December 2003 - cypherpunks-legacy

(fwd) Netscape V2 and Certificates
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text From: John Hemming CEO MarketNet <JohnHemming(a)mkn.co.uk> Date: Thu, 23 Nov 1995 18:54:36 PM PST To: www-buyinfo(a)allegra.att.com Mime-Version: 1.0 Subject: Netscape V2 and Certificates We have now spent an interesting time looking at Netscape V2. If you are interested in looking at V2 and how it relates to certificates not signed by Verisign please take version 0.15b of Workhorse at ftp://193.119.26.70/mktnet/pub/horse.zip (Windows 3.1) switch on the WWW server and try it out. Basically the client allows an SSL link to a server "signed" by a CA that it does not know ("EuroSign") the only problem being that if it does not know the CA then it cannot check the signature. I do think this is a major improvement, however, in that it raises properly the issue of authentication of servers and makes it clear that the client user should properly consider the server. At the end of the day the commercial strengths of the server merchant and its authorisation is more important than who has signed its certificate. I can happily obtain certificates for MarketNet even though there is a US MarketNet Corp. This is because I have a UK organisation called MarketNet. The name, therefore, is not in itself significant. It is also interesting that Netscape will be checking the domain name in the near future. Realistically many people have a large number of different domain names all pointing at the same server so a generic domain name is likely to be the most common registration anyway. At Eurosign.com we will be offering free Certification of a Keypair. We wish to ensure that further certification actually means something commercially viable (eg a Bank regulated by the relevant organisation). However, as our first offering we will be simply certifying that we have received valid certificate requests. (they will be short term certs, however) We have not fully allocated our domain name as yet (as far as I have been told) although the experimental server (not advised for live use as there are a number of flaws) was released today. Eurosign's alpha test site is at http://193.118.187.106/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: ALERT: On Monday, call Congress to stop Big Brother amendment!
by Declan McCullagh 17 Dec '03

17 Dec '03

>From the joint alert that Sameer reposted: >> Other amendments may be proposed. Please urge the Congressman to pass SAFE >> "as is" and oppose any amendments. But wait... The version of SAFE "as is" contains the ***FIRST EVER*** domestic restrictions on encryption! Why should it be passed intact? For the sake of Beltway politicking and deal-cutting? It includes very, very troubling severe criminal penalties for the use of encryption in a crime. When encryption is in everything from light switches to door knobs, any crime will include crypto, no? It would be like criminalizing "breathing air in the commission of a crime..." Why not just say "stop SAFE altogether?" No new laws are better than bad new laws. And even if the crypto-in-a-crime provisions are yanked, SAFE may be a bad bill. I wrote about this in June: http://cgi.pathfinder.com/netly/opinion/0,1042,1022,00.html "Please, do no harm here. Let's keep what we won," says Cindy Cohn, one of the lawyers mounting an EFF-sponsored court challenge to the White House's export rules. So far that effort has been successful: A federal judge ruled last December that the line-by-line instructions in a computer program are "speech" and restrictions on overseas shipments violate the First Amendment. Cohn argues that both Rep. Bob Goodlatte's (R-Va.) SAFE bill and Sen. Conrad Burns' (R-Mont.) ProCODE bill could do more harm than good. She says they might not even help her client, a university professor who wants to discuss encryption without going to jail. "What effect would SAFE or ProCODE have? Either none or a detrimental one," Cohn said on Monday at a conference organized by the Electronic Privacy Information Center. Why are these organizations -- CDT, VTW, Wired, EFF, ATR -- urging it be passed intact, as is? Why should Americans give up their rights so business can make more money on encryption exports? -Declan (Not speaking for anyone but myself, of course.)

1 0

A random-noise sampling device for DOS
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

I'm working on a random noise sampling device for DOS, and so far have a prototype version that samples the keyboard timings. I'm unsure of a good way to implement it... Device timings (and in the future periodic samplings of the mouse position or sound-card noise input) are put into a ring-buffer of raw data and the output is a straight secure hash of it... (when the output buffer is used it, it just rehashes the data in the buffer at the moment...) I'm looking for some advice on how to determine when the raw data has been "used up" and worth processing/encrypting before re-hashing it... This in mind, offers for eventual beta-testers (annnouncement will follow when it's ready), or suggestions for features (what to sample, device interfaces) would be helpful. Thanks in advance, Rob <wlkngowl(a)unix.asb.com>

2 1

Illustrations
by rmarquis＠umich.edu 17 Dec '03

17 Dec '03

Hello. I was wondering if anyone had any .gifs or .jpgs (on the web I suppose) which illustrate how encryption works. Just simple pictures and illustrations are fine. Thanks. -Bob ____________________________________________ Robert Marquis, Jr. University of Michigan - Dearborn e-mail: rmarquis(a)umich.edu www: http://www.umd.umich.edu/~rmarquis

1 0

Cypherpunk Certification Authority
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Tue, 28 Nov 1995, an impostor posing as Alice de 'nonymous wrote: > On Sun, 26 Nov 1995, Perry E. Metzger wrote: > > > Someone spoofing Alice, who is either Detweiler or "Dr." Cohen, says: > > > I have never signed any of my posts to this mailing list and frankly have > > > no intention of beginning at this point. > > > > Well, signed Alice posts have shown up, so we will just have to assume > > that the above was a spoof and that the signed Alice posts are the > > real ones, now won't we? > > Perry. Normally I try my best to ignore you. > > But I will simply repeat, I have never signed a post, and have no > intention of beginning to sign any posts, until I establish a secure > machine in a secure complex that is dedicated to that purpose. This insistence on not making use of authentication tools at the same time as whining about people spoofing you is what caused me to assume your identity. You were given ample warning. Consider it a demonstration of why you should do just what you are stubbornly refusing to do: generate yourself a damn key! It is the best way to ensure a persistent persona whilst retaining anonymity. > I like to think that I take my security somewhat seriously. For a purportedly security conscious impostor, you sure are reluctant to make use of simple authentication tools. Your risk assesment is seriously out of whack too. You do *not* need a secure machine to improve the level of authentication of your posts: signing your posts would provide better authentication than no authentication, even if the machine is not tempest shielded, nor in a secure installation. Finding your machine (we don't know remember), and installing a kernel patch to catch your passphrase as it is typed in, or snag it from PGPs core image is much harder to achieve, even if you are using a multi user system. PGP signing your post will give a much better authentication than people who post from known email addresses; forgeries, and machine breakins are not that hard to effect. > And I would ask whoever DID post the PGP key under my name, to please > issue a revocation certificate. Oh so you do care about authentication :-) An offer: you post your own key, and I'll post a revocation. You might find that people take you more seriously once they know they are talking to a persistent persona. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMLsT3obu8OQjKS7RAQE62gQAoTxWo6Dipa1bZeNi5NygZ/9CLJ2pn44s KN2TFWY0n1KPC4tibEM88GOI7vHCCLE8t/XQ2zx5YArjd/7toCidAlUY07vQ6ums sL4J8oV4JDKdpq9WTWaTS/unBww8qBJRVDBHigtiOneIkmu6kfuBEh0JR+a5plfQ 00GQ4SfcyBk= =SAXZ -----END PGP SIGNATURE-----

1 0

Re: politics aren't all or nothing
by Anonymous 17 Dec '03

17 Dec '03

Mark Hedges wrote: >Mostly, I just don't want to get nuked. I don't want the people in >Washington to get nuked. I don't want to be ostracized because a >disjointed group I'm associated with has members who support nuking >political opponents. "Nuke DC" is crap. "Ecash Assassination Politics" is >crap. The loss of faith in one's ability to convince other people with >rational discussion is crap. That whole attitude reminds me of the guys in >early grade school who beat up on me because I was a nerd. I refuse to >sink to their level. The guys who beat you up in grade school are now the ones who are running Congress. They haven't matured, they are just upscale and have learned better techniques. The only problem I have with Tim May's "Nuke DC" is that he lacks the necessary qualifier: "Nuke D.C. now, while Congress is still in session" ThermoNuclearMonger

2 1

Re: Certificate Authorities?
by rajaram＠morgan.com 17 Dec '03

17 Dec '03

On Nov 27, 4:46pm, Jeff Weinstein wrote: > Subject: Re: Certificate Authorities? > If you want a static list of CAs that netscape products > will accept, you will be disappointed. In the future > there will be more commecial CAs, many companies will run > their own internal CAs, and information providers will > provide certs to their subscribers to handle access > control to their sites. It is a losing battle to try > to maintain a static list of CAs. IMHO, Going with a more > dynamic, user configurable approach is the only way to > keep up. Yes. But... I deal with the security infrastructure for a large corporation. I want only security administrators to configure the list of acceptable CAs. I specifically do not want our users to be able to add new CAs to the list of trusted "approved" CAs. The concern is that some users who are not crypto enthusiasts may be "social engineered" into adding a very liberal CA to their list. Once this happens, the browser's signature verification capability is totally compromised. This is one of the reasons why PGP has not been adopted by many large companies. In response, Viacrypt now seems to have a product that can restrict user modifications to the public keyring. -raj

1 0

Re: Intelligence Community Massive Digital Data Systems Initiative
by Carl Ellison 17 Dec '03

17 Dec '03

I think the real capacity measure is the number of satellite surveillance images per day -- at their high resolution. Anyone know that resolution? - Carl

1 0

ANNOUNCE: NOISE.SYS random sampling device for DOS v0.2Beta
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Re: NOISE.SYS Random Sampling Device Driver for DOS (v0.2-Beta): I've finally gotten a usable version of NOISE.SYS written. The beta is ready for semi-public release and review. If you're interested in testing it or examing the code, email me at <wlkngowl(a)unix.asb.com> It's only a prototype version. I do not know any strong methods of testing random data. If anyone is willing to help on that part or point me in the right direction, it would be appreciated... What this driver does: When loaded, it hooks onto the keyboard interrupt (0x09) and collected fast timings between keystrokes. It can also be easily configured at compilation to sample other interrupts, as well as collect "seedling" keystrokes upon initialization. It sets up a character device called RANDOM, that when polled takes the earliest collected bytes from the random pool (size can be adjusted), combines them with a count-word based on the number of samples collected plus the number of times the driver has fetched data from the pool, transforms it using the Secure Hash algorithm, and outputs the bits from the hash. It's only a prototype: this version doesn't check to see if the pool is "empty" at the moment. Features: written in 386 assembler, takes under 2k of memory and can be loaded from the command line using a utility like DEVLOD. Also under GPL, so you've got the source-code to play with. Comments and criticism from crypto-gurus would be greatly appreciated. Reply if you'd like me to send a copy. (Important Q: is this software covered under ITAR?!?) - --Rob <wlkngowl(a)unix.asb.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOL8gNscUKerH0gxAQHNlAP/eZChSaAEg3go/vxfm9Z0Af5Dfa4WBDhh SfbbpsYfymSkxFbU7bHUfRMFHk+Uy57AeGMUxXkgml7KO8cxyOPS6yVDcNWf6Z9W OeXtXRAFBWRn3CblT1sQzl5YCEG93YBZS9ZkbTsN4rgTcpo15QY8vG5BJCEgfP9f 9XHn5VGSkVo= =jaNN -----END PGP SIGNATURE-----

1 0

ANNOUNCE: NOISE.SYS random sampling device for DOS v0.2Beta
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Re: NOISE.SYS Random Sampling Device Driver for DOS (v0.2-Beta): I've finally gotten a usable version of NOISE.SYS written. The beta is ready for semi-public release and review. If you're interested in testing it or examing the code, email me at <wlkngowl(a)unix.asb.com> It's only a prototype version. I do not know any strong methods of testing random data. If anyone is willing to help on that part or point me in the right direction, it would be appreciated... What this driver does: When loaded, it hooks onto the keyboard interrupt (0x09) and collected fast timings between keystrokes. It can also be easily configured at compilation to sample other interrupts, as well as collect "seedling" keystrokes upon initialization. It sets up a character device called RANDOM, that when polled takes the earliest collected bytes from the random pool (size can be adjusted), combines them with a count-word based on the number of samples collected plus the number of times the driver has fetched data from the pool, transforms it using the Secure Hash algorithm, and outputs the bits from the hash. It's only a prototype: this version doesn't check to see if the pool is "empty" at the moment. Features: written in 386 assembler, takes under 2k of memory and can be loaded from the command line using a utility like DEVLOD. Also under GPL, so you've got the source-code to play with. Comments and criticism from crypto-gurus would be greatly appreciated. Reply if you'd like me to send a copy. (Important Q: is this software covered under ITAR?!?) - --Rob <wlkngowl(a)unix.asb.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOL8gNscUKerH0gxAQHNlAP/eZChSaAEg3go/vxfm9Z0Af5Dfa4WBDhh SfbbpsYfymSkxFbU7bHUfRMFHk+Uy57AeGMUxXkgml7KO8cxyOPS6yVDcNWf6Z9W OeXtXRAFBWRn3CblT1sQzl5YCEG93YBZS9ZkbTsN4rgTcpo15QY8vG5BJCEgfP9f 9XHn5VGSkVo= =jaNN -----END PGP SIGNATURE-----

1 0