December 2003 - cypherpunks-legacy

Next Step show
by crunch＠netcom.com 17 Dec '03

17 Dec '03

Saw Eric Hughes on the Next Step science show on the Discovery Channel last Tuesday. Good job Eric...!! Wish they would have mentioned PGP and how easy it was to get it... Cheers CC

1 0

Jim McBride
by Anonymous 17 Dec '03

17 Dec '03

Got this in the mail today: -- cut -- Date: Wed, 03 Nov 1993 22:11:07 From: jim_mcbr(a)netmail.com Subject: Auto Reply To: <me> Thank you for your mail to Jim McBride at JS McBride & Company. Due to the volume of mail be handled by this account, this is an automatic reply. PLEASE READ CAREFULLY!! 1. JS McBride is NOT collecting demographic information on email addresses. Due to the controversy surrounding this practice, we have discarded the product demographics we collected. We are however still collecting email addresses and user names. 2. The information collected (name and email address) will be offered in a printed white pages directory and in a white pages server on the net. 3. You DO NOT need to ask to have your name removed. BEFORE your name is used in the directory, you will receive mail asking for your permission. If you reply to the inquiry, your information will be used. If you do not reply, your name will NOT be used. 4. Comments regarding the white pages should be sent to Tom Manning at JS McBride & Company. <tmanning(a)netmail.com> 5. Mail to Jim McBride should be sent to <jimm(a)netmail.com> 6. Information regarding the purchase of the white pages directory should be sent to <listinfo(a)netmail.com> or telephone us at 415-949-4295 Thank you for your time, Jim McBride -- David Sward sward+(a)cmu.edu Finger or email for PGP public key 3D567F Encryption is an envelope for your email; read alt.security.pgp for details. GCS: -d+ -p+(---) c++(++++) l+ u+ e+ m+()@ s+/++ n+@ h+ f !g w+@ t+@ r+ y?

2 1

Re: UPDATE: direct-marketing email address list
by Stanton McCandlish 17 Dec '03

17 Dec '03

Here's what you get if you send mail to J.S. McBride's posted address to query about the direct-marketing email address list: ______ begin forward ______

1 0

PC Magizine.....
by Wizard＠falcon.lhup.edu 17 Dec '03

17 Dec '03

...just to let all know, the November issue of PC Magazine mentions PGP in the Trends section. (pg 29) '....in fact, cryptography is included on the State Departments' list of weapons that could compromise the country's security.' '..Despite attemps to keep the technology stateside, 84 products that employ Digital Encryption Standard (DES) are available overseas, says the Software Publishers Association. But the regulation has succeeded in keeping U.S. companies out of the globabl marketplace. And recently, the makers of a software encryption program called Pretty Good Privacey(PGP) have been investigated for possible export violations. (Both DES and PGP are available on the Internet.)' The article also talks some about Clipper, but nothing new to my ears. The Skip-Jack algorithm is mentioned, and the fact that the NSA is keeping mum on how it works. Sean wizard(a)falcon.lhup.edu

1 0

Auto Reply
by jim_mcbr＠netmail.com 17 Dec '03

17 Dec '03

Thank you for your mail to Jim McBride at JS McBride & Company. Due to the volume of mail be handled by this account, this is an automatic reply. PLEASE READ CAREFULLY!! 1. JS McBride is NOT collecting demographic information on email addresses. Due to the controversy surrounding this practice, we have discarded the product demographics we collected. We are however still collecting email addresses and user names. 2. The information collected (name and email address) will be offered in a printed white pages directory and in a white pages server on the net. 3. You DO NOT need to ask to have your name removed. BEFORE your name is used in the directory, you will receive mail asking for your permission. If you reply to the inquiry, your information will be used. If you do not reply, your name will NOT be used. 4. Comments regarding the white pages should be sent to Tom Manning at JS McBride & Company. <tmanning(a)netmail.com> 5. Mail to Jim McBride should be sent to <jimm(a)netmail.com> 6. Information regarding the purchase of the white pages directory should be sent to <listinfo(a)netmail.com> or telephone us at 415-949-4295 Thank you for your time, Jim McBride ___________ end forward __________

1 0

ViaCrypt PGP has arrived
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

My copy of ViaCrypt PGP arrived yesterday (Nov 3). Since I worked late, I haven't had a chance to play with it yet. I looked through the manual. The commands look similar (if not identical) to "classic" PGP's, as far as I could tell at a glance. The bulk of the text for the manual was taken from the documentation that comes with PGP, except all occurances of "PGP" where replaced with "ViaCrypt PGP". The box looks pretty good. :-) Looks like they hired a real graphics designer. I suppose some of you are wondering why I'd fork over 100 bucks for something I could get for free. First of all, I can afford it. Second of all, I simply feel more comfortable using a licensed shinkwrapped software product than a quasi-legal freeware one. Call me a coward. I realize that by not compiling the code myself on my own machine I basically have to trust the ViaCrypt PGP implementation. So be it. If there is something wrong with ViaCrypt PGP I believe it will eventually be discovered. Somebody will no doubt disassemble it and look for backdoors. If someone finds one, ViaCrypt's reputation will be worthless. It's in ViaCrypts best interest not to put in any backdoors. Jim_"Rebel without a spine"_Miller(a)suite.com

1 0

Re: Allegations of PGP Weaknesses
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A few days ago, Victor Borisov posted here the following allegations or rumors about "weaknesses" in PGP. >He made same program (LanCrypto). That why, I hear only bad >words from he. :) You can read about this program in >cypherpunks. >From other KGB-men, I hear, that prophesor >Sidelnicov (the well known cryptoanalisist from Russia) saw, >that PGP has some weak places: > - random number is`t "good" random number. > - md5 has hole (but here man lapse into salence:( ). > - PGP for DOS don`t have any anti-overloking tools. > >BTW: LanCrypto play on last weakness: thay wrote litle >resident DOS program. This program crack PGP and than pgp >sign (and check) only part of message. LanCrypto public >this resalt in buziness newspaper and show program on the >big computer-show. I think this is rough market, but it >work well (as all, that KGB made:))!!! Since then, I have checked with other members of the PGP development team and here is a summary of what they (and I) say: The random number handling in PGP was beefed up in the 2.2 release. We don't know if there were any real weaknesses before that, but the improvements were added anyway. We suspect that if there were any problems, they are gone now. The guy who complained about it, Dr. Sidelnikov, never cooperated with requests for details on what he found wrong with PGP. In fact, he was pointedly uncooperative when contacted with questions asking him for details. If MD5 has a hole, we'd like to know about it. It would be publishable in any crypto journal. At Eurocrypt93, someone did find some slight weakness in MD5, but in realistic situations, this would not be a significant weakness. Future versions of PGP may use the SHA hash algorithm, instead of MD5. MD5 should be kept around for backwards compatibility. MD5 is still a good hash function, and the weaknesses found were not applicable to any real-world uses of it. An old version of PGP did not detect if material was appended to a signed message. This was a bug that was fixed, around version 2.2, or maybe 2.1, I'm not sure which. We're not quite sure what "anti-overlooking" tools are, but based on Boris' example, we guess it would be code added 1) to insure that the code is unmodified and 2) make analysis of the code (e.g. with debugging tools & disassemblers) difficult. Since PGP is distributed with source code, it's obviously open to analysis and modification by anyone even moderately skilled in programming. "Overlooking" attacks are easily countered by 1) making sure you have a "clean" PGP.EXE by checking it against the detached signature packed with it. 2)Running PGP with a freshly booted MSDOS from a factory diskette. This is especially true if you run into "suspicious" actions when running PGP in your normal configuration. (Like you get back a copy of something you signed which seems to have text added you don't remember). -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNeRXt4nNf3ah8DHAQE+0QP/csLY4hw6AHGTdkoZu2koETv2q/ohnVl8 yGDwR65VVeuuiSANHjSmhUbA2w7DcbOaIxamzi1PSY6OHosB1ve4d2hOHKzdMrv1 m38x0iQLPZdGuuX0mCxRqvIJ47W8xKj49CxXIB+Khrva0nn+pAmQF6+IYonPGSAE 7uRREQnIzCU= =7ogP -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

unsubscribe
by crypto＠fizbin.fredd.com 17 Dec '03

17 Dec '03

Please unsubscribe me. Thanks! -- Red Rover crypto(a)nowhere.com

1 0

Re: ViaCrypt PGP has arrived
by Dark 17 Dec '03

17 Dec '03

I was with you all the way until you said: -> I realize that by not compiling the code myself on my own machine I basically have to trust the ViaCrypt PGP implementation. So be it. If there is something wrong with ViaCrypt PGP I believe it will eventually be discovered. Someb ody will no doubt disassemble it and look for backdoors. If someone finds one, ViaCrypt's reputation will be worthless. It's in ViaCrypts best interest not t o put in any backdoors. <- Call me paranoid: I'd never take what it's in someone's "best interest" as a major factor in predicting actions. Look at the crime section of the local paper or that bit called "news of the wierd" I happen to agree with you this time, though it would be nice if ViaCrypt had included the code and a compling mechanism. I suppose this is outside the realm of marketing possibility though. -uni- (Dark)

1 0

Signing keys for nyms
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric Hughes writes, regarding the problem of determining whether the key of a "nym" is valid: > If a provider of any sort is the sole means of access to a series of > communications, there will be the possibility of tampering. If some > public key must issue forth through this channel only, it is possible > to alter the pseudonym's public key each time it is passed throught > that channel. Since every protocol which uses communications only > through the server won't work, every solution needs another channel. Eric goes on to describe a solution based on sending the key through two different channels, with a return message via the pseudonym server channel. I think this is a good solution, but there is the possibility that the evil pseudonym server could corrupt the return message so that the nym did not find out that his key was being mangled (although other people would find out, which may be good enough). A more general solution is to use more than one pseudonym server. Assuming they aren't both colluding, you can send your nym1 key to nym2, and vice versa. By providing two or more channels back to you as well as out from you, you are able to detect corruption of your messages. Eric suggested that if the pseudonym server signed the user's key, then corruption of the key could be proven to third parties. I'm not sure this is the case, because it would seem that a user could falsely incriminate a pseudonym server by claiming that he had never created the key which the pseudonym server signed, that it was a bogus key. I suppose reputations would have to play a role then, in weighing the credibility of the pseudonym server against that of the nym. Hal hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNm4NagTA69YIUw3AQFGOwQApSwLHzBfQKStZd6g/17dsL3WUtgCvy6D OyQjFQ3dRd6VRGrEaQ7aRbnae9If0NqF2qbaxeHAKNP/Uiyo/cGBWvFjAxWeVyY0 hddLRBygxIyqjkDkxAEBGaYRruly8TC4TEU45ChwSUz2Smh0rDm8S2GINgXe340P a1peTNDPSlI= =Ywbw -----END PGP SIGNATURE-----

2 1