December 2003 - cypherpunks-legacy

MIT keyserver: don't panic...
by Mike Ingle 17 Dec '03

17 Dec '03

Take a look at pgformat.doc, which is included in the source or doc releases of pgp23a. Both the public key and signature packets have only a single-byte version number, which is always equal to 2. So there is no way to tell by looking at your key which minor version (2.xx) it was created by. You can tell which version was used to extract it to ascii armor by looking at the "Version: 2.xx" line in the ascii armored message. So get a text editor. Big deal. You will not have to regenerate your keys and get new signatures on them. If we have a no-doubts legal PGP, with source code, and free, that's good! If something sucks about it, PGP23a is not going to disappear. This can only be a positive development. As for why the keyserver crippling was imposed, RSA can lose its patent rights if it can't show in court that it made an effort to prevent its patents from being infringed. --- Mike

1 0

DefenseServices
by Peter Murphy 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <perry(a)snark.imsi.com> Sender: owner-cypherpunks(a)toad.com Precedence: bulk Status: R _______ MESSAGE BEGINS ___________ Jim Miller says: > Section #120.9 of the ITAR defines "Defense Service" as: > > (1) The furnishing of assistance (including training) to foreign > persons, whether in the United States or abroad in the design, > development, engineering, manufacture, production, assembly, testing, > repair, maintenance, modification, operation, demilitarization, > destruction, processing, or use of defense articles; or > (2) The furnishing to foreign persons of any technical data > controlled under this subchapter (see #120.10), whether in the United > States or abroad. This is sick. According to this, I cannot teach foreigners about cryptography in the U.S. -- even about the open literature. This is a grotesque denial of my first amendment rights. I wonder if I should hold an open enrollment cryptography class for the sake of civil disobediance. Perry ______ MESSAGE ENDS _________________________________________ That's interesting..... My cryptology lecturer seems to have an American Mid-West accent (not Canadian - I can generally tell), and seems to be commiting the "heinous" crime of teaching such matters to mainly Australian people. He seems to be on conference somewhere overseas. Well, I hope he doesn't get arrested if he crosses any U.S. border posts. It would certainly piss me off. (For one thing, it would fuck up my syllabus :-[.) Seriously, I don't think it is an offense to teach cryptology to non-NAFTA nationals. All of the stuff is non-classified, and he seems pretty aware of the legal issue of cryptology. That is, he wouldn't do anything that he could be nabbed for (discounting any warped interprepation of the legal statutes...;-( .) ======================================================= | Peter Murphy. <pkm(a)maths.uq.oz.au>. Department of | | Mathematics - University of Queensland, Australia. | ------------------------------------------------------- | "What will you do? What will you do? When a hundred | | thousand Morriseys come rushing over the hill?" | | - Mr. Floppy. | =======================================================

1 0

PGP.....
by lile＠netcom.com 17 Dec '03

17 Dec '03

The MBone session "Cyberstation:audio feed" is going to have Jeffrey Schiller talk about the new public PGP V2.5 release.... Cygnus has a mbone connection.... -lile ps. You can also see info at http://www.media.org/pgp.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

MBone - where to get the software...
by lile＠netcom.com 17 Dec '03

17 Dec '03

Hi folks, You need to get software to see the MBone encapsulated packets. You will also need a tunnel to your site (and you might already have one). So where to get the software... I am looking for it on a ftp site but have not found it. Some of the program names are sd (for session director) vat wb ( for whiteboarding) nv Hey! I just heard from van Jacobson. He wrote alot of this software... >From van(a)ee.lbl.gov Thu May 5 18:12 PDT 1994 To: Lile.Elam@Eng (Lile Elam) Subject: Re: mbone software... Date: Thu, 05 May 94 18:13:30 PDT From: Van Jacobson <van(a)ee.lbl.gov> Content-Type: text Content-Length: 218 The audio (vat), whiteboard (wb) & session directory (sd) tools are on ftp.ee.lbl.gov in conferencing/{vat,wb,sd}/*. The most widely used video tool (nv) is available on parcftp.xerox.com in pub/net-research. - Van Cygnus has a tunnel and so does Sun. I wish I could help more. I am still awaiting the PGP - Jeff broadcast. -lile ps. If you do get it up, the session is "Cyberstation: audio feed" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Keyserver service outage (fwd)
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

FORWARDED MAIL ------- From: netcomsv.netcom.com!ah.com!hughes (Eric Hughes) Date: 05 May 94 Originally To: toad.com!cypherpunks >And since the RSA and IDEA patents aren't valid in Europe, this >is 100% kosher. You guys use MIT-PGP and we'll use free pgp 2.5 IDEA is an international patent, from ETH in Switzerland. Eric What about the idiots that do not know and FTP from STP? -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

2 1

The MBone talk....
by lile＠netcom.com 17 Dec '03

17 Dec '03

You are not going to beleave this, but I missed it!!!! Argh!!!!!!! I had run down the hall to tell someone about it and once we got it up (which was only a few minutes) Jeff had already spoken... I heard from Van that Jeff Schiller just read the text that the MIT legal gave him and that is the same text that is on the www.media.org web server... So, wonder why there is so much darkness about this release... Why can't they just be up front with what it is and what's goin on? hum......... -lile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello everyone! This is a preliminary document which I hope will stir discussion. I didn't write it in order to dictate rules to anyone, so please don't flame me. Hopefully the members of the list will supply lots of feedback! -Lady Ada - ---------------------------------------------------------- Introducting The Cypherpunk Standard For Encrypted Phones (CSEP) Purpose: Encryption software is a form of communication tool. Like other communication systems, it is useless without someone to talk to who shares the same protocol. It appears likely that various forms of encrypted phones will spring up in the near future, ranging from PC and SoundBlaster-based software to simple hardware phones. Now is the time for us to agree on protocols, so that all cypherpunk-built phones can talk to each other. Disclaimer: "But," you say, "Phil Z. is already working on VoicePGP. Why not wait until he releases it and let that be the standard?" Well, I'm not trying to undercut Phil, and I certainly hope that we will be incorporating his protocols into a future version. But I don't think we should let a single product drive all future design. Let's think about the future now. Isn't it better to hash out potential problems in a public forum? Basic Standard - -------------- - -- Diffie-Hellman for key exchange - -- Triple DES for data encryption - -- RSA for digital signatures/identity verification Rationale: Unlike encryption protocols designed for email, a phone system will need to exchange public keys bidirectonally at the beginning of every call, and the existance of an insecure two-directional link can be assumed. Diffie-Hellman is perfect for this application. The alternative, RSA, would require either generation of new keypairs at call time, which is very slow, or the long-term association of a keypair with a specific phone, which provides no benefit to the user and opens a possible path of attack (though not a major one) to eavesdroppers. Also, the patent on Diffie-Hellman expires in 1997, well before the 2000 expiration date of RSA. The information available to me appears to indicate that Triple DES is not significantly more vulnerable than IDEA or other popular algorithms, and it has the advantage of not being patented. I would like to see this standard keep possible future commercialization in mind. I suggest that the TDES implementation should use three different independent keys. IDEA might be offered as an option for those who prefer it. Compression - ----------- It's probably wise to standardize on a particular compression scheme. I have no opinions on this subject and welcome input. The most important feature is speed, not efficiency of compression. Other Features Required for Secure Phones - ----------------------------------------- Each phone shall have a button (hard or soft) which can be pressed by the caller at any time. Pressing it will cause a new TDES key to be generated and exchanged. [Should it generate a new n and g for D-H, or just create a new x and demand a new Y?] Paranoid users can press this button every few seconds if they wish. (In my humble opinion, even a single-DES phone is quite secure if it has this feature.) Other possible options - ---------------------- In some cases it may be desirable to confirm that the call recipient is really the person you wish to speak to. This could be implemented by allowing the phone to store RSA private keys (one for each user) and public keys (to test for other users). These signature keys should be independent of the encryption keys. The phone would require the user to enter a code [of what length?] which would act like the passphrase of PGP, preventing anyone from impersonating another user even if the would-be impersonator had access to the victim's key and phone. Control Codes - ------------- A number of control codes are needed for commands passing between the two phones. Not only the definitions of the codes but the values must be agreed upon by all users. Each of these will be associated with a defined packet that contains the appropriate data. GENNEWKEY [send x, request Y] DATA [send actual packet of data, request ACK] DATAACK [acknowledge data packet with checksum] - -------------------------------------------------------- OK, I admit it, this is pretty minimal, but hey, it's a beginning. Please send comments to the list. Phil Z, if you're out there reading this, I'd particularly like your input. -Lady Ada -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLclivqXNQdJx1hMZAQGq2wP/fcq5gp8unZhy/cog3jpdI8wA3hJORzME ul4qdnu5dOP7ON3LmlsWPeymUlagI1oUtJOUxb5LQ9lAlQMWv7u3TJDj3tqftcu3 il8fVmdIxrf8FYDbhs5GppCcfsMaz2/ervsw9cICspFPQJOKTOWzzTMuUYyoqcYa hWH/OJhMmPw= =coxy -----END PGP SIGNATURE-----

1 0

Chill out.... was Re: Keyserver service outRAGE
by Pat Farrell 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)snark.imsi.com> writes: > Rather than everyone freaking out about 2.5, why not just wait a few > hours until the FTP site is announced and look at the thing for > ourselves? > > Myself, I'm running on the assumption that this is a good thing, > because now PGP is completely legal in the U.S., and doubtless a PGP > thats legal overseas using a library compatible with RSAREF will > appear within days of release. Amen to this! Wait a week, and this might be a great thing. If not, keep using 2.3a. I know that Jim Bidzos was interested in having a "pgp compatible" program that started with rsaref and was legal and free. I know because I asked him about liscensing last spring. He pointed me to an effort that professor Jeffery Schiller (pgp key 0C4EE1 (jis@mit) on the usual servers) was coordinating. I exchanged a few messages with a student up there, then got lost in GMU work and lost track. I think the student did something else, like crack RSA-129. But there are lots of students at schools like MIT and GMU. I sure hope this can provide a cloud free PGP for broke students. Lets drop this thread for while, ok? Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Hell's Bells
by lile＠netcom.com 17 Dec '03

17 Dec '03

Hi, I am listening to the Hell's BElls broadcast on the MBone that's coming from Interop. I just heard that AT&T wants to control conduit *and* content! It's on the session: Cyberstation:audio feed -lile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

List Deletion
by broitman＠koala.bu.edu 17 Dec '03

17 Dec '03

How does one get removed from this mailing list? Please respond privately...so not to clutter up the conf. -jZb

1 0