December 2003 - cypherpunks-legacy

SSLeay 0.5.1
by Eric Young 17 Dec '03

17 Dec '03

SSLeay 0.5.1 is now available. It should be quite stable and has documentation for the lower level cryptographic routines. It is incompatible with the previous version but has no global variables of consequence so it should be a much nicer starting point for threaded libraries. The library should have no memory leaks and the general cryptographic functionality has been filled out more. Tim Hudson <tjh(a)mincom.oz.au> will be updating the applications available on ftp.psy.uq.oz.au in the next few days. I leave for an 11 week holiday today so please address any problems and questions to the ssl-users(a)mincom.oz.au mailing list (if it is of general interest) or to ssleay(a)mincom.oz.au which goes to both myself and Tim Hudson (who will be fixing any bugs while I'm away). Anouncing software and then leaving for 3 months would probably not normally be considered a good practice but 0.5.0 has been tested for the last week or so and I have faith in Tim Hudson's ability to fix bugs after doing pre-alpha testing for the last 6 months :-) As per usual, the primary ftp site is ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL http://www.psy.uq.oz.au/~ftp/Crypto Documentation on the demo application is sparse but I hope Tim Hudson will be able to fill in the gaps while I'm away :-) eric <eay(a)mincom.oz.au> -- SSLeay v 0.5.1 21/12/955 Copyright (c) 1995, Eric Young All rights reserved. This directory contains Eric Young's (eay(a)mincom.oz.au) implementation of SSL and supporting libraries. The current version of this library is available from ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/SSLeay-x.xx.tar.gz There are patches to a number of internet applications which can be found in ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps/ A Web page written by Tim Hudson <tjh(a)mincom.oz.au> can be found at http://www.psy.uq.oz.au/~ftp/Crypto This Library and programs are FREE for commercial and non-commercial usage. The only restriction is that I must be attributed with the development of this code. See the COPYRIGHT file for more details. Donations would still be accepted :-). The package includes libssl.a: My implementation of Netscapes SSL v 2 protocol. This library implements the SSL protocol. libcrypto.a: General encryption and X509 stuff needed by SSL but not actual logically part of it. It include routines for the following: libdes - My libdes DES encryption package which has been floating around the net for a few years. It includes 15 'modes/variations' of DES (1, 2 and 3 key versions of ecb, cbc, cfb and ofb; pcbc and a more general form of cfb and ofb) a fast crypt(3), and routines to read passwords from the keyboard. RC4 encryption, IDEA encryption - 4 different modes, ecb, cbc, cfb and ofb. MD5 and MD2 message digest algorithms, SHA (SHA-0) and SHA-1 message digest algorithms, RSA encryption/decryption/key generation. There is no limit on the number of bits. Diffie-Hellman key-exchange/key generation. There is no limit on the number of bits. X509 encoding/decoding into/from binary ASN1 and a PEM based ascii-binary encoding which supports encryption with a private key. Programs in this package include enc - a general encryption program that can encrypt/decrypt using one of 17 different cipher/mode combinations. The input/output can also be converted to/from base64 ascii encoding. dgst - a generate message digesting program that will generate message digests for any of md2, md5, sha (sha-0) or sha-1. asn1parse - parse and display the structure of an asn1 encoded binary file. rsa - Manipulate RSA private keys. dh - Manipulate Diffie-Hellman parameter files. crl - Manipulate certificate revocation lists. x509 - Manipulate x509 certificates, self-sign certificates. req - Manipulate PKCS#10 certificate requests and also generate certificate requests. genrsa - Generates an arbitrary sized RSA private key. gendh - Generates a set of Diffie-Hellman parameters, the prime will be a strong prime. ca - Create certificates from PKCS#10 certificate requests. This program also maintains a database of certificates issued. verify - Check x509 certificate signatures. speed - Benchmark SSLeay's ciphers. s_server - A test SSL server. s_client - A test SSL client. s_time - Benchmark SSL performance of SSL server programs. Documents included are A Postscript and html reference manual (written by Tim Hudson tjh(a)mincom.oz.au) A list of text protocol references I used. A initial version of the library manual. To install this package, read the INSTALL file. This library has been compiled and tested on Solaris 2.[34] (sparc and x86), SunOS 4.1.3, DGUX, OSF1 Alpha, HPUX 9, AIX 3.5(?), IRIX 5.[23], LINUX, NeXT (intel). For people in the USA, it is possible to compile SSLeay to use RSA Inc.'s public key library, RSAref. From my understanding, it is claimed by RSA inc. to be illegal to use my public key routines inside the USA. Read doc/RSAref.doc on how to build with RSAref. Read the documentation in the doc directory. It is quite rough, but it lists the functions, you will probably have to look at the code to work out how to used them. I will be working on documentation. Look at the example programs. There should be a SSL reference manual which is being put together by Tim Hudson (tjh(a)mincom.oz.au) in the same location as this distribution. This contains a lot more information that is very useful. For a description of X509 Certificates, their use, and certification, read rfc1421, rfc1422, rfc1423 and rfc1424. ssl/README also goes over the mechanism. We have setup some mailing lists for use by people that are interested in helping develop this code and/or ask questions. ssl-bugs(a)mincom.oz.au ssl-users(a)mincom.oz.au ssl-users-request(a)mincom.oz.au This library is reasonable stable now. Version 0.5 has had extensive rewriting since version 0.4. The purify package has been used extensively and I believe most if not all memory leaks have been removed. There are no writable global variable so a multi-threaded/DLL version of the library should be quite simple to write. Look at TODO for a list of thinks I know I still need to do. eric (December 1995) Eric Young (eay(a)mincom.oz.au) 86 Taunton St. Annerley 4103. Australia.

1 0

Cypherpunks resumes?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Is there any chance of seeing a Cypherpunks 'Rogues Gallery' of sorts in the archives anytime soon? It would be nice to see a face connected to the postings here. Some of us don't get the chance of getting out west for the parties, The only other thing I know about Tim May besides being one of the Fathers of the Cypherpunks is that he was a naked hippie in a hot tub at some party that Robert Hettinga was at some weeks ago, That doesn't paint a good picture for me. Thanks, A.E.N.

1 0

Re: The Problem With Blaze And Weinstein
by blancw＠accessone.com 17 Dec '03

17 Dec '03

>From the Fool on the Hill(aka ECafe): ATT and Netscape are both tools of the CIA/NSA. Blaze and Weinstein are in on the plot to force GAK upon us.... ..Only true visionaries like myself and Dr. Frederic B Cohen are telling it like it is; everyone else has had the wool pulled over their eyes by the NSA/ATT/Netscape axis. ................................................... Surely you're joking, Mr. Feynman! Cpunks, do you not "get it" - This has to be a jest, poking at some of the attitudes which have been expressed on the list. I think it's a bit late, though, as most of the excitement has calmed, and this must be why it's not recognizable. (if you think it's worth a comment, at least make it *funny*!, right.) .. Blanc

1 0

Re: on web standards: sent to Markoff
by blancw＠accessone.com 17 Dec '03

17 Dec '03

Attila: I'm surprised at you. I thought you were anarcho-capitalist. Oh, well; I have a few pithy comments in reply to your post (but anything beyond this will be in private email). I'm tempted to say back to you, as you just recently stated: "if you have not walked in the other's shoes, keep silent." Have you read any of the books on Microsoft or Bill Gates? I think this would provide you with additional perspective on your conclusions about him and the company. But think about this: . no company which MS has done business with has been coerced into dealing with the company and its products. Those who felt compelled to do business on Billg's terms were influenced by their desire to reap the lucrative benefits of it. . no customer has been coerced into purchasing the products offered; they were not prevented from shopping for computers from companies which do not pre-install the OS; if it was already installed on the machines they purchased, they were free to delete it, they were not coerced into using it or into upgrading to the next release. . not only have many software companies not take advantage of the opportunities created for cashing in on the unexpected popularity of MS software, . there have been occasions where competitors failed to see opportunities in the market which Microsoft did and took aim for, or . attempted business deals/associations among competitor software companies did not come about, thus failing to create a concerted competitive threat to Microsoft, or . a dominant software product from a competitor suffered in the market place, (sometimes from the fault of "bad management"), thus again giving the advantage to Microsoft. Often it has been what the competition *didn't do*, which gave Microsoft the advantage in the "market place", rather than any amazing magical business savvy or "unethical business practices". Nevertheless, as someone at MS said, "it isn't the customers who are complaining". There have been many willing participants, apparently, who have cooperated (or "conspired", if you will) in making the company the success which it has become. And continue to do so. .. Blanc p.s. Nuri-logical: I like your idea for a "dog-eat-dog" welfare fund.

1 0

Re: The Problem With Blaze And Weinstein
by Greg Broiles 17 Dec '03

17 Dec '03

At 01:12 AM 12/21/95 GMT, "Bill Gates" wrote: [...] >Evidently the cypherpunks are all too impressed >with Blaze and Weinstein's master degrees to see >what's really happening. Only true visionaries >like myself and Dr. Frederic B Cohen are telling >it like it is; everyone else has had the wool >pulled over their eyes by the NSA/ATT/Netscape axis. > >It's amazing how clear everything becomes once >one stops taking the medication that THEY prescribed. > >s/ Bill Gates Oh, I see. I think you misspelled "troll". Hope this helps. -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Re: King Kong Does e$
by Hal 17 Dec '03

17 Dec '03

Thanks to Bob Hettinga for typing that long message about the Microsoft "ecash" scheme. That is some nimble note-taking. I have a few comments on the scheme as Bob presented it, and as it compares to Digicash. I will follow up with some commentary about the politics involved. > Customer chooses secret s, serial number n, n=h(s) and amount. > Customer pays bank (by any method) the amount of the desired banknote > bank signs serial number and amount > Transaction may be anonymous (physical cash purchase at bank) pick > serial number, bank uses private signature to sign the serial number. >[...] > How is it used for payment > Payer simply gives bank note to payee by handing over the secret > payee immediately exchanges the banknote for new ones anonymously, if > desired > Old banknote is now invalid, since bank has its secret; hence payer > can't respend it > If the bank note is already invalid, bank rejcts exchange and informs > payee. > "In effect, these are disposable banknotes" The withdrawal protocol has some similarities to online Digicash ecash. In that system, you choose a random number s, calculate a one way function h(s), and get that signed by the bank. Unlike in the Microsoft scheme, blinding is used for the signature. I imagine Microsoft avoids blinding because of the patent situation, and possibly due to legal concerns about anonymity (more on this below). With Digicash, the coin is then the pair s, SIGN(h(s)). This is then given to the shop as payment. It can check the bank's signature, but that is not enough; being an online scheme, it must also turn the coin in at the bank to prevent double spending. The bank checks the signature and that the coin is well formed to accept it. The Microsoft scheme is like an unblinded version of this. The bank simply signs h(s) and gives that to the customer. This allows a simplification in the spending. Instead of passing s, SIGN(h(s)), it is enough just to pass s. The payee gives this to the bank (since this is an online system), which given s can calculate h(s) and check this against a list of all valid coins. It knows the valid coin numbers because it saw them when it signed them (unlike with Digicash). So there is a slight space savings in the spending protocol. It is also not necessary for the messages to and from the bank to be encrypted during the withdrawal protocol; neither knowing h(s) nor SIGN(h(s)) will allow an attacker to spend the coin, since he doesn't know s. A similar thing is true of DigiCash, though, where the blinded pre-signed or signed coins are useless to an attacker since he doesn't know the blinding factor. The big problem then with the Microsoft system is that it is not anonymous. As a result, it is technically not electronic cash, at least as the word is used in the literature. However we are seeing so many proposals like this, all of them wanting to capitalize on this magic word "cash", that I suppose the definition has to be considered to be shifting. In the new usage, virtually any payment system can be called cash if there is some way that users can be anonymous in using it. And since by allowing anonymous accounts virtually any payment system can do this, the word is becoming meaningless. The problem I see in practice with using their cash anonymously is how to buy it. If I have an account with the Bank of Microsoft, and I withdraw some "mcash", deducting it from my account balance, that mcash will be linkable to my account when I spend it. In order to be anonymous I have to buy the cash anonymously. I can walk into the local bank with a floppy and some dollar bills, but that is not practical in general. I could use mcash to buy some more mcash, but even if the second transaction is anonymous, the bank knows that I was the one who withdrew the first set of mcash, so it can link me to the second set when it is spent. The only good solution I can see is to use Digicash ecash to anonymously buy Microsoft mcash, but I doubt that that is what they had in mind! Frankly, what I see in this message is another example of something which is starting to become common: marketing to cypherpunks. In a way it is a very positive sign, that our views and concerns are becoming so well known and widespread that companies like Microsoft and Netscape are doing their best to keep on the good side of people like us, who are concerned about strong privacy and security. In some ways our attitudes are becoming dominant on the net, thanks to the many excellent writers here, as well as magazines like Wired, and groups like the EFF and other interest groups. But this influence is making us a target of companies who know that gaining our approval, or at least avoiding our criticism, is important for success on the net. In many cases, such as the recent flap over Netscape's attitudes towards key escrow, I detect a whiff of two sidedness, in which one attitude is presented for the benefit of government and law enforcement interests, while another posture, more acceptable to cypherpunks, is adopted on the net. With Microsoft, they use the magic word "cash" a great deal, in my view hoping that we will line up in favor of the idea. But as I have explained it is not really anonymous, no more so than any other payment system. And it is not at all clear that the kinds of anonymous accounts that would be necessary to really make it anonymous will be allowed. In that case, Microsoft can just shrug and say, "well, we tried." They get the best of both worlds. They make the government happy by providing a traceable payment system, while they look good on the net by pushing "electronic cash". I don't have any proof that this is exactly what is going on. But it is possible, and I think we have to be skeptical and at least open to the possibility that this kind of manipulation is occuring, no matter how many assurances we get from the companies involved that they are really on our side. Finance is a high stakes business and there is a lot of government regulation involved. Where our interests and the government's diverge, we need to watch closely to see whether the companies' actions match their words. This kind of marketing is going to continue to increase, I expect. Hal Finney

2 1

Re: The Problem With Blaze And Weinstein
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

I was not interested in starting a flame but I seem to have ignited one. I'm sorry about that. Since almost nobody sees these people from big corps as having a conflict of interest by being here I am willing to drop the subject having raised the point. It just seemed funny to me that cypherPUNKS would be so happy to have these fortune 500 types running the show. I guess I see the point that these people have something to contribute as long as they are honest about who they are. I have to say it rubs me wrong though. Like I said I've written a lot of code in my day and many of you are probably running some of it while you read this (enough said). I just don't want to depend on att or netscape to protect me. Even if they do a good job the cost of using their stuff is too high (for example the fine print in that att product). Lets write our own code and gpl it so no one can take it away! s/ Bill Gates

1 0

Re: COMMUNITY CONNEXION PIONEERS PRIVATE ELECTRONIC COMMERCE
by Robert Heffren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 19 Dec 95, sameer <sameer(a)c2.org> wrote; > COMMUNITY CONNEXION PIONEERS PRIVATE ELECTRONIC COMMERCE > Community ConneXion today announced a new service for its customers > which will make secure, private electronic commerce more accessible > to all merchants, from the small single-person business to large > corporations trying to sell goods and services over the > world-wide-web. There went the neighborhood. The Prez and the Coalition on one side and big biz on the other. AOL and their stings, all the motherfuckers spamming the piss out of everybody else and every place you turn, some swinging dick wants to put his goddamn hand in your pocket. Fuck it! Shut this sonfabitch down and take up doll-collecting. Who NEEDS this bullshit! Unsub this bastard AND gone; -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMNlMrBMzypiVqpjNAQG/fAL9GS5NiWR/5mb+KbKwxp2wSB6MUliwJaEV uBb+a7F5s7PQ0lQEWfujPKIoaF/iCB0zRKN0yLWCuvNiQe3YWMnwn5WggPekDRPl 0b3u37WHmeCKyhamMixnyK4w7jjT2use =WaxG -----END PGP SIGNATURE-----

1 0

Microsoft Flame[tm] [NOISE]
by roy＠cybrspc.mn.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There's a lot of finger waving going on over Microsoft's alleged predatory practices. I just want to remind the pro-MS folks of something. Microsoft has a documented track record of using undocumented entry points in their OS and Windows products. These entry points allow MS apps to do some things more efficiently than a competitor which uses the published API. MS has been known to rearrange these undocumented calls, resulting in sudden incompatibilities with competitors. (remember when Win3.1 came out and DR-DOS was suddenly unable to run Windows?) And in the MS countersuit against Stac Electronics, MS successfully argued that undocumented system calls were protected as Trade Secret material. While this isn't the grand-scale conspiracy some people seem to see, IMHO it's still predatory. Perhaps the call to separate the OS and apps divisions is a good idea. It would be interesting to see if Microsoft could maintain its edge in applications when it had no sub rosa advantage in OS access. - -- Roy M. Silvernail [ ] roy(a)cybrspc.mn.org PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)cybrspc.mn.org -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNlXShvikii9febJAQFoGgP/YtHdGqO8++MfZmk3h61F8SmJBfPYfa1R JlccdIP9BZHVXZseao9b9DqxLY1xRYkK6fWETielJaSjXZKam1WlYKFzL5E8Hf1z IXQmj7rCIIfvqvq3byJq8B3IUbT4UnTMNDAHVlNUwkzrcJ+py8czsWtNy15g3ahY NzYL8UsOtwI= =MpV3 -----END PGP SIGNATURE-----

1 0

cyphernomicon
by avatar＠mindspring.com 17 Dec '03

17 Dec '03

If anyone is interested I would be willing to e-mail a copy of the cyphernomicon to you. BEWARE that it is 1.3MB in file size and 414 pages in text. Charles Donald Smith Jr. 582 Clifton Rd. N.E. Atlanta, Ga. 30307-1787 (404)-378-7282

1 0