December 2003 - cypherpunks-legacy

Re: MIT has released PGP
by Duncan Frissell 17 Dec '03

17 Dec '03

R.>the following questions: R.>Are you a citizen or national of the United States or a person who R.>has been lawfully admitted for permanent residence in the United R.>States under the Immigration and Naturalization Act? Wait a goddamned minute. Since when does the ITAR prevent illegal aliens (who are resident in the US) from obtaining munitions? And what about our Canadian bretheran? I guess they didn't want to register as a munitions seller which I gather you have to do if you export to Canada. DCF --- WinQwk 2.0b#1165

2 2

Testing compatibility 2.6 v. 2.3a
by an99420＠anon.penet.fi 17 Dec '03

17 Dec '03

Please could someone change the date of his computer after 1 september 1994 and send a PGP-ed message to me so I can test the compatibily of 2.6 (I also implemented the patch send to this server in 2.3a so I can check that too...). My public key: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3c mQCNAiv3vSkAAAEEAMGWtCrT8eIhK0qR0yqYepYCcRdjw+EhiIzP4XkHlwkR9iVt 4xnTGHKuuCnGJG0ftez4hEZsTpdrz8mQ0SnYy0KLQ6DUvKH9IMgl6S9yJiYAgtC2 4TN15+t/9ZJjlVMgwtRY5tPLgrZ7h6Jw/rZIj+Wwj78yjcdguYDAdPKe9hHLAAUR tCZFZWxjbyBDcmFtZXIgPGNyYW1lMDAxQGhpby50ZW0ubmhsLm5sPokAlQIFEC20 ++aAwHTynvYRywEBJ/UD+QEah9xIn/Vt3GbJYA3b6i/vXnEhG/z6qrqaJ8fubFin Ia2JMT4AceNEtz+6j7lIz/iJbj9CPIOASnSIQ/hmrERlWcsgWR7U29QnQjunZ6BE S64pONVmEA207lDwgAzUJ4+h+urYTIfz4qW/jHcs6nTfwe5qhfbDM1b6yTe301A/ iQCVAgUQK/qELegWAlGwR3dDAQEd/AQA1iny6lLuQFxVg6yvJ6xjnjSmOpHkz2Un ZTfbnXHtDBLA0CDFT8A4nfW/hLT1j7dx6yD5+lUPkMX1GTttlOMp819VyK8Wm8lv HnkFbehTTmmlY2BxBqWC7EUml39BqQEWbxqlt6M/btScsMVlQJyiluEW1cacYt68 DPpqScQWzz0= =cAIH -----END PGP PUBLIC KEY BLOCK----- ... If you outlaw Privacy, only the Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

IBM's NetSP
by Adam Shostack 17 Dec '03

17 Dec '03

(This is a set of excerpts from a 1000 line file I got from a guy @IBM. If anyone wants the whole thing, just ask.) | Network Security Program Version 1 Release 2 is a distributed authentication | and key distribution program. The Network Security Program authenticates the | identity of two communicating principals in the network and provides each | with the ability to verify the identity of the other via a common third-party | server. | Network Security Program provides secured single sign-on (SSO) to 3270 host | applications via an EHLLAPI emulator interface to a RACF* host system. | Through the implementation of PassTickets, the user at the client workstation | need only provide one log-on password that will allow secured access to | multiple host applications. In addition to the TCP/IP transfer protocols for | these platforms NetBIOS is supported on AIX*, OS/2*, DOS*, and Windows; LU6.2 | is supported on AIX and OS/2. | | Network Security Program provides distributed security services that user | applications may invoke through the Generic Security Services Application | Programming Interface (GSSAPI). GSSAPI is approved as an Request for Comment | (RFC) by the Internet Engineering Task Force (IETF). The underlying security | mechanism is based on KryptoKnight, an advanced authentication technology | developed by IBM Research Laboratories in Zurich, Switzerland and Yorktown | Heights, New York. | | In V1R2 we are extending our platforms from the AIX/6000, OS/2 and DOS | operating systems to include HP, SUN, and DOS/Windows for client and | application server workstations. IPX/SPX is supported on OS/2 and Windows | for authentication servers and clients running on workstations with Novell | Netware. TCP/IP is supported on all the specified platforms. Single sign-on | (SSO) support for OS/2 has been extended to LanServer and Novell. | In DCE environments, Network Security Program is offered to customers whose | environments pose authentication problems at the transport layer and below. | Because of its compact tickets and flexible authentication protocols, Network | Security Program can be more effective in satisfying this set of | requirements. Network Security Program also provides secure LU2 sign-on to | RACF host applications without requiring re-entry of host user names or | passwords. Single sign-on to LANServer and Novell is also available. DCE is | the recommended solution for customers requiring authentication above the | transport layer (through secure RPC), for use by the application layer, for | more complete security services, or for integration with other services, such | as data access control or integration with resource managers. | DATA CONFIDENTIALITY | | Commercial Data Masking Facility (CDMF) is a new technology recently | developed by the IBM Crypto Competence Center. CDMF has a scrambling | algorithm that will be supported under the GSS-API (GSS-SEAL / GSS-UNSEAL API | calls). It provides the application programmer the capability to easily | scramble selected packets of data sent in the network. Data confidentiality | is secured from indiscriminate use and your assets stay protected. | | CDMF alleviates the worry of having your data flow across the network in | clear text. The degree of security is equivalent to encryption using DES but | with keys limited to 40 bits. IBM has obtained approval from the US | Government to export CDMF in products without the license required to export | products containing DES. | TEXT | | TECHNICAL DESCRIPTION | | Network Security Program was developed to exploit key distribution and | authentication technologies based on a third party authentication server. | Several technologies exist in the industry today, one of which is | KryptoKnight, which was developed by the IBM Research Division laboratories | in Yorktown Heights, NY, and Zurich, Switzerland. The KryptoKnight | technology, from a user viewpoint, appears on the surface much the same as | another security service developed at MIT, Kerberos. Though Kerberos has | been made widely available through public access, it presents several | limitations in certain network environments. Network Security Program | provides extensions to the Kerberos technology that can prove most desirable | to customers operating such networks environments. For example, the smaller | KryptoKnight tokens make implementation of security at lower networking | layers possible. Other technical advantages include a use of cryptography | that is not subject to export controls, flexibility in authentication | protocols for situations in which the client cannot contact the | authentication server directly and the reduced dependency on clock | synchronization among communicating principals. | Network Security Program is being developed as an 'open' multi-platform | security solution. The intent is to provide a port to as many different | systems as is possible given the time and resource constraints. In the | workstation environment, a customer typically will have many varieties of | hardware/software in their network. Interoperability is a key requirement | for any security solution. This release of the Network Security Program will | address the AIX/6000, OS/2, DOS, DOS/Windows, SUN and HP platforms. | | Network Security Program is developed with a user-friendly Graphical User | Interface (GUI). The security mechanisms residing below the Application | Programming Interface (API) are transparent to the client. At the | Authentication Server, there is also an administration interface. Industry | standards are supported to provide as seamless a transition among all | platforms as possible; MOTIF standards for AIX/6000 and CUA91 standards for | OS/2 and DOS. | RISC System/6000* POWERstation*. The client code shipped with the Network | Security Program runs on the following workstations: OS/2, DOS/Windows, | AIX/6000, SUN, and HP. The minimum machine requirements are: | o DOS Workstation | Approximately 400KB of free disk space is required for the Network | Security Program. If the Network Security Program software is installed | o SUN Workstation | - A SUN microsystem spark [sic] station running Solaris 1.1 or later. (Most UNIX systems req. 5mb disk, 8mb ram. Seems that Solaris 2 is not later enough to count as 'solaris 1.1 or later;' It was not listed as a supported OS.) -- Adam Shostack adam(a)bwh.harvard.edu Politics. From the greek "poly," meaning many, and ticks, a small, annoying bloodsucker.

1 0

MIT AI Lab PGP keyserver back up...
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

The PGP public key server at the MIT AI lab is now back up, running PGP 2.6. You can access the keyserver via e-mail to: public-key-server(a)pgp.ai.mit.edu, or pgp-public-keys(a)pgp.ai.mit.edu Please use the alias "pgp.ai.mit.edu" when sending mail to the server. I expect the keyserver to move from its current host (martigny.ai) to another machine sometime this summer. The CNAME pgp.ai.mit.edu will always point to the right place. If you have a WWW client with forms support (Mosaic, Lynx, Emacs-W3) you can also use my WWW interface to the keyserver. The URL is: http://www-swiss.ai.mit.edu/~bal/pks-toplev.html [www-swiss is another alias. Our WWW server is moving soon, too.] NOTE: As a result of MIT's legal review of the patent issues surrounding PGP 2.3 and PGP keyservers, this keyserver has been configured to not accept "add" requests containing keys identified as being produced by PGP 2.3 or earlier versions. If you're running a PGP keyserver and would like to sync with this server, drop me a note. --Brian LaMacchia pgp-public-keys-request(a)pgp.ai.mit.edu

1 0

Reputation systems, sources?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Marcos Javier Polanco <marcos(a)dogen.persona.com>: [in private mail] > Is there a mailing list explictly talking about the "distributed > trust' issue? I am very interested in reputational mechanisms. If not > mailing lists, what papers should I download? I don't think there's a mailing list on this. I know that at least Bill Garland wants to set up an experimental reputation market. Anyone else know about papers or projects? > - marcos j. polanco > - marcos(a)dogen.persona.com > - nataraja (contact(a)dogen.persona.com) -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! --------------------------------------------------------------------------

1 0

Pocket Data Encryptor
by Jim choate 17 Dec '03

17 Dec '03

LAN Computing May 94 V5#5 pp.41 Cylink has released a pocket sized DES encryptor that is designed to fit between a modem and a serial port. Cylink 310 N. Mary Av. Sunnyvale, CA 94086 408-735-6643 Check them out...

2 1

seeking Pr0duct Cypher
by steven＠echonyc.com 17 Dec '03

17 Dec '03

I am working on a story for WIRED about digital money, and notice here that someone named Pr0duct Cypher is behind the scheme that some people are experimenting with. Would Pr0duct Cypher mind contacting me? Use this email (steven(a)echonyc.com) to make the connection. Also, if anyone else wants to point me to interesting stuff, feel free. I'm probably on top of the obvious (Chaum, etc), but better to assume that I'm missing stuff. Steven Levy _______________________________________________________ Steven Levy steven(a)well.com steven(a)echonyc.com author, Hackers, Artificial Life, Insanely Great contributor, Macworld, Wired "When the going gets weird, the weird turn pro." _______________________________________________________

1 0

crypto in June Byte
by bart＠netcom.com 17 Dec '03

17 Dec '03

Three items. On p.41 at 2/3 page review of Schneier's "Applied Cryptography" favorable if not raving. In the What's New Hardware pages: The Crypto-Com V.32bis asynchronous pocket modem ($895) from Western Datacom (Westlake, OH) encrypts all data transmissions between two of the companies modems. 800 262 3311 [ It uses single DES they said when I called ] Lastly a seven page article "Distributed and Secure" by a Russell Kay whose bio says he edited Infosecurity News and Computer Security Journal. The box on the front page says "When you distribute information and processing, you also delegate security responsibility. Good access controls, eyes open administration, and communication encryption can make all the difference". Login control token technology is reviewed, Kerberos discussed and explained, PK crypto including PGP, and the Andrew file system. Something new to me was: "... NSA recently placed a large order for what it calls 'sniffless password generators' with Secure Computing in Roseville, Minnesota. With the company's Lockout system, instead of sending a password over the wire "in clear," you send a cryptographic representation of it, using a one time encryption key. Each time you login, the password is encrypted with a different key. The NSA will use Lockout in conjunction with its Tessera Crypto Card, a PCMCIA device. ... It uses both NIST's Digital Signature Algorithm and the NSA's Mosaic encryption algorithms."

1 0

Re: Patentability (was Graph
by Pierre Omidyar 17 Dec '03

17 Dec '03

Reply to: RE>Patentability (was Graph isomorphism based PK cr) [disclaimer: I'm not an expert, but I've done some work with patents.] I believe the best way to ensure that something becomes unpatentable is to: 1. Publish it first. That reserves your right to file a patent if you want. No one else can patent your original work. 2. Don't file a patent within one year of publication. After one year you lose your right to file. No one else can file, because by then the invention is considered to be public knowledge (since it was published), so it would not satisfy the "original and novel" patentability test. If you keep the process a secret, someone else could independantly invent it and patent it. If you publish it before someone else files, it becomes public knowledge and is unpatentable except by the original inventor within one year of publication. Pierre -------------------------------------- Date: 5/25/94 9:21 AM To: Pierre Omidyar From: perry(a)imsi.com Harry Bartholomew says: > > Jay Prime Positive says: > > > I only worry that if I publish, it could be patented. And I don't > > > want the algorithm to end up in the hands of the software patent > > > folks. Especially if they will be making money off it, and I wont. > > > > If you publish, only you could patent it. There is only danger if you > > don't publish, in which case others can independently make the same > > discovery and patent it. > > > > Perry > > But you would then need to file within one year of the publication > date I think. His whole point was that he wanted to render the process unpatentable. Perry ------------------ RFC822 Header Follows ------------------

1 0

Re: Graph isomorphism based PK cryptosystems?
by bshantz＠spry.com 17 Dec '03

17 Dec '03

>Harry Bartholomew says: > > > Jay Prime Positive says: > > > > I only worry that if I publish, it could be patented. And I don't > > > > want the algorithm to end up in the hands of the software patent > > > > folks. Especially if they will be making money off it, and I wont. > > > > > > If you publish, only you could patent it. There is only danger if you > > > don't publish, in which case others can independently make the same > > > discovery and patent it. > > > > > > Perry > > > > But you would then need to file within one year of the publication > > date I think. > > His whole point was that he wanted to render the process unpatentable. > > Perry So, if JPP publishes it, it would be a matter of trust that he wouldn't patent it. Okay, I have no problems with that. However, it is still patentable. What could be done to make it unpatentable? Brad :::::::::::::::::<<< NETWORKING THE DESKTOP >>>::::::::::::::::: Brad Shantz Internet : bshantz(a)spry.com SPRY Inc Ph# (206) 447-0300 316 Occidental Avenue S. 2nd Floor FAX (206) 447-9008 Seattle, WA 98104 ---------------------------------------------------------------- "In gopherspace no one can hear you scream." ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

2 1