December 2003 - cypherpunks-legacy

Re: v2.6 for the rest of us
by Paul K. Strong 17 Dec '03

17 Dec '03

<nobody(a)shell.portal.com> wrote: >Or maybe you could just keep on using PGP 2.3a and stop worrying about it. Hey, I don't care if you Americans want to stick with v2.3a. I just thought that you wouldn't be able to add your v2.3a key to USA keyservers and would therefore move onto v2.6 (not to mention that v2.3a infringes RSA's patents and some people like to stay legal). The fact is some people will move onto v2.6 and I would like the ability to communicate with them. ***************************************************************************** * Paul Strong Fidonet: 2:254/438 (weekly mail check) * * * * pauls(a)dcs.rhbnc.ac.uk Finger for PGP v2.3a public key * *****************************************************************************

1 0

Announcement: PGP 2.6ui -- unofficial international release
by mathew＠mantis-consultants.co.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is to announce an unofficial release of PGP, based on 2.3a, modified for interoperability with MIT's PGP 2.6. The files are on ftp://ftp.demon.co.uk/pub/pgp/ 2.6ui-readme The file README.1st from the 2.6ui release. pgp26ui-src.tar.gz UNIX source distribution, compressed with gzip. pgp26ui-src.tar.gz.sig Detached signature for pgp26ui-src.tar.gz. pgp26uis.zip DOS source distribution, archived with Info-ZIP. pgp26uis.sig Detached signature for pgp26uis.zip. pgp26uix.zip DOS .EXE distribution, archived with Info-ZIP. pgp26uix.sig Detached signature for pgp26uix.zip. pgp23a-26ui.patch.gz Context diffs to go from 2.3a to 2.6ui, gzipped. I tried to upload to ftp.funet.fi, src.doc.ic.ac.uk and ftp.dsi.unimi.it, but the net seems flaky today. The following changes have been made from 2.3a: * Reads encoded data produced by both MIT PGP 2.6 and PGP 2.3a. * Writes data either in the "new" format used by MIT PGP 2.6, or in the old PGP 2.3a format. Option settable via a command line switch or config.txt setting. Default is old 'compatible' format. * No time-bomb code in it. If you want to switch version byte like MIT PGP does, you'll have to do it manually on September 1st. There's no advantage in doing so, unless you want it to look like you're running MIT PGP. * You can choose the version text which you want to have appear in ASCII armoured files. The default is 2.6, and if you're in the USA you probably don't want to change it, as a well known net.personality tends to harass people whose PGP armor says anything else. Again, this can be changed via command line or via config.txt. * Displays and accepts 8 characters of the key ID. Hence there's less chance of two keys having the same visible ID. * Makefile entries have been added for sunos5cc and sunos5gcc, for people using SPARC workstations running Solaris 2. I have personally tested the sunos5gcc build on Solaris 2.3, and it compiles cleanly. A line for NeXTstep Intel has also been added (next486). * The file idea68k.s has been removed, at the request of the author. It was obsolete. Better 68k routines are available; for example, suitable routines for the Amiga are available on Aminet. * A message has been added to the key generation section, reminding the user that MIT PGP 2.6 will only handle keys of 504-1024 bits. This version has no key length crippling, however. * Memory allocated with _fcalloc and freed with _ffree in ztrees.c and zdeflate.c, to avoid memory leakage in the MS-DOS version. * The -w option wipes files with pseudo-random data, to try and ensure the file is wiped even if you're using a disk compressor. Note that this still isn't perfect; DOS can randomly duplicate bits of cleartext files in partially-used clusters, and those fragments won't be removed if the original file is wiped. * Branko Lankester and Paul C Leyland's patches have been applied, so that newer key certification signatures automatically replace older ones. This also fixes a bug in the display of new keys with multiple signatures. This version was assembled by mathew <mathew(a)mantis.co.uk> from the standard PGP 2.3a sources, and from source code patches obtained from the net. All patches were scrutinized carefully before being applied by hand. No binary patches were used. The DOS executables were built by mathew using Microsoft Visual C++ version 1.0 (MS C v8). No RSAREF source code was used; in fact, I used no source code from MIT PGP at all. I haven't even looked at the MIT sources. (No, really.) Thanks to those anonymous individuals who tested the program against MIT 2.6... Disclaimer: This software is nothing to do with Mantis Consultants, and is without warranty or guarantee of any kind. Using it in the USA is probably very naughty. If you have any patches to fix bugs or add features, feel free to mail them to me, and I'll consider adding them to any future unofficial release. mathew <mathew(a)mantis.co.uk> -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLeYh7HzXN+VrOblFAQFYFAP6Ar+1OKDoUg/5A0p6ZljmP/9Z3IZIx797 NPi2/ELLhZyWWCcsrhLxxPgux4+5WEJ2+FlK0FM10UlWFy7FuieXCWwprMM8Ug0A zfpAdxrQP4F7r0lozM2c8HFOtsse2ISxLOsNcObfgSCBfJKBu9c1nJ0/VvnJ42nA EA/vG3KwgyI= =FDlY -----END PGP SIGNATURE----- -- Seeking a decent bug-tracking system for Windows, DOS, UNIX, Mac... http://www.mantis.co.uk/~mathew/

1 0

Re: Email Stalking on CNN
by lile＠netcom.com 17 Dec '03

17 Dec '03

I heard it too. I thought, gosh too bad she didn't know about kill files.... :( -lile

5 4

Re: My 2.3a Key is listed as a 2.6 (Aaargh!)
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> As to not being allowed to have or use 2.6 in Europe, what makes you think so? I didn't think in european law, I was thinking in US law. It is prohibited to export, it is prohibitet to use (patents) and the day will come where it is prohibited to be european and we get arrested after coming to the States... ;-) > I may be wrong, but I thought the only obstacle was that it may not be exported > to us due to ITAR. Once it's available here there's nothing wrong with having > or using it. Do you think they will accept this if they put us in jail after entering an american airport next time? Just a stupid question: Do I violate american law when I transfer files from United Kingdom to Germany? In some cases the internet packets are routed through american machines because the connection Germany/Britain is lousy slow. Hadmut

2 1

Re: Privacy at Dunkin Donuts
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

The Baltimore Sun also ran the AP story on the hidden microphones at Dunkin Donuts. But they sent some reporter out to freshen up the story and check the local DDs. They report that the DD in Severna Park (a nice suburb of Baltimore that is next to Fort Meade) and the DD next to Fort Meade itself have the mikes. Hah!

1 0

Re: removed from list....
by ddt＠lsd.com 17 Dec '03

17 Dec '03

>there was a mass unsubscribing, probably from nalbandian. Can't Majordomo implement passwords for individual users so that only *they* can unsub themselves? It seems ironic that the Cypherpunks list would be vulnerable to this sort of "attack" from miscreants like [insert bozo-of-choice here]. As an aside: I've set up a filter that immediately trashes anything from the above-mentioned "person." I just don't need that kind of noise. dave ssibly, PGP 2.6 is doing a great deal more longer term >damage to the viablity of PGP than is immediately obvious. Is this a >valid viewpoint ? Absolutely valid, Matthew: I recommend that we do our best to resolve what will be done to counter this tactical move against PGP here on this list - without spreading confusing rumors around to the benefit of RSA Labs - and meanwhile provide a simple, patched version of 2.3 for all platforms that both offers fully-2.6-compatible ciphertext and 2.6-impersonating keys. dave

2 1

Re: PGP 2.6 is dangerous in the long term ?
by f_griffith＠ccsvax.sfasu.edu 17 Dec '03

17 Dec '03

>meanwhile provide a simple, patched version of 2.3 for all platforms that >both offers fully-2.6-compatible ciphertext and 2.6-impersonating keys. > > dave > Wouldn't it be better to have a patched version of 2.5? Wouldn't this remove the questions about legal use in the U.S.?

1 0

New MacPGP2.3a has arrived.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

I know you guys like to talk instead of act, but outside of your little debate club are real programmers building the future. One work has been completed, a debugged and AE aware MacPGP. Please release it, as it's source code is available. FTP to ftp.netcom.com and cd to /pub/mpj and read README to get the name of the directory. It's amazing that I've been at this a week and the rest of the world is playing with it already, but whenever I get news of your list, I hear there has been no action taken on this new release. BTW, the author in Germany will be updating this soon, and has finally decided to release source as well.

3 3

Info: Policy Statement by Viacrypt re: PGP 2.6
by NetSurfer 17 Dec '03

17 Dec '03

I received the following and thought it would be of interest to the list: *.................................................................* . == = =....James D. Wilson.....jdwilson(a)gold.chem.hawaii.edu.. . " " "....P. O. Box 15432..........or..NetSurfer(a)sersol.com.. . " " /\ "....Honolulu, HI 96830..Give me the finger for my key. . \" "/ \"....FRC/FAM/AASR/GWB/OTO..........NETSURFER............ *.................................................................* -----BEGIN PGP SIGNED MESSAGE----- VIACRYPT POLICY STATEMENT ViaCrypt(tm) PGP(tm) compatibility with MIT PGP Version 2.6 27 May 1994 This policy statement may be reproduced and redistributed as long as it is done so in its entirety and without alteration. On 24 May 1994, The Massachusetts Institute of Technology began distribution of PGP Version 2.6 which incorporates the RSAREFTM Cryptographic Toolkit and is licensed for personal noncommercial use along with other restrictions. MIT stated that to protect RSADSI's intellectual property rights in public key technology, PGP V2.6 is designed so that messages it creates after 1 September 1994 will be unreadable by earlier versions of PGP, which includes ViaCrypt PGP V2.4. PGP V2.6 will, however, always be able to read messages generated by ViaCrypt PGP V2.4. It is ViaCrypt's policy to make ViaCrypt PGP interoperable with both ViaCrypt PGP V2.4 as well as with MIT's release of PGP V2.6. Therefore ViaCrypt will soon release ViaCrypt PGP V2.7 which will contain new features found in PGP V2.6 and will accept messages created by ViaCrypt PGP V2.4 as well as those created by PGP V2.6. For messages created by ViaCrypt PGP V2.7, either the present format compatible with ViaCrypt 2.4 or the new format which will be produced by PGP V2.6 after 1 September 1994, can be selected. Because PGP V2.6 is licensed for personal noncommercial use, after 1 September 1994 the new format is expected to come into wide use. ViaCrypt strongly urges all ViaCrypt PGP users to upgrade to ViaCrypt PGP V2.7 and to the new format. A ViaCrypt PGP V2.7 upgrade package will be made available to registered users of ViaCrypt PGP V2.4 at a nominal charge of $10 (which includes shipping and handling). Effective the date of this notice and until ViaCrypt PGP V2.7 begins shipping, all new purchasers of ViaCrypt PGP V2.4 will automatically receive a free ViaCrypt PGP V2.7 upgrade package. -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLeZDzmhHpCDLdoUBAQE9iAP/Rg7iO+adsNHSfmGT51BNzrVTzhUlHrcE Nl/i4BAfz3THOb1mr2th3Ed8SzFllw3qXE7jos9Ddu0SeAxKCktt/7KL0JJD25q1 6Bqwq51XU8ID3Sl9lfUjjeFjT9ZQrng2FnPFmDZQbGqDWnhhtgpJ8k4hr+IJ8/Vb kyar9V5LtM4= =o3iY -----END PGP SIGNATURE-----

1 0

Phone Taps Take In Israeli Who's Who
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

LA Times, Sat. 5/28/94, pA2 Phone Taps Take In Israeli Who's Who Two private eyes are charged with listening in on hundreds of people's cellular calls. The incident is viewed as a warning to a security-conscious country. By Michael Parks (Times Staff Writer) Jerusalem -- What do Israeli President Ezer Weizman, Tel Aviv Mayor Ronni Milo, the editors and publishers of the country's best-selling newspapers, two bank managers, and the manager of the Maccabees soccer team, several big building contractors and the owner of high-fashion clothing stores have in common? The answer is that they were all on a list of 231 Israelis -- many politically prominent, some financially powerful but a few relatively obscure -- whose cellular telephones are said to have been methodically tapped for eight months by two Tel Aviv private investigators. But the real riddle -- why? -- so far has no answer. The two investigators, arrested in April and facing charges of illegal wiretapping, are refusing to tell police who hired them or what they overheard. Rafi Friedan, one of the investigators, initially told police that he had been asked "to gather data" and that he was confident that his clients' reasons were "personal and family related," according to court records. but Friedan has said nothing further, on his lawyers' advice. The list of those whose calls were regularly monitored, according to preliminary evidence given Tel Aviv courts, is a veritable Who's Who of Israel's movers and shakers -- and a warning to a security-conscious country of the risks many of its leaders are running in unguarded conversations on their always-in-use cellular phones. "The police have found records of some conversations of some of our people that are, well, rather embarrassing in their content," a senior Israeli official commented, asking not to be quoted by name. "Things were said that should not have been said on open lines, and then things were said that were professionally indiscreet. "During World War II, American had a saying, 'Zip a lip and save a ship,' and we had better think the same way. People have gotten very, very casual in their use of their [cellular phones]. If two guys in a Tel Aviv office building can listen to all that they did, just imagine what a real intelligence service is doing." Among the phones that were monitored, according to police, were some belonging to the Israeli Defense Ministry, senior officials of the country's security services, two members of the opposition Likud Party, the state comptroller and the director of an airline used by the government for charter flights. There were also Weizman, top executives of the country's two television stations, a number of lawyers, the agency that administers the Jewish Quarter of Jerusalem's Old City, an insurance company, staff members from the newspapers Yediot Aharonot, Maariv and Haaretz -- and 10 other private investigators. Friedan and Yaakov Tsur, his partner in Agam Security Consultants, were held for three weeks and are now under house arrest. If convicted under Israel's laws prohibiting wiretapping, they would face sentences of three years for each conversation they monitored. Although police do not believe the two monitored all conversations, they have had very limited success in determining which calls they did record and no luck in finding out what they did with them. "Their clients did not exactly pay with company checks," one police detective said. Prosecutors theorize the monitoring operation may have grown out of the bitter rivalry between Yediot Aharonot and Maariv, which have been engaged in a long-running circulation war. But they are at a loss to explain how it came to encompass such high-ranking officials. Friedan, a former undercover policeman, and Tsur listened to the conversations with a monitor that continually scanned the radio frequencies used by cellular phones for calls made to and from specified numbers, according to prosecutors. They had rented the $200,000 monitor from its Israeli manufacturer, ECI Telecom, for "experimentation purposes" prior to its sale to foreign security services and police departments. Friedan and Tsur pledged in the contract with ECI to listen only to their own telephones and those of ECI. Friedan has a reputation as a "tapping contractor," working for a number of clients and taking on cases from other private investigators, and police and prosecutors have suggested that ECI knew what use he would make of its monitoring equipment. "Even wiretapping for experimental purposes requires permission," prosecutor Rafi Levy told a Tel Aviv court this week, "and they did not get it." -----<O>-----

1 0