December 2003 - cypherpunks-legacy

New Computer Security Act
by John Young 17 Dec '03

17 Dec '03

The Computer Security Enhancement Act of 1997 (HR1903) is intended to replace the Computer Security Act of 1987. It redefines the role of NIST in meeting federal computer security and encryption requirements through cooperation of industry. Public use of encryption is also addressed in the bill. Two lengthy reports on the bill have been issued recently, both of which provide overviews of the current encryption debate. House Report 105-243, published on September 3, provides a detailed analysis of the bill, hearings held, floor remarks and mark-ups since introduction: http://jya.com/hr105-243.txt (115K) And one published today includes recent floor remarks on encryption, mostly supportive of public use: http://jya.com/hr1903-floor.htm (44K) One point of contention is the evaluation of foreign encryption. The original bill put that responsibility on NIST, but the latest version deleted that and leaves the task to BXA (and unnamed others). Moreover, there's dispute over committee jurisdiction for other provisions. Information security now attracts the swarm, with encryption the moths' beacon.

8 9

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33a.tar.gz For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub reord"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post ek reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord"; $remailer{"syrinx"} = "<syrinx(a)c2.org> cpunk pgp hash cut reord mix post"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub"; $remailer{"hroller"} = "<hroller(a)c2.org> cpunk pgp hash mix cut ek"; $remailer{"vishnu"} = "<mixmaster(a)vishnu.alias.net> cpunk mix pgp. hash latent cut ek ksub reord"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"spook"} = "<remailer(a)valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut"; $remailer{"precip"} = "<mixmaster(a)mix.precipice.com> cpunk mix pgp hash latent cut ek reord"; $remailer{"ecafe"} = "<remail(a)ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (robo hroller syrinx c2) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. remailer email address history latency uptime ----------------------------------------------------------------------- hacktic remailer(a)utopia.hacktic.nl *********+** 8:54 99.98% portal hfinney(a)shell.portal.com ###--###**-- 46:06 99.98% ideath remailer(a)ideath.goldenbear.com --.-----_.-- 10:46:11 99.98% wmono wmono(a)valhalla.phoenix.net ************ 12:41 99.97% ecafe remail(a)ecafe.org *##*#*##*#*# 1:06 99.97% alumni hal(a)alumni.caltech.edu *+#--***+*-- 46:01 99.97% robo robo(a)c2.org #--*##.#*#*# 10:10 99.92% spook remailer(a)valhalla.phoenix.net * *+******** 12:11 99.92% penet anon(a)anon.penet.fi --+++-----+ 3:25:44 99.90% replay remailer(a)replay.com * ******+** 7:06 99.88% mix mixmaster(a)remail.obscura.com ---------- 1:59:30 99.75% rmadillo remailer(a)armadillo.com ++++++++++ + 39:58 99.58% bsu-cs nowhere(a)bsu-cs.bsu.edu #-+#* *##++ 13:47 99.23% ford remailer(a)bi-node.zerberus.de ________ . 78:53:54 99.04% syrinx syrinx(a)c2.org __ .+-+--+++ 15:25:24 98.98% flame remailer(a)flame.alias.net **+***+ +** 22:20 98.00% vishnu mixmaster(a)vishnu.alias.net +*******-*+ 22:47 97.99% rahul homer(a)rahul.net +#*****+-**+ 9:18 99.95% c2 remail(a)c2.org +-- **.* - 46:46 86.40% extropia remail(a)extropia.wimsey.com - -..- 10:09:23 31.33% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

PGP signature legal standing?
by Russell Nelson 17 Dec '03

17 Dec '03

Is there any legal standing for a PGP signature? I'm tired of my luser customers faxing me legal documents, then expecting me to sign it and fax it back. Yeah, right, like photoshop can't cut-n-paste. I've got a fax modem on my Linux box, so I'm going to start (in fact have started) uuencoding the .g3 file, indicating my assent, and emailing it back to them. -- -russ <nelson(a)crynwr.com> http://www.crynwr.com/~nelson Crynwr Software supports freed software | PGPok | Freedom causes peace. 521 Pleasant Valley Rd. | +1 315 268 1925 voice | Taxes feed the naked Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | and clothe the hungry.

3 2

PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE
by sameer 17 Dec '03

17 Dec '03

For Immediate Release Date: Nov 6th, 1995 Contact: Sameer Parekh 510-601-9777 sameer(a)c2.org PRINCETON STUDENTS FIND HOLE IN INTERNET SECURITY SOFTWARE Two Princeton University grad students, Dan Wallach and Drew Dean, recently discovered holes in Sun Microsystem's HotJava web browser. In response to this finding, Community ConneXion, well known for offering rewards for exposing holes in internet security products, has decided to award them with a t-shirt and expand the Community ConneXion Hack line of promotions to include Java and Java-related products. Sun's Java product is alleged to allow people browsing the World-Wide-Web to execute programs on their own computers without worrying about whether or not the programs were viruses or not. The holes Wallach and Dean found show that there are a few things in the HotJava alpha implementation of the Java language which make viruses and other malicious programs possible within the alpha HotJava web browser. "We were very impressed with the HotJava concept, so we thought it would be good to poke around their implementation," said Wallach. "While we did find some interesting holes, we believe these can be addressed and Java could make a good standard for remote code on the Web, if an effective security policy is defined." Wallach and Dean released their findings initially in the RISKS Digest, and plan to publish a paper detailing their results. The holes they found make it possible for a malicious applet to set things up so as to be able to monitor or modify all of a given web-surfer's activity, after they ran the malicious applet exploiting the holes. By doing so the applet may make it possible to violate user's privacy by revealing to an third party their web traffic. The holes they found exist only in the alpha release of HotJava. The beta release, which is the version found in the widely-used Netscape Navigator 2.0b1J is not vulnerable to these attacks. "I don't want to be in the t-shirt business," said Sameer Parekh, President of Community ConneXion, "but we felt that these students' work deserved a t-shirt. Java has great potential for making the Internet much more powerful than it already is. It is very important that we examine Java and make sure that we can trust it." Community ConneXion, in addition to this Hack Java t-shirt promotion, is offering t-shirts to people who find holes in Netscape, Microsoft, and DigiCash. Information about the Hack Java promotion is available from http://www.c2.org/hackjava/. Community ConneXion is the premier internet privacy ISP. They offer anonymous accounts, remailers, and psuedonym servers, in addition to the standard ISP fare of webspace and dialup IP access. Information is available from http://www.c2.org/ or from sending email to info(a)c2.org. Java and HotJava are trademarks of Sun Microsystems, Inc. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation. The Hack Java promotion is not affiliated with nor sponsored by Sun Microsystems.

1 0

Crypto-law etc
by Chuck McManis 17 Dec '03

17 Dec '03

The longer I follow the crypto "debate" the more I begin to understand what must have been the real intent behind the 2nd amendment of the constitution. If the White House can get crypto code defined in the true legal sense (that is backed up by case law) as a munition, do US citizens then have a constitutional right to "bear" it? Just curious, --Chuck

3 2

SSL-encrypted apache web server available for beta-test
by sameer 17 Dec '03

17 Dec '03

I put together an SSL/Apache using mostly other people's work, but some of my own. It's available for beta-test to use non-commercial to US-persons. See http://www.c2.org/apachessl/ The README is attached. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org "I don't want to get into the t-shirt business." The release of Apache supports SSL, using Eric Young's SSLeay package and RSADSI's RSAREF cryptography library. Ben Laurie <ben(a)algroup.co.uk> wrote the interfaces to SSL within the Apache server, which was developed by the Apache Group. This release of Apache-SSL is maintained by sameer <sameer(a)c2.org>. For more information on sameer's releases of Apache-SSL see http://www.c2.org/apachessl/. For more information on Apache see http://www.apache.org/ For more information on SSLeay see http://www.psy.uq.oz.au/~ftp/Crypto/ For more information on RSAREF see http://www.rsa.com/ Portions developed at the National Center for Supercomputing Applications at the University of Illinois at Urbana-Champaign. This product includes software developed by Ben Laurie for use in the Apache-SSL HTTP server project. Use of this software is allowed for non-commercial use only, as described in the RSAREF license. For information on commercial use of this software, please see http://www.c2.org/apachessl/. This package is using Apache 0.8.14 -- not the most recent version of Apache. While every effort will be made to keep this package up to date with the most recent Apache version, that can not be guaranteed.

1 0

Re: [noise, personal reply] CBC address.
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

A post from Alice, that might be worth reading twice ... On Sun, 5 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > > On Sat, 4 Nov 1995 anonymous-remailer(a)shell.portal.com wrote: > > > Does anyone on this list know if the CBC has a web site on the Net? > <www.cbc.ca> They have a lot of shows in .au (so I hear) or accessible by > realaudio. Don't know if they have any mpigs [sic] though. There's an alt > newsgroup too. Uhhm, thanks ... I guess ... but I wasn't _really_ looking for the CBC web site. I was actually looking for someone to HOST a website which might showcase one particular program from the CBC, a program broadcast in Canada which highlighted how AECL (Atomic Energy of Canada, Limited) fails to practice safe computing and then when confronted, implements a calculated program of strategic misrepresentation. (i.e. they lie.) I thought that someone who strongly felt that error-free protocols and error-free methods were important -- especially in mission critical applications like medicine, commerce, or nuclear power plants -- might possibly contact the CBC, and either voluntarily donate some bandwidth and a host site, or conversely build a site devoted to showcasing the human tragedy that can follow in the wake of shoddily designed software. I mean, good grief, we have Atomic Energy of Canada taking a cavalier attitude towards computer code. Not only is AECL involved in nuclear medicine, in building wonderful radiological tools to help cancer patients (theoretically) live, but they BUILD nuclear reactors worldwide. The CBC broadcast documented how this international firm REACTS to reports of computer software errors. It documents how the firm reacts to reports of people dying because of sloppily written computer code. The program is NOT (unfortunately) on the www.cbc.ca website, but should be placed on the net and made available. I'm not sure how, that was misunderstood. But your next statement helped make it clear. > You oughta use Sameer's (or someone else's) replyable remailer when asking > questions Alice. I wasn't really asking for an answer, my Ottawa friend. I really wasn't looking for _another_ email in my mailbox to answer and address in my copious spare time. I was looking for some assistance. No direct reply was necessary. Someone could simply announce that they were volunteering to quarterback bringing a host website online, and dealing with all the issues that are involved with that (including liasing with the CBC.) I'm not *quite* sure how you misread what I was hoping to achieve. If however, you were looking to convince me to post to from a remailer that allows replies ... one that might let you send me known plain text back through it ... something traceable back to me ... then I *might* really understand, and I might beg off for a bit. Bit premature, and such ... I think I'll pass on _that_ offer, especially since I really wasn't looking for a personal private reply to what I wrote. Maybe, if I requote myself, it will be a little clearer all around. (That's, strike two, btw ... to my Ottawa friend.) Here's what I wrote: > I know that it is rude to follow up one of your own posts, and I > apologize in advance for this horrible faux-pas, but hopefully, it's > excused this one time. I wrote: > > > >One example of this that should serve as a useful case study is a recent > >problem which was brought to the Canadian public's attention just this > >week, on a program called the Fifth Estate. The CBC (Canadian > >Broadcasting Corporation) detailed a software code problem in one of > >AECL's (Atomic Energy of Canada Limited's) instruments which deliver > >penetrating radiation. > > > >The software which controlled the radiation dose, would periodically > >override the oncologist's calibration and deliver a radiation dose 100 > >times what was prescribed. This software "bug" literally killed wherever > >the machine was in use. > > Does anyone on this list know if the CBC has a web site on the Net? > > I'm hoping that someone (hint, hint) who has a convenient website, one > with lots of spare bandwidth could volunteer to contact the CBC and > persuade them to copyright clear the Fifth Estate program clip which > documented some of the risks of software bugs in mission critical > applications, and allow it to be placed on the Net. I'm hoping that this > English language piece reaches a wide international audience. > > The Canadian Broadcasting Corporation is a Crown Corporation which has > historically received its primary funding from the Government of Canada. > Recently, it has suffered under the budgetary ax, and the push for > privatization. I'm pretty confident that the Corporation would copyright > clear the clip for MPEG distribution across the Net, if they were > approached with the concept that the clip was a demonstration of the CBC's > journalistic excellence and integrity, a piece which is demonstrative of > the critical need to continue their funding. A concrete demonstration of > the need for the CBC. And a piece which could well receive deserved > international acclaim. > > The site would help them, and would simultaneously be a site of > international public service. > > Nothing will drive home the need for quality software, quality code, and > quality security more than the vivid graphic pictures of the consequences > of sloppy code, or of the risks if certain critical systems, LANs, or > private networks are compromised, or if security and privacy (which are > flip sides of the same coin) are ignored. > > The sight of a body, that has had a hole burned straight through it from > the front through to the spine is truly chilling and drives the message > home. Nothing seems to speak as clearly as a picture ... as to what the > stakes are ... of what "bugs" in code do ... and of what a network > compromise can leave in its wake. > > A picture of consequences. > > Six people died in Canada and the United States due to the software flaw. > Even after numerous reports of the flaws, the company refused to even > acknowledge the existence of a problem, and in fact did everything within > its power to make sure doctors, radiologists and physicists were unaware. > > The attitude of trivialization can only be characterized as fantastic, and > would be unbelievable to anyone who has not viewed the piece. > > It's one hell of a backgrounder which not only details problems, but looks > at solutions -- it examines attitudes, especially management attitudes. It > truly deserves an expanded audience. From teachers, to students, to the > international media, to the concerned private individual, all will be > served well if this piece gets wide attention. > > Takers, anyone?? Now, how on earth, (after rereading what I wrote) did my words get misunderstood?? And how on earth did someone figure that they needed to establish a bi-directional communications channel with me?? I mean it's not like I'm atacking AT&T or Netscape, I'm simply trying to coordinate a basic public service, and blow the whistle on bad code. Blow the whistle on software which people expect (rightfully) to be reliable ... software which people expect (rightfully) not to cause any human harm. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

New sendmail coming on toad.com; expect disruptions
by John Gilmore 17 Dec '03

17 Dec '03

Hugh and I will be installing a new sendmail on toad over the next day or two. You can expect some delays and troubles from the list over that period as we shake it down. We hope that the result will be faster and better service for y'all. John Gilmore

1 0

Re: toolkits?
by tcmay＠got.net 17 Dec '03

17 Dec '03

The most common typo (of any significance) I seem to make is leaving out the "not" in a strongly worded statement: >You may have gotten no responses because it generally is not up to a state >government to ensure that "mediocrity" in the Internet is avoided (though >I'm not sure what is meant by "mediocrity." If it is security and >anonymity, this is definitely the state government's responsibility, or ^ not >even area of interest.) It's almost as if I'm "leaning on the horn" so much as I'm typing, that I leave out the all-important "not" modifier. My apologies. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Recovering lost coins in ecash
by szabo＠netcom.com 17 Dec '03

17 Dec '03

> One problem a number of people have reported in DigiCash is disappearing > money. Several people have reported that if a transfer is misconfigured > the cash can flow out of the wallet, be rejected at the other end and > disappear from the system - i.e. misprinted names on cheques mean lost cash! These users need to learn the features of the software. Backups of spent coins are retained in the payment history ledger. Select the payment from the ledger, and hit _Cancel_ to cancel the payment. This credits the lost coins to your account. The story behind this (which is, alas, not so apparent to the user) is that this essentially spends the coins at the bank, so that if they were lost, the amount will be credited to your account. If the coins were already cleared and credited to the payee then you ask the payee for your money back (or to properly deliver the purchased service), relying on their business reputation (ie, complain loud and publically if you don't get satisfaction). For the latter case an escrow service would be a useful third-party add-on to the basic ecash system, to allow exchanges in larger amounts without incurring this risk from the payee. This bit of electronic magic is one place where ecash is superior to physical cash -- but at the expense of not being obvious from the metaphor. It also illustrates the superior flexibility of online clearing -- double spending is used as an error recovery tool, to find out whether the payment was in fact lost, rather than as an indication of fraud. Nick Szabo szabo(a)netcom.com Internet commerce consultant

1 0