December 2003 - cypherpunks-legacy

Re: Authentication vs encryption: CPs on the web
by Amanda Walker 17 Dec '03

17 Dec '03

> I notice that the people who come to this topic from an > institutional point of view tend to be more interested in > the authentication aspects. > This seems to fit better into the control-oriented mindset. > With authentication you can track what people are doing > better; non-repudiable signatures could actually work in some ways > against the signer. I think that may be one reason Phil Zimmermann > is famous for not signing his messages. :-) But encryption can > actually work against institutional interests (compared to individual > ones) by making it harder to keep track of people's activities. Very much agreed. This is why, in my description of the rough criteria I sent out, I included mention of self-signed certificates (which only show that you do in fact have the private key corresponding to a given public key), bare keys, and so on. There clearly needs to be facilities for encrypted anonymous use. To expand on my example of wanting sales literature to be signed so I know it's genuine, I correspondingly *don't* want to include a certificate with identifying information in my own query--I get enough junk mail already, and I don't want vendors to be able to capture market research at the browsing level (I haven't looked at WIRED's server for precisely this reason). Amanda Walker InterCon Systems Corporation

1 0

RE: Winsock & PGP Integration
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Except one. What all of these agents have in common is that they > interface with the Windows Sockets API to establish TCP streams > that are used in the POP and SMTP protocols. Since these are well > known and standardized protocols, this gives us our toehold. > >How might an interposed winsock DLL recognize what high level protocol >it was going to spoof? Getting the port number will be a very good >approximation, but I'm not convinced of its reliability. Well, it could be done "by definition." Let's say I tell my Eudora that the SMTP and POP address to use is 192.0.0.1. I can now configure my spoofing agent that when there is an attempt to establish a TCP stream on port 110 of 192.0.0.1, I can be assured that it is the mailer trying to retrieve mail. Likewise for mail delivery (and news, spoofing NNTP, though this is probably an order of magnitude more complicated than just mail.) >As to the general issue of MSWindows v. Unix, the Unix predominance >for remailer software involves the fact that Unix is on the bulk of >the machines connected to the Internet. It's more reliable for >offering network services than MSWindows and it's got a cleaner >architecture for reconfiguration. None of these explanations, >however, means that there won't be more MSWindows that Unix boxes for >a long time. Of course. Unix was around long before DOS/Windows gained market dominance of the personal computing market. And for automated encryption on that platform, premail seems to do a great job (though there are some features I'd like to see added, Raph). The unfortunate thing I think is that Unix/X-Windows has never gained a foothold in the "consumer" market. - From a marketing perspective, if we are trying to "sell" strong crypto use to the "masses", then it is only prudent to assess where these types of products would be deployed. And the two platforms that will entirely make up the personal computing market will be DOS/Windows95 and to a lesser extent, OS/2 Warp. This was a subject brought up at the last Cypherpunks meeting (by Tim, I think.) For fifteen years we have had some pretty sophisticated theoretical models of strong cryptographic techniques. Some of these, such as PK encryption, have reached the "masses" in the form of PGP. Others, such as digital cash, have been mired in implementation issues. It is frustrating to read about and listen to lectures on advanced cryptographic subjects (such as all the great presentations at the last meeting), knowing that it may be years before this "theory" makes it into "practice." I will be happy when cryptography is as ubiquitous on a PC as screen savers. ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu3ksU1Diok8GKihAQFyXwQApqXdcRfM7cV2EeRbrB6xMDXwJwWSFl5i 3gwTwDkZ8omK/9N+R9gLx4V6CcpPo7kku+GfUy7dkj4wDYtLTZ7m2sZ+mvg0FJNS 3LUSOKC911LpGj9m7uUcFKF+OsthO7WDz5Xtk5AMUTK26Uo0W4lOxBgOTrdiCdDx q3rYla9+ueU= =TL0Z -----END PGP SIGNATURE-----

1 0

Re: Clarification of my remarks about Netscape
by Amanda Walker 17 Dec '03

17 Dec '03

> I didn't bother imbedding the RSA Unaffiliated User CA because I > didn't think server operators would use it to get certificates. Well, it's what Apple is using for PowerTalk signers (which are a key pair and X.509 certificates, by default from the Unaffiliated User PCA). It makes sense for personal (as opposed to organizational) servers, such as someone running MacHTTP for their home page... On the other hand, if RSA has set up a server PCA, that should be suffcient for now. I wonder what the certification policy is, though--how do you prove that you control a given server? For an Unaffiliated User CA certificate, you just have to show a notarized application and two forms of ID, one with a photo (driver's license, passport, etc.). I can't off hand think of an equivalently strong way to ID control of a server... Amanda Walker InterCon Systems Corporation

2 1

Legal implications of a PGP DLL
by bshantz＠spry.com 17 Dec '03

17 Dec '03

I know this has been hashed over recently, but I never found out (or don't remember) what was decided in regards to the legal implications of a PGP functional DLL for Windows. If a company (i.e. SPRY, wink, wink, nudge, nudge.) were to write a PGP DLL and make it publicly available, would that be legal? Viacrypt just straight out charges too damn much to make it worth licensing. So, if a company wants to make it's mail client PGP friendly, but not actually supply the encryption algoritm, etc. Would a DLL be legal if it were in the public domain? >>>>>>>>>>>>>>>>>>>>>INTERNETWORKING THE DESKTOP<<<<<<<<<<<<<<<<<<<<<<< Brad Shantz bshantz(a)spry.com Senior Software Engineer SPRY Inc. Direct #: (206)-442-8251 316 Occidental Ave. S. Main #: (206)-447-0300 Suite 316 Fax #: (206)-447-9008 Seattle, WA 98104 WWW URL: http://WWW.SPRY.COM ---------------------------------------------------------------------- PGP Public Key at: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or email: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET bshantz >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

3 3

Re: Winsock & PGP Integration
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Seems to me that the UNIX model of building one mail transport >instead of 20 is a good one. If you seperate out the UA from the >transport, you make it easy to fix or update the transport. I agree. > So I would suggest, rather than hacking at Winsock and >hoping to catch the right protocols, build a set of libraries that can >be called by programs. smtp.dll, for example, would be a mailer that >any mail program could call. nntp.dll would handle news, underneath >all the various interfaces. If you want to pretend to be premail, you >do it in smtp.dll. This is of course much closer to the ideal way of doing things. However, the original motivation for this project was that in order for all existing Winsock based mail agents (except for Zmail, it looks like now) to add crypto/anonymity to their functionality, some work has to be done to change them. The system I came up with to spoof Winsock would be (hopefully!) transparent, in that it would work with _existing_ mailers _today_. To go the route you outlined, while in the long run a much more sensible way of doing things, would require the same sort of effort on the part of the current mail agents, i.e., they would need to change. Your suggestion is one I would like to follow up on; in the mean time, I am going to make an attempt at the spoofing idea. > The advantage to other programmers is that they no longer have >to do the low level stuff that they had to before. It allows >programmers build whats interesting, namely, the interface & gizmos. Hehe. It's the user interface I hate doing the most! > Make the package do the user interface side of things, and >make a seperate package to do the network protocols. Makes building, >testing, and changing things a lot easier. And while you're at it, >store all of your files as text. :) Nah. Variable bit sized binary records work well enough :) ======================================================================= Johnathan Corgan "Violence is the last refuge of the incompetent" jcorgan(a)netcom.com -Isaac Asimov PGP Public Key: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html Or send email to: pgp-public-keys(a)pgp.ai.mit.edu Subj: GET jcorgan ======================================================================= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu4cV01Diok8GKihAQEQqwP/T1XQPJYPHyVZWB3sAO1Fl8TdgikW+I/6 1/XnNitgm7WwwUdadGFx0gVEzbmwN0yRbwntKV/M8wuYG+0oQ2NPBBSoBDMbUYqR OmIjUDg7P+v7X4Ga4B6MLeca6bemxYGT+Jv3F4xTQrohyUyNc+zMBR6CPWrv5d7g NQzIeTsIn/M= =Tagz -----END PGP SIGNATURE-----

1 0

Re: archiving cpunks
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- > I'm working on a system that indexes,marks up, and serves up html versions > of E-Mail lists. It's still very alpha stuff. cypherpunks is in the > tryal part of system I call the Biblotech. All URL's that come through > the system are also indexed... [...] > Would anyone be against me doing such a thing? alowing anyone to > view the c-punks list via html etc... The list is public and has been archived before (and maybe still is, I'm not clear on the point). Hence I don't see any grounds for objecting to your project. - - -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLu4dtmf7YYibNzjpAQFkNwP/XCHjzLX8Y5VCPTsDRMnP+sc41Koe7acQ RDfT6Ojgb/Fb6rtYiBjn9aSIu57kza5rSYjVmaKljM06p2QptZ2M1Jz9jxU7rfNk BHVJSAc2Y+kbu0KqVzAVgx4o5GC41BnCoJiB9/l8iWvIgkO5pvSHTO3LlrgD15+6 kjlS5fq664Y= =nr2r - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu4gTCoZzwIn1bdtAQHk1wF/XY0PbJjkuOia/lUi+11GsSFVODQLM6b1 lPEF38ufdFM157KPVWX4HI0ry7Wxr+Sm =W21x -----END PGP SIGNATURE-----

1 0

CHOMSKY MADNESS!!!
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- James Donald writes: > One may be a reasonable inference, as I inferred > that Chomsky sought to justify mass murder and > brutal terror. The other is a lie. Hey Eric, how about a filter that delays all messages to the list which mention Chomsky by a month or so ? - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLu4kpCoZzwIn1bdtAQHgDgGApDSD7Z+FZW+ykNEO8WujOFnDUhbyxSnv tyb0ZVY8mnVjmookxn19UVE8iRbLZQKU =Rwt7 -----END PGP SIGNATURE-----

1 0

Re: Fundamental Question?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

> Although I understand the need for remailers for anonymity, is it > not true that the whole idea of encryption (good encryption, that > is) is that no matter who gets the encrypted text, it really doesn't > matter? Does this not mean that something like USENET is *perfect* > for this? Usenet may be provide good untracability for the recipient, but the if the sender desires untracability she needs to use a remailer or some other service to get the message into Usenet. Also, the recipient needs to know if and where to look for the message. If the recipient isn't anticipating the receipt of a message untracably, or doesn't care if 'they' know she is receiving the message, then Usenet isn't necessary. andrew

1 0

Clipper Revived?
by jltocher＠CCGATE.HAC.COM 17 Dec '03

17 Dec '03

From Edupage: REPLACEMENT FOR CLIPPER AT&T and VLSI Technology Inc. will collaborate to develop microchips that use a triple-strength version of DES (data encryption standard), which previously had been rejected by the National Security Agency. VLSI is the designated contractor to make the government-favored Clipper chips, but this latest announcement reveals their doubts over whether there's a market for the Clipper. "These companies have basically made the determination that Clipper is dead and there's going to be the proliferation of encryption anyway, so they might as well take advantage of it," says one observer, who predicts the market for such technology "could reach hundreds of millions" of dollars in annual sales by the end of the decade. (Wall Street Journal 1/31/95 A3) John L. Tocher THE CITY-a bounded infinity. A labyrinth where JLTocher(a)Earthlink.net you are never lost. Your private map where every PGP: CE 72 1A 11 07 47 35 block bears exactly the same number. Even if you 35 9A C1 DE EA 64 21 BC 94 lose your way, you cannot go wrong. --Kobo Abe

2 1

Re: Fundamental Question?
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- In article <199502011911.OAA09754(a)bwnmr5.bwh.harvard.edu>, Adam Shostack <adam(a)bwh.harvard.edu> wrote: > Its awfully expensive to send messages all over creation so >one person can read them. Much better to send it to the person who >wants to read it. Besides, USENET propagation can be slower than >remailers; the far ends of the chain can often take around a week. 1. Let's have some perspective here. Remailer traffic can't really be expected to exceed the traffic in, for example, alt.binaries.pictures.erotica. Additionally, with USENET it's trivial to control when are whether you receive particular groups. Don't want to carry alt.anonymous.remailer.channel? No problem. Don't. 2. USENET propogation is not that slow; Between well connected sites (IE, just about any Internet host that isn't swamped for other reasons like Netcom frequently is) I haven't seen a larger lag than a few hours. The biggest reason to use remailers is not to avoid interception of traffic: that's a trivial problem with PGP. The biggest threat is that of traffic analysis: Alice doesn't want her boss Charlie to know she's having an ongoing discussion with Bob about a new "career opportunity." As I've said, I think USENET is perfect for this. Add some reordering to the processing and a hidden way to define the intended recipients and no way that passive traffic analysis is going to succeed. - - -- Todd Masco | "Schooling serves to reduce the risk of being eaten." cactus(a)hks.net | - Scientific American, June, 1982 Cactus' Homepage - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLy+w1xNhgovrPB7dAQFjcgQAqc6eu22NAB8wE5iAyyGMTFbwlXLbiHF0 FUmJlWXQ4J8EkPXEa+ZUKGlcbCETjQ2rXxzHh3cOiVxjRVnKKh5Q/VmU4JOALPXE lBIfH+W8ty0LxaXBue9KkXh4cFvoehW7UXhq9oitNgSqiTmf/EoCbjJc5A7w7YHd Aqu7sgyyPFQ= =4UNd - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLy/p3CoZzwIn1bdtAQGkNgGAtR+F+nkckmLHgvrlurrHsGng24kdBu4R 20AwntDjdEcZjNHAqrc/aCf8TKVhUUJV =o09G -----END PGP SIGNATURE-----

1 0