December 2003 - cypherpunks-legacy

Justice Jackson on Diary Escrow
by frissell＠panix.com 17 Dec '03

17 Dec '03

Today's WSJ has an article by a Cato type about an Indiana businessman who told state labor investigators to get stuffed. In the course of this article, the author quoted a 1948 opion (in dissent?) by Justice Jackson: The government could simplify criminal law enforcement by requiring every citizen "to keep a diary that would show where he was at all times, with whom he was, and what he was up to." Now we know where they got the idea for various "escrow" and DTI schemes. DCF Who also fondly remembers Justice Jackson's strong dissent in Korematsu vs. US against those great civil libertarians Black and Douglas who voted to uphold that great liberal FDR's imprisonment of persons of Japanese ancestry.

1 0

Correction to CEB
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'd like to clarify something about the recent Cypherpunks Electronic Book that was posted: In the table of contents, the listing for the program WinPGP26 could be misunderstood as coming from me; I'd like to state that I simply forwarded a copy of the program (in it's shareware version) - I am *not* it's author (t'were that it were so!). The author is: Christopher W. Geib 7605 Mt. Hood Dayton, OH 45424 email: 72144.1426(a)compuserve.com I *have* however, registered the program, and am quite pleased with it - the author is _very_ responsive to feedback from users. Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLm0qhcVrTvyYOzAZAQFE0gQAn4iDHD3T84scktaSY6OwY0MKu9L7areh wLKdrIpAm89Vmd5LHxhZADNZk43UR7xg6UnomGVkLdKq+T4tMH0ZnF1IR+b1/VmS XLS/K/cQ1TRzR18AgZXhavFOzrqNI0JsQrGVk/+nbrydeOvSEyP7N4LB1idvK3qq fTY8HCOD69E= =FGOM -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi3uZ2MAAAEEALWQtxX77SZSaFls6cVbPp+fZS4MNyKK3ZFYQo0qWyj+0tMq YgRTPRJRaCQixo63RttknogfPp514qdVMZw5iPeOXmD+RxrmTTwlbGqA7QUiG1x5 LG2Zims5zk4U6/rt8hwLh0/8E4lIb9r5d31qc8L1A9Twk/cmN8VrTvyYOzAZAAUR tClEYXZpZCBLLiBNZXJyaW1hbiA8bWVycmltYW5AbWV0cm9uZXQuY29tPokAlQIF EC3uaE3Fa078mDswGQEBbI8D/0FiwDcbfeNyDVJ+7EIWHjIxVkIGu+ArYUEllR3G SBHVZ9Vh7n8bNXeNHMnG5cZ23TLMVvweyhxFS+cDi+I7omeDNr6x65z500LxfUvL K5bSuSiBVkTp2z+/iojY/662JwKHzEEunuJ4CO8Yhxy11CdeszEX7DpXzRxLL92r EmO2 =4ZfP -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Reputation Capital papers?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 3:20 PM 9/6/94 -0700, Hal wrote: >P.S. I did find a paper on the net called "Endorsements, Licensing, >and Insurance for Distributed System Services", by Lai, Medvinsky, >and Newman of Information Sciences Institute. Here is the abstract: [snip...] >Unfortunately, I can't recall where I saw the pointer to this paper. >I'm sure other people read the same lists and newsgroups I do so perhaps >someone else can provide a pointer. Also, my copy of the postscript >paper would only print the first three pages, so I can't really evaluate >their ideas. Try this... >From: bcn(a)ISI.EDU >Date: Sun, 4 Sep 1994 13:05:42 -0700 >Original-From: Clifford Neuman <bcn(a)ISI.EDU> >To: www-buyinfo(a)allegra.att.com, kerberos(a)mit.edu >Subject: New paper available >X-UIDL: 778899999.011 > >A new paper is available by FTP that may be of interest to the readers >of this list. The paper will be presented in November at the Second >ACM Conference on Computer and Communications Security. > > Charlie Lai, Gennady Medvinsky, and B. Clifford Neuman. Endorsements, > Licensing, and Insurance for Distributed System Services. 2nd ACM > Conference on Computer and Communications Security, Fairfax VA, > November 1994. > >The paper discusses mechanisms for confidence building on the NII. In >particular it discusses methods by which users may assure themselves >of the competence and honesty of service providers on the network. >The paper is available as: > > ftp://prospero.isi.edu/pub/papers/security/insurance-cccs94.ps.Z > >Clifford Neuman > I didn't drop off the face of the earth, I just got a hot project thrown into my lap. I really want to come back and talk about offline cash some more, <groan!> but I won't have a chance for a bit. Anyway this thread is way cool.... Bye! Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

believing three impossible things before breakfast
by Carl Ellison 17 Dec '03

17 Dec '03

There was a news report/discussion tonight about birth control -- and someone advocating that all you need to do is just tell teens to say "no" to sex before marriage, then you won't need to distribute condoms without parental permission.... Suddenly it hit me that the same frame of mind was clearly behind the Clipper Initiative. Do you think there's a way to test for this ability to believe nonsense? Do you think there's a way to treat it? - Carl

1 0

AIDs testing and privacy
by Jeff Gostin 17 Dec '03

17 Dec '03

pstemari(a)bismark.cbis.com (Paul J. Ste. Marie) writes: > Of course, with ANI, calling an 800 number is not an anonymous act, > unless you one of the few that know you need to do it from a payphone. We tell children not to do things until they are old enough to be able to figure it out for themselves. If they cared enough about their privacy, they'd know. Hell, there's alot I don't know about maintaining privacy and security. However, I _do_ know that calling from a pay phone outside of 5 miles from your house is an easy way to take care of the problem. --J

1 0

Al Gore's home page
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

After reading the official announcement in "What's new with NSCA Mosaic" I just checked out Vice President Al Gore's home page at http://www.financenet.gov/vpgore.html Interersting that except for the "This is the Vice President's Mosaic Home Page" header, it is all empty. This from the man who wants to bring us the Information superhighway. Why can't politicians stay away from stuff they don't understand? Because that would mean that they have to stay away from everything. Just another anarchist, -- Lucky Green <shamrock(a)netcom.com> PGP public key by finger

4 3

The New World Order
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

John Young <jya(a)pipeline.com>: > Tim, would you expand the link to crypto of unipolar > superpower? > Maybe some of the non-US c'punks can add more. I'll illustrate by example. Two years ago, the US bullied Russia to renegue on a deal with the Indian Space Research Organization to transfer cryogenic rocket engine technology for the Indian Geostationary Satellite Launch Vehicle. The US claimed that the technology was dual-use and prohibited by the MTCR. India and the Russian company, Glavkosmos, suggested that the reasons were commercial rather than defence, as such engines are useless in ballistic missiles due to their lengthy preparation period, while an Indian GSLV would pose major competition to the US space industry. Russia backed down after Yeltsin's arm was twisted so hard that he negated a personal statement he made when in New Delhi. Recently the Defence Research and Development Organization made a secure phone for commercial (non-defence) use. It has yet to reach the market, and I am in the process of finding out what technology it uses, but if Clipper passes in the US, India could be pressurized into abandoning it in favour of a Clipper-like alternative. As an aside, the Indian government likes to show that it's not following US orders (not signing the NPT etc) and the GSLV will probably be launched with indigenously developed engines in 1998. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

PGP comes of age
by Dave Otto 17 Dec '03

17 Dec '03

Got the following blurb from ORA.COM last Friday. Pretty cool! ------- Forwarded Message O'REILLY'S FALL RELEASES PGP: Pretty Good Privacy by Simson Garfinkel 1st Edition November 1994 (est.) 250 pages (est),ISBN: 1-56592-098-8, $17.95 (est) PGP is a freely available encryption program that protects the privacy of files and electronic mail. It uses powerful public key cryptography and works on virtually every platform. PGP: Pretty Good Privacy by Simson Garfinkel is both a readable technical users guide and a fascinating behind-the-scenes look at cryptography and privacy. Part I of the book describes how to use PGP: protecting files and email, creating and using keys, signing messages, certifying and distributing keys, and using key servers. Part II provides background on cryptography, battles against public key patents and U.S. government export restrictions, and other aspects of the ongoing public debates about privacy and free speech. - -- Brian Erwin, brian(a)ora.com O'Reilly & Associates 103A Morris Street, Sebastopol CA 95472 707-829-0515, Fax 707-829-0104 ------- End of Forwarded Message Dave Otto -- dave(a)marvin.jta.edd.ca.gov -- daveotto(a)acm.org "Pay no attention to the man behind the curtain!" [the Great Oz] finger DaveOtto(a)ACM.org for PGP 2.6 key <0x3300e841> fingerprint = 78 71 3A 5B FD 8A 9A F1 8F BC E8 6A C7 BD A4 DD

1 0

Where to Get the Latest PGP (Pretty Good Privacy) FAQ
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) (Last modified: 7 September 1994 by Mike Johnson) WHAT IS THE LATEST VERSION? There is more than one latest version. Pick one or more of the following that best suits your computer, patent restrictions, and export restrictions. Some countries (like France) may also restrict import or even use of strong cryptography like PGP. |-----------------+---------------------+---------------------------------| | Platform(s) | Latest Version | Distribution File Names | |-----------------+---------------------+---------------------------------| | DOS, Unix, | Viacrypt PGP 2.7 | disk sets | | or WinCIM/CSNav | | | |-----------------+---------------------+---------------------------------| | DOS, Unix, | MIT PGP 2.6.1 | pgp261.zip (DOS + docs) | | others | | pgp261s.zip (source) | | | | pg261s.zip source on CompuServe | | | | pgp261.tar.gz (source) | | | | pgp261.gz (same as above on DOS)| | | | pgp261.tar.Z (source) | | | | pgp261dc.zip (documentation) | | | | pg261d.zip (docs on CompuServe) | |-----------------+---------------------+---------------------------------| | Macintosh | MIT PGP 2.6 | MacPGP2.6.sea.hqx (binary+docs) | | | | macpgp26.hqx (same as above) | | | | MacPGP2.6.src.sea.hqx (source) | | | | macpgp26.src (same as above) | | | | MacPGP2.6-68000.sea.hqx (binary)| | | | mcpgp268.hqx (same as above) | |-----------------+---------------------+---------------------------------| | Mac Applescript | MacPGP 2.6ui v 1.2 | MacPGP-2.6ui-v1.2.sit.hqx | | | | MacPGP2.6ui_V1.2_sources.cpt.hqx| | | | MacPGP2.6uiV1.2en.cpt.hqx | | | | MacPGP2.6uiV1.2src.cpt.hqx | | | | MacPGP2.6uiV1.2.68000.hqx | |-----------------+---------------------+---------------------------------| | Amiga | Amiga PGP 2.3a.4 | PGPAmi23a_4.lha | |-----------------+---------------------+---------------------------------| | Atari | Atari PGP 2.6ui | pgp26uib.lzh (binary, docs) | | | | pgp26uis.lzh | |-----------------+---------------------+---------------------------------| | Archimedes | Archimedes 2.3a | ArcPGP23a | |-----------------+---------------------+---------------------------------| Note: there are other versions available, but these are either old, or outside of the mainstream PGP project. Look for signatures from one of three sources: Viacrypt (Commercial), jis(a)mit.edu (North American freeware), or mathew(a)mantis.co.uk (the unofficial international version source). The "unofficial international" versions are really just PGP 2.3a, modified just enough to make it compatible with MIT PGP 2.6, but do not include all of the fixes in MIT PGP 2.6 and MIT PGP 2.6.1. They are named pgp26ui* or have a "ui" somewhere in their file names. I recommend the use of the "ui" versions only if: (1) You are using a Macintosh; (2) You are using a platform for which there is no Viacrypt or MIT PGP; (3) You are outside of North America, and can't obtain Viacrypt or MIT PGP; or (4) You need to use a key longer than 1024 bits (i. e. a 1264 bit key generated with PGP 2.3a or PGP 2.6ui). WHERE CAN I GET VIACRYPT PGP? If you are a commercial user of PGP in the USA or Canada, contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial applications, and may be used in corporate environments in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP. Due to limitations on ViaCrypt's RSA distribution license, ViaCrypt only distributes executable code and documentation for it, but they are working on making PGP available for a variety of platforms. Call or write to them for the latest information. The latest version number for their version of PGP is 2.7. The Windows version is anticipated to ship by (or before) September 15, 1994; the Macintosh version is expected to ship in early October. The formal announcements will go out about one week prior to first ship dates. The Windows version is a high grade Visual Basic front end with the DOS program in the back end. It is a point-and-click, drag-and-drop operation. Here is a brief summary of Viacrypt's currently-available products: 1. ViaCrypt PGP for MS-DOS. Prices start at $99.98 2. ViaCrypt PGP for UNIX. Includes executables for the following platforms: SunOS 4.1.x (SPARC) IBM RS/6000 AIX HP 9000 Series 700/800 UX SCO 386/486 UNIX SGI IRIX AViiON DG-UX(88/OPEN) Prices start at $149.98 Executables for the following additional platforms are available upon request for an additional $30.00 charge. BSD 386 Ultrix MIPS DECstation 4.x 3. ViaCrypt PGP for WinCIM/CSNav. A special package for users of CompuServe. Prices start at $119.98 In September, 1994, ViaCrypt intends to announce two new major product additions: ViaCrypt PGP for Windows ViaCrypt PGP for Macintosh Prices start at $124.98 Viacrypt's licensing and price information is as follows: ViaCrypt PGP Version 2.7 for Windows (Single User $ 124.98 ViaCrypt PGP Version 2.7 for Windows (Five User) $ 374.98 ViaCrypt PGP Version 2.7 for Macintosh(Single User) $ 124.98 ViaCrypt PGP Version 2.7 for Macintosh(Five User) $ 374.98 ViaCrypt PGP Version 2.7 for MS-DOS (Single User) $ 99.98 ViaCrypt PGP Version 2.7 for MS-DOS (Five User) $ 299.98 ViaCrypt PGP Version 2.7 for UNIX (Single User) $ 149.98 ViaCrypt PGP Version 2.7 for UNIX (Five User) $ 449.98 ViaCrypt PGP for WinCIM/CSNav (Single User) $ 119.98 ViaCrypt PGP for WinCIM/CSNav (Five User) $ 359.98 UNIX platforms of Ultrix and BSD 386 have an additional $30.00 charge per platform. Please contact ViaCrypt for pricing of 20 users and above. Orders may be placed by calling 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. We accept VISA, MasterCard, AMEX and Discover credit cards. If you have further questions, please feel free to contact: Paul E. Uhlhorn Director of Marketing, ViaCrypt Products Mail: 9033 N. 24th Avenue Suite 7 Phoenix AZ 85021-2847 Phone: (602) 944-0773 Fax: (602) 943-2601 Internet: viacrypt(a)acm.org Compuserve: 70304.41 WHERE CAN I GET THE FREEWARE PGP? These listings are subject to change without notice. If you find that PGP has been removed from any of these sites, please let me know so that I can update this list. Likewise, if you find PGP on a good site elsewhere (especially on any BBS that allows first time callers to access PGP for free), please let me know so that I can update this list. Because this list changes frequently, I have not attempted to keep it complete, but there should be enough pointers to let you easily find PGP. There are several ways to get the freeware PGP: ftp, WWW, BBS, CompuServe, America Online (maybe), email ftp server, and sneakernet (ask a friend for a copy). Just don't ask the author directly for a copy. FTP SITES IN NORTH AMERICA These sites generally have some mechanism to (1) discourage export of PGP and violation of the ITAR, (2) protect the site operators from harrassment by the Federal Government, and (3) still allow automated distribution of PGP as far as is allowed under all applicable laws. Telnet to net-dist.mit.edu, log in as getpgp, answer the questions, then ftp to net-dist.mit.edu and change to the hidden directory named in the telnet session to get your own copy. MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws). 1. Read ftp://net-dist.mit.edu/pub/PGP/mitlicen.txt and agree to it. 2. Read ftp://net-dist.mit.edu/pub/PGP/rsalicen.txt and agree to it. 3. Telnet to net-dist.mit.edu and log in as getpgp. 4. Answer the questions and write down the directory name listed. 5. QUICKLY end the telnet session with ^C and ftp to the indicated directory on net-dist.mit.edu (something like /pub/PGP/dist/U.S.-only-????) and get the distribution files (see the above chart for names). If the hidden directory name is invalid, start over at step 3, above. You can also get PGP from: ftp.csn.net/mpj ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/ See ftp://ftp.csn.net/mpj/README.MPJ for the ??????? See ftp://ftp.csn.net/mpj/help for more help on negotiating this site's export control methods (open to USA and Canada). ftp.netcom.com/pub/mpj ftp://ftp.netcom.com/mpj/I_will_not_export/crypto_???????/pgp/ See ftp://ftp.netcom.com/pub/mpj/README.MPJ for the ??????? See ftp://ftp.netcom.com/pub/mpj/help for more help on negotiating this site's export control methods. TO GET THESE FILES BY EMAIL, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message for instructions. You will have to work quickly to get README.MPJ then the files before the ??????? part of the path name changes again (several times a day). ftp.eff.org Follow the instructions found in README.Dist that you get from one of: ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist gopher.eff.org, 1/Net_info/Tools/Crypto gopher://gopher.eff.org/11/Net_info/Tools/Crypto http://www.eff.org/pub/Net_info/Tools/Crypto/ ftp.wimsey.bc.ca /pub/crypto/software/dist/US_or_Canada_only_XXXXXXX/PGP (U. S. and Canadian users only) See /pub/crypto/software/README for the characters for XXXXXXXX This site has all public releases of the freeware PGP. WORLD WIDE WEB ACCESS http://www.matnis.co.uk/pgp/pgp.html http://rschp2.anu.edu.au:8080/crypt.html COMPUSERVE The NCSA Forum sysops have a library (Library 12: Export Controlled) that is available only to people who send them a message asserting that they are within the U. S. A. This library contains PGP. I have also seen PGP in some other places on Compuserve. Try searching for PGP261.ZIP in the IBMFF forum for up-to-date information on PGP in selected other areas. The last time I tried a search like this, PGP 2.6 was found in the PC World Online forum (GO PWOFORUM) new uploads area, along with several PGP shells and accessories. I've also heard that EUROFORUM caries PGP 2.6ui, but have not confirmed this. Compuserve file names are even more limited than DOS (6.3 instead of the already lame 8.3), so the file names to look for are PGP26.ZIP, PG261S.ZIP (source code), PGP261.GZ (Unix source code) and PG261D.ZIP (documentation only). BULLETIN BOARD SYSTEMS Colorado Catacombs BBS Mike Johnson, sysop Mac and DOS versions of PGP, PGP shells, and some other crypto stuff. Also the home of some good Bible search files and some shareware written by Mike Johnson, including DLOCK, CRYPTA, CRYPTE, CRYPTMPJ, MCP, MDIR, DELETE, PROVERB, SPLIT, ONEPAD, etc. v.FAST/v.32bis/v.42bis, speeds up to 28,800 bps 8 data bits, 1 stop, no parity, as fast as your modem will go. Use ANSI terminal emulation, of if you can't, try VT-100. Free access to PGP. If busy or no answer, try again later. Log in with your own name, or if someone else already used that, try a variation on your name or pseudonym. You can request access to crypto software on line, and if you qualify legally under the ITAR, you can download on the first call. For free access: log in with your own name, answer the questions, then select [Q]uestionaire 3 from the [M]ain menu. (303) 772-1062 Longmont, Colorado number - 2 lines. (303) 938-9654 Boulder, Colorado number forwarded to Longmont number intended for use by people in the Denver, Colorado area. Hieroglyphics Voodoo Machine (Colorado) Jim Still (aka Johannes Keppler), sysop. DOS, OS2, and Mac versions. (303) 443-2457 For free access for PGP, DLOCK, Secure Drive, etc., log in as "VOO DOO" with the password "NEW" (good for 30 minutes access to free files). Exec-Net (New York) Host BBS for the ILink net. (914) 667-4567 The Ferret BBS (North Little Rock, Arkansas) (501) 791-0124 also (501) 791-0125 Special PGP users account: login name: PGP USER password: PGP This information from: Jim Wenzel <jim.wenzel(a)grapevine.lrk.ar.us> Other BBS -- check your local BBS. Chances are good that it has any release that is at least a month old if it has much of a file area at all. AMERICA ONLINE: Try PC WORLD soft/lib. (key word PGP). Make sure you get ALL of the files, including the documentation. Somebody apparently split up the .ZIP file just to make life more difficult. OTHER FTP SITES These other ftp sites don't have the "export control" hoops to jump through that most North American sites have in deference to archaic laws. ftp.informatik.uni-hamburg.de /pub/virus/crypt/pgp This site has most, if not all, of the current PGP files. black.ox.ac.uk (129.67.1.165) ftp.netcom.com /pub/dcosenza -- Some crypto stuff, sometimes includes PGP. /pub/gbe/pgpfaq.asc -- frequently asked questions answered. /pub/qwerty -- How to MacPGP Guide, largest steganography ftp site as well. PGP FAQ, crypto FAQ, US Crypto Policy FAQ, Steganograpy software list. MacUtilites for use with MacPGP. Stealth1.1 + other steganography programs. Send mail to qwerty(a)netcom.com with the subject "Bomb me!" to get the PGP FAQ and MacPGP guide if you don't have ftp access. ftp.ee.und.ac.za /pub/crypto/pgp soda.berkeley.edu /pub/cypherpunks/pgp (DOS, MAC) ftp.demon.co.uk /pub/amiga/pgp /pub/archimedes /pub/pgp /pub/mac/MacPGP ftp.informatik.tu-muenchen.de ftp.funet.fi ftp.dsi.unimi.it /pub/security/crypt/PGP ftp.tu-clausthal.de (139.174.2.10) (Atari ST/E,TT,Falcon) /pub/atari/misc/pgp/pgp26uib.lzh (2.6ui ttp, 2.3a docs) /pub/atari/misc/pgp/pgp26uis.lzh (2.6ui sources) /pub/atari/misc/pgp/pgp26ui.diffs (Atari diffs for 2.6 sources) wuarchive.wustl.edu /pub/aminet/util/crypt src.doc.ic.ac.uk (Amiga) /aminet /amiga-boing ftp.informatik.tu-muenchen.de /pub/comp/os/os2/crypt/pgp23os2A.zip (OS/2) iswuarchive.wustl.edu pub/aminet/util/crypt (Amiga) nic.funet.fi (128.214.6.100) /pub/crypt ftp.uni-kl.de (131.246.9.95) /pub/aminet/util/crypt qiclab.scn.rain.com (147.28.0.97) pc.usl.edu (130.70.40.3) leif.thep.lu.se (130.235.92.55) goya.dit.upm.es (138.4.2.2) tupac-amaru.informatik.rwth-aachen.de (137.226.112.31) ftp.etsu.edu (192.43.199.20) princeton.edu (128.112.228.1) pencil.cs.missouri.edu (128.206.100.207) soda.csua.berkeley.edu nctuccca.edu.tw /PC/wuarchive/pgp/ Also, try an archie search for PGP using the command: archie -s pgp26 (DOS & Unix Versions) archie -s pgp2.6 (MAC Versions) FTPMAIL For those individuals who do not have access to FTP, but do have access to e-mail, you can get FTP files mailed to you. For information on this service, send a message saying "Help" to ftpmail(a)decwrl.dec.com. You will be sent an instruction sheet on how to use the ftpmail service. Another e-mail service is from nic.funet.fi. Send the following mail message to mailserv(a)nic.funet.fi: ENCODER uuencode SEND pub/crypt/pgp23srcA.zip SEND pub/crypt/pgp23A.zip This will deposit the two zipfiles, as 15 batched messages, in your mailbox with about 24 hours. Save and uudecode. For the ftp sites on netcom, send mail to ftp-request(a)netcom.com containing the word HELP in the body of the message. IS MY COPY OF PGP GOOD? If you find a version of the PGP package that does not include the PGP User's Guide, something is wrong. The manual should always be included in the package. PGP should be signed by one of the developers (Philip Zimmermann, Jeff Schiller, Viacrypt, etc.). If it isn't, the package is suspect and should not be used or distributed. The site you found it on should remove it so that it does no further harm to others. To be really sure, you should get PGP directly from MIT or check the signatures with a version of PGP that you trust. The copies of PGP on ftp.csn.net/mpj, ftp.netcom.com/pub/mpj, and the Colorado Catacombs BBS are direct copies of the ones on MIT, except that the ones on the BBS include a BBS advertisement (automatically added by the system when it virus scans new files) in the outer .zip files. OTHER PGP DOCUMENTATION PGP is rather counter-intuitive to a Mac user. Luckily, there's a guide to using MacPGP in ftp://ftp.netcom.com/pub/qwerty/Here.is.How.to.MacPGP. There is a Frequently Asked Questions document in ftp://ftp.netcom.com/pub/gbe/pgpfaq.asc For more information on the "time bomb" in PGP, see ftp://ftp/netcom.com/pub/mpj/pgpbomb.asc LANGUAGE MODULES These are suitable for most PGP versions. I am not aware of any export/import restrictions on these files. German * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha Italian * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz Japanese * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz Lithuanian * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip Russian * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip (MIT version) * _RU:_ ftp://ftp.kiae.su/unix/crypto/pgp/pgp26uir.zip (ui version) * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip Spanish * _IT:_ ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz * _FI:_ ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz Swedish * _UK:_ ftp://black.ox.ac.uk/src/security/pgp_swedish.txt * _US:_ ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt ARCHIE WHO? There are many more sites. You can use archie and/or other "net-surfing" tools to find a more up-to-date listing, if desired. WHAT IS ALL THIS NONSENSE ABOUT EXPORT CONTROLS? For a detailed rant, get ftp://ftp.csn.net/mpj/cryptusa.zip The practical meaning, until the law is corrected to make sense, is that you are requested to get PGP from sites outside of the USA and Canada if you are outside of the USA and Canada. If you are in France, I understand that you aren't even supposed import it. Other countries may be worse. It is illegal to export PGP from the USA to any country except Canada, even if that version of PGP originated outside of the USA. Don't do it. Don't ask me to do it. The law is not rational, but it exists, and the Federal Government has no sense of humor. On the other hand, if you should discover a copy of PGP in some place other than the USA, then you are bound by the laws of both that country and your own country with respect to what you can do with it, not necessarily by U. S. Law. Your laws may be more or less restrictive, and may possibly refer to U. S. Law through some sort of treaty. If you live in a place where you can freely distribute and use PGP, then I applaud your government. In spite of the best efforts of MIT and the other primary developers and distributors of PGP not to violate the International Traffic in Arms Regulations, MIT PGP has been observed to migrate to many foreign sites. Whoever is responsible for this export is responsible for their own actions and is not encouraged or endorsed by myself, Philip Zimmermann, or MIT. This doesn't necessarily mean that we agree with the law, or even that the law itself is Constitutional. It just means that becoming a test case is not fun. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN THE USA? MIT PGP is only for noncommercial use because of restrictions on the licensing of both the RSA algorithm (attached to RSAREF) and the IDEA algorithm. PKP/RSADSI insist that we use RSAREF instead of the mpi library for reasons that make sense to them. For commercial use, use Viacrypt PGP, which is fully licensed to use both the RSA and IDEA algorithms in commercial and corporate environments. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST IN CANADA? MIT PGP is only for noncommercial use because of restrictions on the licensing of the IDEA algorithm. Because the RSA algorithm isn't patented in Canada, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license. For commercial use, use Viacrypt PGP, which is fully licensed to use the IDEA algorithm in commercial and corporate environments. WHAT INTELLECTUAL PROPERTY RESTRICTIONS EXIST OUTSIDE NORTH AMERICA? MIT PGP is only for noncommercial in areas where there is a patent on software implementations of the IDEA algorithm. Because the RSA algorithm isn't patented outside of the USA, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license. For commercial use, you cannot buy Viacrypt PGP, but you can arrange to license your use of IDEA directly from ETH Zurich. If software implementations of IDEA are not covered by a patent in your country, then you can use the freeware versions of PGP, provided that you compile it with the mpi library instead of RSAREF. WHAT IS THE "TIME BOMB" IN MIT PGP 2.6? As a concession to the RSA patent holders (in return for endorsement of the legality of the freeware MIT PGP 2.6), MIT placed an inducement in MIT PGP 2.6 to encourage upgrade from the alledgedly patent-infringing PGP 2.3a to the MIT version. The nature of this inducement is a change in a packet ID byte that causes PGP 2.3a and earlier to reject messages created by MIT PGP 2.6 after 1 September 1994. Altering MIT PGP 2.6 to bypass this annoyance (though technically an easy change to the LEGAL_KLUDGE), invalidates the blessing of Public Key Partners on the licence of MIT PGP 2.6. Therefore, it is a bad idea. On the other hand, it is trivial to hack PGP 2.3a to accept these packets, and that (plus a few other bug fixes) is essentially what PGP 2.6ui is. None of the versions of PGP greater than 2.3 have problems reading the old packet ID values, so for maximum compatibility, the ideal is to write the old value and accept either value. Unfortunately, this time bomb has a negative effect on Viacrypt PGP 2.4, as well, which never infringed on anyone's patents. Viacrypt's solution was to issue PGP 2.7, which, by default acts just like MIT PGP 2.6, but has a config.txt option (explained in the release) that allows compatibility with both PGP 2.4 and PGP 2.6. Naturally, this also allows compatibility with PGP 2.3a. The time bomb is annoying for those who still wish to use PGP 2.3a, and for those who use Viacrypt PGP 2.4 and don't want to spend US$10 to upgrade to Viacrypt PGP 2.7, but considering the magnitude of the concession made by Public Key Partners in legitimizing the freeware PGP for use in the USA, it was worth it. For more information on the time bomb, see ftp://ftp.csn.net/mpj/pgpbomb.asc ARE MY KEYS COMPATIBLE WITH THE OTHER PGP VERSIONS? If your RSA key modulus length is less than or equal to 1024 bits (I don't recommend less, unless you have a really slow computer and little patience), and if your key was generated in the PKCS format, then it will work with any of the current PGP versions (MIT PGP 2.6, PGP 2.6ui, or Viacrypt PGP 2.7). If this is not the case, you really should generate a new key that qualifies. Philip Zimmermann is aware of the desire for longer keys in PGP by some PGP fans (like me), but wants to migrate towards that goal in an orderly way, by first releasing versions of PGP in for all platforms and for both commercial (Viacrypt) and freeware (MIT) flavors that ACCEPT long keys, then releasing versions that can also GENERATE long keys. He also has some other neat key management ideas that he plans to implement in future versions. BUGS These are the most annoying: MIT PGP 2.6 -- the function xorbytes doesn't. Replace the = with ^= to fix it. The effect of this bug is that RSA keys aren't quite as random as they should be -- probably not a practical problem, but worth fixing if you are going to compile the code yourself. Fixed in 2.6.1. MIT PGP 2.6 -- DON'T SET PGPPASS when editing your keys, because if you do, and if you don't change your pass phrase, the key is lost. (If this happens, rename your backup keyring files to the primary files before you do anything else). Fixed in 2.6.1. PGP 2.6ui -- Conventional encryption -c option doesn't use a different IV every time, like it is supposed to. (PGP 2.3a had this problem, too). Fixed in 2.6 and 2.6.1. HOW DO I PUBLISH MY PGP PUBLIC KEY? There are lots of ways. One way is to use a key server. Send mail to one of these addresses with the single word "help" in the subject line to find out how to use a key server. pgp-public-keys(a)pgp.iastate.edu public-key-server(a)pgp.ai.mit.edu pgp-public-keys(a)demon.co.uk FTP: ftp.demon.co.uk:/pub/pgp/pubring.pgp (Updated daily) pgp-public-keys(a)cs.tamu.edu pgp-public-keys(a)chao.sw.oz.au pgp-public-keys(a)jpunix.com pgp-public-keys(a)dsi.unimi.it pgp-public-keys(a)kiae.su pgp-public-keys(a)fbihh.informatik.uni-hamburg.de There is also an experimental public key server at http://ibd.ar.com/PublicKeys.html Another way is to upload it to the PGP public keys area of the Colorado Catacombs BBS (303-772-1062). Another way is to just send it to your correspondents. You could add it to your .plan file so that finger returns your key. You could add it to some of your postings. No matter which way you do it, you should have your key signed by someone who verifies that your key belongs to you, so that you don't have someone else generating a key that has your name on it, but that isn't yours. Here is my public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAi4PT2QAAAEEAPPCZnrshEJ9PSnV+mXEwjM4kzJF0kyg2MnLMzo83vWI40ei jogncqdkXT0c2TQWg+Bsu9ckFoXdId0utumYv0aqd8yI/oU/DwJ1zJrqRL2PFbxe ZLofHoKFjvq1TiNiJq9ps3jW6iYS4IU1SzyKhjmyE+K0+WyrPPX0zg8FAL9FAAUR tCdNaWNoYWVsIFBhdWwgSm9obnNvbiA8bXBqQGNzbi5vcmc+IG1wajiJAJUCBRAu G3chZXmEuMepZt0BAZtAA/0Rw5mintlUDgHycNbeoyIiMHoLu8jWaCSaiGSt+dDU 1A/bUCo+gorv5TYxOClRf3XHjD6zSooWyUz3ehotrzPYLunhVOE2YBxPU+OvKFOc 37mcZrnXGBlF5NblnSYxp0186tGaTm7WMWx7NDlHT4GvhzHJQSOoo48ykDkKm/mk LIkAlQIFEC4PWbs/ZwY8hTPrxQEBKyMD/A7kv91C1ZZIRtkbC9k9lsWOgOnO8wG8 bGMajaco465Z5llWD+Y8QCMdSWcowtOBGfW0Wv1bZ1uebeCpg1L66pJ7C+BOExrk gPqRVCstLLiVerKGeSOZo3yXtxYKYX7mHQPrHp98ef7fUG4IiKS+S+znmGxpJwrV sHZRlhJ3hXUsiQCVAgUQLg9ZefX0zg8FAL9FAQFBTAQAh4u4Vun7WhPuL6fsXiXm paaGfeLtd3biRj/aOMAG1eHuhVdWejx71ormyKTdNB2YV56bpsE3JQ/KhBuYDo0N SkRnqeM2S+Ef7aZEg6Q44uXG52pqCZUldtCeYfOs3aLCR9SMlc6Y3zmpSwB1wKP0 5+tN9zruNYVKKBLWEIFAY7W0K01pY2hhZWwgUGF1bCBKb2huc29uIDxtLnAuam9o bnNvbkBpZWVlLm9yZz60IE1pY2hhZWwgSm9obnNvbiA8bXBqQG5ldGNvbS5jb20+ tChNaWtlIEpvaG5zb24gPDcxMzMxLjIzMzJAY29tcHVzZXJ2ZS5jb20+tCtNaWNo YWVsIFAuIEpvaG5zb24gPG1wam9obnNvQG55eC5jcy5kdS5lZHU+tC1EbyBub3Qg dXNlIGZvciBlbmNyeXB0aW9uIGFmdGVyIDI3IEp1bmUgMTk5Ni4= =rR4q - -----END PGP PUBLIC KEY BLOCK----- ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mpj/README.MPJ -. --- ----- ....| | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7 iQCVAgUBLm3RD/X0zg8FAL9FAQGqnwQA5R8PVpgT0tHG7GSY2jjNM9EKnQAngOdy ByZYVhh9lm/7WywiiBsY5XWDwFUEwIC79e+UeCY+8lAhiUEEWQdCAvYO7b/LCtSn D9TL3teei4sH6Z4kpDFFn8peWVwoEc/2l9nWrtUlT1cFvBDKn1KRK8MlZgH0Gld4 J+vPYYYrDMg= =u06H -----END PGP SIGNATURE-----

1 0

Reputation Capital papers?
by John Young 17 Dec '03

17 Dec '03

Prompted by Hal's post I send the following FTP info on Information Sciences Institute. This is their README file. There is much more there, based on a quick look, juicy DoD stuff for the disloyal. John ------------------- USC INFORMATION SCIENCES INSTITUTE PUBLICATIONS Welcome to USC Information Sciences Institute FTP publications directory. When logging in, please use your complete email address as a password. For example: % ftp ftp.isi.edu NAME: anonymous PASSWORD: techlib(a)isi.edu (your_email_address@your_machine) ftp> cd isi-pubs ftp> use the standard ftp commands, such as "dir", "get", "cd", etc. ftp> "quit" when finished A few of our technical reports are now available, in postcript format, through ANONYMOUS FTP from ftp.isi.edu. If you would like to order hard copies of ISI technical reports, please send email to "techlib(a)isi.edu" or written requests can be sent to: USC Information Sciences Institute Library 4676 Admiralty Way, Suite 1001 Marina del Rey, CA 90292-6695 ATTN: Document Distribution If our stock has been depleted, you will be referred to the National Technical Information Service, NTIS. Here is a brief description of the files currently available online: -------------- -------------------------------------------------- ---- filename description -------------- -------------------------------------------------- ---- pubrec.ps This file contains a listing of all the technical reports published by ISI with abstracts. Approximately 50 pages. newpubs0794.ps This is our semi-annual publications announcement newpubs0194.ps newsletter and order form. It is published in January and July. Subsequent newsletters will follow the same filename format, newpubsMMYY.ps, e.g. newpubs0194.ps, newpubs0794.ps. isi-sr-93-374.ps Zoned Analog Personal Teleconferencing (ZAPT) isi-sr-93-374.ps.Z by J.D. Touch December 1993, 23 pages isi-rr-93-372.ps Employing Knowledge Resources in a New Text Planner Architecture by E. Hovy, J. Lavid, E. Maier, V. Mittal, C. Paris, 1992 (Not yet available online. Hard copy only.) 14 pages isi-rr-93-366.ps Synthesis of Asynchronous Systems from Data isi-rr-93-366.ps.Z Flow Specifications by T.-Y. Wuu, S.B.K. Vrudhula December 1993, 73 pages isi-rs-93-364.ps Security Services for Multimedia Conferencing by S. Stubblebine November 1993, 9 pages isi-rs-93-363.ps ATOMIC: A Low-Cost, Very High-Speed, Local Communication Architecture by D. Cohen, G. Finn, R. Felderman, A. DeSchon November 1993, 12 pages isi-rs-93-360.ps The Impact of Scaling on a Multimedia Connection Architecture by E. Schooler August 1993, 14 pages isi-rs-93-359.ps Case Study: Multimedia Conference Control in a Packet-Switched Teleconferencing System by Schooler August 1993, 18 pages isi-sr-93-358.ps The ISI "Tunnel" by A. DeSchon, D. Cohen October 1993 39 pages isi-rs-93-342.ps Parallel Communication by J. Touch March 1993, 12 pages isi-rs-93-301.ps Physics Analogs in Communication Models by J. Touch January 1993, 10 pages isi-rs-92-294.ps An Architecture for Multimedia Connection Management, by E. Schooler, S. Casner August 1992, 8 pages isi-rs-92-293.ps First IETF Internet Audiocast, by S. Casner, S. Deering July 1992, 6 pages isi-rr-92-291.ps ATOMIC: A Low-Cost, Very High-Speed LAN by D. Cohen, G. Finn, R. Felderman, A. DeSchon September 1992, 21 pages isi-rr-91-289.ps A Distributed Architecture for Multimedia Conference Control by E. Schooler November 1991, 18 pages isi-rs-91-286.ps Multimedia Conferencing: Has it Come of Age, by E. Schooler, S. Casner, J. Postel August 1991, 10 pages isi-rs-90-252.ps N-Way Conferencing with Packet Video, by S. Casner, K. Seo, W. Edmond, C. Topolcic April 1990, 10 pages

1 0