December 2003 - cypherpunks-legacy

MIT PGP Announcement (fwd)
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

FORWARDED MAIL ------- From: netcomsv.netcom.com!martigny.ai.mit.edu!bal ("Brian A. LaMacchia") Date: 05 May 94 Originally To: toad.com!cypherpunks MIT has just officially announced the upcoming availability of PGP 2.5. The announcement was just made at Networld+Interop '94 in Las Vegas by Jeff Schiller, MIT's Network Manager. The text of the actual announcement is available via WWW at http://www.media.org/. Look under "MIT PGP Security Announcement." WHAT WAS WRONG WITH 2.2? Damn programers can never do anything right the first time? -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

1 0

Forwarded mail... (fwd)
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

FORWARDED MAIL ------- > TO SUMMARIZE.... > > Let the gov't do the clipper. Pre-encrypt all data transmission before the clipper, so they can't read/see/hear/smell/touch it. What do you people think... > I thinkl as long as it doesn't have bayonet lugs or an attachment to launch grenades then you are OK. NOT, if they mandate a form of crypto as voluntary, they will with in a few years make it mandatory. Then you will be breaking the law and rocks at the federal prison. Distribute crypto to the masses (You remember? THE DUMN FUCKS THAT DOEN'T KNOW WHAT AN FTP IS) and make them on your side with political announcements in the program ZIP -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

2 1

Re: Keyserver service outage
by Graham Toal 17 Dec '03

17 Dec '03

: Not true. The problem is copyright, which is honored by Berne Convention : signers even if they don't have software patents or patent-after-publishing : rules like the US. This includes Europe, the U.S., and many other places. : ViaCrypt 2.4 is copyrighted by ViaCrypt, and RSAREF is copyrighted by RSA, : so you won't be able to use 2.5 source outside the US either; not sure about : binaries. : There's an easy cure for this, though - if some non-North-American wants to : write an RSAREF-compatible software package in C and distribute it as freeware, : then it can be used in non-US versions of things that require RSAREF. You misunderstand what the RSAREF stuff does - it isn't an alternative encryption - it's being used to replace the extended precision etc stuff in pgp to make a 100% compatible version. So the current pgp *is* already 100% compatible, as long as its version number is >= 2.4 (which by an amazing coincidence mines happens to be since I've had to edit a couple of mission-critical comments since I got 2.3a ;-) ) Even if 2.5 checks version numbers or *any* internal details in the pgp packets, as long as it is constrained by being compatible with ViaCrypt 2.4, we can always *guarantee* to be able to make a compatible free pgp based in 2.3a. And since the RSA and IDEA patents aren't valid in Europe, this is 100% kosher. You guys use MIT-PGP and we'll use free pgp 2.5 G

3 2

Lady Ada's Cryptophone
by Hal 17 Dec '03

17 Dec '03

Lady Ada writes: > - -- Diffie-Hellman for key exchange > - -- Triple DES for data encryption > - -- RSA for digital signatures/identity verification > > Rationale: > Unlike encryption protocols designed for email, > a phone system will need to exchange public keys > bidirectonally at the beginning of every call, and > the existance of an insecure two-directional link can > be assumed. Diffie-Hellman is perfect for this application. > The alternative, RSA, would require either generation of > new keypairs at call time, which is very slow, or the Diffie-Hellman can be quite slow as well, depending on the size of the exponents. It involves calculating x**y, twice, where x and y are about 512 to 1024 bits. Some variants have the exponent yl be smaller, around 140 bits, but if strong primes are used for the modulus the exponent will be large like this. And the Chinese Remainder Theorem speedup used by PGP when RSA signing would not be applicable here. So calculating a DH key exchange could take many times longer than an RSA signature by PGP. This takes about fifteen seconds on my old PC; doing a DH key exchange might take a minute. > Each phone shall have a button (hard or soft) > which can be pressed by the caller at any time. Pressing > it will cause a new TDES key to be generated and exchanged. > [Should it generate a new n and g for D-H, or just create > a new x and demand a new Y?] Paranoid users can press > this button every few seconds if they wish. (In my > humble opinion, even a single-DES phone is quite secure > if it has this feature.) It might be possible to compute the DH in the background while the conversation is going on, but if the computer is also compressing, uncompressing, encrypting and decrypting at the same time, that's not going to be easy.

2 1

Bunch of Clueless Idiots
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

I see nobody mentioned the infringment of the second amendment by the assault weapons ban. These weapons cause 8.4% of the mortal wounds in commission of crime. Another piece of the constitution falls. Gee, what article of the constitution protects the right to cryptography? What are you going to do when they take it away from you. Probly nothing. The avereage person is definatly not as cool about cryptoghraphy as you are. But then again they probly are not as clickish as you are. You and your FTP site on Internet. Wow everyone knows about that. If they can not figure it out fuck em'. They are a "NEWBIE". You my friend are the ASSHOlE. To distribute to the masses is strenghth, not hiding behind some discussion of tackey dollars. Personly I think YOU are too stupid (OHHH I can program a computer) and lack the social skills to distribute crypto software to the masses. Any law probly would have a grandfather clause. Oh you say your grandfather died three years ago and you are working on revision X.YYY.Z of your latest greatest crypto software to worry about distribution. YOU PEOPLE ARE FOOLS AND HAVE TO MUCH SELF IMPORTANCE IN YOUR SMALL LITTLE HEADS, NOTHING EXISTS OF OF INTERNET! WRONG THE REAL WORLD DOES!!! BY NOT DISTRIBUTING TO THE MASSES YOU WILL LOSE (oh you can ftp to toilet.flush /urinal/cookies/). WHEN THEY TAKE YOUR PRESIOS CRYPTO AWAY, THEY WILL TAKE AWAY YOUR FIRST AMMENDMENT RIGHTS. (and it serves you right). FUCK IT NEVER MIND -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

4 3

Anybody else see eye-to-eye with Connie Chung tonight?
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

They had a segment on a "digital stalker" on Prodigy. Basically, a guy who kept getting anonymous Prodigy accounts with fake credit cards and then used the accounts to harass people almost like Detweiler. The reporter's attitude was disturbing however. His attitude almost seemed to be that Prodigy should read each and every private message to protect users from harassment. The whole segment is a foreshadow of how society will react when anonymous remailing becomes widespread. One more thing. The narrator seemed to imply that what we know as "flaming" should be controlled. For instance, the phrase "check your thorazine dosage" could be viewed as digital harrasment. It's a brave new world out there. Coming to your local cyberspace soon. -ray

2 1

IRS plans
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

>From: johnl(a)iecc.com (John R Levine) >Newsgroups: comp.society.privacy >Subject: What the IRS is up to Here's some excerpts from a speech by Coleta Brueck, Project Manager, Document Processing system, at the Internal Revenue Service, that she gave at the Computer Press Association Awards luncheon in New York on April 15th. I was at the lunch, but the transcript of the speech just arrived today. The ellipses are mine, but I think I'm not distorting what she said. She started by explaining that their current systems are functionally based on punch card systems from the 1950s, and they want to get more stuff on-line so that when you call with a question, the person at the IRS can retrieve a copy of your records while you're still on the phone. But then: "We should be able to provide you on-line access to that information. ... You will have the availability to know what your current account information is, very much like if most of us who have an American Express Card, you can call -- you don't really know where that 800 number goes, but what you do know is when that person answers your call, they have your complete account information. ... They can give you information on your account, they can update your account, or they can provide you futuristic looks into your account as to where you might be next year, even, for filing tax returns. We've often talked about, and this is the terminology that I used when I was in on a task group, we've talked about the "golden eagle" return. This is the golden -- or gold American Express Card return. At the end of each year, if you have an American Express Card, you get a gold account summary of what you've done for the year. ... Basically, what I say is that if I know what you've made during the year, if I know what your withholding is, if I know what your spending pattern is, I should be able to generate for you a tax return so that I only come to you and tell you, 'This is what I think you should file for the next year, and if you agree to that, then don't bother sending me a piece of paper.' ... But I am an excellent advocate of return-free filing. We know everything about you that we need to know. Your employer tells us everything about you that we need to know. Your activity records on your credit cards tell us everything about you that we need to know. Through interface with Social Security, with the DMV, with your banking institutions, we really have a lot of information, so why would you, at the end of the year or on April 15th, today, do we ask the post office to encumber themselves with massive numbers of people out there, picking up pieves of paper that you are required to file? ... We could literally file a return for you. This is the future that we'd like to go to." Lest there be any doubt, she was entirely serious, and she clearly expected that that we'd all think this is as wonderful as she does. Regards, John Levine, johnl(a)iecc.com, jlevine(a)delphi.com, 1037498(a)mcimail.com

2 1

BANK: quite a bit of interest.
by Matt Thomlinson 17 Dec '03

17 Dec '03

I've had quite a few people ask for instructions for retreiving the ghostmarks I promised. Good to see that more people are getting involved. I'm more than willing to help people get going using the magic money implementations. I've just paid the winner of the sonics/nuggets pool. I'm offering 15 more ghostmarks to the person most closely guessing the spread of the sonics/nuggets game 5 on saturday. (as a reference, the winner this time was only within 14 points of the spread!) You need not have your client installed to enter the pool. I have a feeling that within the next few weeks we're going to see more and more items available via ghostmarks/tacky tokens/bakuins. Get set up now so you can participate later. Email for info. mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

2 1

Cypherpunks change bytes!
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I ought to be studying, but goofing off is more fun. I generated a test key with the binary distribution of PGP 2.3a for DOS. I then changed the byte at offset 2F688 in PGP.EXE from 0x33 (ASCII "3") to 0x34 (ASCII "4"), and the byte at offset 2F689 from 0x61 (ASCII "a") to 0x00 (null). The patched PGP.EXE identifies itself as "Version 2.4" in ASCII armor blocks and otherwise; the key generated with the "2.3a" version extracts as a "2.4" key after the patch. ViaCrypt PGP 2.4 for DOS can successfully read files encrypted with the patched PGP.EXE, and add keys generated under "2.3a" but labelled as "2.4" keys. I haven't done a lot of testing, but spot checks make it look like everything's fine. I don't see the point in forcing everyone to patch their binaries or recompile from source - does anyone else? Bidzos & Co. are certainly smart enough to anticipate this step. What's the catch? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLclzd33YhjZY3fMNAQGiDwP9HjSYfNfn4q/9L/BOqXluH06015x3YmDM gNPfg5T2lWcsYJyyx/tMnVWdtAnFENAFUB7zK5vNq+Y/tquKaE6kEuZeUzZz1o+k sOofUAR1Y+sUii4Fu8R2J7scNCDL2pjl/hIqAAfT0voHiexxOTR9uxCDeiWxz9w0 xpyuvJBLQq8= =G5Oq -----END PGP SIGNATURE-----

3 2

(fwd) What the IRS is up to
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

---------forwarded message---------

2 1