December 2003 - cypherpunks-legacy

Re: procmail-pgp (fwd)
by steve willey 17 Dec '03

17 Dec '03

jmd, asked me to forward this to the list, i think, i was testing his procmail recipe and all that was ever seen of his most recent message was the subject line and a bunch of error messages in my procmail log file :) ---------- Forwarded message ---------- Date: Tue, 16 Nov 1993 01:14:20 -0700 (MST) From: "J. Michael Diehl" <mdiehl(a)triton.unm.edu> To: steve willey <willey(a)seattleu.edu> Subject: Re: procmail-pgp According to steve willey: > any thoughts on procmail version specificy for this pgp recipie? i am > currently using v2.03, which, i am pretty sure, is not the current version. > i'm ready to try it but..., please let me know if you know of any problems > with older procmail versions. I'm using v2.91. I don't think you will have a prob. tho. Let me know. Send yourself a few messages. You need to send a key, a signed message, and an encrypted message. You also might want to try the requests. Hope you like it. J. Michael Diehl ;^) |*The 2nd Amendment is there in case the mdiehl(a)triton.unm.edu | Government forgets about the 1st! <RL> Mike.Diehl(a)f29.n301.z1 |*God is a good Physicist, and an even .fidonet.org | better Mathematician. <Me> al945(a)cwns9.ins.cwru.edu|*I'm just looking for the opportunity to (505) 299-2282 (voice) | be Politically Incorrect! <Me> Can we impeach him yet? |*Protected by 18 USC 2511 and 18 USC 2703.

1 0

secure phones - STU3
by lear35!mdbomber＠nebula.acs.uci.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I browsed through the owner's manual for the AT&T STU-III secure phone unit today. It has no technical information whatsoever (security through obscurity?). It uses a so called CIK (Crypto Ignition Key), which resembles one of those electronic keys that hotels use. It must be inserted in a "lock" in the phone, and turned 90 degrees. This will enable one of the crypto keys that is stored in the phone's battery backed up memory (loaded previously by a "COMSEC custodian" through a data port on the phone. The manual warns the phone must be in a relatively secure location and points out an emergency erase button that wipes out the keys stored in memory. Then you call someone, say you want a secure channel, wait for them to insert their CIK (and tell you so), then touch the "secure voice" button on the panel. The manual then says it will go through an "authentication process", the results of which will be displayed on the STU-III's screen. It will show data such as the other stations ID number, the security level of the channel (secret, top secret, etc), and the baud rate. Does anyone know how this works technically? My speculation: It seems to be a public key system. The phone's memory seems to contain a secret keyring, and a CIK is a 'passphrase' to a secret key, to make an analogy to PGP. Then the authentication process includes exchanging a session key for a conventional crypto system - no doubt DES. Apparently the NSA issues the keys to authorized agencies and contractors. The public keys contain information such as the ID number of the key, possibly the authorized user's name, the security clearance level for that key, etc, which is exchanged during authentication. Am I on the right track? Comments and speculations welcome. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLOg+wDSSmvXojb+5AQEplQH+JdiaWbzgXiWPtqVaQcPIo4arzOI8Fl1Z 6ylkT9UL/Qh8BpoyVK9PqiEwazaLPxCxWYksOty7LlRy0zByVXqWHw== =8E4k -----END PGP SIGNATURE-----

1 0

ENCLOSING SOMETHIN
by thomas.hughes＠chrysalis.org 17 Dec '03

17 Dec '03

Sa> Isn't it a problem to enclose PGP-blocks within a clearsig'ed Sa> message, as the initial -'s in his public key here are slightly Sa> mangled. I've seen this before, and tried to manually reconstruct the Sa> keyblock headers, but with no luck. Sa> Anyone know what one can do about this? pgp signed_message_with_keyblock.asc -o unsigned_message_with_keyblock.asc pgp +force -ka unsigned_message_with_keyblock running a signed message through PGP will return it to it's original pre-signature form. go figure .... ___ Blue Wave/QWK v2.12

1 0

ENCRYPTED FILE SYSTEMS
by thomas.hughes＠chrysalis.org 17 Dec '03

17 Dec '03

>> ObCrypt: I'm looking for info on designing a distributed encrypted >> filesystem. Any pointers? in the "PC" world, look for DISKREET (with Norton's Utilities). it simple, "Stacker"-like, and user friendly. it seems to offer "feeble DES" and "even more feeble DES" it's speed is almost negligable when in use. (which doesn't say very much for the "stength" of the encryption.) ObInTheSameVein?: anyone ever thought of taking a "software MNP" program and creating a "V42enc" software modem protocol? auto-generate unique/random keys after the connection is etablished, allow for "re-training" the connection by generating/switching to a new key. maybe re-train every "set number of seconds" ... pick a "fast" encryption method, and a RSA public key length that is proportional to the strength of the encryption, and have at it. talk about "just like uncle sam does it!" ... If the NSA is paranoid over PGP, what will they think of plug in pirate PROMS for USR Couriers that will create obscenely secure connections? (although the encrypted connections might not fly along at full speed, that tis but a small price to pay...)

1 0

No subject
by an50060＠anon.penet.fi 17 Dec '03

17 Dec '03

Something like this is probably more practical: 1. Driver's license is presented in person to you or qualified staff. 2. Driver's license and two other ID from list are presented in person to you or qualified staff 3. Driver's license is presented in person to registered notary public and stamped certificate sent to you. 4. Driver's license and two other ID from list are presented in person to registered notary public and stamped certificate sent to you. I would avoid accepting xeroxes altogether; too easy to forge. would you change your mind if i told you that i hold three passports in three differe nt names? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

ENCRYPTED FILE SYSTEM
by Mike Ingle 17 Dec '03

17 Dec '03

"thomas.hughes(a)chrysalis.org" wrote: >Subj: ENCRYPTED FILE SYSTEMS >>> ObCrypt: I'm looking for info on designing a distributed encrypted >>> filesystem. Any pointers? >in the "PC" world, look for DISKREET (with Norton's Utilities). >it simple, "Stacker"-like, and user friendly. >it seems to offer "feeble DES" > and "even more feeble DES" >it's speed is almost negligable when in use. > (which doesn't say very much for the "stength" of the encryption.) No, don't use Diskreet. Use my Secure Drive. Beta now if you want it, and release with source soon. Uses IDEACFB, protects a hd partition and floppies, takes only 2K ram, and is very fast. Reasonably user-friendly. You have to create a D: partition to use on a hard drive. >If the NSA is paranoid over PGP, what will they think of plug in pirate >PROMS for USR Couriers that will create obscenely secure connections? > (although the encrypted connections might not fly along at full speed, > that tis but a small price to pay...) What's the CPU in a Courier? Is the hardware well enough documented to hack something like this up? I once burned a rom for a friend's courier, from a file which he had, to give it V.32 instead of just HST which it previously had. Not sure where the file came from. An SRAM also had to be installed. --- MikeIngle(a)delphi.com

3 2

Secure phones - STU3
by Mike Ingle 17 Dec '03

17 Dec '03

"lear35!mdbomber(a)nebula.acs.uci.edu" wrote: >Subj: secure phones - STU3 >I browsed through the owner's manual for the AT&T STU-III secure phone >unit today. It has no technical information whatsoever (security >through obscurity?). Never Say Anything... >It uses a so called CIK (Crypto Ignition Key), which resembles one of >those electronic keys that hotels use. It must be inserted in a >"lock" in the phone, and turned 90 degrees. This will enable one of >the crypto keys that is stored in the phone's battery backed up memory >(loaded previously by a "COMSEC custodian" through a data port on the >phone. The manual warns the phone must be in a relatively secure >location and points out an emergency erase button that wipes out the >keys stored in memory. They should put a mercury switch in it, so if you steal it and move it around much, it wipes the keys. Also a "duress number" which works okay, but displays a warning on the other party's phone display, in case you're forced to call someone with a gun to your head. >Then you call someone, say you want a secure channel, wait for >them to insert their CIK (and tell you so), then touch the "secure >voice" button on the panel. What all buttons does the phone have? Normal dialing, secure voice, self-destruct, anything else? >The manual then says it will go through an "authentication process", >the results of which will be displayed on the STU-III's screen. It >will show data such as the other stations ID number, the security >level of the channel (secret, top secret, etc), and the baud rate. What baud rates does it use? How is the sound quality in secure mode? It must use either a DSP (good sound, high baud) or a vocoder (robot voice, low baud). >Does anyone know how this works technically? My speculation: It seems >to be a public key system. The phone's memory seems to contain a >secret keyring, and a CIK is a 'passphrase' to a secret key, to make >an analogy to PGP. Then the authentication process includes >exchanging a session key for a conventional crypto system - no doubt >DES. It could be public-key or DH exchange. Does the manual tell you to read a hash value to the other party and verify it? If so, it's DH and that's the protection against the man-in-the-middle. If not, it's either public-key or DH-like but with authentication. In any case, the key probably contains a small EPROM which selects and decrypts one of the keys in the memory. If classified secret and top secret info is involved, DES would not be used. The NSA wants us to use DES, but they know better than to use it for classified info. Probably something similar to Skipjack, in a similar tamper-proof chip. >Apparently the NSA issues the keys to authorized agencies and >contractors. The public keys contain information such as the ID >number of the key, possibly the authorized user's name, the security >clearance level for that key, etc, which is exchanged during >authentication. NSA issues the keys...I feel safer already! Can you say, "key escrow"? --- MikeIngle(a)delphi.com

2 1

No Subject
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

>From: thomas.hughes(a)chrysalis.org > >Date: Tue, 16 Nov 93 02:38:02 >Subject: ENCRYPTED FILE SYSTEMS >To: cypherpunks(a)toad.com > ObInTheSameVein?: > anyone ever thought of taking a "software MNP" program > and creating a "V42enc" software modem protocol? > auto-generate unique/random keys after the connection is etablished, > allow for "re-training" the connection by generating/switching to a new > key. maybe re-train every "set number of seconds" ... > pick a "fast" encryption method, and a RSA public key length that is > proportional to the strength of the encryption, and have at it. Yep.

1 0

Re: The Courtesies of Cypherpunks
by Clark Reynard 17 Dec '03

17 Dec '03

yep, it's happened before. and loudly; it repeats itself about once every couple months; some people have even been _more_ floridly and spectacularly whack-o.

1 0

Re: Info on L.Detweiler
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> On Mon, 15 Nov 1993, Douglas Barnes wrote: > > > Here's some info folks might appreciate (all numbers area code > > 303, unless otherwise noted): [handy info to help you ruin Detweiler's life deleted] > > Note that this is just the easy stuff, I have folks digging deeper. > > More to come... > > > > -- > > ---------------- /\ > > Douglas Barnes cman(a)illuminati.io.com / \ > > Chief Wizard (512) 448-8950 (d), 447-7866 (v) / () \ > > Illuminati Online metaverse.io.com 7777 /______\ I'd just like to say that I think this sucks bad. I don't like cops, and you're being one, or worse. And with a team of folks helping you to dig even deeper? This is ugly, vicious, and authoritarian, and I can't believe that you would actually BRAG to hundreds of people that you're doing it. Sounds to me like you're a very frustrated person. You are clearly an insensitive bastard. I just hope that you encounter this kind of sympathy if YOU go through a "difficult period" in your life. --Dave.

1 0