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

1 0