December 2003 - cypherpunks-legacy

FTS2000 Security Info and RFP
by Mark O. Aldrich 17 Dec '03

17 Dec '03

The URL's for FTS2000 RFP, Security Policy data, and assorted sundries are: http://post.fts2k.gsa.gov/ (the official government stuff) http://204.70.134.242/policy/ (This appears to be an MCI server and I don't know if they know that this stuff is online) Enjoy. ------------------------------------------------------------------------- |Just as the strength of the Internet is |Mark Aldrich | |chaos, so the strength of our liberty |GRCI INFOSEC Engineering | |depends upon the chaos and cacophony of |maldrich(a)grci.com | |the unfettered speech the First Amendment|MAldrich(a)dockmaster.ncsc.mil | |protects - District Judge Stewart Dalzell| | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Re: crypto and bagpipes [NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 01:01 PM 6/29/96 -0700, Michael Myers wrote: >>Perry E. Metzger wrote: >>| vinnie moscaritolo writes: >>| > >>>Mr Brooks, the piper, > (...) >>| > >>>claims he wasn't playing a musical >>| > >>>instrument, but practising with a weapon! >>| > >>> >>| > >>>The imagination boggles if his claim is successful! >>| >>| No one who has heard sustained bagpipe playing can deny the fact that >>| bagpipes are indeed an instrument of war, with no legitimate place in >>| peaceful everyday society. >>| >>| Perry > >Of course...when bagpipes are outlawed... Do you mean the FULL-AUTO "Assault Bagpipes," the ones that produce more than one "toot" per blow? Or the more "responsible" (but still dangerous!) semi-auto bagpipes, where you have to blow each time you want a toot. Jim Bell jimbell(a)pacifier.com

3 2

MacPGP 2.6.3 released
by Zbigniew Fiedorowicz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have put FatMacPGP2.6.3 v 1.6 on my web page http://www.math.ohio-state.edu/~fiedorow/PGP for distribution in the US and Canada in accordance with ITAR. The distribution is encrypted and you have to read the file README.txt for instructions on how to decrypt it. Here is a description of the main features of FatMacPGP2.6.3 v 1.6 from the README in the distribution: Enclosed is version 1.6 of FatMacPGP 2.6.3. This is a Macintosh port of the international version PGP 2.6.3ia released 04.03.96. The underlying PGP cryptographic code is the same as in the international release, except that it uses the RSAREF1.0 RSA library instead of Philip Zimmermann's MPILIB, in order to conform with US Patents on RSA. Also the legal_kludge switch, which allows interoperability with infringing pre-2.6 versions of PGP, is disabled. FatMacPGP 2.6.3 will run in native mode on a Power Macintosh, and will also run on 68K Macintoshes having a 68020 CPU or better. It will NOT run on Macintoshes with only a 68000 CPU such as Pluses, SE's, Classics or PB100's. It contains all the enhancements and bug fixes of PGP 2.6.3ia such as 1) It allows recipients of a public key message to be read in from a file containing the list of recipients, one per line. (Unlike previous versions of MacPGP it will not crash if the number of recipients exceeds 5 or 7.) 2) When extracting multiple keys into an ascii file, the each key is put separately into its own block, neatly labelled with the key id and user ids. 3) Better support for 8 bit character sets, ie. characters you get by holding down the option key. 4) Userids can be automatically signed with your secret key when creating keys ('pgp -kg') or adding new userids ('pgp -ke'). This is controlled by the AutoSign flag in the Options menu. 5) The misfeature of the initial 2.6.3i release, which didn't allow softwrapped text to be treated as text has been removed. 6) When clearsigning messages, FatMacPGP 2.6.3 will add a "Charset:" headerto the signature block, explaining which character set was used for creating the signature. This will help the recipient of the message to select correct character conversion when verifying the signature. If he/she is using version 2.6.3i, PGP will automatically choose the correct character set, thereby eliminating a lot of "Bad signature" problems. In addition to the above FatMacPGP 2.6.3 has many enhancements and bug fixes relative to previous versions of MacPGP. 1) Unlike MIT MacPGP 2.6.2 contains native Power PC code. Consequently it runs typically about 1.5 to 2 times faster than the MIT version on PPC machines, and even faster for large keyrings or large keys. It also runs typically 10-20% faster on 68K machines. 2) It has a greatly enhanced AppleEvent suite. For instance, unlike the MIT version, it is not necessary to write data to temporary files before passing it to MacPGP for en/de/cryption or signing. FatMacPGP 2.6.3 accepts AppleEvent TEXT parameters up to 32K in size in memory and returns the processed data as a parameter to the reply AppleEvent. (See the accompanying documentation for further details.) 3) It has options for automatic hardwrapping and detabbing of text, which should make electronic transmission of clearsigned messages more reliable and increase interoperability with many DOS and Unix text processing programs. 4) It has an option for stealthifying PGP encrypted files, removing any trace of their provenance. The resulting files can't be distinguished from white noise and can be completely concealed by "stegoing" into graphics and audio files. (There is of course also an option for destealthifying.) 5) It has an option for using SHA1 as the hashing algorithm for PGP signatures, instead of MD5. (Dobbertin has recently made some dramatic progress towards cryptanalyzing MD5. If he is successful, this might call into question the reliability of PGP signatures under certain circumstances.) This is an experimental feature which is not compatible with earlier versions of PGP. (It is not compatible with the proposed standards of PGP 3.0 either. But 3.0 is supposed to be deliberately incompatible with all 2.x versions to avoid the RSA patent issue.) FatMacPGP 2.6.3 is distributed under the same license terms from MIT and RSADSI as the 2.6.2 release, since its functional core is virtually identical. Please read the license agreements prior to using the program. Distribution of this program may be subject to US government export controls. This release is not endorsed by Philip Zimmermann, MIT or anyone else. However full source code for FatMacPGP 2.6.3 is being released together with the executable (although in a separate archive). It is not difficult to verify that the cryptographic core is unchanged from the 2.6.2 version. Also the author is mentioned in Zimmermann's documentation as the primary developer of previous MacPGP versions. A few support files, such as sample AppleScripts and other extensions, to facilitate interaction with the Eudora mailer program and the BBEdit text editor are included. While they are fully functional and hopefully useful, they are primarily intended to serve as illustrations to other developers on how to integrate PGP with other Macintosh programs. Detailed documentation can be found in the document "MacPGP263_AppleEvents" in the Macintosh Documentation folder. Read the included document "Verifying PGP" for instructions on how to verify this copy of MacPGP. Beginners should first take a look at the document "Getting Started with MacPGP". A detailed reference manual to MacPGP entitled "MacPGP263_Manual" is enclosed in the Macintosh Documentation folder and the indispensible "PGP User's Guide" by Philip Zimmermann is in the Documentation folder. Sources for FatMacPGP 2.6.3 will be available shortly. Z. Fiedorowicz -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: mac Comment: MacPGP 2.6.3 iQCVAwUBMdbLNr1LYmqiC9QjAQEl/wP+JXpDvgQ9VgTmXsvjjfFp+zd4v8ZeIMmt 45WcfqqPvSUPVEXv225MyYHMO1zKDkcKej1swBpFZDz5GV1eZJvriqYuNqc4Z0g0 0w9syQ2i6U5AoF6MR8bPs9Apq2Og9dRbFbaNXZ9Ba6bCtPHXyfZS1qQpi06Mkpty Xh39nE3dv4s= =/3Xe -----END PGP SIGNATURE-----

4 3

Message pools _are_ in use today!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:37 PM 6/29/96, Hal wrote: >From: ichudov(a)algebra.com (Igor Chudov @ home) >> A nice, albeit quite expensive, way of pretection from traffic analysis >> is to create a mailing list (or a newsgroup) and forward all messages to >> all users of that mailing list or newsgroup. Of course, since messages >> are encrypted, only the recipients will be able to decrypt them. > >This was discussed here several years ago, under the name "anonymous >message pools". Myron Cuperman, the operator of the extropia remailer >implemented one, although I don't know if it is still running (I >haven't gotten any mail from it for years). It was basically just a >mailing list specifically for this purpose, that you would use as your >anonymous return address. Of course a problem is that there may not be >enough people signed up to provide much privacy protection. The newsgroup "alt.anonymous.messages" has existed for a year or two, and serves to be working reasonably well as a message pool. Check it out. One will find numerous messages of the sort copied below. Having browsed some of the less common newsgroups (and trolled, in my my earlier days), I surmise that messages to nyms like "TheBear" are related to "support and recovery" sorts of topics. (I mention this because this is a compelling example of where anonymity is often sought; that people are using remailers and message pools to communicate is interesting. When Louis Freeh claims that remailers are only being used by hackers and Russian mafia arms exporters, this is a counterexample.) Here's just one such message, of several I saw this morning in "alt.anonymous.messages". (Note that anonymous message pool sorts of messages also appear directly from time to time in groups like "alt.abuse.recovery" and that ilk.) --begin copied message-- From: nobody(a)REPLAY.COM (Anonymous) Newsgroups: alt.anonymous.messages Subject: TheBear Date: 15 Jun 1996 14:26:12 +0200 Organization: Replay and Company UnLimited Lines: 14 Sender: replay(a)basement.replay.com Message-ID: <4pua54$gt6(a)basement.replay.com> NNTP-Posting-Host: basement.replay.com X-XS4ALL-Date: Sat, 15 Jun 1996 14:26:17 MET DST XComm: Replay may or may not approve of the content of this posting XComm: Report misuse of this automated service to <abuse(a)REPLAY.COM> -----BEGIN PGP MESSAGE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface hIwDrINEDTBBpVEBA/4sKOcgI33fdk6Pz5V27OIX0KiVfb4YDwgNLDpf6Wy0uvix 4oQ9p+vmtsZ32dPBoG4aF7bvh5ejqwZSpvuKOpgt1M8SKbA+Nma+EclMzQ3us3Ey OX5aFKo3TwB1Ck8tZPhpF8b/fI8gqz5v2FJhnon6NdktjFBVo3SBXya8AdlgUaYA AABsOTd6WOMH8PWnKHuP7PMCflH2p+halmCDsn9ytmoG6uzrINHH/B8c7aW6c7xw 9nXbB+99xLldhAqyg1M/oKi4pjfJ8cuSonDxMPTP8rr49XTCFaiOuQ7JUe3MEaop NIppnoBMrBvGRkKOgrYy =lYbJ -----END PGP MESSAGE----- --end copied message-- --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Net and Terrorism
by attila 17 Dec '03

17 Dec '03

Addressed to: CyberEyes <cyberia(a)cam.org> Cypherpunks <cypherpunks(a)toad.com> CyberEyes <cyberia(a)cam.org> pontificated at 07/05/96 12:29pm -0400 = On Thu, 4 Jul 1996, attila wrote: = = > "denied zones" (we were never there) is no longer in vogue. however, we = > will probably see that again in parts of the world as many cultures do = > not have the basic respect for life we do. = = What is your last comment supposed to mean exactly? Just because = some Islamic militants decide to kill a few people in a terrorist attack = does not mean that the entire believer population of Islam does not have = respect for life. Just who is "we"? Americans? Europeans? All = industrialized nations? Every country except those Third World ones? Uh... = I don't see your point very clearly here... The only culture I can think = of that might now have respect for life are cannibals, and they DO have = respect for life in a way, they don't kill each other (I don't think), and = they do it because it's their lifestyle, but they don't perform = cannibalistic acts out of malice. Correct me here if I'm wrong. = let me phrase it another way: there are circumstances where the lives of 'n' innocent people are of less consequence than the enemy --in other words, try to keep collateral damage to a minimum, but get the target before he executes more harm (this applies to hostage situations, as well) in general, this does not mean wipe out an entire 100 story building to find a single sniper, but sometimes a commander is faced with the choice: send a team in with a 10% chance of accomplishing the mission (i.e. the team is killed or the target escapes) or waste the village. until you have experience the death of men in combat, you will never understand this principle. I certainly did not, and even as a graduate of Harvard and an active member of the LDS Church, I found it only takes once to _clearly_ understand that it is 'to kill or be killed.' don't sit in your ivory tower and pontificate until you walk the mile in my shoes. I also had the responsibility for as many as 1600 additional 'black shirts' in a fire zone --think about it. oh, sure, I (or anyone else) will never convince you --but maybe you will think about it. war is hell, son; and war zones are somewhere beyond. if you go, just pray that you come back understanding that and not with scrambled eggs for brains. -attila -- "Don't hunt wild game, hunt lawyers! They provide better sport, suffer from severe overpopulation; and, they taste just like chicken!!

1 0

Re: I confess [Was: Who was that Masked Cypherpunk?]
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:25 PM 7/5/96, Duncan Frissell wrote: >Since no one has mentioned exactly what happened at the LP Convention, I >will relate it from memory and JR can correct me. > >They were going to vote on adopting a platform plank that upheld the right >of everybody to use any crypto they wanted and export it an everything and >also opposing the proposal for a requirement that people use a key escrow >system set up by the government. I'm now watching the LP convention on C-SPAN, and taping it for a friend (who may have a book contract to do a book related to something along these lines). The one LP event I ever attended was the California LP annual convention, some years ago, and found it crushingly boring. This looks a bit more exciting. I suspect the LP will continue to get 3-4% of the vote, maybe a tad more this year due to widespread dissatisfaction with Dinton and Clole and with the obvious charisma of Harry Browne. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Noise: Re: Those Evil Republicans
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 04:05 PM 7/5/96 -0400, hallam(a)Etna.ai.mit.edu wrote: >A parasite is omething that lives off a host to its >detriment. It is easy for a small island nation to be >parasitic off larger ones...In short someone, somewhere >has to do some work. Maybe I missed something here, but only small nations that are on the dole (i.e., foreign aid) can be said to be parasitic, and even they may be giving something in return (e.g., land concessions for military bases). The service industries in these little countries--banking tourism, etc.--are free traders giving value for value. This is not parasitism by any stretch of the imagination. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

RE: The Net and Terrorism
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May If there's any meta-point I'm making is that people are best served by making their own security arrangements, be it home protection, financial security, health security, or the security from rioters, criminals, and terrorists being talked about here. Turning over increased powers to a government to do these things is a recipe for failure, at very high costs (economic and civil liberties costs). ...................................................................... This is what I also understood Tim's point to be. As long as transforming the whole world into a "kinder, gentler", safer, mix of countries, economies, politics, races, religions, recipes for living, etc., is but a remote possibility in a far-off future galaxy, and knowing that governments are typically unprepared to deal with the dangerous states of mind incited by their very own policies, then (as always) it is wise and adviseable that a person take up some responsibility for preparing themselves, mentally and otherwise, for dealing with threats of terrorism, the kind of which we are all aware of by now. This is not fatalism; it is facing the facts. .. Blanc

1 0

New Member Registration
by coryt＠rain.org 17 Dec '03

17 Dec '03

Requested Account Name: whitney Requested Password: elbows THIS MEMBER HAS BEEN ADDED TO THE UPDATE LIST

1 0

Announce: Ecash(tm) Software Developer's Kit Beta 2 release
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Ecash(tm) Software Developer's Kit is available now for download from "http://www.digicash.com/api". The major improvement it that it now _accepts_ payments as well as makes them. Accounts at the "Beta Research Bucks" Bank (dc.digicash.com:9666) are available upon request. Here's the README: - ----- begin included README ----- Announce! This is the second beta release of the Ecash(tm) Software Developer's Kit. It includes: * the beta 2 release of ecashlib * a simple test client with source code for reference * a simple TCP/IP library for use with the test client Changes since the last release: * Importantly: The EC_pocket_begin_accept_payment() function works. * Unimportantly: Some internals got upgraded. EC_main_get_ver_string() implemented. Some parameters moved from EC_pocket_new() to EC_pocket_begin_open_account(), which is their natural habitat. A small bug or two was squelched. How to download: Option 1: Menu Visit the directory structure at "http://www.digicash.com/api/distrib" and take whatever you like. Option 2: MRE For Windows (Win32 DLL): "http://www.digicash.com/api/ecashlib.zip" For FreeBSD (static lib): "http://www.digicash.com/api/ecashlib-freebsd.tar.gz" For Linux (shared ELF lib): "http://www.digicash.com/api/ecashlib-linux.tar.gz" For others: e-mail us What do I do next? Visit: "http://www.digicash.com/api" for the latest release. Subscribe to: "ecash-dev(a)digicash.com" for news and views. Send e-mail to: "bryce(a)digicash.com" for developer support. Withdraw from: the BRB Bank dc.digicash.com:9666. You'll have to send us e-mail explaining why we should allocate any of our precious Beta Research Bucks to you, and what you want your account name(s) to be. Create: innovative net applications using Ecash(tm) -- the only secure, privacy-protecting, token-based digital payment system! - ----- end included README ----- Bryce Ahoy! PGP sig ahead! -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMd2iNkjbHy8sKZitAQEGbgMAkDRKou6yt5ESqtAvJUsgDpf5xGBw0S8A zTPnC4mwVIFbyo0P8rGaiR434OkmqwkZYtkcg3Bt+6QU5b3lVx7qD0JFNp31PGyn Yn8F7dLmTr8yJhU1aCHHkZjPvwt1IcM5 =iTG3 -----END PGP SIGNATURE-----

1 0