December 2003 - cypherpunks-legacy

No Subject
by Anonymous 17 Dec '03

17 Dec '03

McAfee has announced that they are giving away the commercial version of PGP 6.0.2 for free for a limited time. It also includes PGP Disk, which creates virtual encrypted drives. PGP 6.0.2 also claims to have anti-TEMPEST protection, by using a special font. My question is: what's the catch? It is a fact that Network Associates (McAfee's owner) is a member of the Key Recovery Aliance. Is the decision to give the software away part of something that's not being said (i.e. reduced security) or did I spend $39.99 on PGP and an additional $39.99 on PGP Disk for no reason because it would become available for free two weeks later? And, has anyone tested the anti-TEMPEST features in PGP 6.0.2?

5 4

.....
by Anonymous 17 Dec '03

17 Dec '03

* Intel's new chipset -> death of open source security? [ http://www.techweb.com/wire/story/TWB19981214S0008 ] * "[T]he Clinton administration announced further relaxation of U.S. export limits on encryption technologies." [ Mobile Computing and Communications (Jan. 99 issue, pp. 26+) ] ------------------------------------------------------------------------------- Intel plans to include security features in upcoming chipsets, including copy protection, certificate management, and -- get this -- random number generation. This will be implemented in firmware, and, given that it is supposed to perform copy protection functions, there is a significant possibility that the code would be inaccessible, maybe (heaven forbid) within a tamper-resistant shell. Suggested response: Make negative noise about it -- of course -- and, upon the release of the specs, write software which interoperates with it, allowing software written to use the chips to use open-source routines. In the best case, you would be able to correct everything but the copy protection; in the worst case, software-inaccessible key material would be necessary to impersonate any function of the security chips -- possibly for the stated purpose of preventing hostile code from overriding the security functions -- and it's necessary to either get trusted keys out of the chip or patch the chip-using software, assuming that isn't made impossible, too. Although I have no idea how one would go about lobbying Intel to make a software-extensible design, it would be a Good Thing if they allowed a mechanism for software to override the chip without risking losing the security to a virus. It could be as simple as tweaking the relevant specs so that developers would "naturally" make a program which would use a non-Intel-trusted software fill-in for security functions when one is available, but know that software was being used and who has signed it. That is, the protocols not only make it possible for software to fill in for hardware but let programs that work with the hardware work with the software fill-ins without modification. Wouldn't affect the (deeply misguided) copy protection features, because software seeking copy protection could refuse to accept an answer that wasn't authenticated as being from the trusted hardware. ------------------------------------------------------------------------------- Pretty much self-explanatory: those opposing crypto regs present examples demonstrating why crypto should be deregulated; the examples are deregulated and the point is ignored. Far too many people are complacent. A specific example: Mobile Computing and Communications (Jan. 99 issue, pp. 26+). It's an article saying that the Clinton administration has loosened regulations and, denying those who oppose the administration's position the fair shake given to even the most patently useless palmtop, states in the fifth sentence that "[t]he main issues are privacy and security, and with this policy it seems a delicate balance has been met." The same magazine (in fact, the same author in the same issue) referenced single-DES as "advanced encryption" with no mention of the fact that it had repeatedly been broken or that most cryptographers agreed that use of DES was to be avoided. Rather than simply whine or rant about it, I suggest that at least some attempt to respond be made. A letter to the editor may seem like a trite way to respond to these non-crypto-savvy articles, but unless there are plans to hold demonstrations outside the offices or just ignore it all... [Begin sample letter to MC&C] A recent report in Mobile Computing and Communications applauded the Clinton administration's loosening of cryptography when used in electronic commerce and certain other applications. I loved the article, but it gave little attention to what is probably, in the long term, the more important facet of cryptography: everything else -- that is, the applications of cryptography that are still regulated. Because intelligence agencies and some law enforcement organizations are afraid that unregulated cryptography will lead to a privacy-powered wave of terror, most of the vast potential of this technology is being squandered. For example, a worldwide network of computers running "anonymous remailer" software (which is powered by strong cryptography) could use mathematics to provide something which lawyers and legislators have worked to provide for hundreds of years: a virtual guarantee of freedom of speech. The construction of such a network, though, is adversely affected by the controls placed on the cryptographic software involved. It's obvious that this particular application is not highly relevant to businesses, but it's equally obvious to any professional cryptographer that there is a myriad of other potential applications -- for companies and individuals -- using software and hardware that is restricted by the current set of regulations. But the solution is not to follow the current trend, which has been to loosen regulations where there are complaints -- first banking, then medicine and insurance, and maybe anonymity in the future -- while tightening them in other fields through political maneuvers such as the Wassenar Arrangement. The solution I support, and the one supported by many others inside and outside the field of cryptography, is to keep our fears about cryptography reined in by our hopes for it, and to deregulate it so that this growing technology's full potential can be realised. [End sample letter to MC&C] -------------------------------------------------------------------------------

1 0

RE: I must admit. . .
by Brown, R Ken 17 Dec '03

17 Dec '03

Someone claiming to be Joel O'Connor wrote: > It only took one to turn India around. Ghandi nearly > starved to death, used nothing but passifism and won > the race man. I'm sorry but this is nonsense. Ghandi may have been a great man and an inspiration to us all but he *lost*. His first big political involvment was trying to stop the British from allowing the Boers to take away political rights from the "coloured" and Asian population of Cape Colony. The Brits caved into the white South Africans and we all know what happened next. Then he tried to get them (well us I suppose, since I'm British) to "quit India" in the 1920s & 30s - failed again, we got out 2 decades later, after WW2, when a British government was elected that was anti-colonialist. You wouldn't have been able to persuade the 1945-1951 government to stay *in* India. In fact they were so eager to get out they probably caused more problems by the speed of the withdrawal. Ghandi wanted a secular federation of all India - but instead there was partition, the secession of an inherently unviable Muslim state that was bound to end up with either civil war or fundamentalism (and in the end got both, at least for some of the time), and at least hundreds of thousands, and possibly many millions of deaths that could have been avoided. And then of course he himself was killed. And now India has the BJP. Ghandi was perhaps *right* but he certainly didn't "win the race". Ken (and not his employers)

2 1

Re: .....
by Anonymous 17 Dec '03

17 Dec '03

> Intel plans to include security features in upcoming chipsets, including copy > protection, certificate management, and -- get this -- random number > generation. This will be implemented in firmware, and, given that it is > supposed to perform copy protection functions, there is a significant > possibility that the code would be inaccessible, maybe (heaven forbid) within a > tamper-resistant shell. To clarify exactly why this is a problem: although it obviously won't affect the security of existing apps, it's likely that many newer apps will be dependent on this possibly-secret firmware for security, and we all know the evils of depending on a design not subject to intense public scrutiny. Worse yet, it seems possible that a certificate-based system could be used to ensure that neither non-Intel chips nor software fill-ins would be accepted by applications using the firmware. And, of course, except for what was mentioned in the TechWeb article itself, this is all conjecture based almost entirely on Murphy's Law.

1 0

Re: McAfee PGP 6.0.2
by Edwin E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Duh! You're so right. here's the URL http://www.nai.com/products/security/pgp_perspriv602.asp In Liberty Edwin At 08:37 PM 12/17/98 -0800, you wrote: >> I got it! I had to use their search engine to find it though. Took 3 >> tries to get it because the ftp kept stalling. If anyone can't find >> it I will be happy to send it on as an attach. > >It might help if you posted either the URL or the terms you fed their >search engine to locate it. > >-- > Jim Gillogly > Trewesday, 28 Foreyule S.R. 1998, 04:36 > 12.19.5.14.0, 6 Ahau 13 Mac, First Lord of Night > -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNnnoFEmNf6b56PAtEQIe1wCggnyZc8La+KNjL1e2qSK7dbt/kQgAn3o8 GkjttjZC9VldQ7jFCueSm6Ex =PAxS -----END PGP SIGNATURE----- When freedom is outlawed.......Only outlaws will be free! If cryptography is outlawed, pomz pvumbxt xjmm ibwf dszquphsbqiz. Fun! Fast! Revealing! Try "The World's Smallest Political Quiz" at: http://www.self-gov.org/quiz.html IS AIDS A GOVERNMENT/DRUG COMPANY HOAX? http://www.virusmyth.com/aids/index.htm When you blame others, you give up your power to change. Dr. Robert Anthony Libertarian Party of Hillsborough County, FL http://home.tampabay.rr.com/lphc When a place gets crowded enough to require ID's, social collapse is not far away. It is time to go elsewhere. The best thing about space travel is that it made it possible to go elsewhere. Lazarus Long

1 0

RE: Encryption chip
by Brown, R Ken 17 Dec '03

17 Dec '03

> Does anyone know if there is some kind of chip, > or IC commercially available that does secure encryption? Yes, somebody does know. OK, sorry, that was facetious. In fact I know.

1 0

RE: I must admit. . .
by Richard.Bragg＠ssa.co.uk 17 Dec '03

17 Dec '03

So maybe this needs a multi-phase approach. 1)The mail programs themselves will encrypt between servers. This can be used to both protect the message(s) from being read (easily). Does PGP also assist by doing some compression?. Also it can be used to autheticate messages using a signiture which will have the dual purpose of providing some tamper proofing. 2)The receiving mail-server will autheticate the incoming message against its own list of known servers, and validate that the contents of the message as a whole appears OK. Maybe it will flag messages that fail these checks. It can also flag messages that arrived without server encryption. 3)If the incoming decrypted message is not itself privately encrypted by the sender it will use PGP to encrypt the message for the user before storing locally. If the sender has already encrypted the message then it will simply store it. Caveats A)All systems must have compatible encryption systems or access to those systems. (Why limit to just one?) and all those systems must have some sort of agreed means of flagging the message to allow automatted decryption. B)Some means of exchanging public keys must be developed. This must allow for keys to be changed. What happens when keys are changed, and messages are still in transit from the old keys. C)Not everyone is wise enough to use UNIX. Some people even use (pardon the language) Windoze or even AS/400's. There is plenty more scope for discussion here I think even if it is some of the less verbally able slagging off about old ideas that can't/won't work because ... etc. Surely there are enough brains out there to thrash this through properly. Hwyl "William H. Geiger III" <whgiii(a)openpgp.net> on 18/12/98 00:23:05 To: "Marcel Popescu" <mdpopescu(a)geocities.com> cc: "Cypherpunks list" <cypherpunks(a)toad.com> (bcc: Richard Bragg/UK/SSA_EUROPE) Subject: RE: I must admit. . . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In <000301be2a14$9e5a8ec0$22fcb3c3(a)roknet.ro>, on 12/18/98 at 01:26 AM, "Marcel Popescu" <mdpopescu(a)geocities.com> said: >> I for one would like sendmail integrated with PGP. For example: >> sendmail asks receiving server if it has PGP, and please give >> your public key, I have mail for you.. Then send the e-mail >> encrypted, while the receiving sendmail decrypts it and delivers >> forwards. This is not very effective, but it would help some. >I think this is a great idea. First time I'll play with making a POP >client (an idea that appeals to me once in a while) I'll think about >it... Wouldn't it be more efficient to use TLS or SSH as an encryption protocol between the POP3d and the POP3 client? This could also be used for sendmail<->sendmail transactions. This still does not address local storage on the POP3d server. I am looking to setting up procmail to automatically PGP encrypt incomming messages and the forwarding them to a local account so even if the sender does not have PGP once the message is received by the PGP mail forwarder the messages will be PGP encrypted (I have had several people contact me looking for solutions to ISP's snooping on their mail without relying on the senders using PGP). - -- - --------------------------------------------------------------- William H. Geiger III http://www.openpgp.net Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html - --------------------------------------------------------------- Tag-O-Matic: OS/2: Your brain. Windows: Your brain on drugs. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: Registered_User_E-Secure_v1.1b1_ES000000 Charset: cp850 wj8DBQE2eZOrlHpjA6A1ypsRAgVDAKCpsNkbUjYCe77XBFHXnQDjZveHIwCg81zI UQM3ssGqYt/sQ+674XepePs= =GLQh -----END PGP SIGNATURE-----

1 0

Technical Analysis Special Offer
by richardcwaits＠telescan.com 17 Dec '03

17 Dec '03

We've put together a technical analysis package that will help you profit not just in 1999, but into the next millenium. And with your purchase of $125 or more, you'll get your choice of one free investment book! Just buy any of the information packed books, video tapes or CDs below with a total value of $125 or more, and choose one of the four books listed at the bottom of this message. But you must order by December 30, 1998 to receive this special offer! Call (800)324-8246 today to get a great package of educational materials, plus one free book! Trading 101 and 102: The 101 book is a step-by-step guide to all the trading basics. Learn how to create a personalized trading system, backtest it, and evaluate performance. Then step up to the Trading 102 book, "Getting Down to Business," a complete guide to starting and managing your own trading business. Get both books for $68! Market analyst John Murphy shows you how to profit with technical analysis with these two unique resources. In his book "The Visual Investor," Murphy shows you how to track the ups and downs of stock prices by visually comparing charts (includes software disk.) In his new videotape, "Applying Trading Methods to Today's Trading," Murphy shares his perspective as he reveals some of the technical indicators he uses to analyze the markets. Buy both the book and video for only $89! Learn how to Interpret Bollinger Bands. Attend John Bollinger's exclusive one-day seminar... in the comfort of your own home! In this two-videotape set, Bollinger shows you the history and construction of trading bands, how to interpret Bollinger Bands and what indicators to use for confirmation. Also covered is %b, Money Flow, "The Squeeze," and chart analysis. John Bollinger also reviews in detail his latest industry group work, including Early Warning Signals. It even includes an in-depth workbook. Just $195! Thomas Myers' Technical Analysis Course teaches you how to recognize market trends with his basic course, and how to use trends for profit. Just $47.50! Martin Pring, one of the foremost technical analysts in the world, has created the perfect guide for beginning technicians. In his book Technical Analysis Explained, Pring gives you a one-on-one course on every aspect of technical analysis. And the interactive companion CD-ROM is a user-friendly way to help master the techniques. Just $89.95 for both! Through this special year-end offer, a purchase of $125 or more entitles you one of the books below. Cyber-Investing: Cracking Wall Street with your Personal Computer (a $26.95 value) Wall Street City: Your Guide to Investing on the Web (a $27.95 value) ProSearch Strategy Handbook - 1999 Edition (a $39.95 value) Reminiscences of a Stock Operator (a $19.95 value) Call 800-324-8246 to order. This offer ends December 30!

1 0

RPK Encryptonite engine
by CyberPsychotic 17 Dec '03

17 Dec '03

Hello people, Just wondering if anyone could pull a word on RPK crypto. They say they built their engine based on Diffie-Hellman Key Exchange principles (which shoulds safe enough), but they claim their software doesn't fail under US crypto restriction law, which makes me suspicious. -- fygrave(a)tigerteam.net http://www.kalug.lug.net

1 0

War as a public relations excercise (was re:Comrade Klinton at it again)
by Brown, R Ken 17 Dec '03

17 Dec '03

> nobody(a)sind.hyperreal.art.pl is accused of writing: > > As I recall, the name "Desert Fox" was a nickname > held by a Nazi general. Fitting, that. It's what Allied journalists called Erwin Rommel, who was a German general, if not exactly a Nazi. Sometimes said to be a military genius. IIRC he distinguished himself well as a Panzer commander under Guderian in the attack on France; commanded the Afrika Korps & was beaten by the Allies (doing his reputation little harm - they were strongly outnumbered and probably lasted longer than they were expected to); and then was injured in the D-day invasion, invalided out and accused of plotting to kill Hitler. He was murdered by the Nazis (in that he was told that if he commited suicide his wife and children would not be sent to a concentration camp, which counts as murder in my book). Once upon a time a code name for a military "operation" was just that, a code name. These days it is a brand label. Probably thought up by the same guys that Coca-Cola or Ford would hire to name a new product. For any British person over the age of about 30 "Desert Fox" will immediately bring to mind Rommel, WW2 and the "Desert Rats", the British 8th Army (in fact mostly Indian + Australian with contingents from all over the Empire) who fought against Rommel in North Africa. That reminds us of the long-range Desert Group & for those who have been paying attention, the SAS, (who get *heaps* of publicity here. There is a whole tacky genre of SAS books and magazines) which in turn is supposed to make us feel good (all that rhetoric about "punching above our weight" and the "best trained and most skilled army in the world", "the Professionals"). And "Fox" brings to mind foxhunting of course. The choice of name is meant to imply to British audiences that "our boys" are out there hunting Saddam, even though that has been officially denied by both UK and US government. All the publicity refers to "him" and "his" weapons. No-one ever says "we are at war with Iraq", it is always "we are denying *him* the use of *his* weapons of mass destruction". Maybe we will soon start to see planted media hints that there are, or have been, SAS on the ground in Iraq looking for *him* - which will be instantly denied in such away as to allow people to carry on thinking that it is true if they want to. The US may have a law against killing heads of state but we Brits don't (although apparently we are still unsure as to whether we have a law against extraditing them to Spain when accused of a mere 3,000 murders). I strongly suspect the news management for this war was handled by the Brits, possibly the same spin team that handled last years Labour general election victory. The first attack was about 4 minutes to 10 pm UK time. I heard it as a newsflash on the radio & then turned on the TV just in time for ITV's "News at Ten" program. One of their journalists was waiting outside that front door of 10 Downing Street, obviously tipped off about an "important announcement" and the PM came out sometime around 10 past 10 to make his speech (half an hour *before* Clinton, which must have been agreed between the governments) which ended just in time for the ad break. I suppose Clinton's speech would have been about lunchtime on the West Coast, late afternoon on the East Coast. A bit early from the POV of news management. It gives the networks a few hours to work on it before prime-time TV. One of the first rules of this sort of thing you want your own words to go over unedited if at all possible - the less time the networks get the more likely you are just to be given a live mike. That way you get to choose your own sound-bites. Or borrow them from Margaret "There is No Alternative" Thatcher. Of course she needed the Falklands War to get re-elected, and Clinton needs all the help he can get, but Blair is still master of all he surveys (Well, except for a few of us unreconstructed far-lefties, Peter Mandelson's private life, and Welsh Labour Party) so perhaps he can afford to be magnanimous in victory. Or perhaps he really thinks that there is no alternative. We could accuse them or timing the attack for TV, although I suspect 0100 Baghdad time was in fact a sensible H-hour. You'd want it after dark, and later rather than earlier if you were interested in minimising civilian casualties. I suppose 0300 or 0400 might have been better - but that would have missed UK evening TV and given the news media time to sort out their story for the morning (some of the "serious" papers here came out against the attack. Tabloids seem to be all for it of course). As it was everyone got the government announcement first. Ken Brown This all my opinion and nothing to do with my employers. (And I am certainly not even going to speculate about oil prices from this address).

1 0