December 2003 - cypherpunks-legacy

Re: PGP encryption
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 2:59 PM 4/14/94 -0400, marssaxman(a)aol.com wrote: >Are there any shareware/freeware/PD PGP-like encryption systems for the >Macintosh? Or is there a Mac version of PGP and I just haven't heard about >it? > >-Mars There's RIPEM Mac, which I heartly endorse. Does RIPEM and PEM messages (can pull your AOCE signer from System 7 Pro as a Unaffiliated User certificate), and does it quite well. I have a set of AppleScripts I use to link it up with Eudora, my mail program. I can send it to anyone who wants it, if they provide a statement of their citizenship (US or Canada) and their agreement not to violate the export or RSAREF license agreeements. Also available from ripem.msu.edu, although you'll have to mail the ftp site's maintainer the same info I need. MacPGP also exists, but isn't as friendly to use, and is generally available where the standard PGP is located. Bob -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: New anon mailer idea?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hal writes: > - You'd want this feature to be optional. Some people might not want > their anonymity limited by having their return address recorded, even > in encrypted form. The obvious implementation is to add a Generate-Return-Address: header so you can use it if you want it, but won't get one otherwise. The encryption definitely needs some sort of random padding, though CBC with a random IV plus length-padding at the end should probably suffice. > - The use of a symmetric cypher is a very nice way of getting the use-once > capability, along with the "burn after reading" effect of a remailer > chain which destroys itself as it goes. But it could be a considerable > burden on the remailer operator to maintain the database. One possibility > would be to fix a maximum time limit on how long the return addresses are > kept "alive" and require some real money to keep them longer. Public key has the advantage that the operator doesn't *need* a database. If you want to implement use-once addresses (or use-N-times), you could include a tag with the address (such as the IV), and reject future messages using that tag (e.g. save a hash of the tag). You could also implement time-limits by including an expiration date. Perhaps something S-Key like might be applicable, if you want to stick to private-key methods? > - What we would really like is for the recipient to hit the "reply" button > and be able to send his mail back. Matt Ghio's remailer+62647629379278(a)wherever.com syntax does this fine. If desired, you could implement anonymous bit-bucket addresses this way as well, though they're somewhat more useful if your remailer generates encrypted outgoing messages. Alternatively, you can *always* generate either a real or a bit-bucket return address, and leave it up to the sender to inform the recipient that there's a probably-working return path. Bill

1 0

remailers for kids
by Carl Ellison 17 Dec '03

17 Dec '03

To: turet(a)u.washington.edu Subject: Re: K12 Personal Security Newsgroups: comp.society.privacy In-Reply-To: <comp-privacy4.52.6(a)cs.uwm.edu> In article <comp-privacy4.52.6(a)cs.uwm.edu> you write: > >Dear Netters: > >I recently have become involved in a project to implement Internet >feeds to some elementary/high schools. Actually, they already have the >feeds and the hardware, we're putting together a science/math >curriculum, also using Mosaic. I recently (re-)started looking at the >k12 newsgroups, which I haven't done in a few years, since my kids were >small. It struck me that there could be a possibility for abuse of the >system, for example in the 'chat' or 'pen-pals' groups and access to >names/addresses/phone #'s by those with less than salutory intentions. > >Does anyone else have any thoughts or experiences with this, and is >this an appropriate newgroup for this discussion? I hope I'm simply >being parental (fatherly) and not paranoid. > >I would like something like this to be a long thread, since I want to >explore this aspect of things before we just go head-long into the >network with the little kids and expose them to potential problems >later on. > >--Phil Turet >> turet(a)pmel.noaa.gov Funny you should ask this. I had a conversation just yesterday with a relatively new parent who is really scared about the Internet because it leaves kids exposed to wierdos. Rather than ask for elimination of anonymity for weirdos, he was asking for anonymity for the kids -- not just the e-mail address hiding of various remailers but also an automatic filter on postings to remove (or translate) names, addresses and phone numbers. I know of no one who has done anything beyond hiding e-mail addresses but that software exists, at least. (I've cc:'ed them here.) Perhaps some will have thoughts on the rest of the problem. - Carl -- Carl M. Ellison cme(a)sw.stratus.com RIPEM MD5OfPublicKey: 39D9860686A9F075A9A83D49589C677A Stratus Computer Inc. TEL: (508)460-2783 55 Fairbanks Boulevard ; Marlborough MA 01752-1298 FAX: (508)624-7488

1 0

Any cypherpunks building encrypted phone?
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Subject: Any cypherpunks building encrypted phone? > > Hello everyone! I'd like to know if anyone on the list has made >any attempt to construct a true encrypted phone, something at the >level of the AT&T DES phone. I think that it ought not to be too >difficult to build a couple, using existing modems and basic hardware >design. If all the commercial phones are going to be Clipper-based, >we'll have to build the real ones ourselves. > > Lady Ada, Queen of Engines I am working on that exact problem. It is not really that trivial. The encryption has to handle a lot of data real time. I have a license agreement for IDEA and am working on RSA. I am thinking of using tripple DES rather than IDEA because of the cost of the IDEA license. Two questions. One: Does anyone know of a good source of DES chips? Two: How much would you pay for a good encrypted phone? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLa4m2FVkk3dax7hlAQF4vwP+KppgEM/05FsVJoonnDQrLKcaRJxqvt8y CgJ5OgaFNwAdsJJyQ25SfxaaubP/Q/Ncz3os2ECdxFDGiVOk97tg6DvTfXA5QoSw hFYuKb+7W/KK455I8WdZkeX6O6T/cLDqe94pcJSLSKo2mqwuGUaZ3jdKLAthPtOE DjqkjZettOM= =34Dg -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

Re: Remailer Reply Blocks
by Graham Toal 17 Dec '03

17 Dec '03

From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> : Which is why my remailer uses 3DES and adds random padding to the : address before encrypting it. Random padding will thwart many chosen : plaintext attacks, especially if you do some transpositions prior to : encrypting it. Since the text to encrypt is so small, doing five or ten : consecutive DES encryptions with different keys would not use up much : CPU time, but could dramatically increase security. Also I compress the : address slightly by stripping off the high bits so that 8 bytes fit into : 7. Just a few suggestions to keep in mind... You beat me to it :-) I was going to suggest xoring the data with a set of random numbers (generated along with the des key) to shield it from known plaintext, but a few rounds of DES might do just as well. You have to do *something* because there's a known-plaintext '@' in every email addr. : Overall, looks pretty good. BTW, what's the number that it prepends to : your email address when you get a reply? The things I'd improve on it are the need to edit out the indentation when you use the header block in a reply, and that you have to move the block from the end of the file to the top. Either it should start out at the top, or the remailer should search the whole mail for it. On chaining reply blocks: I was wrong about them getting larger and larger as they went through remailers - you don't have to encode the ascii representation of the last remailer's block and then ascii encode that too - you could generate your block by first de-ascii'ing the last block, prepending the return address, and then re-ascii'ing it. That way the previous return addresses would contribute the same size of data in every link in the chain. One thing more has to be done to foil traffic analysis - the encrypted email address has to be padded out a lot so that they can't guess who it was by knowing the lengths of the email addresses of a small set of possible posters. Assuming we're already stripping out the personal names etc in email addreses and just keeping the canonical bits (for example "Graham Toal" <gtoal(a)gtoal.com> -> gtoal(a)gtoal.com then I'd suggest padding with spaces to something like 64 chars, then going up +64 each time for those X400 idiots who might want to post through us :-) That way you won't be able to tell a 128-byte long name from 2 hops of a 64-byte short name. G

2 1

fake pgp messages
by hh＠xcf.Berkeley.EDU 17 Dec '03

17 Dec '03

in the process of doing stuff to fight traffic analysis, i need to generate a bunch of fake pgp messages. it is possible to asciiarmor random bits, but this is pretty easy to spot. does anyone know a good way to generate a large amount of bogus pgp messages? e

4 3

Number Theory
by Matt Thomlinson 17 Dec '03

17 Dec '03

Peter Murphy writes: >... > >and see the major number theorist in this department, Dr. Keith Matthews. >He is a really nice guy, and is always interested in writing and/or >distributing programs for number theory calculations. He even showed me >one of his newest programs, and demostrated it by factoring 2^71 -1 for Is this really that impressive? MapleV and my 386dx-20 just factored it into 212885833 * 48544121 * 228479 in a matter of 23 cpu seconds. >he teaches, and could I post it to the list. Voila! Not only did he have >it printed out on paper, but he also mailed me the relevant LATEX files. way cool. thanks for the legwork.. >{Textbooks: Number Theory} >... >N. Koblitz, "A course in number theory and cryptography", QA3.G7NO.114, Speaking of who .. he's at my university. :) Nice guy; one of the people who offered to help me with the remailer situation last year. Funny thing; last year the computer administrators wouldn't even allow a copy of PGP to reside on their systems -- now it is part of their public account (student-run officially University unsupported software, usable by all). >H. Shapiro, "Introduction to number theory", QA 241.S445 1983, this isn't the Hawk Shapiro..? >D.E.R. Denning, "Cryptography and Data Security", Addison-Wesley, 1982, > QA76.9.A25D461982 sigh. mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

3 2

Aliases (general case)
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

Actually, it is legal to use an alias for any number of things, including the phone book, *_so long as the purpose is not to defraud_*; thus, using Mother Teresa Charities might be so construed, while using Sam Jones probably would not be. There are prohibitions against using false ID...driver's lic., passport, and so forth...but not against using an alias. This is all after consultation with my attorney... As a side note, it is possible in Texas to file an "assumed name" at the courthouse of the county(ies) wherein you plan to do business...costs about $15, including the notary fees, and lasts 10 years. You can have almost anything for a name....and what would be more natural than having your new "business name" in the phone book? Nice, legal...and cheap (except a business line is a bit more expensive). Can this be done in other states? Regards, Dave

2 1

Re: Banyan vine use by US Marine Corps...
by Jim Franklin 17 Dec '03

17 Dec '03

I don't know how I got onto this list, or many others to which I seem to suddenly belong, but I'd be eternally grateful if you removed me from this one. thanks, jim

1 0

Re: Black Net
by Graham Toal 17 Dec '03

17 Dec '03

: Does anyone actually believe Blacknet exists this is about the umpteenth time : I have heard about some kind of Blackmarket internet traders that are very had : to find. It sounds like something out of that Gibson book "Virtual Light" : Reuben Halper I guess there's a lot of new people on this list :-) Why don't you post something here with this key then... [wasabi.io.com] -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCPAixusCEAAAEEAJ4/hpAPevOuFDXWJ0joh/y6zAwklEPige7N9WQMYSaWrmbi XJ0/MQXCABNXOj9sR3GOlSF8JLOPInKWbo4iHunNnUczU7pQUKnmuVpkY014M5Cl DPnzkKPk2mlSDOqRanJZCkyBe2jjHXQMhasUngReGxNDMjW1IBzuUFqioZRpABEB AAG0IEJsYWNrTmV0PG5vd2hlcmVAY3liZXJzcGFjZS5uaWw+ =Vmmy -----END PGP PUBLIC KEY BLOCK----- Type bits/keyID Date User ID pub 1024/A19469 1993/08/15 BlackNet<nowhere(a)cyberspace.nil> 1 key(s) examined. See what sort of reply you get. Heh heh heh. G (Tim, don't go to bed early tonight, you might be getting some mail...)

1 0