December 2003 - cypherpunks-legacy

PGP 2.6 uses RSAREF version 1
by Hal Abelson 17 Dec '03

17 Dec '03

MIT's release of PGP 2.6 uses RSAREF version 1, under the RSAREF license of January 5, 1993. Some people have wondered whether including RSAREF 1, rather than RSAREF version 2, is an oversight in the PGP 2.6 distribution. It is not an oversight. Version 1 is what we intended. The change from RSAREF 2.0 (in PGP 2.5) to RSAREF version 1 (in PGP 2.6) was done on the advice of RSA Data Security, which has granted MIT permission to access non-published routines in all RSAREF versions 1.nn, and rights in accordance with the version 1 license. -- Hal Abelson Dept. of Elect. Eng. and Comp. Sci. MIT

1 0

(fwd) FBI infiltrates Connected.com
by Jim choate 17 Dec '03

17 Dec '03

Path: bga.com!news.sprintlink.net!connected.com!connected.com!not-for-mail From: turmoil(a)hebron.connected.com (Turmoil) Newsgroups: seattle.general,alt.activism,alt.2600,alt.drugs Subject: FBI infiltrates Connected.com Date: 21 May 1994 11:48:31 -0700 Organization: Connected INC -- Internet Services Lines: 22 Message-ID: <2rll1v$jmb(a)hebron.connected.com> NNTP-Posting-Host: hebron.connected.com X-Newsreader: TIN [version 1.2 PL2] Xref: bga.com seattle.general:3840 alt.activism:10793 alt.2600:9216 alt.drugs:20914 Recently the staff at connected. has admitted that they have "invited" two FBI agents to roan that system. According to connected.staff these FBI agents are looking for "hackers phreaks" and people having copywritten programs. I am pretty peaved about this, we don't know how long thev'e been here, what rights they have on the system, or much else. Just that they are here. Watching us. Of course, I never use my account for illegal activities. Shit, I don't even do much illegal (except smoke a bit of pot) But I do not like the idea of giving up my rights against undue searches. This seems a reflection on the state of America today. This used to be a free country, but now there is a pig or FBI agent watching EVERYTHING you do. This is NOT the America described in the constitution. It's not a society of free, independent people. It is a dictatorship that must spy on it's own people in order to survive. I am anxious to here what others that read these groups think about this. Have A Nice Day turmoil(a)hebron.connected.com The FBI have infiltrated this site, I am activly searching for a new site

1 0

Email firewall etc
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Vincent.Cate(a)FURMINT.NECTAR.CS.CMU.EDU: > Companies like the idea of firewall machines to protect the security of > their internal nets. I bet they would also like something called an > "email-firewall". Names are important. :-) I think of the > email-firewall as a slightly modified anonymous-remailer. I haven't delved into the wide world of remailers out there, but I'd like a remailer that encrypted, though did not necessarily anonymize, incoming mail. I'm not really bothered about the NSA reading my mail. In fact, I'm not usually concerned whether someone in New York, for instance read my mail. But I might not want people closer to home (local sysadmins, etc) to read it. I'm sure many others share this position. The problem is that I can't ensure that people encrypt their mail to me. They may not bother, or be unable. An alternative would be for them to send it to a remailer, which, knowing my public key, would encrypt and forward it to me. Comments? -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! --------------------------------------------------------------------------

1 0

Re: PGP 2.6 uses RSAREF version 1
by joshua geller 17 Dec '03

17 Dec '03

>Some people have wondered whether including RSAREF 1, rather than >RSAREF version 2, is an oversight in the PGP 2.6 distribution. It is >not an oversight. Version 1 is what we intended. uh huh.... >The change from RSAREF 2.0 (in PGP 2.5) to RSAREF version 1 (in PGP >2.6) was done on the advice of RSA Data Security, which has granted >MIT permission to access non-published routines in all RSAREF versions >1.nn, what the FUCK? what mean non-published routines? > and rights in accordance with the version 1 license. something smells here. josh

1 0

Re: Graph isomorphism based PK cryptosystems?
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: Graph isomorphism based PK cryptosystems? > Interesting. Have you tested it against the known methods for the > isomorphism problem? Van Leeuwen* references an O(n log n) > average-case algorithm, and ones that are pseudopolynomial w.r.t. > degree, genus, and treewidth. Luks did the trivalent case and then later the bounded valence case. bounded genus is due to Miller. Also bounded eigenvalue multiplicity due to Babai and others. There are also a number of related problems which are believed to be difficult. Finding a small generating set for the automorphism group of a graph is polynomial time equivalent. The graph isomorphism problem also reduces to several of computational problems in permutation groups where these groups are given by small generating sets (e.g. calculation of the centraliser of a permutation, group intersection, double coset membership, subset stabiliser, normaliser) This is one of those problems where the "average" case is relatively easy. Take a random graph (with a reasonable definition), finding the automorphism group is usually relatively easy by backtracking. The hard cases are ones which superficially look like they have lots of symmetry but really have small non-trivial automorphism groups. Similarly for graph isomorphism, i.e. take two random graphs (again one needs to define this), it is usually pretty easy to determine whether they are isomorphic (just look at the degree sequence and work from there). Approaches involving backtracking to find isomorphisms can be effective in more subtle cases. So you need to be careful to avoid the easy cases. I remember some really hard (practically) cases for the usual backtracking approaches to determining automorphism groups came from graphs derived from certain designs. I'd sure like to see more details about a public key system based on Graph Isomorphism. (For a book on graph isomorphism and related computational problems take a look at C.M. Hoffmann, Group-Theoretic Algorithms and Graph Isomorphism, Lecture Notes in Computer Science #136, Springer-Verlag, 1982. A little old but it covers a fair bit). There is a point to this, I remember some papers by Magliveras (sp?) on cryptosystems from problems in permutation groups. Anyone have copies or remember any details? -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLeLV9WrJdmD9QWqxAQHKYAH9EuLksdWKLvnhr6FIRjBZO6O2eyKCY6rI MsDvo2V8QJTLdXDHR/rDuChdOQRIQtsa7H1k3/ZEZnP331Roeg3/3w== =yJZr -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

SRA telnet and ftp (FYI)
by Richard Johnson 17 Dec '03

17 Dec '03

A note about a package that uses D-H to generate a key for telnet and ftp authentication. Has anyone here played with it? Richard ------- Forwarded Message Subject: SRA telnet and ftp Date: Tue, 24 May 1994 08:57:40 -0400 To: Firewalls(a)GreatCircle.COM From: bukys(a)cs.rochester.edu After hearing about David Safford's SRA telnet/ftp package from numerous sources, I finally went and got a copy (from ftp://net.tamu.edu/pub/security/TA MU). It's nice work. I would like to clarify one point, though: This package uses the Diffie-Hellman code from the Secure RPC implementation, to securely compute a session key which the SRA code uses to encrypt an authentication transaction. The code does NOT use the session key to encrypt the whole session. It would probably be relatively easy to add, but it's not in there in the current code. This is from my perusal of the code, and correspondence with the author. FYI ------- End of Forwarded Message

1 0

Re: PGP 2.6 uses RSAREF version 1
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: PGP 2.6 uses RSAREF version 1 > >Some people have wondered whether including RSAREF 1, rather than > >RSAREF version 2, is an oversight in the PGP 2.6 distribution. It is > >not an oversight. Version 1 is what we intended. > something smells here. Most likely the fact that the RSAREF 2.x licence is a lot more liberal about commercial use. (read it yourself, but to sum it up it does allow limited commercial use). This means that one can still use RIPEM and TIS/PEM for many commercial applications. With PGP one would have to buy a licence (presumably from ViaCrypt). e.g. communications between employees of a company about business matters. Mark -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBVAgUBLeLXBWrJdmD9QWqxAQGigwIAl1moi1OPFa78yVNeNBd1JGyQ59jnOfUL FOOuqE/9zNQCQBoYZtTtHtGxQQLWOw1YtbgDcW3Q3jHQ3pkeQwlwWA== =m3Zf -----END PGP SIGNATURE----- -- Mark Henderson markh(a)wimsey.bc.ca - RIPEM MD5: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP key fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 low security key fingerprint: EC E7 C3 A9 2C 30 25 C6 F9 E1 25 F3 F5 AF 92 E3 cryptography archive maintainer -- anon ftp to ftp.wimsey.bc.ca:/pub/crypto

1 0

Re: MIT has released PGP
by Duncan Frissell 17 Dec '03

17 Dec '03

R.>the following questions: R.>Are you a citizen or national of the United States or a person who R.>has been lawfully admitted for permanent residence in the United R.>States under the Immigration and Naturalization Act? Wait a goddamned minute. Since when does the ITAR prevent illegal aliens (who are resident in the US) from obtaining munitions? And what about our Canadian bretheran? I guess they didn't want to register as a munitions seller which I gather you have to do if you export to Canada. DCF --- WinQwk 2.0b#1165

2 2

Testing compatibility 2.6 v. 2.3a
by an99420＠anon.penet.fi 17 Dec '03

17 Dec '03

Please could someone change the date of his computer after 1 september 1994 and send a PGP-ed message to me so I can test the compatibily of 2.6 (I also implemented the patch send to this server in 2.3a so I can check that too...). My public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3c mQCNAiv3vSkAAAEEAMGWtCrT8eIhK0qR0yqYepYCcRdjw+EhiIzP4XkHlwkR9iVt 4xnTGHKuuCnGJG0ftez4hEZsTpdrz8mQ0SnYy0KLQ6DUvKH9IMgl6S9yJiYAgtC2 4TN15+t/9ZJjlVMgwtRY5tPLgrZ7h6Jw/rZIj+Wwj78yjcdguYDAdPKe9hHLAAUR tCZFZWxjbyBDcmFtZXIgPGNyYW1lMDAxQGhpby50ZW0ubmhsLm5sPokAlQIFEC20 ++aAwHTynvYRywEBJ/UD+QEah9xIn/Vt3GbJYA3b6i/vXnEhG/z6qrqaJ8fubFin Ia2JMT4AceNEtz+6j7lIz/iJbj9CPIOASnSIQ/hmrERlWcsgWR7U29QnQjunZ6BE S64pONVmEA207lDwgAzUJ4+h+urYTIfz4qW/jHcs6nTfwe5qhfbDM1b6yTe301A/ iQCVAgUQK/qELegWAlGwR3dDAQEd/AQA1iny6lLuQFxVg6yvJ6xjnjSmOpHkz2Un ZTfbnXHtDBLA0CDFT8A4nfW/hLT1j7dx6yD5+lUPkMX1GTttlOMp819VyK8Wm8lv HnkFbehTTmmlY2BxBqWC7EUml39BqQEWbxqlt6M/btScsMVlQJyiluEW1cacYt68 DPpqScQWzz0= =cAIH -----END PGP PUBLIC KEY BLOCK----- ... If you outlaw Privacy, only the Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

IBM's NetSP
by Adam Shostack 17 Dec '03

17 Dec '03

(This is a set of excerpts from a 1000 line file I got from a guy @IBM. If anyone wants the whole thing, just ask.) | Network Security Program Version 1 Release 2 is a distributed authentication | and key distribution program. The Network Security Program authenticates the | identity of two communicating principals in the network and provides each | with the ability to verify the identity of the other via a common third-party | server. | Network Security Program provides secured single sign-on (SSO) to 3270 host | applications via an EHLLAPI emulator interface to a RACF* host system. | Through the implementation of PassTickets, the user at the client workstation | need only provide one log-on password that will allow secured access to | multiple host applications. In addition to the TCP/IP transfer protocols for | these platforms NetBIOS is supported on AIX*, OS/2*, DOS*, and Windows; LU6.2 | is supported on AIX and OS/2. | | Network Security Program provides distributed security services that user | applications may invoke through the Generic Security Services Application | Programming Interface (GSSAPI). GSSAPI is approved as an Request for Comment | (RFC) by the Internet Engineering Task Force (IETF). The underlying security | mechanism is based on KryptoKnight, an advanced authentication technology | developed by IBM Research Laboratories in Zurich, Switzerland and Yorktown | Heights, New York. | | In V1R2 we are extending our platforms from the AIX/6000, OS/2 and DOS | operating systems to include HP, SUN, and DOS/Windows for client and | application server workstations. IPX/SPX is supported on OS/2 and Windows | for authentication servers and clients running on workstations with Novell | Netware. TCP/IP is supported on all the specified platforms. Single sign-on | (SSO) support for OS/2 has been extended to LanServer and Novell. | In DCE environments, Network Security Program is offered to customers whose | environments pose authentication problems at the transport layer and below. | Because of its compact tickets and flexible authentication protocols, Network | Security Program can be more effective in satisfying this set of | requirements. Network Security Program also provides secure LU2 sign-on to | RACF host applications without requiring re-entry of host user names or | passwords. Single sign-on to LANServer and Novell is also available. DCE is | the recommended solution for customers requiring authentication above the | transport layer (through secure RPC), for use by the application layer, for | more complete security services, or for integration with other services, such | as data access control or integration with resource managers. | DATA CONFIDENTIALITY | | Commercial Data Masking Facility (CDMF) is a new technology recently | developed by the IBM Crypto Competence Center. CDMF has a scrambling | algorithm that will be supported under the GSS-API (GSS-SEAL / GSS-UNSEAL API | calls). It provides the application programmer the capability to easily | scramble selected packets of data sent in the network. Data confidentiality | is secured from indiscriminate use and your assets stay protected. | | CDMF alleviates the worry of having your data flow across the network in | clear text. The degree of security is equivalent to encryption using DES but | with keys limited to 40 bits. IBM has obtained approval from the US | Government to export CDMF in products without the license required to export | products containing DES. | TEXT | | TECHNICAL DESCRIPTION | | Network Security Program was developed to exploit key distribution and | authentication technologies based on a third party authentication server. | Several technologies exist in the industry today, one of which is | KryptoKnight, which was developed by the IBM Research Division laboratories | in Yorktown Heights, NY, and Zurich, Switzerland. The KryptoKnight | technology, from a user viewpoint, appears on the surface much the same as | another security service developed at MIT, Kerberos. Though Kerberos has | been made widely available through public access, it presents several | limitations in certain network environments. Network Security Program | provides extensions to the Kerberos technology that can prove most desirable | to customers operating such networks environments. For example, the smaller | KryptoKnight tokens make implementation of security at lower networking | layers possible. Other technical advantages include a use of cryptography | that is not subject to export controls, flexibility in authentication | protocols for situations in which the client cannot contact the | authentication server directly and the reduced dependency on clock | synchronization among communicating principals. | Network Security Program is being developed as an 'open' multi-platform | security solution. The intent is to provide a port to as many different | systems as is possible given the time and resource constraints. In the | workstation environment, a customer typically will have many varieties of | hardware/software in their network. Interoperability is a key requirement | for any security solution. This release of the Network Security Program will | address the AIX/6000, OS/2, DOS, DOS/Windows, SUN and HP platforms. | | Network Security Program is developed with a user-friendly Graphical User | Interface (GUI). The security mechanisms residing below the Application | Programming Interface (API) are transparent to the client. At the | Authentication Server, there is also an administration interface. Industry | standards are supported to provide as seamless a transition among all | platforms as possible; MOTIF standards for AIX/6000 and CUA91 standards for | OS/2 and DOS. | RISC System/6000* POWERstation*. The client code shipped with the Network | Security Program runs on the following workstations: OS/2, DOS/Windows, | AIX/6000, SUN, and HP. The minimum machine requirements are: | o DOS Workstation | Approximately 400KB of free disk space is required for the Network | Security Program. If the Network Security Program software is installed | o SUN Workstation | - A SUN microsystem spark [sic] station running Solaris 1.1 or later. (Most UNIX systems req. 5mb disk, 8mb ram. Seems that Solaris 2 is not later enough to count as 'solaris 1.1 or later;' It was not listed as a supported OS.) -- Adam Shostack adam(a)bwh.harvard.edu Politics. From the greek "poly," meaning many, and ticks, a small, annoying bloodsucker.

1 0