December 2003 - cypherpunks-legacy

Re: E-money Good or Bad?
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

>The following is not flamebait!!! Heh... Nice try. -j

1 0

Re: Is it happening already ?
by Hal 17 Dec '03

17 Dec '03

Here is my key. I just sent it to the keyservers. I hadn't had a chance to sign it with my secure key yet. Hal -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBNAy7bVn8AAAECAPRhqHLha5WFaFQw0/b1Wn8XCuHokjvbEeJbg5UPHs6fBE3i uZTmAY5aFqnFXOdNGackOOTYu3tEGcwsm07L0wEABRG0F0hhbCBGaW5uZXkgaW5z ZWN1cmUga2V5iQCVAwUQLt5K9agTA69YIUw3AQED0gQAoORH1weDQ+L2gefrRauI GLqDlNy0nJQDo5wgdJky5Pd7vUJalwxGuqnQG1QV+ejnRYEN7wEoYQRjv21tTos9 nbUtWAoINrEVjWHpG7AXIRNyoCJtket9mQ2jz9QNTD9Nt8JsedJlqLuT7RMLN1tb /cIYnrBCyuTCek4fRbTYkSU= =G3nF -----END PGP PUBLIC KEY BLOCK-----

1 0

More on ASIS...
by Ian Farquhar 17 Dec '03

17 Dec '03

I was told this morning that the ASIS post had been reposted to several other lists, including several social ones. Interesting... Anyway, there was a followup to the incident on the radio this morning (2BL, is anyone was listenning): Gareth Evans (Minister for Foreign Affairs) has announced that no documents were irretrievably lost in the fire, as everything which was lost in the fire was also duplicated elsewhere. In addition to this, the fire is being referred to the ACT coroner's office, as despite the original claim by the Federal Government that there were no suspicious circumstances, the Australian Federal Police have decided to do pursue this action. It is not clear yet whether this is a matter of proceedure, or whether suspicious circumstances are suspected. The government's original claim was produced with surprisingly little time for investigation, it has been noted. Ian.

1 0

Why nothing works <g> [Was: Mandatory sig workaround]
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Roy wrote in response to Tim: >Tim, just for fun, what tools would need to appear to make it possible >for you to sign your traffic? Maybe a description will inspire some of >the Macheads out there to get hacking. (the astute reader will note >that I'm not suggesting new tools to the erstwhile Mr. May, as has been >done so often in the past) There is no hacking in the world that could create the kind of tool that would be needed to satisfy Tim. What would be required to satisfy Tim can't be done and I think that most long time CP's are be well aware of that. We have had this discussion over and over for many issues (PGP, MIME,..) for the last two years. The problem isn't that there are no tools for Tim's Mac, the problem is that there is _no way_ to do all these things on Netcom's UNIX host. 1. Tim: "I can't do any of the new things you are proposing because I don't have the tools." 2. Some CP: "Just download your mail to your local machine and process it there. There are many great ways to automate this on a Mac." 3. Tim: "I don't want to have to download mail for processing. I want to be able to do it all on Netcom's machine." 4. Some CP: "Just run PGP on Netcom's machine and process the mail there.' 5. Tim: " Using PGP on a shared machine is a security risk." 6. Some CP: "Just use a low security key on Netcom to sign your messages." 7. Tim: "PGP on a timeshare is worse than nothing. It gives a wrong sense of security. " 8. Some CP: "Since you don't want to do it on the host and you don't want to do it on another machine, there is no way for you to do it." 9. GOTO 1. No, the above is not a quote of an acctual exchange, but rather an abreviated version of what I gathered from reading hundreds of messages and dozens of threads. YMMV, - --Lucky -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLt41vASQkem38rwFAQFNRwP8DjwJ37unGf27LscvTOCU699wvXvH/pEI kBdvRCHJNQbcerBc7SDwjgVJC3XaaIDlO1rqBfcZXZETOa/3EKnjFHiX0+6Kb0zo b1k2lTmzFG7su2biwkmYkI5TlYEM4/nTpq/vYjZ3Md5rjXm5wA+cJcfivJd8RdX6 fRwWq2QXerM= =z9wu -----END PGP SIGNATURE-----

4 3

PGP signing tools for Elm/Pine/nn
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recent comments re the signing controvery give me the impression that a repeat of this information might be useful. I apologize if this seems like a waste of bandwidth. I can't seem to find a copy of a tool to make .shar's (or whatever one calls them) so I've separated files with ===== markers. I have also uploaded a gzip'ed .tar of these files, plus a gzip'ed copy of the mkpgp.txt.uu document referenced below, to cypherpunks/incoming on ftp.csua.berkeley.edu. These scripts + a copy of PGP interface nicely with Pine or Elm and NN to sign/encrypt outgoing messages, and decrypt or signature- verify incoming mail. The four files below came with the PGP 2.3 distribution (under contrib/elm_nn); they were not included in the laster distributions. I don't know why. They still seem to work fine with the newer MIT-PGP stuff. The "mkpgp" script referenced in Michael Handler's message seems to work fine from inside Pine; but I mostly stick with Elm and nn, so haven't used it much. Again, sorry to use list bandwidth for this; I thought that these were already in the hands of most of the folks on the list but the last few days' messages make me feel uncertain about that. (And no, for the zillionth time, it's not great policy to use PGP on a machine where you're not root. Use a small key marked "unsecure" and get on with life. It won't protect you from root but it will protect you from Detweiler and other small-time annoyances.) ===== Michael Handler's message ===== From: Michael Handler <grendel(a)netaxs.com> Subject: Interfacing PGP with Pine (Script pointer) Date: 25 Nov 1994 07:03:03 -0800 Message-ID: <Pine.SUN.3.91.941125094529.29026E-100000(a)unix3.netaxs.com> For a well written script to interface PGP with Pine: finger slutsky(a)lipschitz.sfasu.edu | pgp -f > mkpgp.txt.uu If you don't have finger access, mail me privately, and I'll send the file to you. Mike, who is only as elegant as his actions let him be - -- Michael Handler <grendel(a)netaxs.com> Philadelphia, PA Civil Liberty Through Complex Mathematics VoicePGP Development Team soc.support.youth.gay-lesbian-bi co-moderator ===== readme ===== To integrate PGP 2.1 with Elm and NN: 0) Make sure the path of Perl in the first line of each of the three files reflects the full path of this utility for your system. Also, make sure that the EDITOR and PAGER environment variables reflect your editor and pager of choice (vi and less will be used by default). 1) Put the files morepgp, mailpgp, and postpgp in one of the directories on your PATH. 2) Modify your ~/.elm/elmrc file to contain the following lines: editor = mailpgp pager = morepgp 3) Modify your ~/.nn/init file to contain the following lines: set editor postpgp That's all folks! Now, each time you post a message or reply to a message with nn, after you exit your editor, you will be asked whether you want to sign your message. Each time you compose a private message with elm, or reply to a message, and leave the editor, you'll be asked whether you want to sign and/or encrypt the message. When you browse a message, if it contains any PGP blocks, those will be properly interpreted. When you reply to a message containing PGP blocks, you'll have them properly decrypted and quoted in your editor. BUGS 1) You cannot encrypt messages that you mail from nn. You can only sign them. 2) When you reply to a PGP-encryted message, the encrypted message is temporarily kept on the disk, which is a security hole. 3) The temporary files are not wiped out, they are just deleted. 4) The scripts are ugly, reflecting my lack of knowledge of Perl. In fact, I don't know Perl at all; I hacked somebody else's scripts. If you know Perl better then me, please feel free to improve the scripts and don't forget to mail me a copy of the improved version. I can be contacted as Vesselin Bontchev at bontchev(a)fbihh.informatik.uni-hamburg.de ===== mailpgp ===== #!/usr/bin/perl ($visual = $ENV{'VISUAL'}) || ($visual = '/usr/ucb/vi'); $topgp = 0; $blanks = 0; $paragraphs = 1; $blankcompress = 1; $name=@ARGV[$#ARGV]; umask (077); open (INPUT, "<$name"); open (OUTPUT, ">${name}.rply") || die "Cannot open ${name}.rply for output.\n"; while (<INPUT>) { if (!$topgp && !m/^> -----BEGIN PGP .*-----/) { if (m/^> *$/) { if ($paragraphs) { if ($blankcompress) { if ($blanks == 0) { print OUTPUT "\n"; $blanks = 1; } } else { print OUTPUT "\n"; } } else { print OUTPUT; } } elsif (m/^ *$/) { if ($blankcompress) { if ($blanks == 0) { print OUTPUT "\n"; $blanks = 1; } } else { print OUTPUT; } } else { print OUTPUT; if ($. == 1 && !m/^> /) { print OUTPUT "\n"; $blanks = 1; } else { $blanks = 0; } } } if (!$topgp && m/^> -----BEGIN PGP .*-----/) { $topgp = 1; $tmpfile = "${name}.pgp", unlink ($tmpfile); open (TMPFILE, ">$tmpfile") || die "Cannot open $tmpfile for output.\n"; } if ($topgp) { $_ =~ s/^> //; print TMPFILE $_; if (m/^-----END PGP .*-----/) { $topgp = 0; close TMPFILE; $clrfile = "${name}.clr"; `pgp $tmpfile -o $clrfile`; open (CLEAR, "<$clrfile") || die "Cannot open $clrfile for input.\n"; print OUTPUT "-----BEGIN OF PGP DECRYPTED TEXT-----\n\n"; while (<CLEAR>) { if (m/^$/) { print OUTPUT "\n"; } else { print OUTPUT "> "; print OUTPUT; } } close CLEAR; unlink ($clrfile); unlink ($tmpfile); print OUTPUT "\n-----END OF PGP DECRYPTED TEXT-----\n\n"; } } } close OUTPUT; close INPUT; unlink ($name); rename ("${name}.rply", "$name"); system ($visual,@ARGV); while (!$q) { print "Sign this message? [Y]: "; $q = <STDIN>; $q =~ s/[ \t\n]//g; $q = substr ($q, 0, 1); if (($q eq 'Y') || ($q eq 'y') || ($q eq '')) { push(@opts,'-st','+clearsig=on'); $q = "y"; } elsif (($q ne 'N') && ($q ne 'n')) { $q = ''; } } $q=''; while (!$q) { print "Encrypt this message? [Y]: "; $q = <STDIN>; $q =~ s/[ \t\n]//g; $q = substr ($q, 0, 1); if (($q eq 'Y') || ($q eq 'y') || ($q eq '')) { push(@opts,'-e'); $q = "y"; } elsif (($q ne 'N') && ($q ne 'n')) { $q = ''; } } if (@opts) { system ('pgp','-a',@opts,$name); if ($? == 0) { unlink ${name}; rename ("${name}.asc", "$name"); } } ===== morepgp ===== #!/usr/bin/perl # written by jason steiner, jsteiner(a)anwsun.phya.utoledo.edu, Jan 1993 # # if you use or make improvements to this program i would appreciate # copies of your modifications & your PGP public key. $|=1; $topgp=0; $logname = $ENV{'LOGNAME'}; $pager='/usr/local/bin/less -i -n -s -S -c -M'; $pager = $ENV{'PAGER'} if ($ENV{'PAGER'}); umask 077; open (PAGER, "|$pager") || die "Cannot open pipe to $pager.\n"; print PAGER "\n"; while (<>) { if (!$topgp && m/^-----BEGIN PGP .*-----/) { $topgp = 1; $tmpfile = "/tmp/.pgp.$logname.$$"; unlink($tmpfile); open (TMPFILE, ">$tmpfile") || die "Cannot open $tmpfile for output.\n"; } if (!$topgp) { print PAGER; } else { print TMPFILE $_; if (m/^-----END PGP .*-----/) { $topgp = 0; close TMPFILE; open (CLEAR, "pgp -f < $tmpfile |") || die "Cannot open pipe to PGP.\n"; print PAGER "-----BEGIN PGP DECRYPTED BLOCK-----\n"; while (<CLEAR>) { print PAGER; } close CLEAR; unlink($tmpfile); print PAGER "-----END PGP DECRYPTED BLOCK-----\n"; } } } close PAGER; ===== postpgp ===== #!/usr/bin/perl # written by jason steiner, jsteiner(a)anwsun.phya.utoledo.edu, Jan 1993 # # if you use or make improvements to this program i would appreciate # copies of your modifications & your PGP public key. ($visual = $ENV{'VISUAL'}) || ($visual = '/usr/ucb/vi'); system($visual,@ARGV); while (!$q) { print "Sign this message? [Y]: "; $q = <STDIN>; $q =~ s/[ \t\n]//g; $q = substr ($q, 0, 1); if (($q eq 'Y') || ($q eq 'y') || ($q eq '')) { push(@opts,'-st','+clearsig=on'); $q = "y"; } elsif (($q ne 'N') && ($q ne 'n')) { $q = ''; } } if (@opts) { $name = $ARGV[$#ARGV]; umask(077); open(INPUT,$name); open(HEAD,">${name}.head"); open(BODY,">${name}.body"); while (<INPUT>) { if (1 .. /^$/) { print HEAD; if (m/^From: / || m/^To: / || m/^Date: /) { print BODY; } } else { print BODY; } } close(HEAD); close(BODY); system('pgp','-a',@opts,"${name}.body"); if ($? == 0) { unlink($name); system "cat ${name}.head ${name}.body.asc > $name"; } unlink("${name}.head"); unlink("${name}.body"); unlink("${name}.body.asc"); } -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt5gen3YhjZY3fMNAQF1QwP+OETB9ibDTWxLJ3BWQsgG5tAIeSHgeWs7 cOasOVidSoHJ10LPbOjwfCP9mluUTpsWNzIXC3GRSh5QO0esOPubu5CsFUaouEo8 DwvAik5kxIUcztqry8ImktFY14UmLZDjHshN+2WU7yLNG0BBM4C2mfwqkKDN9ESX ZK2bJj2LVF0= =2toZ -----END PGP SIGNATURE-----

1 0

Eric's proposal has already helped!
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Eric's proposal to get us to use clearsigs has already done some good: It made me use the Mac PGP 2.6 ui clearsig feature for the first time. As many of you told me, my sigs don't check out. I didn't have that problem with other versions of PGP. I don't know what causes the trouble (the message that I send out is fine, the message I get back isn't), but I know that once I'll figure it out my tools will have improved :-) -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. "The very atmosphere of firearms anywhere and everywhere restrains evil interference - they deserve a place of honor with all that's good." <George Washington>

1 0

using us crypto sw outside usa
by Tomaz Borstnar 17 Dec '03

17 Dec '03

Hello! I was wondering what is the legal status for using rsaref ooutside usa. Is it legal or not? Also, what is the legal status of RC4 code posted to the net? Thanks, Tomaz

2 1

Cypherpunks@hks.net service
by cactus＠bb.hks.net 17 Dec '03

17 Dec '03

[This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.] -----BEGIN PGP SIGNED MESSAGE----- The cypherpunks(a)hks.net service is now available. It will sign any message sent to cypherpunks(a)hks.net with its (currently 384 bit) key and forward the signed message to cypherpunks(a)toad.com. The key for the server is: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQA9Ay7eB60AAAEBgOGkDzo6mkSp3G4W3EXwMWK8SrTVSmosuN5Y7Z2FdBS5uJ3o 1O0XNAwqGc8CJ9W3bQAFEbQuQ3lwaGVycHVuayBzaWduaW5nIGFnZW50IDxjeXBo ZXJwdW5rc0Boa3MubmV0Pg== =ajZM - -----END PGP PUBLIC KEY BLOCK----- I welcome any suggestions on the format of the message and the prepended message. - -- Todd Masco | "Roam home to a dome, Where Georgian and Gothic once stood cactus(a)hks.net | Now chemical bonds alone guard our blond(e)s, cactus(a)bb.com | And even the plumbing looks good." - B Fuller -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt5xMyoZzwIn1bdtAQEItQGAzXF0V/4buTcY9Ry0iGsiqjpq3o6jYRr7 E6QAlTsBd5Xy9k8v/ttlXcbEIHNLuhu8 =19Vo -----END PGP SIGNATURE-----

1 0

Re: public accounts / PGP / passphrases
by collsc＠snowbird.aud.alcatel.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > From owner-cypherpunks(a)toad.com Thu Dec 1 20:25:31 1994 > Date: Thu, 1 Dec 1994 21:18:55 -0500 > Subject: public accounts / PGP / passphrases > To: cypherpunks(a)toad.com > From: lmccarth(a)ducie.cs.umass.edu > X-Server-Version: Cactus-Serv 1.1 > Reply-To: cypherpunks(a)bb.hks.net > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1705 > Rather than assume that the "Reply-To:" field shown above is appropriate, I have Cc'ed your originating address as well. So, if you get two copies of this, you'll know why. > > Could someone please elaborate on the foolishness of using PGP with a > passphrase on a public machine (as I do) ? Am I wrong in thinking that my > secret key is useless to an intruder until she guesses my passphrase ? I > have no net access except via an account on a public machine, so I'm not > about to start storing my secret key elsewhere, but I'll change my passphrase > to <null> if it's irrelevant anyway. I just reviewed the PGP docs a bit and > Phil says "Nobody can use your secret key file without this pass phrase.", > which seems to contradict what many people on the list have said. > Postulate an unscrupulous sysadmin (or anyone who manages to get the password for 'root' via fair means or foul). Let's call him Charlie (since we know that neither Alice nor Bob would do such a thing :). Charlie could easily install a process which logs each keystroke you enter, thus capturing your passphrase in said log. Alternately, he could substitute a rogue version of PGP for the real version. This rogue version would function exactly like the real version (to avoid suspicion on your part), but would surreptitiously copy your secret key and passphrase into a log file. Admittedly, this kind of attack is far-fetched. As long as you are aware of the possibility, you are free to assess the likelihood of such an attack and proceed accordingly. - -- Scott Collins "Now, thanks to the computer revolution, many Alcatel Network Systems geeks make ten times as much money as you do." Richardson, Texas Canter & Siegel, the Green Card Lawyers -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBFAwUBLt8tgyoZzwIn1bdtAQFxDAF/Vu1A4jQ5R0hW2OODcMMPCjeCFZG0aRvB OJDeQZi5hBGAVjVk2QOeCZR//zWvp1lC =Rpnk -----END PGP SIGNATURE----- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address belonging to the signature and forwarded.]

1 0

Eric, please can you clarify
by Jonathon Fletcher 17 Dec '03

17 Dec '03

Eric, Can you clarify your intention for the list ? I'm a little puzzled by the alternatives that are flying about. You initially stated an intention to delay (eventually bounce) unsigned messages to cypherpunks list. A couple of posts back you talked about "This is an unsigned message" headers in messages. Are you intending to implement both of these, one of these, or one now and the other later ? What type of checking are you intending on signatures - just syntax or signature verification ? I apologize for asking for clarification, but I've lost the signal in amongst all this noise. -Jon -- Jonathon Fletcher, j.fletcher(a)stirling.ac.uk (X400: "/S=jf1/O=stirling/PRMD=uk.ac/C=gb/")

4 5