December 2003 - cypherpunks-legacy

Re: "Cyherpunks Named Official Signing Authority"
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 3:05 PM 12/01/94, Eric Hughes wrote: >WARNING: The following paragraph does not have direct relevance to the >issue at hand. It discusses servers which might verify signatures, >which my current proposal does not have in it. > >What I have realized in the interim is, that if a server is to verify >a signature, the server should sign not the message but rather the >signature. After all, the signature is what was being verified, not >any property of the message. The user can still detect message >alteration, by first verifying the sig-on-sig, and then comparing the >hash value in the original sig to a hash on the message. I echo Eric's warning, that I also don't mean this to have anything to do with the current thread. The benefit of having the list sign the entire message, is that even if people _don't_ sign the message themselves (assuming they aren't being requried to ;) ), there's still something left to sign. The list would be signing to indicate that, yes, this message did pass through cypherpunks(a)toad.com. Regardless of whether the author signed the message himself or not, completely different issue.

1 0

Re: FYI: Eudora and PGP
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

>I have heard from the (one of the?) author(s) of Mac Eudora, on another Just Stever Dorner. Eudora is his baby. >to support applescript) will be supported to. I still haven't figured out >if ViaCrypt MacPGP uses the same applescript suite as MacPGP 2.6ui, which >is the neccesary detail there. Currently, it does (according to a Viacrypt employee and one other person on this list). >Or at least consider this post a welcome reprive from the Mandatory >Signature Wars. Intentionally posting off topic, eh Jonathan? :) -j

1 0

How do *I* use PGP?
by TheElusiveMatthew 17 Dec '03

17 Dec '03

It has been my belief that there isn't an effective way for me to use PGP, but with all the hubbub, I thought it might be worthwhile to verify this. My internet access is through a personal account provided by my employer. It is on a machine used exclusively by employees of the University of Illinois (no student accounts). My primary access to this account is through my IBM xt (dos 3.3) at work. This machine is occasionally used by others and is outside of my control. I also use many of the public access Win/Mac machines on campus. I have no pc of my very own. Is there an effective way for me to use PGP? -- Matt Hewn <matthewn(a)uiuc.edu> -- Information is not knowledge; knowledge is not wisdom; wisdom is not truth. Truth is absolute.

1 0

Is it happening already ?
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I hope this is not the start of a trend toward meaningless signatures along the lines I mentioned recently. Hal Finney, who commands more respect from me than does anyone else on the list to date, has just started to PGP sign his messages to the list. However, so far they haven't been signed with a key I've been able to locate. AFAIK, he hasn't sent it to the list. Portal does not accept external fingers. I requested "GET Finney" from one of the key servers at MIT, but all I received was the remailer key I had before. Does someone else have Hal's key ? I could send him mail directly, but I'd prefer to get the key from someone else if it's out there (to learn from my mistake), or else raise this issue again if it's deliberately unavailable. - -L. Futplex McCarthy; PGP key by finger or server "Don't say my head was empty, when I had things to hide...." --Men at Work -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLt44O2f7YYibNzjpAQFBQwQAuN3BTSjJnZVnWgsu7WUvsw2ZnE336qqy dFJAkfV7Mdfds3+e3uyR4xHR73TG08lq5Scsohq5D7tOshndzyuVmvKKfRIgSifo hOVkIFuSNjM5Gphnbdcao8NccQMAkZ1CMWysqsI9kAQUBHEXHiUgjAtnsHw8pbL9 JW4GJoo3ADk= =8W2C -----END PGP SIGNATURE-----

1 1

Re: E-money Good or Bad?
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

>The following is not flamebait!!! Heh... Nice try. -j

1 0

Re: Is it happening already ?
by Hal 17 Dec '03

17 Dec '03

Here is my key. I just sent it to the keyservers. I hadn't had a chance to sign it with my secure key yet. Hal -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBNAy7bVn8AAAECAPRhqHLha5WFaFQw0/b1Wn8XCuHokjvbEeJbg5UPHs6fBE3i uZTmAY5aFqnFXOdNGackOOTYu3tEGcwsm07L0wEABRG0F0hhbCBGaW5uZXkgaW5z ZWN1cmUga2V5iQCVAwUQLt5K9agTA69YIUw3AQED0gQAoORH1weDQ+L2gefrRauI GLqDlNy0nJQDo5wgdJky5Pd7vUJalwxGuqnQG1QV+ejnRYEN7wEoYQRjv21tTos9 nbUtWAoINrEVjWHpG7AXIRNyoCJtket9mQ2jz9QNTD9Nt8JsedJlqLuT7RMLN1tb /cIYnrBCyuTCek4fRbTYkSU= =G3nF -----END PGP PUBLIC KEY BLOCK-----

1 0

More on ASIS...
by Ian Farquhar 17 Dec '03

17 Dec '03

I was told this morning that the ASIS post had been reposted to several other lists, including several social ones. Interesting... Anyway, there was a followup to the incident on the radio this morning (2BL, is anyone was listenning): Gareth Evans (Minister for Foreign Affairs) has announced that no documents were irretrievably lost in the fire, as everything which was lost in the fire was also duplicated elsewhere. In addition to this, the fire is being referred to the ACT coroner's office, as despite the original claim by the Federal Government that there were no suspicious circumstances, the Australian Federal Police have decided to do pursue this action. It is not clear yet whether this is a matter of proceedure, or whether suspicious circumstances are suspected. The government's original claim was produced with surprisingly little time for investigation, it has been noted. Ian.

1 0

setting up an non remailer
by Thomas J. Bryce 17 Dec '03

17 Dec '03

setting up an anon remailer To those who might know the answer.... I'm running a power mac here, and I have an ethernet port and my own IP address. To do email, I telnet to my University's unix system. I was thinking, this sort of arrangement might allow me to set up an anon remailer. Does anyone know if I can do this? If the technology is available? If there is a way to do this from a macintosh, I'd like to give it a try. Of course, I would ask the sys admins if necessary for permission. (i.e., if it can come straight to my IP address then it isn't necessary I assume). Thanks Tom

2 1

FYI: Eudora and PGP
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

I have heard from the (one of the?) author(s) of Mac Eudora, on another list, that full support for ViaCrypt PGP will be added to the commercial version of Eudora in the spring. And probably PEM support too. It's unclear to me when (if ever :( ) this will be added to the free version of Eudora, or if 2.6ui (the only free (although semi-legal) version of Eudora to support applescript) will be supported to. I still haven't figured out if ViaCrypt MacPGP uses the same applescript suite as MacPGP 2.6ui, which is the neccesary detail there. I found that exciting, and thought others might be interested in hearing it. Or at least consider this post a welcome reprive from the Mandatory Signature Wars.

2 1

PGP signing tools for Elm/Pine/nn
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Recent comments re the signing controvery give me the impression that a repeat of this information might be useful. I apologize if this seems like a waste of bandwidth. I can't seem to find a copy of a tool to make .shar's (or whatever one calls them) so I've separated files with ===== markers. I have also uploaded a gzip'ed .tar of these files, plus a gzip'ed copy of the mkpgp.txt.uu document referenced below, to cypherpunks/incoming on ftp.csua.berkeley.edu. These scripts + a copy of PGP interface nicely with Pine or Elm and NN to sign/encrypt outgoing messages, and decrypt or signature- verify incoming mail. The four files below came with the PGP 2.3 distribution (under contrib/elm_nn); they were not included in the laster distributions. I don't know why. They still seem to work fine with the newer MIT-PGP stuff. The "mkpgp" script referenced in Michael Handler's message seems to work fine from inside Pine; but I mostly stick with Elm and nn, so haven't used it much. Again, sorry to use list bandwidth for this; I thought that these were already in the hands of most of the folks on the list but the last few days' messages make me feel uncertain about that. (And no, for the zillionth time, it's not great policy to use PGP on a machine where you're not root. Use a small key marked "unsecure" and get on with life. It won't protect you from root but it will protect you from Detweiler and other small-time annoyances.) ===== Michael Handler's message ===== From: Michael Handler <grendel(a)netaxs.com> Subject: Interfacing PGP with Pine (Script pointer) Date: 25 Nov 1994 07:03:03 -0800 Message-ID: <Pine.SUN.3.91.941125094529.29026E-100000(a)unix3.netaxs.com> For a well written script to interface PGP with Pine: finger slutsky(a)lipschitz.sfasu.edu | pgp -f > mkpgp.txt.uu If you don't have finger access, mail me privately, and I'll send the file to you. Mike, who is only as elegant as his actions let him be - -- Michael Handler <grendel(a)netaxs.com> Philadelphia, PA Civil Liberty Through Complex Mathematics VoicePGP Development Team soc.support.youth.gay-lesbian-bi co-moderator ===== readme ===== To integrate PGP 2.1 with Elm and NN: 0) Make sure the path of Perl in the first line of each of the three files reflects the full path of this utility for your system. Also, make sure that the EDITOR and PAGER environment variables reflect your editor and pager of choice (vi and less will be used by default). 1) Put the files morepgp, mailpgp, and postpgp in one of the directories on your PATH. 2) Modify your ~/.elm/elmrc file to contain the following lines: editor = mailpgp pager = morepgp 3) Modify your ~/.nn/init file to contain the following lines: set editor postpgp That's all folks! Now, each time you post a message or reply to a message with nn, after you exit your editor, you will be asked whether you want to sign your message. Each time you compose a private message with elm, or reply to a message, and leave the editor, you'll be asked whether you want to sign and/or encrypt the message. When you browse a message, if it contains any PGP blocks, those will be properly interpreted. When you reply to a message containing PGP blocks, you'll have them properly decrypted and quoted in your editor. BUGS 1) You cannot encrypt messages that you mail from nn. You can only sign them. 2) When you reply to a PGP-encryted message, the encrypted message is temporarily kept on the disk, which is a security hole. 3) The temporary files are not wiped out, they are just deleted. 4) The scripts are ugly, reflecting my lack of knowledge of Perl. In fact, I don't know Perl at all; I hacked somebody else's scripts. If you know Perl better then me, please feel free to improve the scripts and don't forget to mail me a copy of the improved version. I can be contacted as Vesselin Bontchev at bontchev(a)fbihh.informatik.uni-hamburg.de ===== mailpgp ===== #!/usr/bin/perl ($visual = $ENV{'VISUAL'}) || ($visual = '/usr/ucb/vi'); $topgp = 0; $blanks = 0; $paragraphs = 1; $blankcompress = 1; $name=@ARGV[$#ARGV]; umask (077); open (INPUT, "<$name"); open (OUTPUT, ">${name}.rply") || die "Cannot open ${name}.rply for output.\n"; while (<INPUT>) { if (!$topgp && !m/^> -----BEGIN PGP .*-----/) { if (m/^> *$/) { if ($paragraphs) { if ($blankcompress) { if ($blanks == 0) { print OUTPUT "\n"; $blanks = 1; } } else { print OUTPUT "\n"; } } else { print OUTPUT; } } elsif (m/^ *$/) { if ($blankcompress) { if ($blanks == 0) { print OUTPUT "\n"; $blanks = 1; } } else { print OUTPUT; } } else { print OUTPUT; if ($. == 1 && !m/^> /) { print OUTPUT "\n"; $blanks = 1; } else { $blanks = 0; } } } if (!$topgp && m/^> -----BEGIN PGP .*-----/) { $topgp = 1; $tmpfile = "${name}.pgp", unlink ($tmpfile); open (TMPFILE, ">$tmpfile") || die "Cannot open $tmpfile for output.\n"; } if ($topgp) { $_ =~ s/^> //; print TMPFILE $_; if (m/^-----END PGP .*-----/) { $topgp = 0; close TMPFILE; $clrfile = "${name}.clr"; `pgp $tmpfile -o $clrfile`; open (CLEAR, "<$clrfile") || die "Cannot open $clrfile for input.\n"; print OUTPUT "-----BEGIN OF PGP DECRYPTED TEXT-----\n\n"; while (<CLEAR>) { if (m/^$/) { print OUTPUT "\n"; } else { print OUTPUT "> "; print OUTPUT; } } close CLEAR; unlink ($clrfile); unlink ($tmpfile); print OUTPUT "\n-----END OF PGP DECRYPTED TEXT-----\n\n"; } } } close OUTPUT; close INPUT; unlink ($name); rename ("${name}.rply", "$name"); system ($visual,@ARGV); while (!$q) { print "Sign this message? [Y]: "; $q = <STDIN>; $q =~ s/[ \t\n]//g; $q = substr ($q, 0, 1); if (($q eq 'Y') || ($q eq 'y') || ($q eq '')) { push(@opts,'-st','+clearsig=on'); $q = "y"; } elsif (($q ne 'N') && ($q ne 'n')) { $q = ''; } } $q=''; while (!$q) { print "Encrypt this message? [Y]: "; $q = <STDIN>; $q =~ s/[ \t\n]//g; $q = substr ($q, 0, 1); if (($q eq 'Y') || ($q eq 'y') || ($q eq '')) { push(@opts,'-e'); $q = "y"; } elsif (($q ne 'N') && ($q ne 'n')) { $q = ''; } } if (@opts) { system ('pgp','-a',@opts,$name); if ($? == 0) { unlink ${name}; rename ("${name}.asc", "$name"); } } ===== morepgp ===== #!/usr/bin/perl # written by jason steiner, jsteiner(a)anwsun.phya.utoledo.edu, Jan 1993 # # if you use or make improvements to this program i would appreciate # copies of your modifications & your PGP public key. $|=1; $topgp=0; $logname = $ENV{'LOGNAME'}; $pager='/usr/local/bin/less -i -n -s -S -c -M'; $pager = $ENV{'PAGER'} if ($ENV{'PAGER'}); umask 077; open (PAGER, "|$pager") || die "Cannot open pipe to $pager.\n"; print PAGER "\n"; while (<>) { if (!$topgp && m/^-----BEGIN PGP .*-----/) { $topgp = 1; $tmpfile = "/tmp/.pgp.$logname.$$"; unlink($tmpfile); open (TMPFILE, ">$tmpfile") || die "Cannot open $tmpfile for output.\n"; } if (!$topgp) { print PAGER; } else { print TMPFILE $_; if (m/^-----END PGP .*-----/) { $topgp = 0; close TMPFILE; open (CLEAR, "pgp -f < $tmpfile |") || die "Cannot open pipe to PGP.\n"; print PAGER "-----BEGIN PGP DECRYPTED BLOCK-----\n"; while (<CLEAR>) { print PAGER; } close CLEAR; unlink($tmpfile); print PAGER "-----END PGP DECRYPTED BLOCK-----\n"; } } } close PAGER; ===== postpgp ===== #!/usr/bin/perl # written by jason steiner, jsteiner(a)anwsun.phya.utoledo.edu, Jan 1993 # # if you use or make improvements to this program i would appreciate # copies of your modifications & your PGP public key. ($visual = $ENV{'VISUAL'}) || ($visual = '/usr/ucb/vi'); system($visual,@ARGV); while (!$q) { print "Sign this message? [Y]: "; $q = <STDIN>; $q =~ s/[ \t\n]//g; $q = substr ($q, 0, 1); if (($q eq 'Y') || ($q eq 'y') || ($q eq '')) { push(@opts,'-st','+clearsig=on'); $q = "y"; } elsif (($q ne 'N') && ($q ne 'n')) { $q = ''; } } if (@opts) { $name = $ARGV[$#ARGV]; umask(077); open(INPUT,$name); open(HEAD,">${name}.head"); open(BODY,">${name}.body"); while (<INPUT>) { if (1 .. /^$/) { print HEAD; if (m/^From: / || m/^To: / || m/^Date: /) { print BODY; } } else { print BODY; } } close(HEAD); close(BODY); system('pgp','-a',@opts,"${name}.body"); if ($? == 0) { unlink($name); system "cat ${name}.head ${name}.body.asc > $name"; } unlink("${name}.head"); unlink("${name}.body"); unlink("${name}.body.asc"); } -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLt5gen3YhjZY3fMNAQF1QwP+OETB9ibDTWxLJ3BWQsgG5tAIeSHgeWs7 cOasOVidSoHJ10LPbOjwfCP9mluUTpsWNzIXC3GRSh5QO0esOPubu5CsFUaouEo8 DwvAik5kxIUcztqry8ImktFY14UmLZDjHshN+2WU7yLNG0BBM4C2mfwqkKDN9ESX ZK2bJj2LVF0= =2toZ -----END PGP SIGNATURE-----

1 0