December 2003 - cypherpunks-legacy

Signing keys for nyms
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The big weakness with public-key cryptography is making sure you have a valid key for the person you are communicating with. If you just get a key off a key server, it's possible that the key has been faked and does not actually belong to the person it claims to. Key signatures from trusted individuals testify that the key actually is associated with the given userid. Without a trusted signature, it's possible that your messages could be read en route and then re-encrypted with the true key of the recipient, who receives a properly encrypted message and doesn't suspect anything. In practice, this attack would normally be difficult to mount, as it would imply some way of intercepting and altering the messages you are sending. But anonymous communicants are perhaps more vulnerable to these attacks since their mail generally must go through a server system. They have to trust these servers not to reveal their true identity (at least, with the penet.fi server), but there is also the danger that the server could alter their messages as they pass through the server, possibly posting false public keys for them. If Wonderer, for example, communicated mostly through the penet server, there could be many kinds of changes being made to his messages, and he might not notice. His key could have been changed, then when his posted Cypherpunks message came back to him, it could have been changed back to what he sent. Encrypted mail to him could be read by the penet operator and then re-encrypted with his real key. (Naturally, I'm not suggesting the Julf would do something like this, but the attack is possible in principle.) Obviously this kind of attack could be defeated in many ways, such as if Wonderer could check his postings through some other path than penet.fi. But this might require him to expose himself in some ways (such as by signing up to the CP list under his True Name) that he would prefer not to. Ideally, a nym should be able to explore interests completely separate from any connection with his True Name. In general, it seems to me that anonymity server operators are the ones in the best position to create fake keys for nyms. Eric's suggestion that operators should sign the keys doesn't help much in this situation. I'd say that other methods are needed to confirm that encrypted messages to nyms are not being read en route. Hal -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNLezagTA69YIUw3AQGk+AP9HX8RUXgV+qKHcDLOnb75dHJUv+gqO0dm znRHtyNruRWOTtbqCp7VMV84+etnU90sMIDt/fwsCJdvaGnktYGwdQx2TkiIUQGF +n1nXb6/YRvDPcry7/W5Um4cQVHFd3thS8g7GI2FRZgS/qZ9BHJLcmRf17w+FsQs ORHMk+JowQw= =Y8Uf -----END PGP SIGNATURE-----

2 1

Re: Mail delivery question
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- T. William Wells posted here on Oct 24: As an operator of an anonymous service, I'm constantly amazed at the things that supposedly worthwhile net.citizens will do, without even the slightest thought for the consequences. And consequences there have been, sometimes potentially tragic ones. Perhaps I should tell some of my horror stories. Yes! Yes! Please tell us all the gory details! -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNLzXd4nNf3ah8DHAQGAowP/fkWAwK8cuHKf8+LNY6+u8bP3T7avsf6d GpDLUIpgD/PKhHVTChHMGjm5Ga51mFlB60dY3CxF/qyrybr2071HwAb4CkhCiDdy guz8UU3n2iz00+HjlG4Rjqlpnejkm9AJE1Hm5Jm3a0i0bPNUtBfsD0xBhYoaVZ8K SKAJIapQ7nU= =Wr1L -----END PGP SIGNATURE----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

(fwd) Getting a Copy of APPLIED CRYPTOGRAPHY
by ferguson＠icm1.icp.net 17 Dec '03

17 Dec '03

I thought some of you folks might find this of interest. Forwarded message: > Newsgroups: sci.crypt,comp.security.misc,alt.security > From: schneier(a)chinet.chinet.com (Bruce Schneier) > Subject: Getting a Copy of APPLIED CRYPTOGRAPHY > Message-ID: <CFn0Jz.LEn(a)chinet.chinet.com> > Summary: I'll send you my book if you want it. > Keywords: Cryptography, Book > Organization: Chinet - Public Access UNIX > Date: Fri, 29 Oct 1993 02:35:59 GMT > Lines: 19 > > If anyone has trouble getting a copy of my book, I would be happy to mail it > to them for $45 plus postage. (Postage can very from 4th Class Book Rate to > Federal Express, and depends on what country you are in.) > > If you prefer, you can order it from your bookstore. (I've been getting > enough questions about this to post this info for all.) All you need is the > ISBN, but here's the rest of the information: > > APPLIED CRYPTOGRAPHY: PROTOCOLS, ALGORITHMS, AND SOURCE CODE IN C > Bruce Schneier > John Wiley & Sons, 1994 > ISBN: 0-471-59756-2 > $44.95 > > I am currently attempting to get permission to put the index on line. > > Bruce _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group fergp(a)sytex.com Fairfax, Virginia USA ferguson(a)icp.net

1 0

The lighter side of computing...
by Anonymous 17 Dec '03

17 Dec '03

Although this cross-post is off-topic, I thought perhaps many of you would find it as humorous as I did. If not, sorry for the bandwidth. From: mnemonic(a)eff.org (Mike Godwin) Newsgroups: comp.org.eff.talk,talk.politics.crypto,misc.legal,alt.security.pgp Subject: Re: "Honest argumentation" Date: 30 Oct 1993 09:14:45 -0400 Organization: Electronic Frontier Foundation Lines: 55 Message-ID: <2atpc5$cds(a)eff.org> References: <strnlghtCFKFLy.DtC(a)netcom.com> <CFo1Gs.AyH(a)cs.uiuc.edu> <strnlghtCFo7uo.BGx(a)netcom.com> <2atp3u$cca(a)eff.org> NNTP-Posting-Host: eff.org In article <strnlghtCFo7uo.BGx(a)netcom.com>, David Sternlight <david(a)sternlight.com> wrote: >Courts have discussed this point in the past. There was a famous case in >which a distinction was made between "the sound seemed to wander" and "the >sound wandered." (Bose vs. Consumers Union). One cannot assume that Mike's >usage (particularly since he is an attorney) meant "seemed" unless he said >so. He did not. He said "is". Interesting that you should apply a product libel case to your own situation. Are you a product, David? Which manufacturer produced you? A better precedent, of course, is Gertz v. Robert Welch Inc. David Sternlight, after having thrust himself into the vortex of public opinion, will find it hard to avail himself of the protections against reputational damage that a private citizen has. My statement falls so clearly within the area of non-actionable speech that your case would lose on summary judgment. I'd move for sanctions, of course, since Rule 11 of the Federal Rules of Civil Procedure, as well as comparable state rules, sanction the initiation of frivolous lawsuits. Ask your attorneys how they like Rule 11 sanctions, David. Whoever those attorneys are, that is. >Since it is a remark that goes to a matter of fact and is false, and more >than that, Mike has no knowledge of my study of the history of press freedom >in this country, and finally, since he is an attorney, this is considerably >more than some layman's ad hominem. First, it's not false. Second, libel law doesn't distinguish between lawyer statements of fact and non-lawyer statements of fact. Third, it's not an ad hominem, as that term is used precisely. >It is quite material to my view of EFF that one of their attorneys should >post, over their name, a message that I am advised is defamatory. Please, please don't dig yourself any deeper. If you like, I can give you some examples of truly defamatory and non-defamatory statements, so you can learn the distinction. In the meantime, I await the letter from your "attorneys." Nothing would give me more pleasure than to slamdunk a frivolous libel suit. --Mike -- Mike Godwin, (202) 347-5400 |"In our sleep, pain which cannot forget mnemonic(a)eff.org | falls drop by drop upon the heart until, Electronic Frontier | in our own despair, against our will, comes Foundation | wisdom through the awful grace of God." -------end forwarded article----------

1 0

NSA Security
by a2＠ah.com 17 Dec '03

17 Dec '03

Seymour M. Hersh, writing in the November 1, 1993 _New Yorker_, comments: "...current and former high-ranking officials with access to intelligence, whose information has been extremely reliable in the past, specifically told me that the National Security Agency, which is responsible for electronic intelligence, had produced no significant high-level intercepts from Iraq in years. American intellignece experts have concluded that the Reagan Adminstration's policy of providing satellite and communications intelligence to Iraq in the mid-nineteen-eighties had an unwelcome side effect: the Iraqi intelligence service learned how to hide its important communications from the N.S.A.'s many sensors." I am posting this to help provide an insight into some of NSA's motivations. If you think this is disinformation, consider the motives for creating it -- the insights are similar. -a2

1 0

Hardware encryption device...
by Michael J Kirwin 17 Dec '03

17 Dec '03

Hey 'Punks! I found a kit to build a hardware encryption device. The whole kit costs less than $120 and both partys need one. There rather slow however, the top speed is only 1200 baud. I found the article on it BYTE September '86. Here's the address of the place that sells the kit CCI P.O. Box 428 Tolland, CT 06084 If anybody does get this kit and trys it out I would be interested in how it turns out. Drop me a line. Thanks, Michael mkirwin(a)acs.ohio-state.edu

1 0

MEDIA: PGP in CompuServe Magazine
by russell＠eternity.demon.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- 1 Nov 93 Yesterday, 31 Oct 93, in London, some of us privacy advocates held another meeting of the UK Cryptoprivacy Association. One of our regulars brought in the latest CompuServe Magazine, the issue of November 1993. I was delighted to read an article (pp 19-25), "The Digital Deadbolt", strongly advocating the use of secure cryptography, including PGP 2.3. The article, written by Christopher J. Galvin, an associate editor of the publication, was truly an advocacy piece. For those on CompuServe (CIS) who were unfamiliar with the issues, cogent and useful reasons for using encryption were given, with pointers for finding the relevant software. I quote: ZIFFNET PUBLIC BRAND SOFTWARE APPLICATION FORUM (GO PBSFORUM) Pretty Good Privacy 2.3 - The controversial program PGP combines the convenience of the RSA public-key cryptosystem with the speed of conventional cryptography to protect e-mail and data files. Includes digital signatures, data compression before encryption and sophisticated key management. Manual included. Freeware. Library 1, "Hot Off the Presses," PGPRIV.ZIP (232,895 bytes). Further file references included text in the CYBER FORUM (GO CYBERFORUM) on anonymous remailers (Library 13, "MONDO 2000," PRIVAC (7,078 bytes)), and a NIST publication on public-key cryptology in ELECTRONIC FRONTIER FORUM (GO EFFSIG), (Library 3, "The Frontier Files," PUB_KE.EXE (125,472 bytes)). CompuServe claims a worldwide subscriber base of around 1 million accounts. Every account holder is sent a monthly copy of CompuServe Magazine. Based on this circulation alone, the article is a notable achievement in public access to strong encryption. What makes it even more notable is the bald admission in the article that "... PGP and RIPEM aren't circulating as far as they might. They've been removed from various CompuServe forum libraries and some university Internet sites by sysops and administrators concerned that export laws might be violated by online availability." Those who are puzzled as to why, then, PGP is listed in the same article as being available _through_ CompuServe should take note that it is not available _on_ CompuServe. Having had some CompuServe experience myself, I was struck by what I think might be the case here: Ziffnet is a separate service from CompuServe (CIS), with CIS acting solely as a gateway. Ziff-Davis is a very large publishing house. Anyone who's been to trade shows around the world has run across the Ziff-Davis booth, where various of its magazines - the biggest names in the business - are given away as samples. It may be an ill-informed hunch on my part, but I suspect that Ziff-Davis is drawing on its statutory rights as a _publisher_ to make PGP available through one or more gateway services. If this is the case, I applaud them. And I congratulate CompuServe for having run Mr. Galvin's article. Christopher Galvin can be reached at 70003.5571(a)compuserve.com. Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor AMiX: RWhitaker EXTROPY: The Journal of Transhumanist Thought Board member, Extropy Institute (ExI) Co-organizer, 1st European Conference on Computers, Freedom and Privacy, London, 20 November 1993 -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLNRf6YTj7/vxxWtPAQEotgP/SU04KS325v8ca8ydCgr/358QsxmHhz// TtHkdhLRjvDLeWOEbG5LKY1VsVovU5YY1ru8h1xjrMqLiWvv4LQJanhg7I+D3Cpr J5xhM0IZSMotYKmCdY20SRdw918VA8JlNck+r1n40ozgdY8yOsAO6qdjOsolyquA OXShI0Gkzf8= =U0GH -----END PGP SIGNATURE----- -----END PGP SIGNATURE-----

1 0

unsubscribe
by D Nicoll 17 Dec '03

17 Dec '03

unsubscribe please thanks

1 0

Re: Secure Phone Progress (fwd)
by jim＠Tadpole.COM 17 Dec '03

17 Dec '03

Most (US-based) phone equipment can't deal with clear channels, (ok, long strings of zero data) thus, a DS0 (the cannonical single voice call) operates with one bit always set 'on', so your 64kbps channel is now a 56kbps channel. 4:1 compression would get you to (just) inside the magic '14400' bps limit of v.32bis signaling. Such algorithms exist, though their performance on data with characteristics like 'voice' is poor at worst. CLEP is a speech encoding algorithm (compressor) that can work well inside a 4800bps channel. It is, however, quite expensive in terms of CPU power. A DSP would help here. :-) CLEP also tends to diminish the dynamic range of its input, with a resulting loss of 'quality'. Writing things in assembly is not a magic bullet, making the algorithm go faster just as a consequence of it being hand-rolled. The v.fast (28000 bps) modes may, or may not work at 28000 bps between any two endpoints. (subscribers). Jim

2 1

Anonymous remailer with encryption (query)
by Alan Ruttenberg 17 Dec '03

17 Dec '03

Is there a stable anonymous remailer which can encrypt any mail that it sends to me?

1 0