December 2003 - cypherpunks-legacy

Re: What's happened to the mail?
by Peter Murphy 17 Dec '03

17 Dec '03

Well, did anyone write "who cypherpunks" to Majordomo? I did. The number of people it contained was about 10 (although it would probably be more than that by now). My guess is that someone (possibly Jim Nalbadian (sic?)) was the culprit. On a related matter, do you need an old (i.e. about 2 weeks old) copy of the cypherpunks mailing list, so as to bring it back to its old glory? ======================================================= | Peter Murphy. <pkm(a)maths.uq.oz.au>. Department of | | Mathematics - University of Queensland, Australia. | ------------------------------------------------------- | "What will you do? What will you do? When a hundred | | thousand Morriseys come rushing over the hill?" | | - Mr. Floppy. | =======================================================

1 0

PGP 2.5 changes
by Hal 17 Dec '03

17 Dec '03

Below I have included the contents of the file newfor25.doc from the PGP 2.5 beta release which I just grabbed. It says that old (pre 2.3) signatures will not verify under 2.5. That's too bad. Also, key sizes are limited to 1024 bits. Tough luck for people who made bigger ones, I guess. Looks to me like there may still be a market for a non-RSAREF PGP. Anyway, here's the file: Changes to PGP 2.5: ***** MOST IMPORTANT ***** This version of PGP uses RSAREF 2.0, so it's legal in the U.S.! The RSAREF license forbids you to (among other things; see the license for full details) "use the program to provide services to others for which you are compensated in any manner", but that still covers a lot of people. If you want to use it in a commercial or governmental setting, talk to ViaCrypt (2014 West Peoria Avenue, Phoenix, Arizona 85029, +1 602 944-0773). PGP 2.5 should always be distributed with a copy of the RSAREF 2.0 license of March 16, 1994 from RSA Data Security, Inc., so that all users will be aware of their obligations under the RSAREF license. Since the RSAREF license conflicts with the GNU General Public License that PGP was formerly distributed under, the GPL had to go. PGP is still freely distributable, though. (From a copyright point of view; export controls or some other legal hassle may apply.) *** IMPORTANT CHANGE: RSAREF 2.0 can understand only the pkcs_compat=1 formats for signatures and encrypted files. This has been the default since 2.3, so old files should not be too much of a problem, but old key signatures will encounter difficulties. This change will result in a hole being ripped in the "web of trust" as many old signatures are invalidated. Please check your key rings (pgp -kc) and re-issue any signatures that have been invalidated. PGP by default offers to remove such signatures. Even if you leave them in, they are not trusted. Another RSAREF limitation is that it cannot cope with keys longer than 1024 bits. PGP now prints a reasonably polite error message in such a case. OTHER CHANGES: The support files are thinner. The various contrib directory utilities have not been updated since 2.3a, and since the PGP developers know how annoying it is to have people using an ancient version and complaining about a bug in a program that was fixed a year ago, they have been omitted rather than annoy the contributors in this way. Also, the language translation file, language, is incomplete. The strings that were in 2.3a are there, and some that could be updated without much knowledge of the language, but others that are new to 2.5 are untranslated. The format should be obvious and some tools for manipulating the language traslations are included in the contrib directory. Printed KeyIDs have been incresed to 32 bits, as there were enough keys out there that 24-bit keyIDs were no longer sufficiently unique. The previous 24-bit keyID is the LAST 6 digits of an 8-digit 32-bit keyID. For example, what was printed as A966DD now appears as C7A966DD. The config-file options pubring=<filename>, secring=<filename>, and randseed=<filename> have been added. Hopefully, the uses will be obvious. With these, you can keep keyrings anywhere you like. Of course, they can also be specified on the command line with +pubring= (or abbreviated to +pub=). If the line comment=<string> appears in the config file, the line "Comment: <string>" appears in ASCII armor output. Of course, you can also use this from the command line, e.g. to include a filename in the ASCII armor, do "pgp -eat +comment=filename filename recipient". PGP now enables clearsig by default. If you sign and ascii-armor a text file, and do not encrypt it, it is clearsigned unless you ask for this not to be done. The now enables textmode. Textmode detects non-text files and automatically turns itself off, so it's quite safe to leave on all the time. If you haven't got these defaults yourself, you might want to enable them. All prompts and progress messages are now printed to stderr, to make them easier to find and ensure they don't get confused with data on standard output such as pgp -m output. PGP now wipes temp files (and files wiped with pgp -w) with pseudo-random data in an attempt to force disk compressors to overwrite as much data as possible. On Unix, if the directory /usr/local/lib/pgp exists, it is searched fror help files, language translations, and the PGP documentation. On VMS, the equivalent is PGP$LIBRARY:. (This is PGP_SYSTEM_DIR, defined in fileio.h, if you need to change it for your site.) Also, it is searched for a default global config. This file may be overridden by a local config, and it may not set pubring, secring, randseed or myname (which should be strictly personal) The normal help files (pgp -h) are pgp.hlp or <language>.hlp, such as fr.hlp. Now, there is a separate help file for pgp -k, called pgpkey.hlp, or <language>key.hlp. No file is provided by default; PGP will use its one-page internal help by default, but you can create such a file at your site. On Unix systems, $PGPPATH defaults to $HOME/.pgp. PGP used to get confused if you had a keyring containing signatures from you, but not your public key. (PGP can't use the signatures in this case. Only signatures from keys in the keyring are counted.) PGP still can't use the signatures, but prints better warning messages. Also, adding a key on your secret key ring to your public keyring now asks if the key should be considered ultimately-trusted. Prviously, you had to run pgp -ke to force this check, which was non-obvious. Due to a few people distributing PGP without the manual (including one run of a few thousand CD-ROMs), and the resultant flood of phone calls from confused users, PGP now looks to make sure a manual is somewhere in the vicinity when running to discourage this sort of thing. (If you're getting this warning and need details on how to get rid of it, try pgp -kg.) On Unix, PGP now figures out the resolution of the system clock at run time for the purpose of computing the amount of entropy in keystroke timings. This means that on many Unix machines, less typing should be required to generate keys. (SunOS and Linux especially.) The small prime table used in generating keys has been enlarged, which should speed up key generation somewhat. There was a bug in PGP 2.3a (and, in fact in 2.4 and dating back to 1.0!) when generating primes 2 bits over a multiple of the unit size (16 bits on PC's, 32 bits on most larger computers), if the processor doesn't deal with expressions like "1<<32" by producing a result of 1. In practice, that corresponds to a key size of 64*x+4 bits. Code changes: At the request of Windows programmers, the PSTR() macro used to translate string has been renamed to LANG(). The random-number code has been *thoroughly* cleaned up. So has the IDEA code and the MD5 code. The MD5 code was developed from scratch and is available for public use. The Turbo C makefile was dropped in favour of a Borland C .prj file. You can use makefile.msc as a guide if you need one for a command-line Turbo C.

2 1

Idiots
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

Well it seems like you people are really as stupid as it seems. Anybody (That is the dumb fucks name) decided to mail me twenty or so messages thru a remailer to try and clog my slow timeshare environment mail reader. Also someone named Ryn R. Snyder (This guy is extra autistic) did the same thing. Too bad I read all my mail offline by UUCP on an old slow IBM PS/2 MOD80 (intresting though, local supermarkets use this model computer as a product code server). Would not it be funny if someone set there .forward command in there little used Internet timeshare terminal environment to the cypherpunks mailing list and then subsribed to the list. I guess most people missed the point about distribution but that's OK, CLIPPER is a much better crypto program anyway. People that are not members of the Internt clique are expossed to it almost nightly on the news wheras they are not exposed to PGP or other RSA type crypto. I think marketing whizzes call this product recognition (don't ask me I am just a dumm as dirt sod buster). Oh well, I must go now, I now you all respect and adore me as much as I do you. Also it seems that the few fools that send repeated stupid mail to my box are in the minority. Thanks for the excelent and way cool mail that the rest of you send. 32% had heard or read about Internet (AKA Superhighway) 68% had NEVER heard or read of Internet I quess that 68% can FTP to a site to get PGP (etc.). Out of that agregate I wonder what percent has heard of PGP or RSA? CLIPPER? -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

2 1

05\03\94 - VOLUNTARY NATURE OF TELECOMMUNICATIONS SECURITY INITIATIVE (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

pulled this of the IITF server. FOR IMMEDIATE RELEASE: NIST 94-21 May 3, 1994 Contact: Anne Enright Shepherd VOLUNTARY NATURE OF (301) 975-4858 TELECOMMUNICATIONS SECURITY INITIATIVE STRESSED BY NIST OFFICIAL IN TESTIMONY A government-developed technology to protect the security of telephone conversations and other information communicated over telephone lines is meant to be used by both the government and the private sector on a strictly voluntary, as-needed basis -- and is not intended to be mandated in the future, a National Institute of Standards and Technology (NIST) official said today in congressional testimony. In statements to both the Senate Committee on the Judiciary and House Subcommittee on Technology, Environment and Aviation, NIST Deputy Director Raymond Kammer stressed that the "voluntary key escrow" coding system "first and foremost, was devised to provide solid, first-rate cryptographic security for the protection of information held by the government when government agencies decide such protection is needed for unclassified government communications." He cited as examples the protection of tax records, Social Security records, census data and other proprietary information when transmitted over telephone lines. At the same time, Kammer pointed out the importance of strong encryption protection for citizens and U.S. companies. Encryption "protects the individual privacy of our citizens.... Private-sector organizations can also benefit from encryption by securing their product development and marketing plans, for example. It also can protect against industrial espionage," Kammer said. But the increasing proliferation of encryption techniques also is expected to make the law enforcement community's job more difficult, he said, and the voluntary key escrow approach provides a way for law enforcement authorities -- when legally authorized -- to decode messages sent over telecommunications systems using the key escrow technique. The initiative is intended to strike a balance between the needs of law enforcement and national security with the needs of businesses and individuals for security and privacy. In every instance, Kammer stressed, the system is being made available on a strictly voluntary basis. Each federal agency can use the key escrow technology to protect its information on an as-needed basis. Companies can choose to use the system when they need excellent security -- or they can use any other encryption technologies available in the marketplace. "Let me be clear," Kammer said. "This Administration does not seek legislation to prohibit or in any way restrict the domestic use of cryptography." - 30 - NOTE TO EDITORS: Copies of the NIST testimony are available to reporters by calling (301) 975-2762. -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Voice encryption info request
by David T. Witkowski 17 Dec '03

17 Dec '03

I'm looking for technical info on analog voice encryption techniques, including app notes and schematics if available. Any help would be appreciated, direct email replies are preferred. ...dtw /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ | I'll do whatever my Rice Krispies tell me to do... | | | | ******* Notice of impending email address change: ******* | | New interim address: dwitkow(a)eis.calstate.edu | /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCNAqeeBhcAAAEEAM8M83T/IpKEFbho61dHQIiXx3gFcmBNqMGKtAFFprt9obHH GQ0N1sm/T9DNnS59IxYkB1e08rEMHlearsiw48/p/A43jsYiwYVvy2IBPw6Lnwwc Cdtgbkou/PPiDq/M5nzC9EziljDAE8QhJISKgmez89d4HlLsNqhwMY4XVqGjAAUR tDJEYXZpZCBULiBXaXRrb3dza2kgPGR3aXRrb3dzQG5lcm1hbC5zYW50YXJvc2Eu ZWR1Pg== =PqVE -----END PGP PUBLIC KEY BLOCK-----

1 0

PGP 2.5 working on UNIX
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Note -- I built it for my UNIX machine but I needed to edit the rsaref2 makefile in 3 places to specify gcc. cc barfed on the make. The instructions say to make your own directory, but you need to edit the makefile and run make in place in the rsaref2/install/unix directory or the pgp makefile won't find it. You should make rsaref2 first. - Carl P.S. I'll sign my new 1024 bit key with my old 1264 bit key later. -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLc7EflQXJENzYr45AQEiqAP/Wg4jq/u8636hMd/zmKS8opL683rKnL0a Jv+WVNIqOASyA9UYoAXegmmXDIohW1PjzudQ3SkZPxfhr9yLrz4h7KUZSowNAdlq XaVBJETumF60YYKPzjDLSj2j3z9yqC8HR4Vv5HtbEv/nEIM8RsFW03rIn4HcUiiO fCCA5K70ouc= =6i8v -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.5 mQCNAi3OxA8AAAEEALNdAXftavTBG2zHV7BEV59gntNlxtJYqfWIi2kTcFIgIPSj KlHleyi9s5dDcQbVNMzjRjF+z8TrICEn9Msy0vXB00WYRtw/7aH2WAZx+x8erOWR +yn1CTRLS/68IWB6Wc1x8hiPycMbiICAbSYjHC/ghq2mwCZO7VQXJENzYr45AAUR tC5DYXJsIEVsbGlzb24gMTAyNC1iaXQga2V5IDxjbWVAc3cuc3RyYXR1cy5jb20+ =tEQq -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: PGP 2.5
by anon1df3＠nyx10.cs.du.edu 17 Dec '03

17 Dec '03

|> Another RSAREF limitation is that it cannot cope with keys longer than |> 1024 bits. PGP now prints a reasonably polite error message in such a |> case. |Reasonably polite? It says "Error: Bad pass phrase." That doesn't |sound at all polite to me. And since my key is 1234 bits, I'm vastly |unimpressed. What in the world is the point of this restriction? |I see a lot of "what it is" but not "why it is" in the docs. Would one of This restrcition comes from RSAREF code, over which the PGP team had no control. Everyone is entitled to their own opinion, but to me the development of a free, legal, source code version of PGP is such a positive development that it easily outweighs any of the problems (key sigs, incompatibility with big keys, etc.) that the new release has brought about. When the jump from verison 1 to verison 2 was made, everyone's key became obsolete, and everyone survived. Everyone will survive this time, too. I'm also very pleased with some of the new features (like the default for PGPPATH, which will make PGP a lot more accessible to casual users).

3 2

reassuring press release
by Bradley W. Dolan 17 Dec '03

17 Dec '03

>Date: Mon, 09 May 1994 18:54:08 -0400 (EDT) >From: Stanton McCandlish <mech(a)eff.org> >Subject: 05\03\94 - VOLUNTARY NATURE OF TELECOMMUNICATIONS SECURITY >INITIATIVE (fwd) >Sender: owner-cypherpunks(a)toad.com >FOR IMMEDIATE RELEASE: NIST 94-21 >May 3, 1994 >Contact: Anne Enright Shepherd VOLUNTARY NATURE OF > (301) 975-4858 TELECOMMUNICATIONS SECURITY > INITIATIVE STRESSED BY NIST > OFFICIAL IN TESTIMONY >clear," Kammer said. "This Administration does not seek >legislation to prohibit or in any way restrict the domestic use >of cryptography." ^^^^^^^^^^^^ !!!!!!!!

1 0

I am sorry I bothered you.
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

I am sorry to have bothered the group known as cyberpunks. Please forgive me, but I must go. There is a TV program about guns in America, I must watch this so I may have a good laff. They say you can buy a gun on the street anywhere. I doubt if I could here near Arizona State University (rated #1 party school by playboy magazine). But if an econimist would look at graphs for public assistance from the Fed and comparied it with crime rate per 1,000 citizens in an area he probly could find an area to purchase guns rather rapidly (he probly would not need to look at the crime figures, just public assistance). Freenzy like a shark. The newspapers do a survey to see what people are concerned about. They are concerned about crime. So they write articles about crime. People get more concerned about crime. So they write more articles 8 (that is supose to be sideways) Intresting to note, no one brags about the statistics involving police officers and violent gun related crime. Could it be that having a hand gun strapped to your belt deters crime? Or is it just the bullet proof vest. I know this is stupid second amendment talk, but it is only one away from cryptographies 1st amendment and 3 away from the 5th that should allow you to have any crypto your heart desires. After they strike down the right to protect your documents on your word processer, what next, torture for confessions? Well one thing for sure you probly won't have a gun to defend your freedom of speech or your freedom to assemble or any other freedom you can think of that can be taken away in the proclamation of national intrest. Sorry for bothering you. -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

1 0

Re: 05\03\94 VOLUNTARY ... SECURITY INITIATIVE
by drzaphod＠brewmeister.xstablu.com 17 Dec '03

17 Dec '03

> . . . meant to be used by both the government and > the private sector on a strictly voluntary, as-needed basis -- > and is not intended to be mandated in the future, a National > Institute of Standards and Technology (NIST) official said today > in congressional testimony. I would have been impressed if they left out "intended." The above "testimony" is meaningless. How is NIST supposed to know what diabolical plans NSA/etc has in store for us. > But the increasing proliferation of encryption techniques > also is expected to make the law enforcement community's job more > difficult, he said, and the voluntary key escrow approach > provides a way for law enforcement authorities -- when legally > authorized -- to decode messages sent over telecommunications > systems using the key escrow technique. This is the same argument used for the Digital Telephony Bill. That's MANDATORY . . it won't work if it's voluntary. > . . . Companies can choose to use the system when > they need excellent security -- or they can use any other > encryption technologies available in the marketplace. Can companies believe the government's secret[obscure] crypto is safer than PGP or it's offspring? Why does the government feel the need to spend all our money and provide us with inferior encryption? ANSWERS: 1] They're lying to us. 2] They have too much money..and we trust them to print it? It's too bad people, in general, believe what they hear, not what is done. The Master Plan to hypnotize our nation [+the world?] into supporting what they have not a clue about continues . . . -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - DrZaphod #Don't Come Any Closer Or I'll Encrypt! - - [AC/DC] / [DnA][HP] #Xcitement thru Technology and Creativity - - [drzaphod(a)brewmeister.xstablu.com] [MindPolice Censored This Bit] - - 50 19 1C F3 5F 34 53 B7 B9 BB 7A 40 37 67 09 5B - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

1 0