December 2003 - cypherpunks-legacy

Re: Unicorn suit
by Blanc Weber 17 Dec '03

17 Dec '03

>From Uni: Again, it is not my responsibilty to guard myself against defamation. <intermediate statements skipped> I should be able to conduct business, without interference, in peace, with whomever, whenever, whatever, and however uptight, as I choose. ................................ But who will guard you against defamation when you insist on doing business so indiscriminately, wouldn't you say that you bear a bit of responsibility for the kind of associations you engage in which could endanger your reputation? If you were doing a furniture business deal with third-world drug lords (you never know!) and they suddenly declared you to be a scum-bag lawyer who was really a double-agent spy working with the DEA, could you expect much success in taking them to court for accusations which besmirched your reputation? Guess you could try, huh. Many things are possible, although somewhat difficult to achieve. Blanc

1 0

Re: Official Anarchism
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort in reply to the question: > is there an official Anarchist codicil? What makes one an official anarchist? Official Anarchists are issued an official certificate (suitable for framing). . . . ............................................ I have one of these, stamped on my forehead. It's in invisible ink, but somehow collectivists can always read it, and react as expected. Blanc

1 0

on detectability of PGP versions
by hughes＠ah.com 17 Dec '03

17 Dec '03

The issue has arisen of whether displaying some particular version number of PGP on the inside of messages or signatures implies that one is using that version number. How could it? The format that one bit of public software makes can be duplicated by another. If there are two bodies of code which produce the same output, an external observer can make no decision as to which one was used if the only evidence were one of format. If, however, there were only one piece of code (say PGP 2.6), there would be a statistically valid judgement that a 2.6 version number indicated a 2.6 use. Let's say we want to avoid that. I'd suggest that a future derivation of the 2.3a code base or the as-yet-mythical 3.0 code base use the version number in the PGP formats (both binary and ascii) as format version numbers, and let the version numbers of PGP proper diverge. To make it really convenient, the config file might have a version_output flag which indicated what kind of message to generate. There's no good functionality reason why such a PGP shouldn't write post-Sept. 2.6 messages, 2.3 messages, 2.4 messages, even non-PKCS 2.2 messages. Ditto for reading and verifying all those kinds of messages. Could anybody really tell the difference? Eric

1 0

PGP 2.confusion
by Robert A. Hayden 17 Dec '03

17 Dec '03

I guess I'm sorta confused. 2.3x cannot 'legally' be used in the U.S., and it seems that the release of 2.6 is motivated in part so that U.S. users of 2.3 can become "special friends" of the RSA goonsquad. Yet, 2.6 cannot be used by anyone outside of the U.S./Canada. So what is the solution that will be legal, secure, and useful for the whole world? Do we (the cypherpunk community) perhaps need to come up with EBP 1.0 (Even Better Privacy) that abandons the RSAREF patent problem with some other public-key system that is functionally equial and just as safe? Sorry, I'm babbling, but as I said, I do not relish the thought of becoming a special friend of RSA's lawyers. (Or worse, what if 'exporting' a digital signature violates ITAR and makes you a very special friend of an over-ambitious federal district attorney?) ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> I do not necessarily speak for the \/ Finger for PGP Public Key <=> City of Mankato or Blue Earth County -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Re: PGP 2.confusion (fwd)
by Robert A. Hayden 17 Dec '03

17 Dec '03

This was sent to just me by mistake, and I'm forwarding with permission of Jay. ---------- Forwarded message ---------- Date: Fri, 27 May 94 21:26 PDT From: Jay Prime Positive <jpp(a)jpplap.markv.com> To: hayden(a)krypton.mankato.msus.edu Subject: Re: PGP 2.confusion Date: Fri, 27 May 1994 23:49:55 -0500 (CDT) From: "Robert A. Hayden" <hayden(a)krypton.mankato.msus.edu> Do we (the cypherpunk community) perhaps need to come up with EBP 1.0 (Even Better Privacy) that abandons the RSAREF patent problem with some other public-key system that is functionally equial and just as safe? EBP would have to provide the two critical functions of PGP -- digital signatures, and key distribution. There exist signature standards other than RSA. Perhaps the USA's DSS can be exported. If not, there may well be other systems out there. Feel free to implement DSS, or others. But the critical problem seems to be encryption. Or more exactly the key distribution problem. How do I and my secret corespondant share a secret key? I only know of four kinds of solutions. Send the key via a secure channel. Secure chanels are hard to find, and as history teaches us, not fully secure. (Read Kahn for instance.) Use a trusted key distributer. Trusted. Ha. This is cypherpunks list. Public key cryptography. The problem is that PKP (or is it RSADSI?) claims pattent rights to the whole PK ball of wax. The Diffe Helman key exchange (oblivious transfer?) pattent will expire the soonest, and it can be used in the future. The really exciting result, IMHO, is from crypto 92 that I mentioned a while back. If A and B can hear a source of bits S with some errors, then they can generate a shared secret which even an eves dropper with much greater (listening) resources can't discover. This is exciting. Is it pattented? Does it work on the internet? I don't know. Unfortunately all of these suffer from various active tapper attacks. More unfortuneately, on the internet active tapping isn't very hard to arrange. If you can come up with aditional solutions, or ones more resistant to active tappers, please publish. j'

1 0

Quantum Computers
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

Ken Kirksey writes > lost in the discussion on quantum computers and cryptography. Can > anyone give me the Reader's Digest Condensed Version (TM) of the > theory behind quantum computers, or maybe point me to a good journal > article or two? Many thanks, No readers digest version. It is very heavy going, and any simplified version is necessarily misleading. The key articles are D. Deutsch, Quantum Theory, the Church--Turing Principle and the Universal Quantum Computer, Proc. R. Soc. Lond., Vol. A400, pp. 96--117 (1985). E. Bernstein and U. Vazirani, Quantum Complexity Theory, Proc. 25th ACM Symp. on Theory of Computation, pp. 11--20 (1993). Set aside a long time for understanding them. If your quantum theory is weak, you will need to brush up on quantum theory first. --------------------------------------------------------------------- We have the right to defend ourselves and our | property, because of the kind of animals that we | James A. Donald are. True law derives from this right, not from | the arbitrary power of the omnipotent state. | jamesd(a)netcom.com

1 0

Re: PGP 2.confusion
by ghio＠andrew.cmu.edu 17 Dec '03

17 Dec '03

"Robert A. Hayden" <hayden(a)krypton.mankato.msus.edu> wrote: >Do we (the cypherpunk community) perhaps need to come up with EBP 1.0 >(Even Better Privacy) that abandons the RSAREF patent problem with some >other public-key system that is functionally equial and just as safe? Sounds good to me... which public key system did you have in mind? :)

1 0

Re: Why it is legal to export PGP under ITAR
by Matthew.Ghio＠andrew.cmu.edu 17 Dec '03

17 Dec '03

Is there anywhere I can ftp a copy of the ITAR law?

1 0

Re: v2.6 for the rest of us
by Paul K. Strong 17 Dec '03

17 Dec '03

<nobody(a)shell.portal.com> wrote: >Or maybe you could just keep on using PGP 2.3a and stop worrying about it. Hey, I don't care if you Americans want to stick with v2.3a. I just thought that you wouldn't be able to add your v2.3a key to USA keyservers and would therefore move onto v2.6 (not to mention that v2.3a infringes RSA's patents and some people like to stay legal). The fact is some people will move onto v2.6 and I would like the ability to communicate with them. ***************************************************************************** * Paul Strong Fidonet: 2:254/438 (weekly mail check) * * * * pauls(a)dcs.rhbnc.ac.uk Finger for PGP v2.3a public key * *****************************************************************************

1 0

Announcement: PGP 2.6ui -- unofficial international release
by mathew＠mantis-consultants.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is to announce an unofficial release of PGP, based on 2.3a, modified for interoperability with MIT's PGP 2.6. The files are on ftp://ftp.demon.co.uk/pub/pgp/ 2.6ui-readme The file README.1st from the 2.6ui release. pgp26ui-src.tar.gz UNIX source distribution, compressed with gzip. pgp26ui-src.tar.gz.sig Detached signature for pgp26ui-src.tar.gz. pgp26uis.zip DOS source distribution, archived with Info-ZIP. pgp26uis.sig Detached signature for pgp26uis.zip. pgp26uix.zip DOS .EXE distribution, archived with Info-ZIP. pgp26uix.sig Detached signature for pgp26uix.zip. pgp23a-26ui.patch.gz Context diffs to go from 2.3a to 2.6ui, gzipped. I tried to upload to ftp.funet.fi, src.doc.ic.ac.uk and ftp.dsi.unimi.it, but the net seems flaky today. The following changes have been made from 2.3a: * Reads encoded data produced by both MIT PGP 2.6 and PGP 2.3a. * Writes data either in the "new" format used by MIT PGP 2.6, or in the old PGP 2.3a format. Option settable via a command line switch or config.txt setting. Default is old 'compatible' format. * No time-bomb code in it. If you want to switch version byte like MIT PGP does, you'll have to do it manually on September 1st. There's no advantage in doing so, unless you want it to look like you're running MIT PGP. * You can choose the version text which you want to have appear in ASCII armoured files. The default is 2.6, and if you're in the USA you probably don't want to change it, as a well known net.personality tends to harass people whose PGP armor says anything else. Again, this can be changed via command line or via config.txt. * Displays and accepts 8 characters of the key ID. Hence there's less chance of two keys having the same visible ID. * Makefile entries have been added for sunos5cc and sunos5gcc, for people using SPARC workstations running Solaris 2. I have personally tested the sunos5gcc build on Solaris 2.3, and it compiles cleanly. A line for NeXTstep Intel has also been added (next486). * The file idea68k.s has been removed, at the request of the author. It was obsolete. Better 68k routines are available; for example, suitable routines for the Amiga are available on Aminet. * A message has been added to the key generation section, reminding the user that MIT PGP 2.6 will only handle keys of 504-1024 bits. This version has no key length crippling, however. * Memory allocated with _fcalloc and freed with _ffree in ztrees.c and zdeflate.c, to avoid memory leakage in the MS-DOS version. * The -w option wipes files with pseudo-random data, to try and ensure the file is wiped even if you're using a disk compressor. Note that this still isn't perfect; DOS can randomly duplicate bits of cleartext files in partially-used clusters, and those fragments won't be removed if the original file is wiped. * Branko Lankester and Paul C Leyland's patches have been applied, so that newer key certification signatures automatically replace older ones. This also fixes a bug in the display of new keys with multiple signatures. This version was assembled by mathew <mathew(a)mantis.co.uk> from the standard PGP 2.3a sources, and from source code patches obtained from the net. All patches were scrutinized carefully before being applied by hand. No binary patches were used. The DOS executables were built by mathew using Microsoft Visual C++ version 1.0 (MS C v8). No RSAREF source code was used; in fact, I used no source code from MIT PGP at all. I haven't even looked at the MIT sources. (No, really.) Thanks to those anonymous individuals who tested the program against MIT 2.6... Disclaimer: This software is nothing to do with Mantis Consultants, and is without warranty or guarantee of any kind. Using it in the USA is probably very naughty. If you have any patches to fix bugs or add features, feel free to mail them to me, and I'll consider adding them to any future unofficial release. mathew <mathew(a)mantis.co.uk> -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLeYh7HzXN+VrOblFAQFYFAP6Ar+1OKDoUg/5A0p6ZljmP/9Z3IZIx797 NPi2/ELLhZyWWCcsrhLxxPgux4+5WEJ2+FlK0FM10UlWFy7FuieXCWwprMM8Ug0A zfpAdxrQP4F7r0lozM2c8HFOtsse2ISxLOsNcObfgSCBfJKBu9c1nJ0/VvnJ42nA EA/vG3KwgyI= =FDlY -----END PGP SIGNATURE----- -- Seeking a decent bug-tracking system for Windows, DOS, UNIX, Mac... http://www.mantis.co.uk/~mathew/

1 0