December 2003 - cypherpunks-legacy

Re: c'punks top 5
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Adam Shostack <adam(a)bwh.harvard.edu> writes: >> Whats wrong with PGPtools? (A lack of documentation. Been >> a while since I looked, but I think it lacked a high level >> interface. The low level stuff is great, but on the mac, I can >> send an Appleevent "Encrypt *file recipient" and, some extended >> period later, get a response. > >It has been a while since I looked too, does it work with the 'new' format >messages generated by MIT pgp? Does anyone actually USE pgptools for any >available applications? As far as I know, nobody uses it. If nobody uses >PGPtools, then what is the reason? Either nobody really wants a PGP library >(which isn't true judging from the inquiries on cypherpunks), or something is >wrong with PGPTools. Is it the documentation like you said? Maybe some of >us should pick up where pr0duct cypher left off and enhance PGPTools. This >brings me to another point: > I use PGPTools. It is the crypto engine for Mixmaster. I have been having problems with it though. It works fine with PGP2.6 messages. > <BIG SNIP> >andrew -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCUAwUBLvZ0SVVkk3dax7hlAQG6AwP42xb6cPFWhMMPY83Vv/Q6akWBCuccbEqP RaAaz/iVJHdP6WLdItPSvpZQsp0KL6+pfqAwH3IMZd0a/ixJyFAEGOQ1gr/OQjCC fKYVfH5K6C1j5GMy9dLFKbWCxKk7n/3e1is3nNtoV6kqMsJxlo3WBWgtEWOz+WrE 8EZv9EwmdA== =Wg/K -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

SSL server experiment
by Hal 17 Dec '03

17 Dec '03

Here is a perl script which connects to a netscape-style "https" server. The results of running it with "https.pl home1.mcom.com 443" is: Attempting connection to 198.93.93.10 Connected Sent message, length 40 Received length = 502 Message type = 4 Session ID Hit flag = 0 Certificate type = 1 Server version = 2 Certificate length = 472 Cipher specs length = 3 Conn ID length = 16 Supported ciphers: RC4_EXPORT40, 128 bits This way you can see which of the 5 cipher options (RC4 or RC2 in full and export versions, plus IDEA) are supported by any given server. You always use port 443 and just specify the machine name. I was a little surprised that Netscape's own server is only running the 40 bit version. I hope the export restrictions will not prevent the use of full strength ciphers. Here is the script, which I call https.pl: #!/usr/local/bin/perl # Perl script to test connection to http ssl port # Usage: https machine port # Standard internet stuff $AF_INET = 2; $SOCK_STREAM = 1; ($name, $aliases, $proto) = getprotobyname('tcp'); $sockaddr = 'S n a4 x8'; # Parse if (@ARGV == 2) { ($them, $port) = @ARGV; } else { die "Usage: $0 machine port\n"; } select (S); $| = 1; select (STDOUT); socket (S, $AF_INET, $SOCK_STREAM, $proto) || die "socket: $!"; ($name, $aliases, $type, $len, $thataddr) = gethostbyname($them); $that = pack ($sockaddr, $AF_INET, $port, $thataddr); @thataddr = unpack('C4', $thataddr); $thataddr = join('.', @thataddr); print "Attempting connection to $thataddr\n"; die $! unless connect (S, $that); print "Connected\n"; $cli_hello = 1; $vers = 2; $msg = pack ("C n4", $cli_hello, $vers, 5*3, 0, 16); $challenge = pack ("d2", rand, rand); #16 bytes $cspecs = pack ("Cn"x5, 1, 128, 2, 128, 3, 128, 4, 128, 5, 128); $len = 1+8+5*3+0+16 + 32768; $h = pack("n", $len); $totmsg = pack("a2 a9 a15 a16", $h, $msg, $cspecs, $challenge); print S $totmsg; print "Sent message, length ", $len-32768, "\n"; # Now for the interesting part read (S, $phd, 2); ($slen) = unpack ("n", $phd); print "Received length = ", $slen-32768, "\n"; read (S, $pm1, 11); ($smsg, $ssess, $scert, $sver, $sclen, $scspeclen, $scidlen) = unpack ("C3 n4", $pm1); print "Message type = $smsg\n"; print "Session ID Hit flag = $ssess\n"; print "Certificate type = $scert\n"; print "Server version = $sver\n"; print "Certificate length = $sclen\n"; print "Cipher specs length = $scspeclen\n"; print "Conn ID length = $scidlen\n"; if ($sclen) { read (S, $scert, $sclen); } read (S, $pspecs, $scspeclen); $nscspecs = $scspeclen / 3; @scspecs = unpack ("Cn" x $nscspecs, $pspecs); @ciphernames = ( "(undefined)", "RC4", "RC4_EXPORT40", "RC2", "RC2_EXPORT40", "IDEA" ); print "Supported ciphers:\n"; for ($i=0; $i<$nscspecs; ++$i) { printf ("\t%s, %d bits\n", @ciphernames[@scspecs[2*$i]], @scspecs[2*$i+1]); } read (S, $scid, $scidlen); close S; exit 0;

1 0

Mac PGPTools
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a Magic Money client for the Mac, so PGPTools MUST have been ported to the Mac. Does anyone know where I might find the source for Mac PGPTools? I am starting to think about porting the Mixmaster front end to the Mac. Thanks. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLvaQflVkk3dax7hlAQHwcQP+IQrZMS05Vtw/hNJKoR9hv61joYlv2CtP pyOzWMFW5gHopc29UR1lI311MJnnj3/vDRLhVtN3hDNGl4LsS6s6xNIRPpKdeoaT 0ESSGaWq7ddmVmFmhcta9b1sX8GsoHrJbjjDXTcOEKICo+0qZlHzgtGvLfArl0or /MI7guanhH0= =FqTm -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

scripts, recipes and things of that ilk
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Has anyone put together a compilation of all the perl and procmail scripts for integrating PGP into various mail readers? If so could you please forward a copy to me. Thanks, Sam ============================================================================== Bore, n: a person who talks when you wish him to listen. - Ambrose Bierce, "The Devil's Dictionary" 1911 ============================================================================== skaplin(a)skypoint.com | "...vidi vici veni" - Overheard | outside a Roman brothel. PGP encrypted mail is accepted and | preferred. | Change is the only constant in the | Universe..."Four quarters, please." E-mail key(a)four11.com for PGP Key or | Finger skaplin(a)mirage.skypoint.com | Smile!! Big brother is watching. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: This message digitally signed to verify the identity of the sender iQEVAwUBLvaRVclnXxBRSgfNAQFy5gf7BrK3LAKSWvAF6kJY+vbvcjsp/xuq+Voc khzmyouW9i1JFVm5xq8htXIqcazz6Vd51y9rSqQhUpMHZqA9IsT+oom1ifpD16v4 GGv/jGDYJWq8Zz1MRO7xnCqKL0jT9kWSbkGqC/flssE5xlyI2OxTh73S+jHnj7Qh YQoDWjZ2SZVBskjkLEUFnfqARY/ExQ5PghA39ZqGQfrFAoTLPz6XxAO5l3L5oGRv cEiUpvux8lUNM2Te727HjXtnwvcf3xseBqN5ncWwfb3ftDSJX8+FyIG+i2GVKnXS pt1cYmm3jWJLxbm3OSrOrxzHQj3gXo8Ulw3Uib7rkuszNYsEnJf/SA== =d6jk -----END PGP SIGNATURE-----

1 0

Re: Callback phones
by ddt＠lsd.com 17 Dec '03

17 Dec '03

At 10:19 am 12/10/94, Ben wrote: >I picked this up on the alt.2600 newsgroup. Seems like it could be used >for things like privacy enhancement if it was coupled with a credit >card/cashier's check that wasn't in your name along with perhaps a call >back loop. > >Ben. FYI: ----- The following addresses had delivery problems ----- <kallback(a)halcyon.halcyon.com> (unrecoverable error) ----- Transcript of session follows ----- ... while talking to halcyon.halcyon.com.: >>> RCPT To:<kallback(a)halcyon.halcyon.com> <<< 550 <kallback(a)halcyon.halcyon.com>... User unknown 550 <kallback(a)halcyon.halcyon.com>... User unknown

1 0

PGP Tools
by Mark Grant 17 Dec '03

17 Dec '03

On Mon, 19 Dec 1994, Andrew Lowenstern wrote: > It has been a while since I looked too, does it work with the 'new' format > messages generated by MIT pgp? I don't think it does by default, but you can just change the code that looks for a version number to accept version 2 or 3. Works for me... > Does anyone actually USE pgptools for any > available applications? As far as I know, nobody uses it. Magic Money Privtool Mixmaster Dunno about anything else.... > Either nobody really wants a PGP library > (which isn't true judging from the inquiries on cypherpunks), or something is > wrong with PGPTools. Is it the documentation like you said? Maybe some of > us should pick up where pr0duct cypher left off and enhance PGPTools. I'd say there are three problems, firstly there's very little documentation, which isn't a problem for those of us who can read and understand the source code, but could be for more general use, secondly it's not entirely legal in the US (patents, etc) and not widely available outside (there are some versions on ftp.dsi.unimi.it, but you have to actually go looking for it if you want to find it). The other problem is that the interface is very low-level, which makes it difficult to just take a standard PGP message and decrypt it in your program. You can get around the latter by using pgplib.c from Privtool (it's been released under the GPL), however it's only really been tested on Suns at this point and may need a bit of hacking - if you port it to other machines please mail me any bugfixes. It also has some potential security problems, for example there are lots of places where it should probably zero the memory that's been used but doesn't (I've fixed most of those in my own copy). But otherwise it's a pretty good product and I'm suprised that more people don't use it. There also appears to be a bug in pgpk_findkey() such that it only looks at the first id on each key, so if you request a key by another id it fails to find it. Does anyone know if Pr0duct Cypher is still updating PGP Tools, or should I look at fixing this instead ? Mark

1 0

Re: Pgp in Europe
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> As long as _Swedish_ law doesn't bar you from importing strong cryptography > into Sweden, you can grab PGP from wherever you like. But after access to a ftp-server inside of the states he never should go to America personally, I guess... Hadmut

1 0

Re: McCoy is Right! New Mail Format to Start Now.
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from junk.interesting: 19-Dec-94 Re: McCoy is Right! New Mai.. wcs(a)anchor.ho.att.com (616) > If there were a convenient MIME viewer to pop in as my PAGER, > I might have mail use it rather than less -sc, my current preference. This is precisely what metamail is for. It's in ftp://thumper.bellcore.com/pub/nsb/mm2.7.tar.Z.

1 0

Re: PGP-MIME spec (No Flames Allowed!)
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from radiomail-dups: 19-Dec-94 PGP-MIME spec (No Flames Al.. "JEFF LICQUIA @mhc.uiuc. (1794*) > I've noticed Mr. Borenstein's presence here in cypherpunks; I invite him > to clarify or update as needed. I think you stated it pretty well. I think we now have someone who has stepped forward to write the new MIME-PGP draft, in consultation with Phil Zimmerman and myself. (I won't name him in public, since he may prefer to keep a low profile for now.) I'm sure that when the draft is ready, its existence will be announced on cypherpunks. -- Nathaniel

2 1

C code contest
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

Elton(a)sybase.com wrote: >I gather that this was one of the entries in the "obfuscated 'C'" >programming contests that used to be held some years ago. >(Are they still held?) Yep, Mail chongo(a)TOAD.COM, co-incedentally T

1 0