December 2003 - cypherpunks-legacy

Source Code
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

Hello, I created a stand alone utility for DOS to do a multiple cipher IDEA-TRAN-IDEA-TRAN-IDEA and call this 3DEA. "usage: 3dea e|d [infile [outfile]]" Without files, will use standard in and out. Will prompt for (5) Pass Phrases. MD5 on each phrase to get 128*5 bits of key. I also made some changes to my copy of the PGP source code to use this 3DEA cipher as an optional extension to the single IDEA cipher that comes with PGP. Will communicate with current versions of PGP (2.3a, 2.6, 2.6ui). 1 - Can process 4096 bit RSA keys. 2 - Optional 3DEA message encryption for more security. 3DEA is a multiple cipher IDEA-TRAN-IDEA-TRAN-IDEA. Include the command line option '3' when encrypting with 3DEA. Example "pgp -3seat message". Uses a 640 bit session key as specified. 128 bit key for first IDEA round. 64 bit IV for first IDEA round. 32 bit key for Transpose of bytes within a 4096 byte buffer block between first and second IDEA rounds. 128 bit key for second IDEA round. 64 bit IV for second IDEA round. 32 bit key for Transpose of bytes within a 4096 byte buffer block between second and third IDEA rounds. 128 bit key for third IDEA round. 64 bit IV for third IDEA round. 3 - Automatic detection of IDEA or 3DEA session keys for decryption of messages. Would anyone in the USA or Canada like a copy of these programs (Source and Object) ? I would appreciate any feedback on bugs, ect... So, if you want a copy, send me an E-mail. Thanks, Tom Rollins <trollins(a)debbie.telos.com>

1 0

Re: TC May's policy change proposal
by Jeff Gostin 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May) writes: > 1. Could we people make an effort to pick reasonably meaningful thread > titles? Agreed. A few people on this list have mailed me privately (thanx for the discretion, guys!) and told me my Subject: headers were coming up as (None). All mailing lists are gated to local newsgroups here at Eternal. As a result, my newsreader doesn't seem to like maintaining subject headers on mailing list mail. It's a known bug... *sigh* "Ok," you ask,"...what's the point?" The point is this: If I can take the time to manually change the subject, working around an annoying bug in my software (it'll be fixed literally RSN, BTW), everyone else can take the time to do it right. :-) > 2. People should feel free to edit the subject line to better reflect > the topic of their post. Agreed. Since I can't preserve the subject heading as a result of aforementioned cyber-roach (hey, I _like_ that term!), I _have_ to make up creative titles. So can all of you. You've shown you're smart, and by being a 'punk, you've shown you care about privacy, crypto, and all that other good stuff. Don't skimp on subjects. :-) > 3. Forwards are really getting out of hand. It seems that the "Four > Letter Acronyms" of CPSR, EPIC, ACLU, and EFF (an honorary FLA) Agreed, again. Perhaps we should change "policy" to dictate that only members of the organization in question should forward "infograms" to the list. Forwarded Usenet posts should be pointered and perhaps summarized. Beyond that is wasted traffic, IMHO. > This list is not a place to ask 500-600 people "What's so bad about > Clipper?" or "Can't the NSA break any cipher with enough effort?" Do you mean to imply that "Everything" and "Yes" aren't good enough answers from 500-600 people? :-) --Jeff -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

2 1

PGP bastardization (fwd)
by Philip Zimmermann 17 Dec '03

17 Dec '03

Forwarded message:

2 1

No Subject
by Dan Harmon 17 Dec '03

17 Dec '03

who cypherpunks

1 0

Re: FW: Ordering White House docs via email
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> The goal of Phase Three, which we hope to achieve soon, is to respond > electronically to the substance of incoming messages. Speaking of which, does anyone doubt that the point of this is to completely eliminate human beings from the loop? You'll write a letter to president(a)whitehouse.com, and some kind of AI will process it and determine the proper form letter to be sent back to you. Heck, they'll probably borrow that groovy semantic-parsing spy thingamobob software from the NSA. Actually, even though my knee jerk reaction is to be bothered by this, I'm not sure there's cause. It's not as if the president actually sees the letter you write to him snaimail anyhow. What difference does it make if some minimum-wage secretary picks the proper form letter to send back to you, or if a computer program does?

2 1

Re: PGP bastardization (fwd)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

While I sympathise 100% with prz's annoyance at this hack, I should remind him that he *did* put pgp out under the GPL and anyone is free to modify it in any way they chose as long as they too release it under the GPL. He has no legal comeback (ha, there's an interesting irony about the author of the world's leading piece of guerilla software...) and the most he can do is apply peer pressure to get the guy to back down. (Personally I'd never release anything under the GPL for precisely that reason and others...) G

4 3

Re: FW: Ordering White House docs via email
by David Merriman 17 Dec '03

17 Dec '03

> >Actually, even though my knee jerk reaction is to be bothered by this, >I'm not sure there's cause. It's not as if the president actually sees >the letter you write to him snaimail anyhow. What difference does it make >if some minimum-wage secretary picks the proper form letter to send back to >you, or if a computer program does? > *I* got a "real answer" type card from them when I faxed Billary about what I thought of that U.S. Card <expletive deleted>. Granted that the card may have been signed by a robo-arm, but what the hell...... Dave Merriman

1 0

Re, PGP bastardization (fwd)
by trollins＠debbie.telos.com 17 Dec '03

17 Dec '03

I was shocked to receive an E-mail from Phill Zimmermann. Here is my reply to his E-mail. From: Philip Zimmermann <prz(a)acm.org> >Tom, I hear that you are distributing a modified version of PGP that >uses a different customized encryption algorithm of your own design. I have pieced together a multiple cipher that consists of the chain IDEA-TRAN-IDEA-TRAN-IDEA. Where IDEA is the same IDEA (128 bit key + 64 bit IV) algorithm that pgp uses and TRAN is a byte transposition across the 4K buffer block (each tran uses 32 bit key). Thus giving this multiple cipher a keyspace of 640 bits. I have made modifications to pgp that will let a user _optionally_ use this alogrithem instead of the single IDEA cipher. This change was made to show pgp versitility and usefullness in transporting an unweildly large conventional key with ease. On decrypting, the modification detects which type of key is in the RSA packet and then invokes the proper algorithm. Please note that the origional cipher algorithems are intact and are used as the default method. >If you read the "Snake Oil" section of the PGP User's Guide, then you >know how I feel about amateur cryptographer's encryption algorithms >that have not been subjected to extensive peer review. Well, It is true that I am _not_ being paid for this software. It is my hobby. And I don't care how you feel about my hobby. Please feel free to make any constructive comments about the algorithm. >PGP's reputation, and my repuitation (which is tied to PGP), depends >of people trusting the quality of encryption algorithms and protocols >that I have carefully selected for PGP, using all of my knowledge and >experience. If someone were to put a new encryption algorithm into >PGP without my permission, it could serve to tarnish the reputation >that PGP has earned over the years. I am a little confused about this statement. The following (2) paragraphs came from the a pgp.c source file. So, I don't see that my small changes can damage your reputation. (c) Copyright 1990 by Philip Zimmermann. All rights reserved. The author assumes no liability for damages resulting from the use of this software, even if the damage results from defects in this software. No warranty is expressed or implied. All the source code I wrote for PGP is available for free under the "Copyleft" General Public License from the Free Software Foundation. A copy of that license agreement is included in the source release package of PGP. >Accordingly, I do not approve of anyone modifying the cryptographic >characteristics of PGP. PGP and Pretty Good Privacy are my trademarks, >and their good name is trusted the world over because of the care that >I have exercised in selecting its algorithms. I believe that you have released the pgp software under the Free Software Foundation "Copyleft" License. >If you'd like to write your own cryptographic utility, using your own >algorithms and protocols, I have no problem with that. But I do not >want my program, my documentation, my name, and my trademarks, to be >used for products that may have flawed algorithms. Let me show you a paragraph from the "Copyleft" License that you released the pgp program under. The license agreements of most software companies try to keep users at the mercy of those companies. By contrast, our General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. The General Public License applies to the Free Software Foundation's software and to any other program whose authors commit to using it. >I also have no problem with you modifying PGP for your own private >use, if you like to experiment with new algorithms of your own design. >But I do not want you to distribute such a program to others, if it uses >my code, my manuals, my name, and my trademarks. It could hurt my >reputation and PGP's reputation. I guess that I will have to quote (2) more paragraphs from the "Copyleft" License that you released the pgp program under. When we speak of free software, we are referring to freedom, not price. Specifically, the General Public License is designed to make sure that you have the freedom to give away or sell copies of free software, that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. >If I am misinformed on this subject, please let me know and accept >my apology for assuming too much. Otherwise, I'd like you to remedy >the situation. Please let me know what has happened and what we can >do about it. I believe that you may by misinformed. I hope that I have made my position clear. You relesased the pgp program under the "Copyleft" License. I have the right to change the software or use pieced of it. I am protected from you trying to deny me those rights. >Sincerely, >Philip Zimmermann >prz(a)acm.org Sincerely, Tom Rollins <trollins(a)debbie.telos.com>

1 0

RE: PGP bastardization
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Philip Zimmermann <prz(a)acm.org> wrote: > Accordingly, I do not approve of anyone modifying the cryptographic > characteristics of PGP. PGP and Pretty Good Privacy are my trademarks, > and their good name is trusted the world over because of the care that > I have exercised in selecting its algorithms. [comments deleted] > cc: Curtis Karnow > Landels, Ripley, and Diamond My copy of PGP (v2.3a) came with the following notice: > Pretty Good Privacy version 2.3a - READ ME FIRST > Notes by Perry Metzger > Edited for 2.3a by Colin Plumb [intervening material deleted] > PGP is distributed under the terms of the GNU General Public > Licence, a copy of which is included. In brief, this states that > PGP is freely distributable, subject only to the condition that ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > if you make a modified version and choose to distribute it, you ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > must make it freely distributable as well. See the file COPYING ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > for details. What are your LEGAL grounds for attempting to retain "editorial control" over PGP, as commendable as your desire to maintain its integrity undoubtedly is? The notice distributed with PGP itself seems to say otherwise -- only that modifications must also be freely distributable. So why CC: your letter to what appears to be a legal firm? Does the legal term "in terrorem" apply here? <g>

2 1

Re: NATIONAL SECURITY PORN RISK
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 9:43 AM 7/13/94, Paul J. Ste. Marie wrote: >Of course, any machine with classified info on it would neither be on >the net nor would it be connected to one that was. In theory, anyway. I do know of classified data having been on unclassified machines before, generally by accident. Comes from the fun fact that unclassified datum A + unclassified datum B can = classified data C. Bob -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0