December 2003 - cypherpunks-legacy

PGP 2.3 vs 2.6 outside the US
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Jeff Barber <jeffb(a)sware.com>: > While creating a 2.6-like version from 2.3a seems a worthy goal, this > supporting argument is flawed. The original PGP was written in the USA > and, never having received the proper export approvals, must have been > "illegally exported." Isn't Phil Zimmerman being "investigated" by a > grand jury for this even now? So, it would seem to me that a bulletin > board carrying any version of PGP holds illegally exported software (wrt > US law). How does 2.3a differ from 2.6 in this respect? 2.0 to 2.3a were developed outside the US, released in New Zealand and the Netherlands, and _imported_ into the US. While a version of 2.3a in India, say, need not have come from the US, and hence does not indicate an ITAR violation somewhere, the version of 2.6 in Italian sites got there only because they were illegally exported from the US.

1 0

Is DES exportability context-dependent?
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

I don't have my "Applied Cryptography" handy, but this keyboard's here in front of me always ready :-) Lets say I rigged up a "signature" system that cranked the message through a DES or 3DES engine in CBC mode, and used the last value as the signature (or something like that; whatever makes the most sense). In that context---as a signature algorithm---would DES be exportable? It's been demonstrated that something developed as a signature algorithm but later adapted to encryption purposes remains exportable, right? What about going the other direction? -- | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

2 1

NSA breaks Russian PRNGs with neural networks??
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

tcmay(a)netcom.com: > An interesting article by Seymour Hersh is cited below. It says that > NSA had transcripts of the 1991 coup plotters (and presumably other > Russian leaders) and that Bush passed these on to Yeltsin to warn him. A recent article from the Daily Telegraph, another British paper, went on about the possible encryption techniques used by the Russians. It described how reused one-time pads led to the unmasking of Fuchs, the Rosenbergs, Philby et al. Then it suggested that the method the NSA broke was based on (presumably weak) PRNGs, a stream cipher. It suggested that the NSA might have developed techniques to find patterns in PRNG outputs through neural networks, or genetic algorithms!! While the latter sounds like crap to me, even though I've worked with and believe in the power of neural networks for amazing pattern recognition, unless the PRNGs were _really_ weak, I'm skeptical. I don't think the Russians are fools, and in these times one doesn't rely on secret weak algorithms for crypto, not when there are publicly well known strong ones. Humint? Maybe. The Atlantic Monthly will carry a story on the NSA-Yeltsin thing in June. It would be nice if someone posts it here. -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Fairness to Game Animals Association says: Support your right to arm bears! --------------------------------------------------------------------------

1 0

Cypherpunks' Electronic Book 4
by Gary Jeffers 17 Dec '03

17 Dec '03

Cypherpunks' Electronic Book (CEB) 4 Martin Janzen suggests using World Wide Web (WWW) to support & distribute the CEB. I am not at all familiar with WWW but hopefully its good. My concern with this distributed organization is that CEB could be controlled by the Cypherpunks' List & that all additions & changes to CEB would be refereed. No unauthorized changes would be made. As for updates, the point of CEB is to be made up of the most recent knowledge. People concerned with an area of electronic privacy & making contributions to the CEB would naturally update the CEB whenever they ran into new developments. People who wanted to read the CEB would be assured that by the nature of the CEB, what they found there would be the latest & the current best. Martin suggests that the CEB could be on several servers. I would suggest, then, that they be on different servers by chapter. Referees who are interested in particular chapters could maintain & administer that chapter. This could mean very little administration by Eric Hughes (cringe). For those who are kindly offering their archives of Cypherpunks' list, they are not needed now, but if & when the CEB gets established, it would be good to have your names on the CEB as archivists. Yours Truly, Gary Jeffers

1 0

Re: Cypherpunks' Electronic Book 4
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

An important frustration from this electronic age: Information moves so easily now but people move no more quickly than before. Changes to CEB should not be a continuous process. Changes need to happen slow enough and in meaningful enoug chunks that someone other than the author can keep up. I think this means digests of the changes, digests which are readable in their own right--not mechanical diffs--should both detail *and* summarize for those who recently read the old copy. Refereing might dove tail nicely with keeping the whole thing stable enough to be usable. -kb, a Kent with a thick enough protective coating of ignorance to avoid most of the work... -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 28:15 hours of TV viewing so far in 1994!

1 0

Re: Privacy at Dunkin Donuts
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Hidden microphones at Dunkin Donuts Hey, all this time we've been worrying about cops spying on people. Now _we've_ got a way to listen to _them_ :-) .....

1 0

Re: Cypherpunks' Electronic Book 3
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Well, you've got an opportunity for a Learning Experience, then :-) Assuming you've got access to a Unix machine you can run things on, it's not hard to set up procmail or majordomo or the old, simple, reliable netlib stuff that ran the netlib(a)research.att.com (and maybe still does?). Since you're posting from MIZZOU1, you're at least behind a mail server run by somebody else, so I'm not sure how much control you have..... If you want to roll your own crude mail-reply system on Unix, it's really not hard, using some simple shell programming and the sed batch editor equivalent to "ed" and the : commands of vi - when you receive a mail message, you stick it in a file, then use sed or whatever to find the "From:" line so you know who to send it back to, and lines that look like your command set (e.g. "get foo"), stickthe appropriate stuff into a mail message and send it back. If you want to do all this on DOS, well, good luck :-) Look at teh tools you've got available for handling mail, and get yourself a copy off Eudora or Waffle if you don't have either of them. Then you're on your own. BIll

1 0

Re: IMP (was Re: ecash-info (fwd))
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > 1.) Chaum's e-cash coupled with WWW/Mosaic is a de facto internet > > mercantile protocol. It ain't de facto until a lot of people are using it. I suspect PGP with credit card numbers in free-form ASCII is almost as common, at least for now; there are 4 or 5 groups I've seen that will accept that. And phone calls or faxes to the number on the bottom of the ad on Usenet probably outmumber those... In particular, digicash isn't a standard until there's at least one bank a lot of people can access via digicash. However, it's certainly a nice approach. Credit cards do take care of one of the objections Hal mentions, which is how you can trust your vendor to ship you the goods instead of absconding with your cash. Some of the digicash protocols can help with that process, at the cost of privacy - the spender can reveal the number of the coin that was ripped off, but the receiver may have cashed it via anonymous remailers, making it difficult to prove who's telling the truth in court, especially when the goods were software delivered by anonymous remailer chains as well. Bill

1 0

Re: PGS bug! (fwd)
by ER CRAMER 17 Dec '03

17 Dec '03

I tried to reply to this messages but it was bounced back to me... So I mail it to this list... > > I like your PGS shell a great deal. Thank you for writing it. > > Thank you for liking it ;-) > > > However, I have found what appears to be a small bug. I do not have my > > keyrings in my pgp directory. They are in a separate directory, specified > > via the PubRing, SecRing, and RandSeed directives in 'config.txt'. When I > > load PGS, it checks my pgp directory for these files, does not find them, > > and asks if I want to create a secret key ring. When I answer no, the > > program generates a General Protection fault #13, which is gracefully > > caught and handled by QEMM386, my memory manager. > > We don't support keyrings that aren't in the PGPPATH (at least not yet). > To tell you the truth I didn't know of hte PubRing, SecRing and RandSeed > directives... I guess I can take a look at it, maybe it's easy to change... > > If you answer NO on the question to create a keypair PGS should quit. I have > know problem with QEMM myself. What version of QEMM do you use??? > BTW: I tried out the PubRing and SecRing directives in my config.txt but they where nog supported... Does anyone knows something about it??? ... If you outlaw Privacy, only the Outlaws will have Privacy! Eelco Cramer <crame001(a)hio.tem.nhl.nl> ------ --------------------------------------------------

1 0

PGS-list
by HHM LIMPENS 17 Dec '03

17 Dec '03

For anyone who is interrested in bug-reports/update reports etc for the Pretty Good Shell (PGS, available on several FTP sites, see previous (few days) mail from Eelco Cramer, send a mail to listserv(a)vox.hacktic.nl and "they'll get my crypto key when they pry it from my dead, cold fingers" -NSA's (former) chief counsel Stewart Baker "the NSA being the devious bastards" - Michael Handler +----------------------------------------+----------------------------+ | Eric Limpens | Where is my spycamera !? | | | ..Bart Simpson.. | | <Limpe001(a)hio.tem.nhl.nl> +----------------------------+ | S=limpe001;OU=hio;OU=tem;O=nhl;PRMD=surf;ADMD=400net;C=nl | | finger limpe001(a)141.252.36.60 for PGP 2.7 key | +---------------------------------------------------------------------+

1 0