December 2003 - cypherpunks-legacy

No Subject
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

alk.politics.guns.usenet(a)decwrl.dec.com Subject: [ANON] War: How Secure? Reply-To: john.nieder(a)tigerteam.org Bcc: v043948(a)stortek.stortek.com Bcc: mike(a)hopper.itc.virginia.edu Bcc: ricky_g_williamson(a)aud.alcatel.com Bcc: donb(a)netcom.com Bcc: johng(a)rosevax.rosemount.com Bcc: magnum(a)cs.umd.edu Bcc: sybok(a)athena.mit.edu Bcc: brunner%lakota(a)icarus.ssd.loral.com Bcc: kolju(a)cc.lut.fi Bcc: dan(a)hopi.dtcc.edu Bcc: justice(a)mcs.com Bcc: cypherpunks(a)toad.com Bcc: alt.privacy.usenet(a)decwrl.dec.com Bcc: charles.martin(a)f217.n125.z1.fidonet.org Bcc: walter(a)netcom.com Bcc: martin.greifer(a)f216.n914.z8.rbbs-net.org [[Reply-To: john.nieder(a)tigerteam.org]] [Please note that I wrote a 70+ line response to your message last night, but was hit by an hour long power outage which destroyed the post before completion. Perhaps this is Pacific Gas & Electric's divine method of remonstrating such excessive casting of pearls before swine, but this is probably a question for theologists. It also prevented me seeing or taping _Kids in the Hall_, which was the greater tragedy. What follows is an abbreviated recreation from memory:] -=> Quoting Syoung(a)pecanpi.atl.ga.us to John Nieder <=- Sy> Imposing? Hardly. The Moderator gets to do that, based on the input Sy> of everyone who cares to write - you, me, and even Sarah Brady, should Sy> she care to participate. Note that the moderator censored my posts and that pro-anon netmail I received that was posted to the group did not appear. Sy> Well, considering that I make a very nice living in the field of data Sy> communications and security, I think I'll stand by my statements. :-) Sy> The folks interested in getting information about this don't even have Sy> to break Sy> the coding; in many cases, just being able to do traffic analysis may Sy> be enough. Keeping an eye on a handful of key systems could do it. I'm amazed that you are being paid good money for supposedly knowing about these things and do not know that the current generation remailers incorporate several different schemes for making traffic analysis virtually impossible at the remailer. The only thing that can be determined with any certainty is that an account sends or receives encrypted messages from a remailer. This isn't much to go on, especially considering that the messages are frequently dummies, may abort or split, do not correspond in size before and after entering the remailer and are remailed in random order at random times. Additional precautions against traffic analysis may be implemented at the originating and receiving accounts, by generation of artificial volume or by chaining. Sy> I don't contend that it would necessarily be easy, but it can be done. It's my opinion that no one short of the NSA can do it, but they are estopped by charter from most of such activities (not that this matters), could not do it economically or routinely and presumably have more important fish to fry in any case. It has been established by barium tests that the top level encryption and remailer tech is immune from law enforcement from the FBI down, barring physical security breach, tempest attack or user error. All of which is beside the point, namely that most users need only trivial anonymity adequate to protect their participation from being known to nosey employers, administrators and soforth. As I pointed out, remailers in a non-anonymous mode are useful for many people. Sy> I agree. In spite of your email address, it is obvious that you have Sy> no real experience or understanding of this arena. You'd be surprised. Really. In any case I would personally use other methods than remailers, particularly advanced steganography techniques, for the transmission of truly serious communications, if I had any. Sy> Concentrating on Sy> the supposed invulnerability of the encryption scheme, and ignoring Sy> the other methods of attack, like traffic analysis, is the mark of a Sy> rank amateur. Indeed! Note that no one I know does, certainly not the Cypherpunk principals, and I never said they did. |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| | <john.nieder(a)tigerteam.org> * CP2A * PGP Key # E27937 on all servers | |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| |"If you love wealth better than liberty, the tranquility of servitude | | better than the animating contest of freedom, go home from us in | | peace. We ask not your counsels or arms. Crouch down and lick the | | hands which feed you. May your chains set lightly upon you, and may | |posterity forget that ye were our countrymen." -- Samuel Adams, 1776| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| |BOYCOTT: Pepsico <KFC - Taco Bell - Frito-Lay - Pepsi-Cola> & Gillette| |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| ---

1 0

Disguise_PGP_Ascii
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- It occurred to me that if we are going to be posting pgp'ed files to a newsgroups it might be best to remove the PGP headers and make the ciphertext look more text-like. So here is some code to do that, sort of. Basically I kept it simple so it's easy to read. To make this: - -----BEGIN PGP MESSAGE----- Version: 2.3a pgAAANL6C1+DERhOIhjtLQnEA0GZOnXmXa7xSqPTdX1Retrkn+CnnqkBrdGXQ/sO 9Gl+k4MjG/8991Erhl+cay+SBSKS+YoGNp79mwEnvwHICq/WsMs6lTo6GudHku/e 9gnXVHkYg5/lYbAWFLRnIMDhGpeeUqCEoG5vlhl++JMwzgc/lqGCwZAeUd+q5UXG bqm/sGAo80xtG2hs1LqLPP0lCoqSZ5cJkuNRJBgpm+r8P4PHijCLr9iAE4InFy+F otm+Ut8SDYbt8OjR9WPig8V7aYdp8x0= =i8Hu - -----END PGP MESSAGE----- turn into this: - --- --BEG IN PGP M ESSAG E ---- -.. Ver s ion : 2.3a .. .. pgAAA N L 6C1+ DER hO IhjtL Qn E A0G ZO n X mXa7 x SqP TdX1 Retrk n+Cnn qk Br dG XQ/sO ..9Gl +k4 MjG/8 9 91Er hl+ca y+SB SKS+ Yo GNp 79 m wEnv w HICq /W sMs 6lT o 6GudH ku /e..9 gn XVHk Yg 5/lY bAW FLRn IMDh Gp e eUq CEo G5 v lhl++ J M w zgc / lqGCw ZAe Ud+q5 UXG ..bq m/s GAo 80xt G2 hs1Lq L PP0lC oqS Z5c JkuN RJBg pm+r8 P4P H ijC Lr9iA E4 InFy + F..ot m+U t8 SD Ybt8O jR 9WPig 8V 7 aYd p8x 0=..= i8 H u..--- --E ND P GP ME S SAG E---- -.. type "st e < infile > outfile" And to convert it back type "st d < infile > outfile" ST.C: #include <stdio.h> #include <time.h> #ifdef MSDOS || __OS2__ #include <stdlib.h> // for exit() #endif void main(int argc, char **argv) { int i = 0, j = 0, k; char c; if (argc > 2) fprintf(stderr, "\nUsage: %s [e|d] < infile > outfile\n", argv[0]), exit(1); srand(time(0)); while (!feof(stdin)) { if (toupper(*argv[1]) == 'E') { k = rand() % 5; for (i = 0; i < k + 1; i++, j++) { if (!(j % 50)) putchar('\n'); c = getchar(); if (c == '\n') printf(".."); else putchar(c); } putchar(' '); } else if (toupper(*argv[1]) == 'D') { switch (c = getchar()) { case ' ': case '\n': break; case '.': if (i == 1) putchar('\n'); i = !i; break; default: putchar(c); break; } } else fprintf(stderr, "\nUsage: %s [e|d] < infile > outfile\n", \ argv[0]), exit(1); } } -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCcAgUBLdh1frhnz857T+PFAQH9RQQ2KC5uYfO8tLlq1X8PcmuJy0Akog84lyfK sYEiiwMHJsNm6/isVWvihZHBct/DuBkqtNsWXzwxl1rxlVvjTjOMyyDioidbfqnb IOWLXkY+/vzdvgxr/Z0tV31mwCVoCcHIMUeBZ9+PBCHt16YCEb7emPE0/QzLFWnB VNUSkSW+hYtP8Ezg1UoS =TESU -----END PGP SIGNATURE-----

1 0

D-H key exchange - how does it work?
by ecarp＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I browsed through the (SCANT!) documentation that comes with rsaref-2.0. I didn't find any decent programming examples, just a list of function calls, which is next to useless without sample code, but that's beside the point. If I understand D-H right, both sides generate public keys from their private keys, then just exchange public keys. Is that right? Or is there something I'm missing? - -- Ed Carp, N7EKG/VE3 ecarp(a)netcom.com 519/824-3307 Finger ecarp(a)netcom.com for PGP 2.3a public key an88744(a)anon.penet.fi If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever" -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLdkNCyS9AwzY9LDxAQFW9AP/YeQR0rrX6kfonzLPI5/5U6MB8Q8Uu01a C9y5y/U2rkYU5gYsAKiw9d4i0yFAiI3KyNWOamdr7aQMWMCOa8y6RPdfKQzuzREg h4KTjcflcZoffWP7JamboQUPAsOrNwHlumTVnI3cf30U0Zi5QxNHj9PlVupOOvQ4 dSO4Nv6LiG4= =icYy -----END PGP SIGNATURE-----

2 1

FBI decryption capability / MSDOS disk wipe question
by Black Unicorn 17 Dec '03

17 Dec '03

A few moments ago I uploaded a file called "hyperdsk.zip" to the soda (cwrc??) site in the incoming directory. My understanding is that this is a disk utility program with some encryption option. It is my hope that someone will take a look at the executable and try to discover what method of encryption is used. I suspect DES, but that is a wild guess without the slightest basis in evidence. Although I do not want to comment more specifically on the list just yet, an evaluation of the method and strength of the executable will go a long way to answering questions about the capabilities and resolve of federal law enforcement in cryptanalysis. Unfortunately the executable offers no basic text documentation. (I assume it is instead "online." As I am a mac user, these are unavailable to me. I hope that some diligent MSDOS 'punk will take a look and see what can be seen. In addition, I was hoping someone could provider a pointer to a robust and aggressive disk wipe utility. Something with varied triple wipe, or "DOD" spec overwrite (which isn't really DOD spec at all) would be nice. -uni- (Dark) -- 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

2 2

Who did win???
by ER CRAMER 17 Dec '03

17 Dec '03

I read a message that the 'american' had won the 'RSA war'. I think the loose. Because we can still send private messages to the states with PGP 2.3a but they can't sent private messages out of the states... So, really? Who did win??? ... If you outlaw Privacy, only the Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ --------------------------------------------------

1 0

PGP 2.6
by dave.hodgins＠canrem.com 17 Dec '03

17 Dec '03

********** Original From: DAVE HODGINS * CARBON * To: ALL * COPY * Date/Number: 05/17/94 - Not Yet Posted ********** On: CRS - 5207 - U-AltSecurPGP ----------------------------------------------------------------------- In response to a request, to have canrem.com added to MIT's list of Canadian sites, I've just received a response indicating that pgp 2.5 has been removed from the MIT servers. The message states that PGP 2.6 will be released, probably next week, after a new release of rsaref is out. The new version will be "upgraded", to be incompatible with earlier versions, in order to protect the patent rights of rsadsi. Regards, Dave Hodgins. cc: ALL in 6525 on CRS ALL in 1139 on CRS --- * RM 1.3 00820 * Internet:Dave.Hodgins@Canrem.com Rime->118 Fido(1:229/15)

1 0

Re: Fixing pgp 2.6
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 6:19 PM 5/16/94 -0700, Hal wrote: >First, note the strong hint in Schiller's message about operators of >key servers who accept pre-2.6 keys being guilty of contributory >infringement of the RSA patent. I think we can expect strong legal >pressure from RSA to shut down the remaining U.S. key servers, even >those which don't use illegal versions of PGP. They succeeded once in >shutting down the key servers which used PGP; they will succeed again >in shutting down the others due to the contributory infringement threat. Presumably this won't affect the non-US keyservers. I don't see the people running said servers bowing into pressure about a patent that doesn't affect them.... >For the same reason, hopes of getting a non-RSA-approved "2.6a" (hacked >to be backwards compatible with 2.3) widely available in the U.S. are >not well founded. FTP sites which hold programs or even patch files to >allow 2.6 to interoperate with 2.3 will be targetted by RSA as >contributory infringers. In short, the legal advantages PGP 2.6 will >have over unapproved versions will be strong enough that it will be >widely used in the U.S. The thing is, though, that PGP 2.5 *doesn't* infringe on the patent, because of the use of RSAREF. Any version that uses RSAREF should be legal from that patent sense. Presuming that there aren't copyright issues involved with the 2.5 release, I don't see any reason that code couldn't be maintained and fixed. I'll have to check the copyright status on 2.5 when I log on. There are many people, including myself, that won't get involved with an infringing version of PGP. PGP won't get "wide" acceptance until the isssues are resolved. At the same time, PGP also won't get "wide" acceptance unless it is interoperable with the outside world. This would involve code using RSAREF coming legally into the US and being used, or code using RSAREF being illegally shipped outside of the US. Apparently, the latter has already happened. But either way, for PGP to be noninfringing in the US, it needs to use RSAREF. I'm guessing that the new version of RSAREF they announced would be coming out will probably alter the terms to make this difficult/impossible. However, I don't believe there is any requirement we use the latest version of RSAREF... Just to use the license that comes with that version of the code. Bob -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

2 1

(none)
by cdodhner＠indirect.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <2r9h97$oro(a)nyx10.cs.du.edu>, Alex Strasheim wrote: > > I have been reading nothing but complaints ever since the planned release > of 2.6 was announced. With good reason. It's a bullshit product. > It is true that messages generated with 2.6 won't be decodable with some > earlier versions, including 2.3a. And most likely 2.4 as well, although that's a horse of a different color. > It is also true that 2.6 can't be exported with RSAREF code. Not quite. It's not *legal* to export it. But to say that it "can't be exported" is simply untrue. It "can" be exported, and easily at that. However, I doubt there will be much demand for it, in or out of the us. It is slower than 2.3a, has unreasonable limits on keysize, and is not backwards compatable with the versions much of the world uses. > This means that it will not be possible, at > first, to use 2.6 to correspond with users who are not in the US or > Canada. Or with users in the usa or canada who choose to use 2.3a. (and possibly 2.4 as well? Any confirm or deny on this one?) > But this will be a temporary condition. There are precedents for > exporting code into which foreign users can plug their own crypto > engines. This is probably what will happen with PGP: programmers > outside of the US will develop code which duplicates the functionality of > the RSAREF engine, and a non-US version of PGP, functionally equivilant > to the American version, will be made available to users who don't have > access to the US version. A total waste of time. Any 'foreign users' who wish it will be able to get a copy of 2.6 in short order. But that's still not going to change the fact that it's not a worthwhile program. > The word to describe what has happened is "compromise". The PGP > developers, along with MIT, were able to reach a compromise with RSADSI > and PKP. Yes, they had to give some things up. But in exchange, they > were able to secure the right to legally distribute, for free, an open > source version of PGP in the USA. The word to describe what has happened is "disaster". It is a deliberate attempt to fragment the international crypto community. > This is an enormous victory. It is the end, in practical terms, of the > struggle to put strong, verifiable, and affordable crypto software into > the hands of the general public. It's over, and we have won. It will be "over" when I can use whatever encryption I choose to protect my communication, without the requirement of government of corperate 'approval' to avoid "legal trouble" > The thing that bothers me the most about the complaints which have been > posted is that they are implicity, if not explicity, condemnations of the > compromise which PRZ and MIT negotiated. I _explicitly_ condemn the _decisions_ of whoever wrote the damn program to: 1)disallow keys bigger than 1024bits 2)remove backwards-compatable operation > I think that PRZ deserves the > benefit of the doubt. He's the one who has put himself on the line for > the rest of us, and he's the one who is most responsible for raising > public awareness of crypto issues. I'm not suggesting that we follow him > blindly; but at the same time, if he thinks this is a good deal, that > ought to carry a lot of weight. I have not yet heard prz's position regarding the limitations on pgp version 2.6, however if he supports it I simply disagree with him. Happy Hunting, -Chris ______________________________________________________________________________ Christian Douglas Odhner | "The NSA can have my secret key when they pry cdodhner @ indirect.com | it from my cold, dead, hands... But they shall pgp 2.3 public key by finger | NEVER have the password it's encrypted with!" cypherpunks WOw dCD Traskcom Team Stupid Key fingerprint = 58 62 A2 84 FD 4F 56 38 82 69 6F 08 E4 F1 79 11 - - ------------------------------------------------------------------------------ A government mandante for key-escrow encryption in all communication devices would be the information-age equivalent of the government requiring private citizens to quarter troups in their home. --David Murray PGP NSA ViaCrypt Phrack EFF #hack LOD/H 950 FBI MindVox ESN KC NUA murder QSD Hacker DEFCON SprintNet MCI AT&T HoHoCon DNIC TRW CBI 5ESS KGB CIA RSA Communist terrorist assassin encrypt 2600 NORAD missile explosive hack phreak pirate drug bomb cocain payment smuggle A.P. bullets semi-auto stinger revolution H.E.A.T. warheads porno kiddiesex export import customs deviant bribe corrupt White House senator congressman president Clinton Gore bootleg assasinate target ransom secret bluprints prototype microfilm agents mole mafia hashish everclear vodka TnaOtmSc Sony marijuana pot acid DMT Nixon yeltsin bosnia zimmerman crack knight-lightning craig neidorf lex luthor kennedy pentagon C2 cheyenne cbx telnet tymenet marcus hess benson & hedges kuwait saddam leader death-threat overlords police hitler furer karl marx mark tabas agrajag king blotto blue archer eba the dragyn unknown soldier catch-22 phoenix project biotech genetic virus clone ELINT intercept diplomat explosives el salvador m-16 columbia cartel -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdiuIuKc9MdneB1xAQFwfQP/THNlr7lcPK1ZtF1dFqdM8yw+RJE2q+C6 tScuiBduZAGBhKlOpx8yUnFr76FV8v76bhCzR4NJNMY4ybm/xpU+UBVg/gp5CB/S 8WAGE3w6FIHYBxHxxHDNtyvwzC8ySCBU47CWDhGXgXbx4kBnr7EBKv6s+x3d9GtX 0hu4XzlNqR4= =yZ4m -----END PGP SIGNATURE-----

2 1

Penet ID allocated
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

daemon(a)anon.penet.fi Mon May 16 10:39:28 1994 > You have sent a message using the anonymous contact service. > You have been allocated the code name an98437. > You can be reached anonymously using the address > an98437(a)anon.penet.fi. Obviously I'm not going to send anon mail through penet! I guess this is a response to my post to the list yesterday, so someone must have subscribed with their anXXXX address. ------------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! -------------------------------------------------------------------------------

3 3

Sun to leave US over Clipper?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

In "Superchip bugs US companies," an article on Clipper by Adrian Berry reproduced from The Daily Telegraph, the author says that big companies are threatening to move their headquarters overseas at a cost to the government of billions of dollars in lost tax. "Without this initiative, the government will eventually become helpless to defend the nation" says Louis Freeh, director of the FBI. ... Foreign buyers want nothing to do with any hardware that might contain Clipper. ... Many computer companies are talking of leaving America. Trusted Information Systems, a Maryland-based encryption firm, has started a subsidiary in Britain [to avoid US ITAR restrictions] ... "I can't estimate the sales we're losing through Clipper, but they could be worth hundreds of millions of dollars," said [Scott] McNealy, [CEO Sun Microsystems]. McNealy added "The new rules may force us to leave. If we don't leave, we just don't grow." Not clear what "new rules" McNealy's talking about. ITAR's been around a long time, maybe it's just beginning to affect them? DT II? Clipper's not yet a "rule"... ------------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! -------------------------------------------------------------------------------

1 0