December 2003 - cypherpunks-legacy

ANNOUNCEMENT: Mailcrypt 3.3 for GNU Emacs
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mailcrypt version 3.3 is now available. Mailcrypt is an Emacs Lisp package which provides a simple interface to message encryption with PGP. (You do use Emacs to handle your mail and news, right?) Features: Encryption, decryption, signing, adding keys, extracting keys, passphrase caching with timeout, multiple secret key (identity) support, a simple but flexible interface to Cypherpunk remailers (including chaining, response blocks, pseudonyms, and Mixmaster support), and an automatic keyserver interface via HTTP. *We* think it's the best interface to these functions anywhere, but then again, we're biased. The NEWS file is appended to this message. Obtain it through the Mailcrypt home page at http://cag-www.lcs.mit.edu/mailcrypt/ or from the FTP mirror at ftp://cag.lcs.mit.edu/pub/patl/ and enjoy! - Patrick J. LoPresti (patl(a)lcs.mit.edu) - Jin S. Choi (jin(a)atype.com) Tue Aug 1 15:00:27 1995 -0500 ====================================================================== Noteworty changes in Mailcrypt version 3.3: Numerous minor bugs have been fixed. Mailcrypt now requires at least FSF Emacs version 19.28 or XEmacs version 19.12. Sorry, but anything else is too annoying. Support has been added for reading mail under (ding) GNUS. Noteworthy changes in Mailcrypt version 3.2: Mailcrypt now uses "start-process" instead of "call-process-region" to run PGP; this uses a pipe instead of a temp file for various inputs, including your passphrase. Ahem. All Mailcrypt commands now start with the prefix `C-c /' to bring Mailcrypt into line with documented GNU standards. `mc-insert-public-key' is now bound to `C-c / x' (an in "extract") instead of `C-c a'. `mc-deactivate-passwd' is bound to `C-c / f' (as in "forget"). `mc-read-mode' and `mc-write-mode' are now full-blown minor modes. So you can do, for example, `M-x mc-install-write-mode' from a Text mode buffer and have the normal encryption and signing commands available. The keymaps for the modes are configurable variables. Interactive commands `mc-encrypt-region', `mc-sign-region', etc. are now defined. If you use RMAIL and you say no to "Replace encrypted message with decrypted?", you will be dropped into RMAIL mode for viewing. RMAIL summary mode is now supported. Documentation in the form of a Texinfo file is now part of the distribution. Mailcrypt can now fetch a needed key from finger, HTTP, or any of a list of locally stored keyrings. `C-c / k' initiates a fetch manually; Mailcrypt will offer to initiate one automatically as appropriate during encryption or signature verification. The remailer functions now support Mixmaster. `C-c / d' can handle conventionally encrypted messages. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMB6GjHr7ES8bepftAQGXLQP/W4sWXEWficWMlQ340StWd+RC5pJmFh4d 9jlAodH/Gmv1slPmJy21WDPqeyp+3z5BJ8BUgz98e7rqooZ3tB7Fy6cT4Q3UJ0Gv +WZQBkNV4tT7bNjCQxjIE3QrowGBeko0CZIMwGlRujioguHMgHcm8XTJO37ZuypB Sn24f/uPkGc= =8f59 -----END PGP SIGNATURE-----

1 0

Re: OS noise [Was: a hole in PGP]
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>On Mon, 31 Jul 1995, Phil Fraering wrote: > >> For better or for worse, we all must use programs (or collections >> of programs) that large or larger: even if PGP could be implemented >> in 1 % of the current source code, it would still be running in an >> operating system that's cramped in 4 megabytes of ram, because that's >> a characteristic of the common modern operating systems. > >Ahem! Commiedore APOLOGIED when it released its 512K OS a couple of >years ago. These things _don't_ have to be this large. Foo. Unix used to work just fine in 64K+64K split I&D space on a PDP-11 :-) It got bigger when lots of stuff was added, especially networking and X windows, and I wouldn't want to go back to small machines. However, during one such discussion on comp.unix.wizards or wherever, Dennis Ritchie posted a nice article about "Mine is smaller than yours", saying "here's how big my OS is" (I think ~250K, and the OS was 8th or 9th Edition), "telnet over to foovax, it's this big", "datakit over to barmips, it's that big", "some other networking method over to some other machine, it's that big", "yet another protocol over to yet another bigger machine", "display size of the operating systems on my 256K Blit and Gnot terminal, etc. And QNX's kernel fits just fine inside the cache on a 486, though it wouldn't actually stay there much. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

Re: a hole in PGP
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>It is definitely much more difficult to implant a backdoor into a program >which is available as source code than into a black box. > >BTW: Has anyone ever found a modified and weakened version of pgp ? Not that I know of, but there were some versions with a bug in the random-input generation - I forget if that was with ~2.2 or ~2.6.0; Colin Plumb had something to do with it. I've recently acquired ViaCrypt 2.7.1 for WinDows, and one nice feature is that in addition to typing in random keystrokes, you can click your mouse in a box and wave it around to input randomness. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

Re: a hole in PGP
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

> Now, my knowledge, time and resources are limited. I see that MIT >or whomever has made a program that, under test, is more secure than my >XOR 00000000 implementation. I may not fully trust them but it is better >than anything I could come out with. Foo. Clipper is better than anything I could come up with from scratch, and it's provably untrustable. (I could easily build better stuff out of existing pieces like DES and IDEA, but that's a separate issue.) Even Enigma's pretty strong, and look what it got its users... Some of Dr. Fred's distrust is well-founded. DES is also pretty good, and it's looking less and less likely that there's a secret NSA backdoor in it (other than differential cryptanalysis and maybe linear cryptanalysis), but it and IDEA and MD5 fundamentally depend on messiness and obscurity for their security (plus elimination of obvious holes.) Maybe the authors of IDEA are paid by the same space aliens who really run NSA? RSA has some provable strength to it, though it's not totally risk-free. (One Time Pads do too, and yet people manage to misunderstand and misimplement them almost as much as they mishandle keys.) If you want a provably strong cryptosystem, you could build one out of pure RSA, which would merely be painfully slow, but could be usable. Or you could build a Blum-Blum-Shub Random Number generator, and use it to generate one-time-pads (putting BBS into PGP version N+1 would be interesting...) However, the real weak point of PGP doesn't appear to be the algorithms, or the implementation (except ease-of-use issues); it's attacks on the computers themselves. TEMPEST is fun, if difficult and expensive, black-bag-jobs on keyboards are easy and effective if you're a good housebreaker, and you can always try viruses and trojan horses to distribute keystroke-stealers. I seem to remember that Dr. Fred was once a proponent of using viruses for good purposes for propagation of information or whatever? Anathema! #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- # Crypto in 3-4 lines of perl --> http://dcs.ex.ac.uk/~aba/

1 0

who cypherpunks
by Jonathon Fletcher 17 Dec '03

17 Dec '03

... oops. sorry folks

1 0

Re: a hole in PGP
by Marc Horowitz 17 Dec '03

17 Dec '03

So Dr. Cohen, what do you use when you want to send a message across the Internet with better security than cleartext? What do your recommend to others? Marc

3 4

Re: [NOISE] was Re: a hole in PGP
by ethridge＠Onramp.NET 17 Dec '03

17 Dec '03

>... >> Anyway, after reading the crap below I have been forced to comment. >> For an individual that parades the title of Doctor (and the indication >> of intelligence that title should imply) you seem to lack the grasp of what >> has been stated over and over again. If you can't study the source code, >> find somone that you trust that can! Prove it *doesn't* work before you >> knock it. > >So you claim that software is secure unless it has been shown to be >insecure, while I claim it is insecure unless it has been shown to be >secure. Which position do you think more sensible? (rhetorical >question, does not require any responses). I suspect the practical point of view is more sensible, but if that's what you meant i doubt that you would have called your question rhetorical. allen

1 0

"The Future does not Compute"
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I am reading "the Future does not Compute" by Stephen L. Talbott. I wonder if anyone else has gotten into this. Its a fairly interesting read that is some of the typical trendy reactionism against the utopianism of various visionaires promoting cyberspace and the bit revolution. Talbott however seems to be awfully vague in his criticisms. They seem to amount to, "I'm not sure what the net is missing, but it lacks something crucial that is the essence of our humanity". It reminds me of the various criticisms against AI by Penrose and Searle, "the technology fundamentally lacks, and will continue to lack, that inexpressible something that makes us human which is impossible to define or characterize." One quote drew my attention. He quoted an anonymous participant on an "irvc-l" discussion list: While I'm not forecasting Utopia, I think networks of the future will be the most incredibly egalitarian technology ever invented. It will transform our entire societies. Imagine that homeless people or single parent children can "interconnect" with anybody who is willing to talk to them in the *world*. The possibilities are rather dazzling. Sure, there might be even cyberspatial outcasts, but the point is that we will be doing *at least* as well as we are now, which is not something to "write home" about. The writing seems vaguely familiar, yet I can't quit pin it down. I think I might have been on that list in the time period, and I am trying to figure out the authorship. (And am a bit annoyed at Talbott for not giving proper credit.) Surely one of the visionaires like Gilmore, Barlow, Rotenberg, or somesuch. Its an interesting theme; I think it may have been the same author who said, quoted by Talbott, "the net is fundamentally democratizing and leveling." If anyone recognizes that quote, maybe drop me a line. Talbott uses this theme of whether "the Net is inherently democratizing and leveling" as a counterpoint thought to the chapter, even at times the whole book. I am inclined to agree with Talbott in general, by the way, and I think the quotes are overstated. In my opinion networks are like all other technologies: they bring out the best and worst in human beings, beyond what was known previously. In this way technology is like a magnifying glass on our virtues and vices. We may find the things that work about our society magnified, but at the same time our failings become expanded and exacerbated as well. That is what I like about great technology. It is not necessarily an ends in itself, but a way of learning about the essence of our human psychology. It forces us to confront what we find uplifting and what we find despicable, and removes the possibility of denial. It seems to me that networks are inherently democratic in a society that craves democracy, but I don't really believe that there is fundamentally something egalitarian or democratic about certain kinds of technology. Actually, I think that is true in general if *everyone* is given access to the techology, but the problem is that some governments can use the technology for themselves as a powerful instrument of control by the elites over the downtrodden. To me Talbott has a very good point, that we should be thoughtful in the creation of new technology, and examine our axioms as to whether we can even achieve what we are attempting to derive from it in the long run. The Thoreauian quote, "men have become the tools of their tools" comes to mind repeatedly when I read Talbott. ~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ \ / ~/ |\| | | |> | : : : : : : Vladimir Z. Nuri : : : : <vznuri(a)netcom.com> \/ ./_.| | \_/ |\ | : : : : : : ftp://ftp.netcom.com/pub/vz/vznuri/home.html

1 0

Billing for internet usage
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

>From time to time there is noise about billing for information transfer on the internet. Historically, it cost more to do the billing calculations then it was worth, yet you still hear about people wanting to figure out how. One way would be to perform cooperative billing balances between nodes, and allow each node to 'bill upward'. This means that any two machines are more interested in their relative balance than how much money they are really spending. There are some interesting problems of trust and reliability, that might be solved through the use of digital money. Then there is the wiley programmer (or machine) that applies expert solutions to the problem trying to 'route' around billing imbalances. With sophisticated enough algorithms such machines would be basically trading on billing futures, perhaps demonstrating that computers could be better capitalists than people. Imagine a communications network that collapses because of an economic crash. Would the internet require the equivalent of suspension of programmed trading (routing) and a FTC?

1 0

There's a hole in your crypto, dear Eliza dear Eliza...
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Alright, here's my 2 cents worth for this petty flamewar... Once upon a time, there was PGP 2.3. MIT had nothing to do with it. The population of the net that used the program was fairly small. In addition to being small, they were all (mostly) computer literate people. These people were confident in the security of PGP because the had read and understood the source code. It was checked and declared good. Then, in stepped MIT. I, and a few others, raised concerns about a possible conflict of interest with MIT distributing the code, and encouraged everyone to double check the code for back doors and other NSA nasties. It was checked and declared good. Now, we are in the present. MIT is still part of the equation. However, the demographics of the net have chaged. Fewer people are here that (by percentage) are computer literate to the level to do source code investigations. A few question why they shoudl trust PGP when they don't know it's secure. We, those who have grown up with PGP, point out that it is good, yet that really isn't a great reason to trust it. So the question is, why shoudl non-technical people believe that PGP is good? They don't have the skills to check it for themselves, and you have to admit that the associations of MIT with various TLAs are at the very least concerning. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMB2F0DokqlyVGmCFAQGhpgP9EIaGx3cHG78pFic0poPsgI/Yo1UNn6SY gRG9kfx3M1XzWITND5m2ywUx1B9n48hGoPfgP9ISvGoXDd5/yHgsY6uEjzZCGaLU tXzace1PvdjL5htH9prvh5GMoghCi34B9cDh01d1U2hKXEypj1pTRA+z+xWUfnGT teMJ9uEaOu0= =2aWA -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ Finger for Geek Code Info <=> Finger for PGP Public Key \/ / -=-=-=-=-=- -=-=-=-=-=- \/ http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.0 GED/J d-- s:++>: a-- C++(++++) ULU++ P+! L++ E---- W+(-) N++++ K+++ w--- O- M+ V-- PS++>$ PE++>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G++++>$ e++ h r-- y++** ------END GEEK CODE BLOCK------

3 2