December 2003 - cypherpunks-legacy

Nazis/Privacy/Cypherpunks
by Dark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -> Observe the following exchange > I remember reading some time ago that the Nazis had a method of >trapping communists that went like this: > They'd put the suspect in room and carry on a conversation with him >(all males, as I remember). [Stuff deleted, no value judgment implied.] This practice is, IMHO, extremely unethical and dubious at best! If the world's experiences are a metaphorical "object" bundled up in a <.lib> somewhere in the cosmos, then *anything* that the Nazi's did should be considered completely bugged code. Why do we want to inherit their flawed algorithm's? [See note 1] The whole point of the cypherpunk cause is to compile code from the ground up--considering the ethics involved with decisions such as rooting out 'nyms. [See note 2] Have we decided that it is now imperative to know the identities of those on 'our' side (further fueling this polarization of 'us' versus 'them')? Let's leave behind this obsession with determining who's who; it has taken us too close to the kluged code of Nazi history! My eye is on the prize... ;) [See note 3] --- still(a)kailua.colorado.edu ------------------------------------ - -> so... [Note 1] Personally, I don't rule out examination of Nazi tactics as a worst case scenario model. Let's face it, as ugly and dark as Nazi rule was, they did some things quite efficiently indeed. Take state security. The Nazi's had so perfected the process of identifying dissidents and quashing opposition that aside from the high ranking traitors, war time and early pre-war Nazi Germany was probably the most stable dictatorship in history. (From an internal and counter intelligence perspective anyhow [See Barry Posen for more.]) The price, of course, was the death of many, many innocents who were just perceived as threats (camps aside.) To rule out Nazi approaches, especially when dealing with intelligence and counter-intelligence issues (which IMHO is basically what cypherpunks is all about on some level or another...) is plain silly. Current intelligence practices are based a great deal on what was learned in WWII (OSS being the basis for today's CIA etc...) I'll begin to differ when you start talking about medical issues. [Note 2] No one writes code from "the bottom up" in the manner that you suggest. If that were the case we'd see the wheel invented time and time again. One of the reasons this mailing list exists is to accomplish exactly the opposite. That being to incorporate common or even fringe ideas into the development of code for the common purpose (The Prize as you adeptly put it.) so we don't HAVE to build from the ground up every time. [Note 3] One of the ways we learn is through trial and error amongst ourselves. It's funny that the list is beginning to lose some of the major personas that were here when I first joined last fall (winter?) Cypherpunks was a collection of experts, and newbies all feeding off each other to push the technologies farther and make a social impact encouraging privacy in the process. Where better to defeat anonymous posting and improve the art than among ourselves? This brings up a side issue for me, and incidentally the reason I rejoined cypherpunks (aside from my brief loss of net access when I went back to Liechtenstein this summer). More and more, where I look, I see privacy in this country eroded. It has gotten to the point where I can see no other direction now than the centralization of government in an age where technology makes it a joke to keep track of individuals from what they buy, to which toll booths they drive through, to which bank tellers they use, to what they "Publish" on the net. I feel that a hands on approach for government becomes more and more dangerous the farther technology progresses. Information technology is like nuclear technology in this way, you just can't tell how it will be applied, to liberate, or to oppress. Either is possible. Will something not have to give if we are to be reasonably secure in the belief that a brutal and powerful dictatorship will not succeed in this country? I will be the first to admit that the U.S. is not likely to fall to such a fate in the next (insert number appropriate to your ideology here) years, but if it does, it will be a dictatorship/authoritarian/ centralized power the likes of which no one has ever seen. The tools exist to make freedom meaningless. Personally I'm not secure enough relying on the balance of powers as the only safeguard. The omnipotence that any authoritarian power would have in this country, a country where the pizza delivery man punches up your usual order and doesn't have to ask for your address or credit card number when you call (In 2 years will they have to answer the phone at all?), is staggering in its scope. If the Nazi's took power in such an environment... phew. Personally (yet again) with the prospect of national health care, the card to be issued at birth, and the adjoining files to be collected on anyone who claims anything under it, I am that much more sure that everyone should establish three or four identities complete with documentation before acquiring such documentation becomes impossible anymore. (Speaking of which, does anyone know if the Social Security act of 1974 which limited the use of Social Security numbers and tried to form some basic (albeit limited) privacy to card holders has any counterpart in the health card?) There is great safety in anonymity. I intend to keep it. - -uni- (Dark) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLNGb1xibHbaiMfO5AQH2QgP+KkvBHohXgFMEhotPPSwFgqWta5E+KTuk tfSSFLO0EyoERFUz6mZPU6cKFpxAgpX5aHNeHsfAwLs0WRQs+T4ZE7cJDgDS215F gmhUaHKpBfgwQz5aoT1EHnGcLRZCQl9h2uAXubpnHUUb1d+sBWUNRnFJKkKmBIZ+ eODsv0JZHEc= =yXrJ -----END PGP SIGNATURE-----

1 0

ViaCrypt PGP on its way
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I ordered ViaCrypt PGP today. They said I should get it by next friday. I'll post comments about it as I learn to use it. I haven't used "classic" PGP so I wont be able to make any commparisons. Jim_Miller(a)suite.com (camping on the mailbox)

1 0

Re: ID of anonymous posters via word analysis?
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't see anything wrong or unethical about using software. It is true that the Nazis used gas against the Jews in WW II, so are you not going to use gas? I hope this doesn't sound insensitive, but part of studying anonymity and the pseudonymous experience is finding out what sort of techniques can be used to discover someone's nym. I pointed one out earlier - watching for double postings, one by nym, the other by actual identity. If studying writing patterns is a viable method for discovering the true identity of a nym, then by all means try it. If someone were to discover my identity, I would use it as a learning experience. I'm going to be as careful as possible, but I would not advocate ignoring software if it exists, no matter what its historical significance. Wonderer -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNF+hh1kTJuroDD9AQG96QIAo5JEYTSOAwaAdFDs9AOEbbq27Uho3b8r T1corhWKdZVmESMYLKTCaIcxlkABUcCcZfyCS8bLlud7P4HlCSq3dw== =RKfn -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Duplicate key in keyring?
by J. Michael Diehl 17 Dec '03

17 Dec '03

Lately, when I use pgp -ka, I get the following message: warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' warning: duplicate key in keyring '/usr/tmp/1730s/pubring.pgp' I'm using the keyring from the key-server. This really annoys me. Is there any way to fix this? Thanx in advance. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

2 1

Re: pgp and procmail
by J. Michael Diehl 17 Dec '03

17 Dec '03

Well, I've had a lot of people asking me where to get procmail from. I'm including several addreses at the end of this list. At the momeent, I am testing my procmail recipes for pgp. I suspect I have a file locking problem, which, while it hasn't manifested itself yet, could cause problems later. I am working on fixing this before I release my recipes. So that I may test my recipes, I would appreciate it if you would send me, first, a copy of your public key, then a message signed with it. Also, I would like you to try to spoof it. To make this easier for you, I will send you back your message as it appears in my mailbox. Thanx in advance. Host ftp.cs.widener.edu (147.31.254.132) Location: /pub/src/mail FILE -r--rw-r-- 118657 bytes 00:00 1 Jul 1992 procmail.tar.Z Host ftp.sunet.se (130.238.127.3) Location: /pub/unix/mail FILE -rw-rw-r-- 111459 bytes 22:00 15 May 1992 procmail.tar.Z Host ftp.edvz.univie.ac.at (131.130.1.4) Location: /unix/systems/linux/util/mail FILE -rw-r--r-- 221413 bytes 02:08 25 Jun 1993 procmail.tar.Z Host alf.uib.no (129.177.30.3) Location: /pub/Linux/util/mail FILE -rwxr-xr-x 221413 bytes 03:18 26 Jun 1993 procmail.tar.Z Host keos.helsinki.fi (128.214.4.83) Location: /pub/archives/comp.sources.misc DIRECTORY drwxrwxr-x 512 bytes 00:00 12 Feb 1993 procmail

1 0

Re: ON THE ROAD TO NOSINESS...
by an15489＠anon.penet.fi 17 Dec '03

17 Dec '03

>In Europe, I believe that there are highways >that you can speed on, and then receive a ticket in the mail >when the camera photographs your plate. This happens here in the United States. In Campbell, California the police have a small van which they set up on major streets. If the radar thinks you're speeding, it photographs you and mails you a ticket. Jack ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Sternlight with the news...
by Anonymous 17 Dec '03

17 Dec '03

Newsgroups: sci.crypt,talk.politics.crypto,alt.security.pgp,alt.security.ripem,comp.org.eff.talk From: strnlght(a)netcom.com (David Sternlight) Subject: News from the cipher front Message-ID: <strnlghtCFKJoH.IHu(a)netcom.com> Organization: DSI/USCRPAC Date: Wed, 27 Oct 1993 18:36:16 GMT Lines: 143 Ciphertext, the RSA newsletter (v1 n1, Fall 1993) showed up in my mailbox this week. It contains much useful and interesting information, as well as an announcement of RSA's 1994 conference on January 12-14. What follows are some digested excerpts, posted with permission. On the Clipper front there is a very useful and non-polemical summary of the technical aspects of Clipper by Paul Fahn, and an article by Martin Hellman. Hellman is a Distinguished Associate of RSA Laboratories, one of the inventors of Public Key technology, and a Professor of Electrical Engineering at Stanford. He's not happy with Clipper as presently proposed, and says why. Since the article is based on his NIST testimony, the latter can be obtained by anonymous ftp at isl.stanford.edu in /pubs/hellman/nist.clipper.text. The third annual RSA Data Security Conference is at Redwood Shores, CA. It costs $245 per person. There is no Onsite registration. Deadline is Friday 12/17/93. For details contact RSA. Registration is limited to 400 and includes the conference, tutorials, and hardcopy conference proceedings, as well as a cocktail reception, and breakfast and lunch on all three days. Apple Ships RSA Digital Signature in Long-Awaited System 7 Pro. On October 4th, Apple Computer introduced millions of new users to the RSA Digital Signature. The producs are called PowerTalk and PowerShare and are part of System 7 Pro, a new version of the Mac operating system. They include five components, integrated into the operating system--Messaging, Electronic Mail Directories, Privacy and Authentication, and Digital Signatures. They also include RSA's RC4 symmetric stream cipher for server-to-server link encryption. Powertalk is compliant with the Public Key Cryptography Standards, and users will receive a voucher for a free unaffiliated "residential digital certificate, good for use with any secure PKCS or Internet PEM-compliant application. The Apple System 7 Pro implementation is PEM-certificate compatible, and the messages are as well. (For those who want privacy, RIPEM Mac operates with the key pair generated by the Mac.) There is an API to the sign/verify functions of the MacOS so that any app developer can use the features without needing to license from RSA. Of course, the MacOS with RSA Digital Signatures is fully exportable. RSA has a free signer utility for Windows that is compatible with the Mac sigs. Internet Privacy Enhanced Mail Arrives. Several commercial and freeware versions are available right now: TechMail, written at MIT, is a complete mail reading program for Macintosh and (soon) Windows. It includes full implementation of the Internet PEM RFCs, using RSA's TIPEM toolkit as its security engine. It is a client of the Internet Post Office Protocol. Techmail for the Mac is available from net.dist.mit.edu in pub/TechMail. It runs on SLIP or non-SLIP. (Poster's note: The SLIP version incudes PEM and works fine. I haven't tested the non-slip version and am not sure if it yet includes PEM.) TIS/PEM and T-Mail are non-commercial freeware and commercial supported versions, respectively, of Trusted Information Systems implementations of Internet PEM. The former was developed under contract with ARPA and agreement with RSADSI and is available in source code for academic research or exploratory use by corportions or individuals on the Internet. For more information send e-mail to tispem-support(a)tis.com. TIPEM 1.1 is the latest release of RSA's Toolkit for Interoperable Privacy-Enhanced Messaging. It permits creating applications that comply with the Internet PEM standards as well as the commercial Public Key Cryptography Standards (PKCS) established by vendors including Lotus, Apple, Novell, and Microsoft. The toolkit was used for Apple's Powertalk. It is available directly from RSA Data Security Inc. RIPEM is another freeware public key encryption program designed for Internet PEM. It implements a subset of PEM as described in RFC's 1421-1424 The internet host ripem.msu.edu acts as a RIPEM key server for users who choose to register their keys. It is available via anonymous ftp from rsa.com and non-anonymous ftp from ripem.msu.edu. RSA Certificate Services Center Opens for Business. This article describes the center RSA has established to get ral certificates with your name, public key, and organizational affiliation safely embedded in a cryptographically tamper-proof digital document. This provides the digital ID for Apple Powertalk, Internet Privacy-Enhanced Mail, or any X.509 certificate-based secure application. The center allows you to issue your own affiliated certificates using RSA's Certificate Issuing System; or the Certificate Services Center can issue affiliated certificates for you, or you can purchase individual unaffiliated certificates directly from the CSC. Revocation services are also provided, as are certificate verification services. Users of Apple's System 7 PRO may get their first certificate free. (Poster's note--as I understand it, subsequent individual certificates are $25.) For more information contact George Parsons, CSC Manager at 415-595-8782. RSA Licensee Update: This piece is a partial list of products using RSA Technology available now or coming soon. They include products from Novell, Apple, Microsoft, Trusted Information Systems, Motorola, AT&T, Lotus, Word Perfect, Racal, IBM, Northern Telecom, Hughes, etc. in categories of Security in the OS, Secure E-mail, Secure Telephone and Fax, Secure Workgroup, Secure Electronic Forms, Link and Node Encryption, and Secure Remote Access. Hilgraeve Licenses RSA for Best-Selling Asynch Package. Hilgraeve, Inc. is about to release the very first mass-market asynchronous communications package with RSA encryptoin capabilities built in. The current release of that software, HyperACCESS/5 is already a market leader, for DOS, OS/2, and Windows. It has received PC Magazine's Editors' Choice Award three out of the past five years for its quality, performance, and ease of use. For more information, contact Matt Gray at 313/243-0576. DataMedia's SECURExchange can "secure virtually any existing DOS, Windows, or Macintosh E-mail system. It uses RSA Digital Envelopes, RSA Digital Signatures, and RSA Digital Certificates. It has been fully tested with cc:Mail, Microsoft Mail, DaVinci Mail, Beyond Mail, Internet, Compuserve, MCI Mail, AT&T EasyLink, and other systems. For more info call 603/886-1570. Dr. Ron Rivest has a piece on the Difficulty of Factoring--a reprint of a "classic paper." The RSA Factoring Challenge is a list of very long numbers posted on rsa.com. There are cash prizes for the most successful factorers. Prizes vary from the tens to the thousands of dollars, and unrewarded prize money rolls over into a kitty from month to month. SmartDisk is a smartcard that fits in a standard 3-1/2 inch diskette slot and interfaces with the disk read heads. It's a high-performace smart card that doesn't need a reader. It has its own embedded OS firmware. the firt application available is SafeBoot, a complete PC access control package which is "virtually unhackable. The encryption algorithm and key are stored on the SmartDisk to protect them. For further info call Gene Wagner or Jon Kaplan at Fischer International, 813/643-1500. The above excerpts are only partial summaries of the material in the newsletter. RSA Data Security Inc. is at 100 Marine Parkway, Suite 500, Redwood City, CA 94065-1031. Disclaimer: The poster of this summary has no connection with any of the companies mentioned herein, except as an occasional beta tester for some, and an interested observer. David -- David Sternlight When the mouse laughs at the cat, there is a hole nearby.--Nigerian Proverb

1 0

Get this (from alt.security.pgp)...
by mikeingl＠news.delphi.com 17 Dec '03

17 Dec '03

>Newsgroups: alt.security.pgp,talk.politics.crypto,comp.org.eff.talk >Path: news.delphi.com!noc.near.net!howland.reston.ans.net!spool.mu.edu!sgiblab!rtech!amdahl!netcomsv!netcom.com!strnlght >From: strnlght(a)netcom.com (David Sternlight) >Subject: L'Envoi >Message-ID: <strnlghtCFoIwF.IqG(a)netcom.com> >Followup-To: poster >Organization: DSI/USCRPAC >Date: Fri, 29 Oct 1993 22:09:50 GMT >Lines: 60 >Xref: news.delphi.com alt.security.pgp:5751 talk.politics.crypto:1071 comp.org.eff.talk:20845 When I began participating in cryto discussions here, there were several issues of interest to me. One was to encourage RSADSI to permit a "U.S.-legal" version of PGP. I have worked behind the scenes with RSA to encourage that, and it now appears that with ViaCrypt that goal has been reached for DOS, and one assumes soon for Unix and the Mac. Another was to make it clear that I thought both that pgp 1.x and 2.x were infringements of PKP's patents in the U.S. and those who encouraged or supported that were acting in a counterproductive way to RSA's permitting a licensed version. I've made my views very clear on this, and now that ViaCrypt is out, the issue is somewhat stale. A third was my concern that PGP2.x was the result of violating U.S. law. Since a Grand Jury is now investigating this matter, I am happy to leave it, whatever the outcome, in the hands of the professionals. I claim no personal credit for any of the above developments. Along the way I electronically met many colleages who vigorously but civilly disagreed with some of my views and advocacies. They have earned my undying respect and admiration. I also met some who were, not to put too fine a point on it, badly in need of having their mouths washed out with soap. They will remain in memory for who they have shown themselves to be. My biggest single disappointment was with Mike Godwin and EFF. I had considered them to be professionals working on issues I supported. I now believe they are petty special pleaders riding a particular hobby horse, and to some extent a toy of their major funders. They have, again in my view, shown themselves not above both inaccurate propaganda statements, and a complete inability to acknowledge and correct such errors when they arise. Thanks to the many who sent me e-mails of support during this whole experience. Thanks also also to the few who had genuine disagreements and expressed them civilly in e-mail. Since the main issues of concern to me now seem to be well in train, it's time to use my energies in other ways. Thus I am removing talk.politics.crypto and alt.security.pgp from my reading lists. I am always available via e-mail, and would welcome news from colleagues who wish to take the trouble to write me on how Phil Zimmerman is doing, how the Grand Jury proceedings are coming along and with what result, and when "U.S.-legal" Mac and Unix versions of PGP become available. For those who are curious, when I need encryption my current tools of choice are TechMail for correspondence flowing via POP Mail servers, and MacRipem for point-to-point traffic to other Macs. I am also experimenting with the new Mac System 7 Pro and an illustrative application Apple sent to developers that handles internet mail within it. I understand Ripem Mac will fit into this model and accept the System 7 Pro signer keys for encryption, and I'm going to work with that as well. David -- David Sternlight When the mouse laughs at the cat, there is a hole nearby.--Nigerian Proverb

1 0

Paranoid
by nobody＠Menudo.UH.EDU 17 Dec '03

17 Dec '03

>>> Does this allow a cracker to search for the compression's signature >>> after every attempt? >Every attempt? You mean every attempt at encryption? Well, yes and >no. Yes, there is a semi-known plaintext inside the encrypted data. >It is unknown if this can help an attacker. "unknown" doesn't provide anyone with very much reassurance. >>> Would using UUENCODE on the text and deleting the "begin/end" lines >>> before encrypting it have a synergistic effect on the difficulty of >>> cracking a secret key from that particular message? >This would give an attacker even MORE of a plaintext attack, since >this will create lines of 64 characters, starting with an "M", which >gives a regular pattern to the plaintext. Not all versions of UUENCODE start each line with an "M" and there are other programs similar to UUENCODE that can be used. The synergistic effect would also be due to the fact that the cracker would be clueless to the fact that UUENCODE was being used, but only if there is no type of checksum or compression signature that was being used instead of a spell checker. A spell checker?? This is insane. There has got to be some type of checksum code that verifies if the text was decrypted properly or not. Crackers can't possibly be trying keys and word searching for "the" or "and". Where have all the code writters vanished to? Doesn't the recursive use of DES have a synergistic effect? >>> Is there an easy way to generate keys larger than 1024 bits? >No. However given current technology and assuming no significant >breakthroughs in factoring algorithms, a 1024 bit key wont be broken >for over a million year (significantly more, if I recall). My opinion ---> What TotalFuckingBullshit(tm) <--- Technology is growing exponentially. Try: "for over 10 year[sic]" Any decent "personal computer" can crack mediocre DES encryptions in a semi reasonable amount of time. 10 years ago how many people do you think thought that this would be possible? Is there some type of design flaw that limits RSA keys to 1024 bits??

2 1

Question about Proper Names of Crypto Companies
by Mike Godwin 17 Dec '03

17 Dec '03

A journalist friend asks me the following: > what is the proper (as in inc., corp. co., etc) > name + location of viacrypt + austin code works? I know where Austin Code Works is, of course, but couldn't be authoritative on the other matters. Could someone fill me in? --Mike, not afraid to express uncertainty

2 1