December 2003 - cypherpunks-legacy

PGP Public Key Server Commands HTML Document
by Jon 'Iain' Boone 17 Dec '03

17 Dec '03

Although I can access this document and read its contents, I am unable to select the options for submitting or extracting a key. I am using XMosaic to access it -- is this a problem? Jon Boone | PSC Networking | boone(a)psc.edu | (412) 268-6959 finger boone(a)psc.edu for PGP public key block

2 1

Bugs Reported in SecureDrive 1.3
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

The following bugs have been reported in SecureDrive 1.3. I have already fixed these here, but I want to wait a short time before releasing 1.3A to allow any more bugs which may be present to show up. Please be aware of the following problems and try to work around them as suggested until 1.3A is released. Please report any further problems with 1.2 or 1.3 to edgar(a)spectrx.saigon.com (Edgar W. Swank) ====================================================================== Bugs Reported in SecureDrive 1.3 The Version 1.3 key hashing mode that is supposed to be compatible with version 1.1 isn't, the key is compatible, but the check bytes are not. This means you can't decrypt disks encrypted with 1.1 with 1.3. This will not affect you if you don't already have any disks encrypted with 1.1 and you want to stay compatible with 1.0 and 1.2. Go ahead and install 1.3 and set environment variable SET SD10CMP=X If you already have disks encrypted with 1.1, wait for 1.3A. If you can't wait, decrypt with no TSR installed and CRYPTDSK 1.1. Then Re-encrypt with 1.3 using either compatibility mode as you choose. Note the 1.3 mode supposed to be compatible with 1.1 offers essentially the same added security as 1.1. There will be code in 1.3A to change any "orphan" 1.3 check bytes to those compatible with 1.1 and 1.3A If you have multiple encrypted Hard Disk partitions, and one is active and you use CRYPTDSK to decrypt a different partition. Then the active one stays active but is no longer being correctly decrypted by SECTSR, leaving it in an UNSAFE condition until the next boot. Fixed in 1.3A Version 1.3 SECTSR is supposed to have a check so it doesn't get installed more than once, but this doesn't work. If you install 1.3, make sure you don't install SECTSR twice in the same boot session. Best to make your -only- call to SECTSR from AUTOEXEC.BAT and never install it from the keyboard. Cosmetic: Several msgs in LOGIN/CRYPTDSK refer to "V 1.3" passphrases. These references should more correctly be "V 1.1" since that was the version that defined the new standard. This would be even more confusing now since V 1.3 is not completely compatible with V 1.1. If LOGIN d: /PGP is specified, but PGPPASS is set to incorrect passphrase, the correct hard disk passphrase not prompted for. -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

FORWARD: Lecture re Internet Commercialization
by edgar＠spectrx.saigon.com 17 Dec '03

17 Dec '03

Subject: The Internet Advantage Date: Wed, 26 Jan 1994 21:08:11 -0800 (PST) Reply-To: eventinfo_ca(a)clbooks.com To: edgar(a)spectrx.saigon.com *Edgar* X-Mailer: fastmail [version 2.4 PL21] From: cherrie(a)clbooks.com (Cherrie Chiu -- Computer Literacy Bookshops) Message-ID: <9401262108.aa25193(a)clb_hq.clbooks.com> AN EVENT AT COMPUTER LITERACY BOOKSHOPS ---------------------------------------------------------------------- FINDING COMPETITIVE ADVANTAGE ON THE INTERNET: Resources and Strategies ---------------------------------------------------------------------- a free presentation by: Dr. Mary Cronin Commercial use of the Internet can offer companies new opportunities for improving products and services, reaching new markets, and gaining competitive advantage. But it takes more than just establishing a network connection. Mary Cronin will discuss examples of innovative uses of the Internet, drawn from her book "Doing Business on the Internet", and present some of the latest business resources available on the network. DR. MARY J. CRONIN has more than 20 years of experience in information management and technology. She is on the staff of Boston College, and teaches information management at the college's School of Management. Dr. Cronin has written articles about business and the Internet for Computer World, Internet World and Database magazines. She is also the author of "Doing Business on the Internet: How the Electronic Highway is Transforming American Companies", a book that addresses the Internet's impacts on and opportunities for customer support, product research and development, and marketing. Date: Thursday, February 3rd, 1994 Time: 6:30 - 8:00 p.m. Location: Computer Literacy Bookshops 2590 North First Street (At Trimble) San Jose (408) 435-1118 Stay tuned. There are more events to come. Events at our stores are always free. ------------------------------------------------------------------------ If you would like to receive e-mail announcements for upcoming store events, simply write to: events_ca-request(a)clbooks.com (for events held at our California stores) events_va-request(a)clbooks.com (for events held at our Virginia store) ------------------------------------------------------------------------ If you have signed up for email announcements but have not received any, or wish to be removed from this list, please contact us. We add names by request only. **************************************************** Computer Literacy Bookshops, Inc. Cherrie C. Chiu eventinfo_ca(a)clbooks.com (408) 435-5015 x116 -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >I have a question for all the 'punks who are running remailers. >I've noticed that most of you run the remailers from your accounts at >various colleges & universities. I want to know what kinds of reactions >you got from the system administrators. Did they ask lots of questions, Well, I run three remailers, and as far as I know, the system administrators don't know about them. Actually, for the two on rosebud.ee.uh.edu, I don't think the admin would care since it doesn't take up much cpu time. The remailers run on previous accounts I had when I was a student at UH. As far as Rice, the usage policy states: :Sending electronic mail directly to an unofficial automatic mail :handling program is not allowed. Unofficial means something that is :not a standard part of the system and has not been installed by the :Owlnet system management. Using an automated method to direct any :incoming mail to an unofficial program is not allowed. so the chances of me running one here are zero, since I can't really risk the hassle with my only account. >Also, if I was to try running a remailer, would I need my own >machine, or is there some way I could get the school's computers to >run the remailer for me? Well, running it from a school account is probably the least expensive option :-) If you have your own machine then that's the way to go! Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU01KYOA7OpLWtYzAQEoSwP/byCQamg1NgbK/cv8gqJZLliqMF8lhBZm /i6+Q9KryvdLsMcc/Kg1XAIYPMGO+PDttCqpzqJoFC2kL2FkzkkXI4vB/RtdQScT flA7CRcpIWfYfOoCkuou4GMAAbZnkKCrOpDu3Ea8j6geQN6HZn5sGP0stF/9w/Y+ VxwkbePp4C8= =yrzM -----END PGP SIGNATURE-----

1 0

An easy-to-create pay-for-use remailer service
by Sameer 17 Dec '03

17 Dec '03

I might set one of these up sometime this fall when I get a better net connection for my computer.. meanwhile, here's the idea: A payforuse anonymous id system. Someone would snail mail to me a money order, an login/aliasname, and a pgp SASE, encrypted with the public key of the remailer of their choice. (And the address of the remailer of course.) I would set up a mail alias which would take incoming mail, and send it off to the anonymous remailer defined by the user, with the SASE block thrown in the beginning of the message, and the To: From:, etc. lines added to the message using the "##" header pasting mechanism. Accounts would be debited according to the amount of traffic going through. Once all credit is used up, it would take another money order with the login/aliasname attached to refill the account with credit. In this way an anonymous persona can have a much more normal-looking email address, and the operator of the remailer is still ignorant of the anon-id<=>real-address mapping, to protect against subpeonas. This is just as weak as the remailer-chain used in the SASE block. The privacy of that will improve as the remailers improve.

1 0

Properties of hash functions
by Aviel David Rubin 17 Dec '03

17 Dec '03

Does anyone know the following, or can someone point me to the proper references? What properties are preserved by hash functions? For example, take x = MD5(Y). Now, say that Y is a quadradic residue mod N, is it the case that x is also a quadradic residue mod N? Are there any interesting properties that are preserved by frequently used hash functions? Thanks a lot for any help, Avi Rubin

1 0

Re: Index for ftp site csn.org:/mpj/
by smb＠research.att.com 17 Dec '03

17 Dec '03

I just recently got MacRipem and find it much easier to use th an PGP, and was wondering why I should use PGP over Ripem. The above seems to indicate that Ripem isn't as secure. Why is this? I don't doubt that its much easier to use -- it was written by Ray Lau, who is an excellent Mac/UI programmer. The most reasonable reasons why it might be called "less secure" is that RIPEM does not have a signature web like PGP does. It is possible in PEM to only have one signature on your certificate, which can be your own signature, or that of a CA. Therefore, you either have the status of "I say I am who I say I am", or a "Certification Authority says I am who I say I am". I can't speak for RIPEM, but that's not accurate for PEM. You can have as long a chain of signatures as you want up to the certifying authority. That may not be as general as you'd like, but it's better than just a single authority. A bigger problem is that PEM uses DES rather than IDEA. I just learned of a new attack by Mitsuru Matsui of Mitsubishi that requires 2^43 *known* plaintexts, not chosen ones. The note I received says that it ``breaks the scheme in 50 days on 12 HP9735 workstations''. This was presented last week at the Japanese Conference on Cryptography and Information Security.

2 1

Re: Index for ftp site csn.org:/mpj/
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

> A bigger problem is that PEM uses DES rather than IDEA. I just learned > of a new attack by Mitsuru Matsui of Mitsubishi that requires 2^43 > *known* plaintexts, not chosen ones. The note I received says that it > ``breaks the scheme in 50 days on 12 HP9735 workstations''. This was > presented last week at the Japanese Conference on Cryptography and > Information Security. RIPEM supports two key triple DES. Mark

1 0

Re: MacPGP BAD on soda.be
by Duncan Frissell 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com W >> Re: encrypted valium W >Just wait until Chemical CAD/CAM becomes available - shipping valium W >will be protected by the First Amendment, the data police will be W >competing with the drug police to confiscate your computers, W >and LD wibe ranting that drug dealers are using crypto remailers W >for both payments and product delivery :-) Likewise, the BATF. "Who's that knocking on my door?" "The Dowager Dutchess of Dykedom's Daring Destructors?" "But my stout door will only last a few minutes and I have no weaponry." "Oh, woe is me." "But wait, I just got my new 3D molecular deposition printer and the varlets have yet to block my wireless net link. What is the address of that hot new weapons haven. Quick, download the DDF's for that new full auto flechette cloud Block Leveler (plus DDF's for the ammo belt)." Copy the gun DDF out the printer port, wait that looong 30 seconds, grab the freshly printed device, copy the ammo belt ddf out the printer port (after clicking the icon for continuous printing), grab the end of the belt as it starts to come out of the printer. Get the kids, dogs, goats, and chickens into the circle around the printer, when the door gives way, start a circle sweep taking out the house, the garden, and all vertebrate life out to the visible horizon." ******* Just kidding. No problem running off a couple dozen Ruger Mini 14s though. Though cypherpunks is not the place to argue RTKBA issues, it *is* the place to discuss issues like the effect of crypto, and reduced costs of information, on society. Since some of the things that people will choose to trade over the nets will be porno, drug files, and weapons files (they are already doing so), and since desktop molecular synthesis units and molecular deposition "printers" are inside our event horizon, they can be discussed here. DCF Who (despite evidence to the contrary) doesn't have a psychological need for automatic weapons merely a tactical one (just like Salman Rushdie). --- WinQwk 2.0b#1165

1 0

Re: 2-way anonymous via SASE
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Jon Boone <boone(a)psc.edu> writes > Isn't it true that no matter how many remailers you use, the full spec > of the return path has to be included? And if the last remailer is > keeping a log of all messages passed, then the reciever/replier need > only interrogate the last remailer to find out the sender's address? No, the last remailer only needs to know how to send mail to the preceeding remailer. Depending on how fancy a remailer system you're using, and whether the recipient or remailer operator can be trusted, there are different amounts of work you need to do to get what you want. If you're creating 1-shot reply tokens, they can be set to send to an address at the n-1th remailer, which anonymizes and adds the address for the n-2th remailer, etc. This gives you reasonable security as long as at least one remailer can be trusted and isn't coercible. Don't know if anybody's implemented remailers supporting this yet; Julf's anon.penet.fi remailer gives a more persistent return address. BTW, an alternative to arranging digipayment to every remailer in the chain, which is complex, slow, and introduces opportunities for leakage, might be to create a "Remailer Postage Cooperative"; postage gets sent to the first remailer only, and the remailers use some sort of settlements process to divide up the payments, the way phone companies or post offices do. Postage might vary by number of hops you're paying for or whatever (e.g. a 3-hop stamp), and settlements might be per-message or might just be apportioned by the difference in amount of traffic flowing in each direction. This works better with a stable system of remailers, but even if the remailers aren't all cooperating, it at least lets you reduce the number of postage-stamp messages to the number of cooperatives your message uses instead of the number of remailers, and reduces setup considerably. > Jon Boone | PSC Networking | boone(a)psc.edu | (412) 268-6959 > finger boone(a)psc.edu for PGP public key block Finger can be faked - including your Key ID or fingerprint in your .signature file lets people be more sure it hasn't. e.g. > finger boone(a)psc.edu for PGP public key block ID #123456 # Bill Stewart AT&T Global Information Systems, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1