December 2003 - cypherpunks-legacy

Re: using us crypto sw outside usa
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I was wondering what is the legal status for using rsaref ooutside usa. > Is it legal or not? There are three problems - getting a copy, patent, and copyright. Getting a copy of RSAREF means that somebody has to export it, which the US government strongly disapproves of. On the other hand, if you're not a US citizen, and not in the US, and your government doesn't have laws against possessing things that other governments don't want you to have, no problem. Patent - the RSA algorithm patent doesn't apply outside the US, so no problem. Copyright - Most governments do honor U.S. copyrights. Some of the early RSAREF versions said that you may not export it, so there may be copyright problems if you use them outside the US. Newer versions have a warning that the US government doesn't permit export, and recommends talking to a lawyer if this affects you, but doesn't say that you may not do so - so there isn't a problem with permission, and therefore not with copyright. That's nice, because otherwise I would have had to pay somebody outside North America to write a clone. (I had offered anybody on the net outside the US/Canada $100 to do so, but nobody took it, and I now cancel that offer because RSA doesn't forbid overseas use and copies have apparently gotten distributed.) > Also, what is the legal status of RC4 code posted to the net? Uncertain. It was protected by trade secret (not giving anybody copies unless they sign a license contract), but somebody apparently violated their contract and disclosed it anyway. Some places have laws against using information released like that, some don't, some allow the originator of the information to sue. There's also the problem of verifying whether that *really* is RC4. Bill Stewart

1 0

pgp / passphrase / capture / yikes!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

just wondering , if i use pgp on my pc , and lets say while on my unix connection to the net i shell to dos to do encryption or decryption , does this compromise my security in any way ? can some admin catch my passphrase, i don think so , but i'm really fucken paranoid ! thanks for any answers felloe punks ! -feast oh , msg to larry detweiler : your really looney man , cracked me up ! :*)

2 1

6-hour Secure Mobile Voice
by cdodhner＠news.primenet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm sure most of you have seen some of the cheap (relatively speaking) 'phone scramblers' and such sold in local "spy shops" and catalogs. I know as well as most of you that these (almost always analog) scrambler systems even with thier "10,000 code frequencies!" and such are totaly insecure against an attacker with modern resources, but I was wondering if any of these techniques would be good enough to use for real-time applications where the transmitted data is only valuable for 6 hours or less. Such a system would be usefull if you only need security 'right now' and didn't care who knew after a certain (short) timeframe. Comments, advice and product reviews are all welcome from anyone with knowledge or experience in the area. Happy Hunting, -Chris. ______________________________________________________________________________ Christian Douglas Odhner | "The NSA can have my secret key when they pry cdodhner(a)primenet.com | it from my cold, dead, hands... But they shall pgp 2.3 public key by finger | NEVER have the password it's encrypted with!" cypherpunks WOw dCD Traskcom Team Stupid Key fingerprint = 58 62 A2 84 FD 4F 56 38 82 69 6F 08 E4 F1 79 11 - ------------------------------------------------------------------------------ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuAPJioZzwIn1bdtAQFjGAF/e+c8KHSfboM+JuM1GTTuQ76zzJykn5C8 xZTHrpw2/mHDKsDVVLnhb+rbFH9f7w1U =sGdw -----END PGP SIGNATURE-----

2 1

Info about Linux
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

Joe Block, jpb(a)gate.net, sez: > I want to run linux on this beast and would like some suggestions from the > list - which of the linux CDs do you recommend? Hi, I've got Linux. Linux comes in different "distributions" - collections of files that have been integrated into a coherent system. My distribution is sold by Yggdrasil, (408) 261-6630, (800) 261-6630, for $39.95. I like it because it comes with a single boot floppy, and will run off the CDROM once it boots, so you can check it out without even having a hard disk installed. If you've got time, patience, a good, fast net connection and a whole lotta floppies, the slackware distribution (and a couple of others) are available via anonymous FTP from sunsite.unc.edu. There are also several other distributions available on CDROM from various vendors. Check the ads in the Linux Journal (subs(a)ssc.com for subscription info, (206) 527-3385, or at one of the bookstores I mention further down). If you know about computers, and are willing to put some time into mucking around fixing little petty problems, you can get a very nice system. Mine is a 33 MHz 386 (this is a little too slow for me, but works well), with 8MB of memory (sufficient, should have more), and a nice fast 2.1 GB Fast SCSI-2 Quantum Empire 2100S hard disk. I invested in the hard disk as I felt it would be a lasting value in future computers. I'm skimping on ISA bus cards for the PC as I want to get a PCI bus machine, probably a 100MHz 486, in a few months. You will be able to install Linux, the compiler, basic utilities, and the kernel sources with the disk space you have. You'll want to get more hard disk. I would recommend installing Linux a couple of times, just to see how it goes, before committing to a permanent installation. If you can't get more disk space, you can leave the Yggdrasil CDROM in your drive all the time and run the programs off the CDROM. Slower, but it works OK. I highly recommend the Linux Bible, from Yggdrasil, whatever distribution you get. Read the "How To's" on the various hardware options _before_ purchasing any new hardware. There are many supported peripherals, but I understand many of them work only marginally. For example, the UART chips generally used in PC serial ports are quite inadequate for driving an internet connection, as your machine will spend all its time servicing one-interrupt-per-character interrupts, but a serial card with a 16 character buffer that works just fine is available quite cheaply. You can FTP the bible from ftp.yggdrasil.com, but you'll want the hardcopy as it is over 1000 pages. The cover price is less than the cost of the toner cartridge you'll burn printing it. The How To's, the Linux MetaFAQ and lots of other info are on rtfm.mit.edu and sunsite.unc.edu. I've used lots of Unix systems, from System V on a 286, to Sun workstations, Vaxes, and even a Cray running Unicos, and I can say that Linux is equal to or better than any of them as far as what the OS can do, in some respects much much better. (I removed SCO ODT from my hard disk to install Linux. I might reinstall it on a second drive just to test my programs). There are still lots of glitches, but you have the source code, and access to comp.os.linux.help, where everyone else has the source code too - it beats the Hell out of Sun's technical support, IMHO. With about two thousand dollars more hardware, I would have a machine I would enjoy as much as a fifteen thousand dollar Sun, with the source code to boot ;-). One thing I highly recommend: if you or anyone you know is planning on setting up a full-time Internet connection, use a Linux box as a router, running PPP or SLIP out a modem, and ethernet on your LAN. Even a slow 386 has enough performance to service a SLIP connection at 28 kbaud, and since you have the source code to the kernel and all the internet server software, you can implement a firewall any way you like. I'm contemplating preparing my own distribution, which would be a very stripped-down Linux kernel and OS utility set, on a small number of bootable CDROMs, to allow one to install a firewall router on a small hard disk. Don't hold your breath waiting for this though. There is a security enhancement I mean to try once I've set up my own full-time router (watch for http://crawford.sc.scruznet.com, in about two weeks, maybe a month). I want to remove the ability to set the setuid bit from the kernel. Trying to set the setuid bit on a file will abort the process. Of course you can't install system software if this is done - but I could boot off a different kernel to do maintenance. This would prevent the problem of a hacker breaking in and dropping a program in my path that the hacker intends me to accidentally execute as root. There would be ways to set the bit (writing into the raw disk special file) but it would require more effort to accomplish. Crypto enthusiasts in the US and Canada can get Matt Blaze's CFS - I just got the sources, and haven't tried them out yet, but I understand there is already a Linux port. Now here's a puzzler for you. The People's Republic of China is working very hard to modernize, but still lacks capital for much hardware investment, so you see banks using 386 boxes to run an entire bank, if the bank uses a computer at all. A couple of years ago I heard that the PRC signed a deal with some big Unix vendor to supply the nation with computers and software, for many millions of dollars. Why don't they use Linux? The PRC is certainly not lacking for educated people who could do all the development they need. You can get Linux books and CDROM's from the Computer Literacy bookstore on North First Street in San Jose, and Powell's technical books in Portland Oregon. Powell's does mail order, and has a Web page which allows you to search their inventory for books. They've got lots of crypto books too, 2600 Magazine and lots of engineering books. I think the URL is http:technical.powells.portland.or.us. Development versions of Linux are available for Macintoshes and MIPS machines. If I were to use a Linux Laptop, I would put it on a Macintosh Powerbook. Regards, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Kudos
by usura＠xs4all.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks and congratulations to Todd for a job well done with the CP signing service and Raph for his excellent work with premail. An appreciative lurker/learner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuA9wioZzwIn1bdtAQFXnwGAitqcooxfEeABifXLhmxmRAQKlM90Gm6K Y2vmZi3kjSYWpDMYQNkID+HXYTeps30Q =oN3X -----END PGP SIGNATURE-----

1 0

ecash trial issues explained
by Marcel van der Peijl 17 Dec '03

17 Dec '03

(This message is not an official DigiCash message but represents my personal opinions) Here are some answers to issues recently discussed on the cypherpunks list. I do not read this list as that takes too much time, I only read what people that do read forward from the list to me. Stefan Brands is not excluded in any way from the trial. His request was never received at DigiCash. Several others in the CWI crypto group (all that applied) did receive their accounts. There is no 'political boycot'. The ecash software allows for multiple payment protocols to co-exist. Besides the currently implemented protocol and the Stefan Brands system there are more possible systems. We are not fixed in any way to the current protocol. Besides the patent issues, it is not clear which protocol is better. Last time I checked (a week ago, I am currently on the road) there well over 500 or 600 active ecash accounts. But there are another 1000 accounts waiting, and new requests coming in between 10 and 100 per day. As the mail that was sent out explains, the trial is rolled out in phases. The result is that the software is more 'robust' before large quantities of users run into the same problem, in the sense that it works on any OS in any configuration with any network hookup, no matter how 'bad'. (We are not in the business of being a 'network helpdesk'.) Potential ecash vendors have had priorities in being assigned ecash accounts. But they are also 'harrassed' for actually doing what they promise to do. Because we can not support a 24 hour staff and we want to keep response time low, people in time zones close to ours (GMT+1) have been issued accounts first. At the moment we are confident we can scale up the trial. I promise you it will not be several more months before everyone can join the trial. People that run into ecash problems are almost always helped or replied to the same day, and often within the hour. However, some people send their problems to the wrong address, such as the generic ecash info address or the feedback address, which may result in not getting an answer for several days. If mails go to ecash-bugs(a)digicash.com, the developers involved immediately see the mail and help out, provided they are technical mails and have sufficient information to actually be able to give help. As you can imagine, problems described as 'it does not work for me' without any extra information take a few mails back and forth, and tedious searching in log files, before the actual problem is clear. You can understand the anonimity of the system does not make that easier. People that compare FV or other systems and ecash are really comparing apples and pears. From a business view they may look the same, but how they operate is totally different. Ecash is the only system that allows for full anonimity on the buyers side using public key technology. We strongly believe it should not be possible for anyone to see all individual transactions a person makes. The business model used is also different. We do not charge users or shops a fee to use the ecash system, and provide the ecash software (both client and shop) for free, and give support for free. Unfortunately this does mean we are not getting large sums of money to spend on slick marketing schemes. Just a final remark before totally boring you to death: Some of the people that post unfriendly messages on mailing lists, like Stefan Brands, do so before actually mailing to us. Please give us a fair chance! Marcel van der Peijl Ecash technical project leader DigiCash bv http://www.digicash.com/

1 0

Info about Linux
by jya＠pipeline.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Responding to msg by crawford(a)scruznet.com (Michael D. Crawford) on Sat, 3 Dec 1:4 AM Thanks for this Linux info. FWIW, PC Mag's John Dvorak plugs Linux and Yggdrasil in the December 20 issue. He says, "there's no excuse not to have Linux as a primary or alternative operating system ... highly recommended, bargain of the year." - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuCI6SoZzwIn1bdtAQGzsAF/bDaj0dXzETyOkhL+qN+EfJYumWR6Oocj m4drVaoXQBnuEmQMM4UfOwcTt6tqsr/a =saEy -----END PGP SIGNATURE-----

1 0

Re: First Virtual?
by Andrew Lowenstern 17 Dec '03

17 Dec '03

Mark Terka writes: > Ok, so what are our options, given that this company seems to think > of security in terms of a plastic padlock. From corresponding posts > on the list, the only other alternative, Digicash, doesn't seem to > be too responsive to anyone's participation right now. It seems to me that DigiCash mistakenly 'jumped the gun' and announced before they were truly ready to test. This is such a common ocurrance in the computer industry that I'm suprised people are making noise over it. However, it indicates their reluctance to ship something before it's ready, which is good considering the technical and political challenges of the task they are undertaking. How can you really compare the proposed DigiCash systems versus FirstVirtual? One is a 'toy' system for moving credit card numbers around without actually broadcasting them in the clear, the other is a cryptographically secure digital cash type system. It's not suprising that FirstVirtual is ready sooner than DigiCash. However, assuming each system was ready and working as advertised, which would you trust for your financial transactions? With the possibility of millions and billions of dollars of commerce ocurring on the net in the near future, which do you think most people will want to use? While FirstVirtual may have it's place in the world of online payment systems, it is IMHO no replacement for a real digital cash system. The fact that most of the people who have even heard of these new payment systems are unaware of the not so subtle differences should alarm most cypherpunks. Digital cash isn't going to happen overnight (although most of us would like it to), and the last thing we want is for systems like FirstVirtual to become the de facto standard for online payment... andrew

3 2

Re: Brands excluded from digicash beta
by Paul Dinnissen 17 Dec '03

17 Dec '03

Hi, We're sorry to hear any complaints about the handling of any requests for information regarding ecash. As you can understand, we are certaintly not planning to create unsatisied ecash users at the very start of the ecash endeavour. So at least we are happy to hear from you so we can act appropriately. DigiCash has the ambitious goal to make the ecash client software available on virtually every OS platform and/or system. Alas, our programmers crew is not that extensive that we're able to release everything at once, we has to resort to a phased release approach. For some insight in the release history of the sundry ecash versions, we refer to our WEB server pages. With this background we answer your questions and remarks, at the hand of some of quote orginating form your mail to DigiCash. > Hal said: > > I just figured that I didn't have enough clout for them to bother to > > respond to me, but today on the www-buyinfo list, Stefan Brands, who > > many think has the best ecash technology available today, posted that he > > had had the same experience! Brands himself has still not been given > > an opportunity to join the beta test. He did not sound very happy about > > this. As announced, the ecash-trial starts in phases. Currently we are completing most versions of ecash. We receive quite a lot of good feedback from the first releases. Therefore we decided to change the user-interface to get better software that is easier to use, before confronting the user of the next releases with problems already solved! We decided to first to select tester from our own timezone to facilitate easy voice communication in case extensive support issues. Contrary to our expectations we encountered relatively few problems, so we can soon release also the beta-test to tester in the remaining time zones. So as you can see our release policy is not that staight forward and involves a lot of considerations like usability and acceptance. This is one of the main reasons why Mr. S. Brands HAS received his beta-test version friday the 11th of November, together with all his collegues at the CWI. They all run Silicon Graphics International OS and before that date this version wasn't finished. > I was in the same boat-- I sent in several requests, all of which were > ignored. After Digicash issued a call for prototype shops, I signed > up. WHAM. I immediately started getting mail asking when I'd have my > shop ready-- sometimes two or three messages a day. > > Once I got everything up and running, I didn't hear further from them. Sometimes we can react very fast, but alas this is only the case for standard procedures which we did automate. More specific questions and requests *have* to be handled by humans. We think the people who are willing to invest quite some effort in setting up a shop for the beta test, are very important participants in the beta test trail. Therefore it seems *very* unlike to us that we didn't respond to *any* mail or request from you. Not trusting our own memory ( we do receive more than 100 (yes, hundred) mails on ecash *each* day, even Sundays) we dove right in to it and found a trail of DigiCash answers to your mail with the subject: 'Concerns about ecash'. > Since then, an accident on my WWW server has rendered the e-shop > inoperable. I've asked Digicash, in the form of Paul Diniessen, for > help reconstructing the bank records. No go. Sorry we *did* sent you a respons within an hour from your request by my colleague Branko. He is responsible for our bank in the trial. His respons was: -The dbm library used by Linux and FreeBSD are different, so the ecash -databases are also incompatible. If you have a password for getting an -initial balance, you can also use this password for reopening your -account (and keeping your old balance). For the server(a)fairgate.com -account you can use the password ******** (pw made invisible PD) for this. - -Branko > > Of course, it may well be a matter of incompetence rather than insult, > > but the net result is the same. The more I see of digicash's lack of > > consideration towards their potential customers and important figures like > > Brands the more I question whether they have the potential to succeed. > > The more I deal with Digicash, the better First Virtual looks. My > technical preference is for using Brands or Chaum cash; at present, > though, there aren't any shipping Brands servers, and the Digicash > folks don't seem to be able to get all their socks in one bag. We feel somewhat troubled by these comments. We strongly feel that the alleged 'lack of consideration' as unjustified. First we would like to split up your comment in to two different issues, first regarding our potential customers and secondly the issue of Mr. S. Brands. As we mentioned before we deem *all* our users, in the past, now, and in the future, as important whether it concerns "shops" or mere "customers" they all contribute to a successful new payment medium. We like you to consider this phase in the existence of ecash as a genuin beta trail. In beta test not only software is being trailed but the supporting services too! However, it should be noted that we did respond to your mail and requests. On the issue on Mr. S. Brands. As we explained before no way we even considered to exclude Mr. Brands for the beta test. As of the technical appreciation of the Chaum system as opposed to the Brands system and the alleged scalability issues , we propose you contact Mr. S. Brands and Mr. D. Chaum for details. We will give a call today to check if received this mail. We hope to resolve the problems mentioned above and to continue our co-operation. Kindest regards, Paul Dinnissen DigiCash bv.

8 12

Voice over data
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Eric Hughes wrote: > the great voice-over-data protocols and products introduced by > Intel, Rockwell, ZyXEL and others at Comdex which will make > Voice-PGP so much easier > > As I understand these voice-over-data products, the voice goes over > analog, added to the modem signal. The modem signal is interpreted, > and then reconstructed and subtracted from the incoming signal, > leaving voice. Very clever, but insufficient for secure phones. I don't think that's how they do it. As far as I know, most methods multiplex digitized audio with the data. One system used by some people in India provides a dynamic combination of fax, (digitized) voice and data, depending on the throughput - eg vox/9.6 data if 14.4kbps, fax as well if 19.2, etc. While Intel and others are proposing standards, ZyXEL does it with software along with a voice card or possibly RJ11 input. A friend of mine saw a demo of it at Comdex, on an old 1496E (16.8 kbps zyxel to zyxel). The new v.34 does 28.8k - lots of room for clear digitized voice and high speed data. This is exactly why I thought it would make secure voice easier, if not secure phones (who wants to lug a modem and PC around as a 'handset'?). I'll be testing some Onetics Rad VFAST modems this week, which apparently do digitized voice over v.34 as well. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." rishab(a)arbornet.org Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1