December 2003 - cypherpunks-legacy

Re: Signing our keys
by smb＠research.att.com 17 Dec '03

17 Dec '03

The PGP feature that a key doesn't have to belong to the True Name of an entity is a big plus in my book; otherwise, we'd have no Wonderer, no deadbeat, and no S. Boxx. It is, of course, worth noting that the PEM specs make explicit provisions for aliases; it's just up to some issuing agency to decide to issue them. And if no one wants to -- well, no one has to sign an anXXXX address's key, either. --Steve Bellovin

1 0

Re: Signing our keys
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In an interesting list message, Wonderer wrote: >It seems to me that we have an interesting dilemma >here. If we are willing to sign a key based on an >entity that we KNOW does not really exist, then what >does a signature mean? Here's a terrific example of one of the interesting differences between the PEM-style key hierarchy and the PGP web. Consider that any entity (real or spoofed) can own a key pair in either model. A PEM key is bound to a particular identity by a certificate. Right now, you can only get these certificates from entities that want some concrete evidence of your True Name; this makes sense, since the certificate establishes that key X belongs to True Name Y. PGP, OTOH, doesn't have any direct equivalent of a certificate. If I get Wonderer's key with no signatures, I can't guarantee anything about the association between that entity and the key I get. If I get that same PGP key with signatures from Phil Karn and L. Detwiler, I know that they're willing to certify the assocation. Does that mean anything? Well, it depends on who the signers are :) A set of PGP signatures can be equivalent to a PEM-style certificate; that is, the set of signatures on a key, establishing that a particular key belongs to a particular entity, can potentially be as trustworthy as a certificate from Dun & Bradstreet or RSA. The PGP feature that a key doesn't have to belong to the True Name of an entity is a big plus in my book; otherwise, we'd have no Wonderer, no deadbeat, and no S. Boxx. - -Paul - -- Paul Robichaux, KD4JZG | Caution: cutting edge is sharp. Avoid contact. Intergraph Federal Systems | Be a cryptography user - ask me how. ** Of course I don't speak for Intergraph. ** -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLNAJ2yA78To+806NAQF/DAQApsjQgIjW26GPvL2kINfCzTGyxn6zXJr9 OZVdLjPRe/J7eudxXfe5q7MlENxyomXgXqnUr5AxmTEjPzWCj63D1Yq2qr2Gcjq+ i7YTg8d9P+L+yTsTVUBk+ZIbBv+AFnD35yCEQnIC5nCE0kK644cpwa1FjDyLla01 2m4fvPNTOnM= =ZF43 -----END PGP SIGNATURE-----

2 1

Chaos - A noun we can live with
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

> i like cpunx the way it is: uncontrolled. I too agree with this statement up to a point. I don't believe there should be any control by the list management. However, I see no problem with the democratic process of participants on the mailing list saying whatever they can to quiet those who are disrupting the intelligent discussions that are taking place with useless banter and silly flames. Personally, I always found flaming to be an unproductive way of expressing one's self. Constructive criticism is always better in my view. Wonderer p.s. something's wrong with my pgp, I'll start signing soon. Sorry. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

Hackers 9.0 Crypto Panel, the Semi-Final Agenda
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Many of you will be attending Hackers 9.0 beginning next Friday at Lake Tahoe. This message is for you. The Hackers Conference panel on crypto has come together nicely. Glenn Tenney has asked us to move it from Saturday afternoon to Friday night, 9:30 to 11, and I've agreed. I don't think this should conflict with any other sessions, as this is a one-track section too. If there are conflicts, let me know and we can arrange substitutes or somesuch. A few weeks ago I solicited your advice on topics and asked for any volunteers. This is what came out of this process: * a panel discussion, as opposed to the short speeches of last year. * a discussion of whatever is of main interest after the panel makes their initial points. * panelists: - Phil Karn, on Internet encryption - Peter Honeyman, on issues of anonymity and trust - John Draper, on the spread of PGP - Eric Hughes, on digital money and banking - Mike Godwin, on legal issues surrounding crypto If any of you has changed your mind, let me know as soon as you can. And if anyone else has some topics they really want to talk about, let me know...maybe you can be added or be a sub for anyone who drops out. I'll try to moderate this thing and keep any one topic from sucking up all available time. Clipper and the legal issues surrounding PGP are two of the obvious things that the audience could "demand" more attention be given to. I think we of course _should_ talk about these issues, but we also want to bring up new material and not just today's "headlines." (For example, a year ago the "key escrow" stuff was relatvely obscure next to the Steve Jackson Games issue....then key escrow blossomed into "Clipper" just six months later and is now the Really Hot Topic. The use of anonymous remailers in the breaking of the Verilog encryption system is similarly a portent of things to come.) These topics will likely come up many times in the audience participation phase. And if Phil Zimmermann attends, which I've not been able to confirm, I expect he will be on the panel, or will participate centrally in the "BOF" (birds of a feather) session which I expect will start after our panel). (In fact, if he attends, it might be good to just let him speak for as long as he wants at a BOF. I remember Cliff Stoll speaking until nearly 4 in the morning a couple of years ago.) See you there! -Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Re: Signing our keys
by an41418＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Well, Paul Robichaux, actually, that message was not intended for the list, as you seem to realize. However, given your message, and the thoughts that it sparked, I guess it wasn't such a bad thing after all that my lack of sleep caused me to be careless. I'd like to know how many people check the signatures at the end of messages. Maybe whenever there's a questionable one, or if someone claims that a message seemingly from them is a spoof. So, my question is: how do I get people to agree to sign my key when I don't really exist? Is my net reputation enough for you? -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLNARpB1kTJuroDD9AQEiEAH/etWoc0WA89+Rb9ojM4jRQflZQNjVrnYx r8YSYpq1k+G2W6eDPA+m0mQnWqaKGizKwPJecXkpQGfW5YawWSOg6w== =kZgv -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

pgp versions
by hortonb＠source.asset.com 17 Dec '03

17 Dec '03

I would like to use PGP on multiple platforms, and am unsure of which version I should use to maximize my interoperability with other PGP users. In the PGP documentation, "hmiller(a)lucpul.it.luc.edu" is listed as a source of info regarding the availability of PGP for various computer platforms. I EMailed Mr. Miller but recieving no response. Finger indicates he hasn't used that account in over a month. John Draper suggested I contact you. I am unable to read PGP2.23 files created under DOS on the Macintosh running MACPGP2.2. I saw nothing in the "newfor23" file to indicated that the PGP file format had been changed so as to be incompatible. Are you familiar with this problem? Is there a MACPGP2.23 in the works? -bh

1 0

Re: Signing our keys
by jim＠nimrod.suite.com 17 Dec '03

17 Dec '03

"Eric Hughes" writes... > RSA is running a persona certificate server for PEM keys. > They don't ask for anything. Their latest brochure > diagrams these as "anonymous internet users." I don't > know the address, but I do know that six months ago it was > running and being tested. > Here's an extract from the latest RSA Newsletter: ------------ _RSA Certificate Services Center Opens for Business_ Last month, the RSA Certificate Services Center (CSC) officially opened for business. Right now, today, you can obtain real certificates with your name, public key, and organizational affiliation safely embedded in a cryptographically tamper-proof digital document. [stuff deleted] GETTING A CERTIFICATE There are two primary types of certificates that are supported by the RSA Certificate Service Center: affiliated and unaffiliated. [stuff deleted] There are three ways to get a certificate: [stuff deleted] 3. You can purchase individual unaffiliated certificates directly from the CSC. [stuff deleted] For more information contact George Parsons, CSC Manager, at 415/595-8782. ------------ Jim_Miller(a)suite.com

1 0

RE: pgp and procmail
by J. Michael Diehl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi again! I've gotten some real good replies to my question regarding whether I should use procmail to send pgp advertisements. The overwhelming response has been that I shouldn't. I will instead, as was suggested, put my advertisement in my heading, like my pgp key info. Any suggestions as to what to put there? I have also been asked if I intend to post my procmail rc file. Yes, I do. As soon as I have tested it and feel finished, I will post it to the list. I've only been using procmail for ~4 days. By the end of the week-end, I will have procmail preprocessing my incoming encrypted email, a non-secure key on the mainframe to sign quick letters with, and a secure message-signing and transport system on my pc at home. I intend to run the link program from within Telix and Use Mike Ingle's encrypted disk driver. Short of burying my computer under 500 feet of concrete, what else can I do to build a reasonably secure system at home? Just for the Hell of it. ;^) -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLMsjE1WjzUwifAbxAQG2fAQArUMrQBKa0o2n3HieGO/aUCZX1CsHgpXY QluVsGK1I8JPqxVdo6hPwl4M8gE6VSNimUjo7Sp/a/UzonjdS7BkOYX+V2/1oIv3 iHi6Y0ms0FmXBP/m7/ZZq2t2BQGCmLXiJ9M4r57nnZsqagsVUXStr0vMzWN/V+fd R3qdl3Iopps= =VDMU -----END PGP SIGNATURE-----

1 0

["Tom Jones": ViaCrypt PGP for MS-DOS Now Shipping]
by Marc Horowitz 17 Dec '03

17 Dec '03

------- Forwarded Message Date: Thu, 28 Oct 93 15:58:57 -0700 To: marc(a)gza.com From: "Tom Jones" <wk01965(a)worldlink.com> Organization: ViaCrypt div Lemcom Systems Subject: ViaCrypt PGP for MS-DOS Now Shipping You recently contacted ViaCrypt and asked for information about ViaCrypt PGP, and that it be sent to you electronically. ViaCrypt PGP Version 2.4 for MS-DOS is now available for shipment. Appearing below is information from our literature, along with details about ordering ViaCrypt PGP. ViaCrypt Introduces... ViaCrypt(tm) PGP(tm) Pretty Good Privacy(tm) Protect The Privacy Of Your Files And E-Mail Messages ===================================================== Your files and messages. They're personal. They're private. And no one's business but yours. You may be planning a political campaign, preparing your taxes, or negotiating a contract. Whatever it is, you don't want your private electronic mail (e-mail) or confidential documents read by anyone without your permission. ViaCrypt PGP is the perfect tool for individuals, small businesses, large corporations, or anyone who values the privacy of their proprietary or sensitive information. A software program that combines powerful cryptography with ease-of-use, ViaCrypt PGP provides the ability to encrypt files and messages. Using Digital Signatures, it also provides a facility for message authentication. You Control The Keys To Your Privacy ------------------------------------ With ViaCrypt PGP, you are in complete control of your privacy. YOU create your keys. YOU decide how long they are valid. YOU decide who to trust. Other systems require you to place your trust in a disinterested third party, or worse yet, a chain of faceless people you've never met. ViaCrypt PGP allows you to do so too, but never requires it. YOU are always in control. ViaCrypt PGP is for people who don't want to surrender control of their privacy. Strong Cryptography ------------------- ViaCrypt PGP combines the respected RSA system for Public Key Cryptography with state-of-the-art IDEA(TM) encryption to protect your files and electronic mail, and to let you communicate securely with people you have never met. Features -------- * Protects the privacy of your files and e-mail messages. * Digitally signs files and e-mail messages to protect them from tampering and to authenticate the sender. * Sophisticated key management * RSA/IDEA hybrid encryption scheme * Message digests for digital signatures * Data compression before encryption * Simple, command-line interface for ease of use * Easy-to-understand documentation How It Works ------------ ViaCrypt PGP combines the best features of conventional and public key cryptography. Using conventional secret key cryptography, a file can be encrypted using a key, then sent to the recipient. The recipient decrypts the file using the same key. Conventional cryptography is very fast, but it is difficult to provide the recipient with the key in a secure manner. Public key cryptography eliminates the problems associated with distributing keys. Using public key cryptography, the key is split into two halves: A private key that you never reveal, and a public key that you can freely distribute. The public key and private key are mathematically related such that anything encrypted using the public key can be decrypted only using the matching private key. In a process invisible to the user, ViaCrypt PGP creates a temporary one-time key, called a session key, to encrypt the file using fast conventional cryptography. Then the recipient's public key is used to encrypt the session key. The encrypted session key is sent along with the encrypted file to the recipient. Once the file is encrypted, only the intended recipient(s) can read it. Using a single ViaCrypt PGP command, the recipient uses her own private key to recover the session key, then uses that key to quickly decrypt the file. Message authentication is also provided. The sender's own private key can be used to encrypt a 'fingerprint' or message digest of the file or message. This creates a digital signature of the file or message, which the recipient can check by using the sender's public key to decrypt and compare with the original. The digital signatureproves that the sender was the true originator, and the file or message has not been altered by anyone else. ViaCrypt PGP Enables You To: ---------------------------- * Encrypt files or messages, sign them, or both * Decrypt previously encrypted files or messages * Check previously generated digital signatures * Encrypt messages to multiple recipients * Encrypt files or messages using just conventional cryptography * Generate your own keys * Easily add and remove other people's public keys to your 'key ring' * View the keys on your key ring * Revoke your keys * Re-format encrypted files so they can be sent through e-mail channels * Sign and certify other people's public keys * Specify 'trust parameters' for various keys Requirements ------------ * IBM Compatible PC * MS-DOS Version 3.3 or later * 640K RAM * 3-1/2 or 5-1/4 inch floppy disk drive ================================================================= What You Get * ViaCrypt PGP on both 3-1/2 and 5-1/4 inch diskettes * User Manual * License Agreement * Software registration card ================================================================= Pricing (Licensed for sale in USA and Canada only) ViaCrypt PGP Version 2.4 for MS-DOS (Single User) $ 199.95 (Promotional price good thru December 31, 1993: ($ 99.98) ViaCrypt PGP Version 2.4 for MS-DOS (Five User) $ 599.95 (Promotional price good thru December 31, 1993: ($ 299.98) ViaCrypt PGP Version 2.4 for MS-DOS (Twenty User) $1649.95 (Promotional price good thru December 31, 1993: ($ 824.98) Please add $8.00 shipping and handling per order If you live in AZ, CA, IL, TX, WA, NY, NJ, or GA please add appropriate sales tax. ================================================================= How To Order Four ways to order: 1. Via telephone at 1-800-536-2664 (orders only) 8 a.m. to 5 p.m. MST Monday - Friday. We accept American Express, Discover, MasterCard, or VISA. 2. Via FAX at (602) 943-2601. We can FAX you a pre-printed order form that you can fill in and FAX back to us. 3. Via Mail. Send your Check or Money Order to: ViaCrypt ViaCrypt Order Desk 2104 W. Peoria Ave. Phoenix, AZ 85029 4. Via company purchase order, providing you have been pre-approved for credit. Please contact ViaCrypt for terms, conditions, and credit information. ================================================================= For more information, contact ViaCrypt at (602) 944-0773. U.S. Patent No. 5,214,703 licensed by Ascom Tech, AG. U.S. Patent Nos. 4,200,770, 4,218,582, 4,405,829, and 4,424,414 Licensed Exclusively by Public Key Partners ------- End of Forwarded Message

1 0

Paranoid
by major＠dcd.wa.gov.au 17 Dec '03

17 Dec '03

A nym of no particular repute <nobody(a)Menudo.UH.EDU> writes: > Does PGP compress the text before it is encoded? yes > Does this allow a cracker to search for the compression's signature > after every attempt? There is no "signature". Unix compress(1) leaves a signature but there is nothing in the math of compression which forces a compression algorithm to do so. Major

1 0