December 2003 - cypherpunks-legacy

FWD: Encryption for Newton
by plaz＠netcom.com 17 Dec '03

17 Dec '03

An interesting tidbit for those who are watching out for Newton Encryption and Privacy solutions: > From: R._Braithwaite-Lee(a)magic-bbs.corp.apple.com > Newsgroups: comp.sys.newton.misc > Subject: Encryption for Newton > Date: 31 May 1994 14:13:24 -0500 > Organization: M A G I C > Hello: > > On June 1, 1994, CustomWare of Toronto will be releasing a freeware newton > application called "nCrypt". nCrypt provides "strong" encryption for newton > objects including notes and names. > > The freeware version of nCrypt will provide password protection for newton > objects and is intended for use as a personal privacy utility. A commercial > version to follow will also implement "public key" protocols for digital > signature authentication and key distribution similar to PowerTalk, > RIPEM/SIG, PGP and RIPEM. > > nCrypt also suppports "drop in" encryption modules for adding compatibility > with other encryption systems. > > Interested developers may contact CustomWare about writing encryption > modules or for testing their apps with nCrypt for compatibility. The > algorithms used by nCrypt will be made available in a technical note for > review. There may even be another of those cash prizes for breaking the > system... > > Contact Reginald Braithwaite-Lee or Andrew Bartle: > > Compu$erve: 73114,2055 > Internet: 73114.2055(a)compuserve.com (temporary) > Telephone: +1 416 410 0675 > Facsimile: +1 416 932 8304 > AppleLink: CUSTOMWARE > SnailMail: 1111-200 Dufferin Street, Toronto, ON, Canada, M6K 1Z4 > > Regards, > Reginald !:-) > > Public Key Fingerprint: D8 B8 C1 D0 DD 56 20 B4 06 A2 81 83 87 E8 8B 64 > (Send message with subject "HELP" to pgp-public-keys(a)pgp.ox.ac.uk) _______________________________________________________________________ Geoff Dale -- Cypherpunk/Extropian -- Plastic Beethoven AnarchyPPL - Anarch (Adjudicator) ExI-Freegate Virtual Branch Head plaz(a)netcom.com 66 Pyramid Plaza plaz(a)io.com Freegate, Metaverse(a)io.com 7777 "You don't greet Death, you punch him in the throat repeatedly as he drags you away. I think John Wayne said it best when he said, 'Fuck Death and the lung cancer he rode in on.'" - Denis Leary

2 1

Sternlight infested version of pgp26
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

The pgp26-RSAREF_3.0_beta.tar.gz file is not real. From some other post, it seems this came from the site in Italy that I mentioned awhile back. They have removed the file from there. It is a lot of bytes for a joke. It should probably be removed from soda too. -- Vince > pwd /alex/edu/berkeley/soda/pub/cypherpunks/pgp/pgp26 > ls -NOT_FOR_EXPORT pgp26ui-src.tar.gz pgp26uis.zip pgp26-RSAREF_3.0_beta.tar.gz pgp26ui-src.tar.gz.sig pgp26uix.sig pgp26.zip pgp26uis.sig pgp26uix.zip > gunzip -c < pgp26-RSAREF_3.0_beta.tar.gz | (cd ~/tmp; tar xvf -) gunzip: stdin: not in gzip format > strings pgp26-RSAREF_3.0_beta.tar.gz WANTED FOR NET.TREASON: |\/\/\/\| | | | (o)(o) C _) OFFICER David Sternlight | ,___| Net.Police | / a.k.a. PROUD _0--------/\/----\/\-------0_ DICK OF / /0 \----/ 0\ \ THE INTERNET / | \ \||/ / | \ / /|STERN || POLICE|\ \ _/_____/ ||LIGHT] || | [#] || \_____\_ |_______/ |\____/ || \__*_/| \_______| > ll pgp26-RSAREF_3.0_beta.tar.gz -rw-r--r-- 1 alexsrvr 567791 May 25 00:20 pgp26-RSAREF_3.0_beta.tar.gz

1 0

PGP 2.3 vs 2.6 outside the US
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Jeff Barber <jeffb(a)sware.com>: > While creating a 2.6-like version from 2.3a seems a worthy goal, this > supporting argument is flawed. The original PGP was written in the USA > and, never having received the proper export approvals, must have been > "illegally exported." Isn't Phil Zimmerman being "investigated" by a > grand jury for this even now? So, it would seem to me that a bulletin > board carrying any version of PGP holds illegally exported software (wrt > US law). How does 2.3a differ from 2.6 in this respect? 2.0 to 2.3a were developed outside the US, released in New Zealand and the Netherlands, and _imported_ into the US. While a version of 2.3a in India, say, need not have come from the US, and hence does not indicate an ITAR violation somewhere, the version of 2.6 in Italian sites got there only because they were illegally exported from the US.

1 0

Is DES exportability context-dependent?
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

I don't have my "Applied Cryptography" handy, but this keyboard's here in front of me always ready :-) Lets say I rigged up a "signature" system that cranked the message through a DES or 3DES engine in CBC mode, and used the last value as the signature (or something like that; whatever makes the most sense). In that context---as a signature algorithm---would DES be exportable? It's been demonstrated that something developed as a signature algorithm but later adapted to encryption purposes remains exportable, right? What about going the other direction? -- | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

2 1

NSA breaks Russian PRNGs with neural networks??
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

tcmay(a)netcom.com: > An interesting article by Seymour Hersh is cited below. It says that > NSA had transcripts of the 1991 coup plotters (and presumably other > Russian leaders) and that Bush passed these on to Yeltsin to warn him. A recent article from the Daily Telegraph, another British paper, went on about the possible encryption techniques used by the Russians. It described how reused one-time pads led to the unmasking of Fuchs, the Rosenbergs, Philby et al. Then it suggested that the method the NSA broke was based on (presumably weak) PRNGs, a stream cipher. It suggested that the NSA might have developed techniques to find patterns in PRNG outputs through neural networks, or genetic algorithms!! While the latter sounds like crap to me, even though I've worked with and believe in the power of neural networks for amazing pattern recognition, unless the PRNGs were _really_ weak, I'm skeptical. I don't think the Russians are fools, and in these times one doesn't rely on secret weak algorithms for crypto, not when there are publicly well known strong ones. Humint? Maybe. The Atlantic Monthly will carry a story on the NSA-Yeltsin thing in June. It would be nice if someone posts it here. -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Fairness to Game Animals Association says: Support your right to arm bears! --------------------------------------------------------------------------

1 0

Cypherpunks' Electronic Book 4
by Gary Jeffers 17 Dec '03

17 Dec '03

Cypherpunks' Electronic Book (CEB) 4 Martin Janzen suggests using World Wide Web (WWW) to support & distribute the CEB. I am not at all familiar with WWW but hopefully its good. My concern with this distributed organization is that CEB could be controlled by the Cypherpunks' List & that all additions & changes to CEB would be refereed. No unauthorized changes would be made. As for updates, the point of CEB is to be made up of the most recent knowledge. People concerned with an area of electronic privacy & making contributions to the CEB would naturally update the CEB whenever they ran into new developments. People who wanted to read the CEB would be assured that by the nature of the CEB, what they found there would be the latest & the current best. Martin suggests that the CEB could be on several servers. I would suggest, then, that they be on different servers by chapter. Referees who are interested in particular chapters could maintain & administer that chapter. This could mean very little administration by Eric Hughes (cringe). For those who are kindly offering their archives of Cypherpunks' list, they are not needed now, but if & when the CEB gets established, it would be good to have your names on the CEB as archivists. Yours Truly, Gary Jeffers

1 0

Re: Cypherpunks' Electronic Book 4
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

An important frustration from this electronic age: Information moves so easily now but people move no more quickly than before. Changes to CEB should not be a continuous process. Changes need to happen slow enough and in meaningful enoug chunks that someone other than the author can keep up. I think this means digests of the changes, digests which are readable in their own right--not mechanical diffs--should both detail *and* summarize for those who recently read the old copy. Refereing might dove tail nicely with keeping the whole thing stable enough to be usable. -kb, a Kent with a thick enough protective coating of ignorance to avoid most of the work... -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 28:15 hours of TV viewing so far in 1994!

1 0

Re: Privacy at Dunkin Donuts
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Hidden microphones at Dunkin Donuts Hey, all this time we've been worrying about cops spying on people. Now _we've_ got a way to listen to _them_ :-) .....

1 0

Re: Cypherpunks' Electronic Book 3
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Well, you've got an opportunity for a Learning Experience, then :-) Assuming you've got access to a Unix machine you can run things on, it's not hard to set up procmail or majordomo or the old, simple, reliable netlib stuff that ran the netlib(a)research.att.com (and maybe still does?). Since you're posting from MIZZOU1, you're at least behind a mail server run by somebody else, so I'm not sure how much control you have..... If you want to roll your own crude mail-reply system on Unix, it's really not hard, using some simple shell programming and the sed batch editor equivalent to "ed" and the : commands of vi - when you receive a mail message, you stick it in a file, then use sed or whatever to find the "From:" line so you know who to send it back to, and lines that look like your command set (e.g. "get foo"), stickthe appropriate stuff into a mail message and send it back. If you want to do all this on DOS, well, good luck :-) Look at teh tools you've got available for handling mail, and get yourself a copy off Eudora or Waffle if you don't have either of them. Then you're on your own. BIll

1 0

Re: IMP (was Re: ecash-info (fwd))
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > 1.) Chaum's e-cash coupled with WWW/Mosaic is a de facto internet > > mercantile protocol. It ain't de facto until a lot of people are using it. I suspect PGP with credit card numbers in free-form ASCII is almost as common, at least for now; there are 4 or 5 groups I've seen that will accept that. And phone calls or faxes to the number on the bottom of the ad on Usenet probably outmumber those... In particular, digicash isn't a standard until there's at least one bank a lot of people can access via digicash. However, it's certainly a nice approach. Credit cards do take care of one of the objections Hal mentions, which is how you can trust your vendor to ship you the goods instead of absconding with your cash. Some of the digicash protocols can help with that process, at the cost of privacy - the spender can reveal the number of the coin that was ripped off, but the receiver may have cashed it via anonymous remailers, making it difficult to prove who's telling the truth in court, especially when the goods were software delivered by anonymous remailer chains as well. Bill

1 0