December 2003 - cypherpunks-legacy

How good is MIT-PGP 2.5?
by Robert A. Hayden 17 Dec '03

17 Dec '03

When 2.5 was first announced a few weeks ago (with the non infamous keyserver announcement), there was some concerns expressed over the political manipulations of the new program and thus, the overall security of the code. To this date I haven't seen any additional commentary on that subject, and I figure that before I recommend locally changing to 2.5, I'd like to find out what exactly was changed from the standpoint of the algoritms and the overall safety of them. No flame please, but I am not a math-oriented person, so please keep it in pseudo-english :-) ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> Political Correctness is \/ Finger for PGP 2.3a Public Key <=> P.C. for "Thought Police" -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

2 1

Dr Dobbs "CD ROM"
by mgream＠acacia.itd.uts.edu.au 17 Dec '03

17 Dec '03

Curiously; thumbing through the last issue of Dr Dobbs (April 94 -- it just made it into the newsagents here), I notice their CD ROM for sale (well, I've seen it in previous issues, but just thought about the point I'm going to make now). Considering that previous issues of Dr Dobbs have contained cryptographic algorithms (ie. Nov '93 -- scheiner & IDEA), and this CD ROM makes the code available, then how did they get an export license -- if indeed they did ? The order form for the CD ROM states "add $x.xx if outside US or Canada", so their market is clearly international. Does anyone have this CD ROM, is the code in "ready to compile" form, is it all there ? Matthew. -- Matthew Gream Consent Technologies Sydney, (02) 821-2043 M.Gream(a)uts.edu.au

3 2

Anonymous message failed (wrong password)
by daemon＠anon.penet.fi 17 Dec '03

17 Dec '03

Sure enough the penet server tracked the message (which I posted to cypherpunks) back to me and sent me the error message thinking that was the right thing to do. Note that had I copied the entire bounced message there is porbably something in it to relate me to my penet anon address. In the case of the other user who was complaining at having been assigned an alias without ever having used the service, this might be the explanation as you likely had no password or account, your mail was not bounced. -uni- (Dark)

1 0

Quantum Computers and stuff
by John K Clark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I found this in the May 6 issue of Science: >At the same press conference where Lenstra and company announced >the defeat of RSA-129,he promised a "surprise" for the next >factoring feat. He hinted at a new, faster algorithm- and >perhaps a test involving a number with quite a few more digits >than 129. Then I found this in the May 7 issue of Science News: >In a startling theoretical result that could call into question >any cryptosystem based on factoring, Peter W Shore of AT&T Bell >Laboratories in Murray Hill, N.J., has just proved that >factoring is "easy" when done on a special type of computer >operating according to quantum mechanical principles . Although >such a quantum computer does not yet exist, this finding has >shaken the cryptographic community. By "easy" I presume they mean solvable in Polynomical time. I'm not saying the writing is on the wall or anything but it might be prudent to start thinking about Diffe-Hellman, perhaps using elliptic curves. John K Clark johnkc(a)well.sf.ca.us -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCzAgUBLdbskn03wfSpid95AQFZuwTvVug954sJilmhlyR3Sye+LpCB9ktG+erw mfDHBbAUpYC34P/lL81dzekGj7hmMhOIgZklZn7h/XfgCydQihm0e+DHGC9h64nT AI6g2xHI5k/hH9QZRUPjFLwreaFeKX4ARy3rfWEgpGC7g1qqyPnKQi7TBuffyYCV 51NJ9lGzGjuSVIcDdHcGBIoTkMg1T8pH+Yr44jo/MehE86KB+/0= =pxVR -----END PGP SIGNATURE-----

2 1

Puzzle Palace 2nd edition?
by Ted Cabeen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I few months ago, around when the second edition of The Codebreakers came out, there was mention of a second edition of the Puzzle Palace. Was that just a misguided rumor, or is there a second edition in the works? I was planning on rereading it, but if a second edition is soon coming, I'll wait. Thanks. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBM9jOvNBqlyHCkS2NAQEZHgf/Vf3WvnIjzfPCt2wjC7wqwTS6ke26/epr 7J41U+aCrk/fVTtBrTPSmjOTTgfKatRfI407Iq7h2YDHP7FVAKnVzIlXLSddtbr2 1p7A3OU0thZcn9sdq8LfJovqDXgdflSiU+eGC7uhU4MK0Tdx1Xc+/ARO/v6E7zXQ y7sLudLEXyG7P7oM6aLa1eebpfv2rOdq7l5sgIeNRn56k6QuWpFAx1aALjIaWxJD ZnEtLfq/kPXQHu0jXy1mKtb7wvr4+iF/VNI+mDlCh2Q9HvNSi6wGq1vREoJNazxq ReVIeMYwxJt92RLmwDNexFA0qlaB56jNWaH4TER8Qc5JYH+2llNCAQ== =cQhp -----END PGP SIGNATURE----- -- Ted Cabeen http://shadowland.rh.uchicago.edu cabeen(a)netcom.com Check Website or finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." -F. Bacon cococabeen(a)aol.com "Human kind cannot bear very much reality."-T.S.Eliot 73126.626(a)compuserve.com

1 0

Rabin decryption
by nobody＠rebma.rebma.mn.org 17 Dec '03

17 Dec '03

How do you do Rabin decryption? In the Rabin PK system, your modulus is a Blum integer, a number n of the form p*q, where p and q are primes equal to 3, mod 4. According to Schneier, p. 289, encryption is done by C = M^2 mod n. On the next page, he gives four possible square roots of C: M1 = C^((p+1)/4) mod n M2 = p - C^((p+1)/4) mod n M3 = C^((q+1)/4) mod n M4 = q - C^((q+1)/4) mod n These formulas don't work. Also, note the "p -" and "q -". This is suspicious. If M^2 is C, then (n-M)^2 is also C. I suspect M2 and M4 should have "n -" instead. Try p=7, q=11, n=77. (p+1)/4 is 2, (q+1)/4 is 3. Try M=50, so C=36. M1 = 64; M2 = 20; M3 = 71; M4 = 17. None of these are the original M, and none of them is a square root of 36. Anybody know the right way to do square roots mod a Blum integer?

1 0

Cryptosystems Journal
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

Does anyone know where one can read back issues of CryptoSystems Journal? I was looking for Volume 2 Number 2. I tried at several Univeristies but they said only the Library of congress had it. Thanks.

1 0

a couple of shell scripts for use with PGP
by Jef Poskanzer 17 Dec '03

17 Dec '03

pgpextract: Given one or more keyids or userids, either on the command line or on stdin, extracts the keys and writes them to stdout. Basically just a more useful interface for 'pgp -kxa'. pgpgetweb: Given one or more keyids or userids, either on the command line or on stdin, expands the "web of trust" out to the specified depth and writes the resulting keyids to stdout. You could feed the resulting file to pgpextract to make a subset keyring of only your 'close neighbors'. If I come up with more scripts I'll add them to the sharchive in my ftp dir on netcom. --- Jef #! /bin/sh # This is a shell archive, meaning: # 1. Remove everything above the #! /bin/sh line. # 2. Save the resulting text in a file. # 3. Execute the file with /bin/sh (not csh) to create the files: # README # pgpscripts.1 # Makefile # pgpextract # pgpgetweb # This archive created: Mon May 16 00:11:13 1994 export PATH; PATH=/bin:$PATH echo shar: extracting "'README'" '(536 characters)' if test -f 'README' then echo shar: will not over-write existing file "'README'" else sed 's/^X//' << \SHAR_EOF > 'README' X pgpscripts - shell scripts for using PGP X version of 15may94 X XSome simple scripts that give a more Unix-like interface to some Xof PGP's functions. See the manual entry for more details. X XFiles in this distribution: X README this X Makefile guess X pgpscripts.1 manual entry X pgpextract script X pgpgetweb ... X XTo install: X Unpack the files. X Edit the Makefile to change the configuration options if necessary. X Make install. X XComments to: X Jef Poskanzer jef(a)netcom.com jef(a)well.sf.ca.us SHAR_EOF if test 536 -ne "`wc -c < 'README'`" then echo shar: error transmitting "'README'" '(should have been 536 characters)' fi fi # end of overwriting check echo shar: extracting "'pgpscripts.1'" '(744 characters)' if test -f 'pgpscripts.1' then echo shar: will not over-write existing file "'pgpscripts.1'" else sed 's/^X//' << \SHAR_EOF > 'pgpscripts.1' X.TH pgpscripts 1 "15 May 1993" X.SH NAME Xpgpextract, pgpgetweb - shell scripts for using PGP X.SH SYNOPSIS X.B pgpextract X.RI [ keyid... ] X.br X.B pgpgetweb X.I depth X.RI [ keyid... ] X.SH DESCRIPTION X.PP XDescription of each script: X.TP X.I pgpextract XGiven one or more keyids or userids, either on the command line or Xon stdin, extracts the keys and writes them to stdout. Basically Xjust a more useful interface for 'pgp -kxa'. X.TP X.I pgpgetweb XGiven one or more keyids or userids, either on the command line or Xon stdin, expands the "web of trust" Xout to the specified depth and writes the resulting keyids to stdout. XYou could feed the resulting file to X.B pgpextract Xto make a subset keyring of only your 'close neighbors'. X.SH "SEE ALSO" Xpgp(1) SHAR_EOF if test 744 -ne "`wc -c < 'pgpscripts.1'`" then echo shar: error transmitting "'pgpscripts.1'" '(should have been 744 characters)' fi fi # end of overwriting check echo shar: extracting "'Makefile'" '(592 characters)' if test -f 'Makefile' then echo shar: will not over-write existing file "'Makefile'" else sed 's/^X//' << \SHAR_EOF > 'Makefile' X# CONFIGURE: the directory where you want the executables installed XINSTDIR = /usr/local/bin X X# CONFIGURE: the directory tree where you want the man pages installed XMANDIR = /usr/local/man X X# End of configurable definitions. X XSCRIPTS = pgpextract pgpgetweb X Xall: X Xinstall: all X for i in $(SCRIPTS) ; do \ X rm -f $(INSTDIR)/$$i ; \ X cp $$i $(INSTDIR) ; \ X done X rm -f $(MANDIR)/man1/pgpscripts.1 X cp pgpscripts.1 $(MANDIR)/man1 X for i in $(SCRIPTS) ; do ( \ X rm -f $(MANDIR)/man1/$$i.1 ; \ X echo '.so man1/pgpscripts.1' > $(MANDIR)/man1/$$i.1 ; \ X ) done X Xclean: X rm -f core SHAR_EOF if test 592 -ne "`wc -c < 'Makefile'`" then echo shar: error transmitting "'Makefile'" '(should have been 592 characters)' fi fi # end of overwriting check echo shar: extracting "'pgpextract'" '(894 characters)' if test -f 'pgpextract' then echo shar: will not over-write existing file "'pgpextract'" else sed 's/^X//' << \SHAR_EOF > 'pgpextract' X#!/bin/sh X# X# pgpextract - extract multiple pgp keys onto stdout X# X# Copyright (C) 1994 by Jef Poskanzer <jef(a)netcom.com>. X# Permission to use, copy, modify, and distribute this software and its X# documentation for any purpose and without fee is hereby granted, provided X# that the above copyright notice appear in all copies and that both that X# copyright notice and this permission notice appear in supporting X# documentation. This software is provided "as is" without express or X# implied warranty. X Xout=peo.$$ Xkey=pek.$$ Xkeya=${key}.asc Xrm -f ${out} ${keya} Xumask 077 X X( X if [ $# -eq 0 ] ; then X cat X else X while [ $# -ne 0 ] ; do X echo $1 X shift X done X fi X) | ( X while read id ; do X pgp -kxa ${id} ${key} > ${out} 2>&1 X if [ -z "`grep 'Key not found' ${out}`" ] ; then X cat ${keya} X else X echo "Keyid ${id} not found." >&2 X fi X rm -f ${out} ${keya} X done X) SHAR_EOF if test 894 -ne "`wc -c < 'pgpextract'`" then echo shar: error transmitting "'pgpextract'" '(should have been 894 characters)' fi chmod +x 'pgpextract' fi # end of overwriting check echo shar: extracting "'pgpgetweb'" '(1338 characters)' if test -f 'pgpgetweb' then echo shar: will not over-write existing file "'pgpgetweb'" else sed 's/^X//' << \SHAR_EOF > 'pgpgetweb' X#!/bin/sh X# X# pgpgetweb - finds the keyids that comprise the 'web of trust' for X# specified ids X# X# Copyright (C) 1994 by Jef Poskanzer <jef(a)netcom.com>. X# Permission to use, copy, modify, and distribute this software and its X# documentation for any purpose and without fee is hereby granted, provided X# that the above copyright notice appear in all copies and that both that X# copyright notice and this permission notice appear in supporting X# documentation. This software is provided "as is" without express or X# implied warranty. X Xif [ $# -eq 0 ] ; then X echo "usage: $0 depth [keyid...]" >&2 X exit 1 Xfi Xdepth=$1 Xshift X Xids=/tmp/pgwid.$$ Xtodo=/tmp/pgwtd.$$ Xout=/tmp/pgwo.$$ Xrm -f ${ids} ${todo} ${out} Xumask 077 X( X if [ $# -eq 0 ] ; then X cat X else X while [ $# -ne 0 ] ; do X echo $1 X shift X done X fi X) | sort -u > ${ids} Xcat ${ids} > ${todo} X Xecho "Starting with `cat ${ids} | wc -l` keyids." >&2 Xn=0 Xwhile [ ${n} -lt ${depth} ] ; do X cat ${todo} | ( X while read id ; do X pgp -kvv ${id} 2>&1 | egrep '^sig ' | awk '{printf "0x%s\n", $2}' X done X ) | sort -u > ${out} X comm -13 ${ids} ${out} > ${todo} X cat ${ids} >> ${out} X sort -u ${out} > ${ids} X X n=`echo ${n}+1 | bc` X echo "At depth ${n}, `cat ${ids} | wc -l` keyids." >&2 Xdone X Xcat ${ids} Xrm -f ${ids} ${todo} ${out} SHAR_EOF if test 1338 -ne "`wc -c < 'pgpgetweb'`" then echo shar: error transmitting "'pgpgetweb'" '(should have been 1338 characters)' fi chmod +x 'pgpgetweb' fi # end of overwriting check # End of shell archive exit 0

1 0

[ANON] War in rec.guns
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

[[Reply-To: john.nieder(a)tigerteam.org]] -=> Quoting Dputzolu(a)uxa.cso.uiuc.edu to John Nieder <=- [Nieder to "Magnum"] >You also, I note, have not been passing on numerous other dissenting >messages of which I have received Cc:s. >This is an excellent way to engineer the illusion of common consent, >however dishonestly. I congratulate you. Unfortunately, you do not >have control of the other lists and newsgroups on which I plan to >discuss this issue and your personal handling of it. Dp> Whoa there! This is a very serious accusation here (IMHO). While I Dp> tend to agree with many of the points you make about the subject of Dp> anonymity, I can understand forwarding this particular posting Dp> by the moderator via email instead of posting it to rec.guns, Dp> based on his "kinder, gentler" newsgroup policy. It is my impression Dp> that the moderator tends to try to keep flameage on rec.guns to a Dp> minimum, and your post was quite loaded in that regard. I agree with the point, and believe it or not I much prefer to have things pleasant about me, but when people do ignorant things like banning remailer use (or guns, or encryption...) without any good reason and insult the motives and character of those who use them, it's only reasonable to expect offended parties to yell and cuss. I mean, think about it: Would you be polite to Charles Schumer? Dp> However, you have made quite an accusation. I did see at least Dp> a few posts arguing the pro-anon side (including mine). Look again and see if you got to see Martin Greifer's post or one from a guy named Vetleson (sp?). Greifer's was angry (he was the main objector to the anti-anon policy on ca-firearms who got me radicalized on the issue), but made the valid if - damned obvious - charge that nobody disputed a single point I made supporting remailer use, and Vetleson's explained _why_ he had to use a remailer to get through to the group for technical reasons. I didn't see them in the "digest" the moderator selectively prepared, nor did I see any of the posts that came via remailers (naturally). I didn't see any of the short posts of support, which may not have been considered "worthy" of inclusion either. The incoming headers showed that these had also been posted to rec.guns. The Vetleson post was entered onto a BBS's rec.guns feed, but didn't show up on the net. I didn't save any of these personally (I didn't think I'd have to), but I'll see if I can retrieve them tomorrow from my main feed, though this is probably not possible, as it only saves the last x-number of messages before overwriting. I think I have Greifer's netmail address here somewhere left over from the ca-firearms anon wars, if you want to check with him. Don't know Vetleson's, but can find out [here's Greifer's: martin.greifer(a)f28.n125.z1.fidonet.org] Anyway, my mail ran about 80% pro-anon. Obviously, he excluded _mine_, and admitted it. This is exactly what the media does when it wishes to appear "fair" on an issue - tailor the raw response to support the agenda, with a few innocuous dissenting remarks to give the illusion of even-handedness. You'll notice that all anti-anon responses were either butt-kissing "me-too" posts of moderator adulation, or else completely ignored the arguments in my post. Dp> To put it briefly: "Put up or shut up." Hey, why don't we apply that idea to these folks who want to ban anon posts? If you can raise a _valid_ objection, or can refute my points, DO IT!...but they _can't_. Anyway, check with Greifer if you doubt this. If the posts I mentioned showed up in the digest, post them and I'll apologize, but _I_ sure didn't see them there. Did you? Note that the moderator (funny how he doesn't use his name much - I've never seen it, and that seems pretty anon to me) has closed the discussion, so I'm sure that he'll say these posts came in _afterwards_. Frankly, I think he ought to quit the moderator position, as he's unfit. He provides no protection on the newsgroup from endless boneheaded and useless newbie posts about illegal modifications of weaponry, but somehow he finds time to kill 100% legitimate, non-anonymized posts (as Vetleson asserted in his case, I think) of valid and useful content _simply because they come through a remailer_. Obviously, the guy's got his priorities fucked up and I don't see where's he's doing the group much good. I have mixed emotions about the concept of moderated groups anyway, particularly ones where the "moderation" is so quirkily counterproductive. |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| | <john.nieder(a)tigerteam.org> * CP2A * PGP Key # E27937 on all servers | |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| |"If you love wealth better than liberty, the tranquility of servitude | | better than the animating contest of freedom, go home from us in | | peace. We ask not your counsels or arms. Crouch down and lick the | | hands which feed you. May your chains set lightly upon you, and may | |posterity forget that ye were our countrymen." -- Samuel Adams, 1776| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| |BOYCOTT: Pepsico <KFC - Taco Bell - Frito-Lay - Pepsi-Cola> & Gillette| |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%|

1 0

[ANON] War in rec.guns
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

[[Reply-To: john.nieder(a)tigerteam.org]] -=> Quoting Paul(a)vixen.cso.uiuc.edu to All <=- Pa> Btw, it's only a "war" in your mind. To everyone else involved it's Pa> been a calm discussion of the pros and cons. I have seen no substantive refutation of the points I made in my original post there, BTW, indeed no "discussion" of the _issues_ at all. The only reason it's a "calm discussion" is that the moderator is apparently shortstopping most effective pro-anon posts to the list. He admits to stopping mine and Cc:ed posts I've received netmail do not show up on the group. In short, what you see on the group appears to be what he wants you to see and is not reflective of the actual traffic. Ingenious, huh? If you have an actual, substantive objection to the points I raised in my original post, I'd be pleased to read them. If you missed it on the first time around, I'll send it to you again. So far only _one_ anti-anon correspondent has actually challenged one of my points on a technical matter, but he's factually mistaken. I do applaud him for at least facing the questions on their merits, though. |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%| | <john.nieder(a)tigerteam.org> * CP2A * PGP Key # E27937 on all servers | |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| |"If you love wealth better than liberty, the tranquility of servitude | | better than the animating contest of freedom, go home from us in | | peace. We ask not your counsels or arms. Crouch down and lick the | | hands which feed you. May your chains set lightly upon you, and may | |posterity forget that ye were our countrymen." -- Samuel Adams, 1776| |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| |BOYCOTT: Pepsico <KFC - Taco Bell - Frito-Lay - Pepsi-Cola> & Gillette| |%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%|

1 0