December 2003 - cypherpunks-legacy

Re: "Email-Firewalls" / Instant Corporate PGP
by Hal 17 Dec '03

17 Dec '03

From: Vincent.Cate(a)FURMINT.NECTAR.CS.CMU.EDU > #!/bin/csh -f > # > # Vince Cate > > setenv PGPPATH /usr/vac/pgp > setenv PGPPASS "not really vinces passphrase" > > cd $PGPPATH > > cat > mailtmp.asc > > egrep 'Date:|From:|Subject:|To:' mailtmp.asc > mailtmp > echo " " >> mailtmp > > pgp -f < mailtmp.asc >> mailtmp > > /usr/ucb/mail -s "Was encrypted" vac < mailtmp > > exit 0 A more secure way is not to setenv PGPPASS but rather: setenv PGPPASSFD 1 and then (echo "vinces passphrase" ; cat mailtmp.asc) | pgp -f >> mailtmp The PGPPASSFD means take the passphrase from file descriptor 1, which is the standard input. This way it never appears in the environment of a process. Many unix systems have a switch to ps to show all processes' environments. Hal

2 1

Re: "Email-Firewalls" / Instant Corporate PGP
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

ecarp(a)netcom.com (Ed Carp): >I thought stdin was 0, and stdout was 1... That works much better!!!! Thanks. I also made an outgoing "pgp-send" and renamed the incoming to "pgp-receive". The pgp-send can be used for many users but does need a new line in your .maildelivery for each. They are both FTPable from: ftp://furmint.nectar.cs.cmu.edu/security I also include them below. -- Vince #!/bin/csh -f # # pgp-send # # This lets you set up mail addresses like "vac+eric" so you # can send that you send encrypted mail without any extra work. # To use this add lines like the following to your .maildelivery # file: # # Addr vac+tovince pipe ? /usr/vac/pgp/pgp-send vac+pgp(a)cs.cmu.edu # # The "vac+tovince" is your own alias for this person. The # vac+pgp(a)cs.cmu.edu is both the mailing address and what PGP uses # to find the key. # # This assumes PGPPATH is set and pgp is on your PATH. # If not either fix that, or add a "cd" to that directory. # # Note that the unecrypted mail will be on your machine a little # longer this way so this is a bit less secure than encrypting the # mail by hand. However, this is a short period, and if your # machine's security is broken they could have read your mail as you # wrote it. # # With this, someone would need to do some "breaking and entering" # to get at your mail. # # Vince Cate # vac(a)cs.cmu.edu # # cd /usr/vac/pgp set TO = $1 cat > sendtmp.txt pgp -fe $TO < sendtmp.txt | /usr/ucb/mail -s "encrypted mail" $TO /bin/rm sendtmp.txt exit 0 #!/bin/csh -f # # pgp-receive # # The idea is to have an email address like "vac+pgp" that causes # this script to be run which decrypts the mail and then sends it # to your normal address. # # This lets you receive encrypted mail on a Unix machine without # having to do anything extra. It will work with any Unix machine # that supports .maildelivery files using any mail reader. It # could even be used to forward mail to non-Unix machines if you # thought you were on a reasonably secure net. The entry in the # .maildelivery file should be something like: # # Addr vac+pgp pipe ? /usr/vac/pgp/pgp-receive # # This would be safe if your host machine were safe. In any case, # someone has to do some "breaking and entering" to get your mail. # So this is much better than no encryption at all. # # This file is ftp://furmint.nectar.cs.cmu.edu/security/pgp-receive # Vince Cate # vac(a)cs.cmu.edu # # For me the pgp directory is protected, so is a good to be in # that directory both to drop the temporary file. # The setenve PGPPASSFD 1 tells PGP to get the passphrase from # the standard input. To install this you need to edit the 3 # places with a "vac". setenv PGPPATH /usr/vac/pgp setenv PGPPASSFD 1 cd $PGPPATH cat > mailtmp.asc egrep 'Date:|From:|Subject:|To:' mailtmp.asc > mailtmp echo " " >> mailtmp # This is less secure since some Unix ps commands can show other # user's environemnts. # # setenv PGPPASS "not really vacs passphrase" # pgp -f < mailtmp.asc >> mailtmp setenv PGPPASSFD 0 (echo "not really vacs passphrase" ; cat mailtmp.asc) | pgp -f >> mailtmp /usr/ucb/mail -s "Was encrypted" vac < mailtmp exit 0

1 0

Re: MacPGP
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

Unicorn, are you in the US?

1 0

If you don't vote...
by dmandl＠panix.com 17 Dec '03

17 Dec '03

From: lefty(a)apple.com (Lefty): >In case anyone's been wondering, I vote a straight "None of the Above" >ticket. Every election. I happen to believe that if you don't punch holes >in your cards (we don't have those big, fun voting booths here in >California like they do back East), you have no right to complain. At the risk of prolonging an irrelevant thread, I feel I've got to point out the bum logic in this argument. If you go to Las Vegas, put a thousand bucks down on the blackjack table, and lose, you can't complain. You made a bet knowing the risks involved, and you lost. You would gladly have accepted the profits if you'd won. If a blackjack dealer comes over and takes a thousand dollars out of my pocket, he's just robbed me. If you vote, you're tacitly accepting that it's a fair game and agreeing to abide by the rules. If your candidate loses, that's the way the cookie crumbles. If you don't vote because you think the whole game is rigged and don't want any part of it, you're clean. You never wanted to play to begin with. Many people on this list are familiar with Lysander Spooner's article "No Treason," which explains that the Constitutional "contract" is not a binding contract at all, because you and I never signed anything. Same argument. I understand why some anarchists vote (though I think it's a big mistake), but there's no way I can be told that I've got no right to complain because I didn't agree to play. If you DO vote, don't complain. --Dave. -- Dave Mandl dmandl(a)panix.com

1 0

Re: Unicorn suit
by Blanc Weber 17 Dec '03

17 Dec '03

>From Uni: Again, it is not my responsibilty to guard myself against defamation. <intermediate statements skipped> I should be able to conduct business, without interference, in peace, with whomever, whenever, whatever, and however uptight, as I choose. ................................ But who will guard you against defamation when you insist on doing business so indiscriminately, wouldn't you say that you bear a bit of responsibility for the kind of associations you engage in which could endanger your reputation? If you were doing a furniture business deal with third-world drug lords (you never know!) and they suddenly declared you to be a scum-bag lawyer who was really a double-agent spy working with the DEA, could you expect much success in taking them to court for accusations which besmirched your reputation? Guess you could try, huh. Many things are possible, although somewhat difficult to achieve. Blanc

1 0

Re: Official Anarchism
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort in reply to the question: > is there an official Anarchist codicil? What makes one an official anarchist? Official Anarchists are issued an official certificate (suitable for framing). . . . ............................................ I have one of these, stamped on my forehead. It's in invisible ink, but somehow collectivists can always read it, and react as expected. Blanc

1 0

on detectability of PGP versions
by hughes＠ah.com 17 Dec '03

17 Dec '03

The issue has arisen of whether displaying some particular version number of PGP on the inside of messages or signatures implies that one is using that version number. How could it? The format that one bit of public software makes can be duplicated by another. If there are two bodies of code which produce the same output, an external observer can make no decision as to which one was used if the only evidence were one of format. If, however, there were only one piece of code (say PGP 2.6), there would be a statistically valid judgement that a 2.6 version number indicated a 2.6 use. Let's say we want to avoid that. I'd suggest that a future derivation of the 2.3a code base or the as-yet-mythical 3.0 code base use the version number in the PGP formats (both binary and ascii) as format version numbers, and let the version numbers of PGP proper diverge. To make it really convenient, the config file might have a version_output flag which indicated what kind of message to generate. There's no good functionality reason why such a PGP shouldn't write post-Sept. 2.6 messages, 2.3 messages, 2.4 messages, even non-PKCS 2.2 messages. Ditto for reading and verifying all those kinds of messages. Could anybody really tell the difference? Eric

1 0

PGP 2.confusion
by Robert A. Hayden 17 Dec '03

17 Dec '03

I guess I'm sorta confused. 2.3x cannot 'legally' be used in the U.S., and it seems that the release of 2.6 is motivated in part so that U.S. users of 2.3 can become "special friends" of the RSA goonsquad. Yet, 2.6 cannot be used by anyone outside of the U.S./Canada. So what is the solution that will be legal, secure, and useful for the whole world? Do we (the cypherpunk community) perhaps need to come up with EBP 1.0 (Even Better Privacy) that abandons the RSAREF patent problem with some other public-key system that is functionally equial and just as safe? Sorry, I'm babbling, but as I said, I do not relish the thought of becoming a special friend of RSA's lawyers. (Or worse, what if 'exporting' a digital signature violates ITAR and makes you a very special friend of an over-ambitious federal district attorney?) ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> I do not necessarily speak for the \/ Finger for PGP Public Key <=> City of Mankato or Blue Earth County -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Re: PGP 2.confusion (fwd)
by Robert A. Hayden 17 Dec '03

17 Dec '03

This was sent to just me by mistake, and I'm forwarding with permission of Jay. ---------- Forwarded message ---------- Date: Fri, 27 May 94 21:26 PDT From: Jay Prime Positive <jpp(a)jpplap.markv.com> To: hayden(a)krypton.mankato.msus.edu Subject: Re: PGP 2.confusion Date: Fri, 27 May 1994 23:49:55 -0500 (CDT) From: "Robert A. Hayden" <hayden(a)krypton.mankato.msus.edu> Do we (the cypherpunk community) perhaps need to come up with EBP 1.0 (Even Better Privacy) that abandons the RSAREF patent problem with some other public-key system that is functionally equial and just as safe? EBP would have to provide the two critical functions of PGP -- digital signatures, and key distribution. There exist signature standards other than RSA. Perhaps the USA's DSS can be exported. If not, there may well be other systems out there. Feel free to implement DSS, or others. But the critical problem seems to be encryption. Or more exactly the key distribution problem. How do I and my secret corespondant share a secret key? I only know of four kinds of solutions. Send the key via a secure channel. Secure chanels are hard to find, and as history teaches us, not fully secure. (Read Kahn for instance.) Use a trusted key distributer. Trusted. Ha. This is cypherpunks list. Public key cryptography. The problem is that PKP (or is it RSADSI?) claims pattent rights to the whole PK ball of wax. The Diffe Helman key exchange (oblivious transfer?) pattent will expire the soonest, and it can be used in the future. The really exciting result, IMHO, is from crypto 92 that I mentioned a while back. If A and B can hear a source of bits S with some errors, then they can generate a shared secret which even an eves dropper with much greater (listening) resources can't discover. This is exciting. Is it pattented? Does it work on the internet? I don't know. Unfortunately all of these suffer from various active tapper attacks. More unfortuneately, on the internet active tapping isn't very hard to arrange. If you can come up with aditional solutions, or ones more resistant to active tappers, please publish. j'

1 0

Quantum Computers
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

Ken Kirksey writes > lost in the discussion on quantum computers and cryptography. Can > anyone give me the Reader's Digest Condensed Version (TM) of the > theory behind quantum computers, or maybe point me to a good journal > article or two? Many thanks, No readers digest version. It is very heavy going, and any simplified version is necessarily misleading. The key articles are D. Deutsch, Quantum Theory, the Church--Turing Principle and the Universal Quantum Computer, Proc. R. Soc. Lond., Vol. A400, pp. 96--117 (1985). E. Bernstein and U. Vazirani, Quantum Complexity Theory, Proc. 25th ACM Symp. on Theory of Computation, pp. 11--20 (1993). Set aside a long time for understanding them. If your quantum theory is weak, you will need to brush up on quantum theory first. --------------------------------------------------------------------- We have the right to defend ourselves and our | property, because of the kind of animals that we | James A. Donald are. True law derives from this right, not from | the arbitrary power of the omnipotent state. | jamesd(a)netcom.com

1 0